Describe why protocol 6 and 17 without ports stay numbers without relying on the port 0 bug

Signed-off-by: Brad House <bhouse@nexthop.ai>

Author: bhouse-nexthop

core/src/main/java/com/cloud/agent/api/routing/SetNetworkACLCommand.java

@@ -107,8 +107,9 @@ public String[][] generateFwRules() {
      * The VR applies ports only to a rule it is sent as tcp or udp, and an ICMP type and code only to one
      * sent as icmp; any other protocol goes to it as a bare number, which matches the whole protocol. So
      * send protocol number 1 as icmp, and 6 and 17 as tcp and udp when the rule has ports, whatever form
-     * or case they were stored in. Without ports 6 and 17 stay bare numbers: that is what matches all of
-     * TCP or UDP, where a tcp or udp rule without ports would match port 0 only.
+     * or case they were stored in. Without ports 6 and 17 stay bare numbers, which match the whole
+     * protocol on every VR path; a tcp or udp rule without ports has matched port 0 only on the iptables
+     * path (see #14363).
      */
     protected static String normalizeProtocol(String protocol, boolean hasPorts) {
         if (protocol == null) {

core/src/test/java/com/cloud/agent/api/routing/SetNetworkACLCommandTest.java

@@ -66,7 +66,7 @@ public void testTcpAndUdpByProtocolNumberKeepTheirPorts() {
 
     @Test
     public void testTcpAndUdpByProtocolNumberWithoutPortsStayWholeProtocol() {
-        // as tcp or udp with no ports the VR would match port 0 only
+        // a bare number matches the whole protocol on every VR path
         assertEquals("Ingress;6;0;0;10.0.0.0/24;ACCEPT;", generateRule("6", null, null, null, null));
         assertEquals("Ingress;17;0;0;10.0.0.0/24;ACCEPT;", generateRule("17", null, null, null, null));
     }