From f91d1735115eda7769a0165ee0d91a753540d2eb Mon Sep 17 00:00:00 2001
From: Chiradeep Vittal <chiradeep@cloud.com>
Date: Thu, 11 Aug 2011 14:36:34 -0700
Subject: [PATCH] bug 10561: handle icmp (finally\!)

---
 .../debian/config/root/firewall_rule.sh       | 36 ++++++++-----------
 1 file changed, 15 insertions(+), 21 deletions(-)

diff --git a/patches/systemvm/debian/config/root/firewall_rule.sh b/patches/systemvm/debian/config/root/firewall_rule.sh
index 63b4656c111..f0f8c0c1e2d 100755
--- a/patches/systemvm/debian/config/root/firewall_rule.sh
+++ b/patches/systemvm/debian/config/root/firewall_rule.sh
@@ -64,33 +64,27 @@ fw_entry_for_public_ip() {
   logger -t cloud "$(basename $0): enter apply firewall rules for public ip $pubIp:$prot:$sport:$eport:$scidrs"  
 
 
-  # note that rules are inserted after the RELATED,ESTABLISHED rule but before the DROP rule
+  # note that rules are inserted after the RELATED,ESTABLISHED rule 
+  # but before the DROP rule
   for src in $scidrs
   do
-    if [ "$prot" == "reverted" ]
-    then
-      continue;
-    fi
+    [ "$prot" == "reverted" ] && continue;
     if [ "$prot" == "icmp" ]
     then
-    # TODO  icmp code need to be implemented
-    # sport is icmpType , dport is icmpcode 
-      if [ "$sport" == "-1" ]
-      then
-           sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot  -j RETURN
-       else
-           if ["$eport" == "-1"]
-           then
-               sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot --icmp-type $sport  -j RETURN
-           else
-               sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot --icmp-type $sport/$eport  -j RETURN
-           fi
-       fi
+      typecode="$sport/$eport"
+      [ "$eport" == "-1" ] && typecode="$sport"
+      [ "$sport" == "-1" ] && typecode="any"
+      sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot \
+                    --icmp-type $typecode  -j RETURN
     else
-       sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot --dport $sport:$eport -j RETURN
-  fi
+       sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot \
+                    --dport $sport:$eport -j RETURN
+    fi
+    result=$?
+    [ $result -gt 0 ] && 
+       logger -t cloud "Error adding iptables entry for $pubIp:$prot:$sport:$eport:$src" &&
+       break
   done
-  result=$?
       
   logger -t cloud "$(basename $0): exit apply firewall rules for public ip $pubIp"  
   return $result