Mutual network acl peerings fail #3987

Activity

1. jochumdev

   added the

   Bug

   issue type on Sep 13, 2026
2. jochumdev commented on Sep 13, 2026

   

   jochumdev

   on Sep 13, 2026

   MemberAuthor

   More actions

   LLM Proposed Fix / Patch

   The generated cluster mapper in internal/server/db/cluster/networks_peers.mapper.go already includes a prepared statement specifically for this lookup:
   networkPeerObjectsByNetworkIDAndTargetNetworkProjectAndTargetNetworkName
   (matching NetworkID, TargetNetworkProject, and TargetNetworkName).

   By looking up targetNetID via tx.GetNetworkID(ctx, peer.TargetProject, peer.TargetNetwork), PeerCreate can pass NetworkID: &targetNetID to scope the search directly to the intended peer network. In PeerDelete, only the reciprocal peer matching dbPeer.TargetNetworkID should be cleared.

   diff --git a/internal/server/network/driver_ovn.go b/internal/server/network/driver_ovn.go
   index 63d1a89..a3e7fc1 100644
   --- a/internal/server/network/driver_ovn.go
   +++ b/internal/server/network/driver_ovn.go
   @@ -7736,8 +7736,14 @@ func (n *ovn) PeerCreate(peer api.NetworkPeersPost) error {
    		case "local":
   +			targetNetID, err := tx.GetNetworkID(ctx, peer.TargetProject, peer.TargetNetwork)
   +			if err != nil {
   +				return fmt.Errorf("Failed loading target network ID: %w", err)
   +			}
   +
    			// Check if target peer already exists.
    			peers, err := dbCluster.GetNetworkPeers(ctx, tx.Tx(), dbCluster.NetworkPeerFilter{
   -				Type:                 &record.Type,
   +				NetworkID:            &targetNetID,
    				TargetNetworkProject: &n.project,
    				TargetNetworkName:    &n.name,
    			})
   @@ -8233,12 +8239,17 @@ func (n *ovn) PeerDelete(peerName string) error {
    	err = n.state.DB.Cluster.Transaction(context.TODO(), func(ctx context.Context, tx *db.ClusterTx) error {
   -		// Deactivate any existing peer.
   -		if peer.Type == "local" {
   +		// Deactivate any reciprocal peer.
   +		if peer.Type == "local" && dbPeer.TargetNetworkID.Valid {
   +			targetNetID := dbPeer.TargetNetworkID.Int64
    			peers, err := dbCluster.GetNetworkPeers(ctx, tx.Tx(), dbCluster.NetworkPeerFilter{TargetNetworkID: &n.id})
    			if err != nil && !errors.Is(err, sql.ErrNoRows) {
    				return err
    			}
    
    			for _, peer := range peers {
   +				if peer.NetworkID != targetNetID {
   +					continue
   +				}
   +
    				peer.TargetNetworkID = sql.NullInt64{}
    
    				err = dbCluster.UpdateNetworkPeer(ctx, tx.Tx(), peer.NetworkID, peer.Name, peer)
3. stgraber

   added a commit that references this issue on Sep 13, 2026

   incusd/network/ovn: Scope mutual peer lookups to the target network

   ...

   This issue will close once commit e3c6e74 is merged into the 'main' branch.

   e3c6e74
4. stgraber

   closed this as completedin e3c6e74on Sep 14, 2026
5. stgraber

   added a commit that references this issue on Sep 21, 2026

   incusd/network/ovn: Scope mutual peer lookups to the target network

   ...

   This issue will close once commit 0c3de23 is merged into the 'main' branch.

   0c3de23