VPC ACL tcp/udp rule without ports matches only port 0 (--dport 0) on the VR #14363

problem

On a VPC virtual router, a network ACL rule for tcp or udp with no port range matches only port 0. It should match every port. Nothing is reported.

• How the rule reaches the VR: a rule without ports is sent as the range 0:0 (NetworkACLTO.getStringPortRange()). SetNetworkAclConfigItem builds a TcpAclRule/UdpAclRule, whose ports are ints, so the VR always receives "first_port": 0, "last_port": 0.
• On the VR: configure.py's AclRule.init_vpc() only checks that first_port is present, so it renders:

  -A ACL_INBOUND_eth3 -p tcp -s 10.0.0.0/8 -m tcp --dport 0 -j ACCEPT
  

What that does:

• An allow ("tcp from 10.0.0.0/8, no ports") admits nothing.
• A deny blocks nothing, so the traffic goes on to the rules after it. With a broader allow later in the list, the deny is silently bypassed.

This is the iptables path: IPv4 on VPC tiers and private gateways that are not in routed mode. The nftables paths (routed IPv4 and IPv6) treat 0 as "no ports" and match all of them. So the same rule allows all TCP on IPv6 and none on IPv4.

versions

Present on 4.22.

The steps to reproduce the bug

1. In a VPC ACL list, add an ingress rule: protocol TCP, no start/end port, CIDR 10.0.0.0/8, Allow. Attach the list to a tier.
2. On the VR, run iptables -S ACL_INBOUND_ethX. The rule shows as -s 10.0.0.0/8 -p tcp -m tcp --dport 0 -j ACCEPT.

What to do about it?

On the iptables path, treat 0:0 as no ports, as the nftables paths do.