[CLOUDSTACK-9480] Egress Firewall: Incorrect use of Allow/Deny for ICMP

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 4.6.2, 4.7.1, 4.8.0, 4.9.0
• Fix Version/s: 4.10.0.0, 4.9.1.0, 4.8.2.0
• Component/s: Network Controller
• Security Level: Public (Anyone can view this level - this is the default.)
• Assignee: Murali Reddy
• Reporter: Murali Reddy
• Created: 30/Aug/16 06:05
• Updated: 06/Jan/17 11:20
• Resolved: 04/Jan/17 09:46

Description

When 'default egress policy' is set to 'allow' in the network offering, any egress rule that is added will 'deny' the traffic overriding the default behaviour.

Conversely, when 'default egress policy' is set to 'deny' in the network offering, any egress rule that is added will 'allow' the traffic overriding the default behaviour.

While this works for 'tcp', 'udp' as expected, for 'icmp' protocol its always set to ALLOW.

Egress firewall rule behaviour should be consistent for all the protocols.

Issue Links

• is related to: CLOUDSTACK-9519 test_01_RVR_Network_FW_PF_SSH_default_routes_egress_true Smoke Test Failure
• links to: GitHub Pull Request #1666