etan39
/
cloudstack
mirror of https://github.com/apache/cloudstack.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
cloudstack/systemvm
History
Rajani Karuturi cc043e9f8f Merge pull request #1666 from murali-reddy/egress_rules 
CLOUDSTACK-9480,  CLOUDSTACK-9495 fix egress rule incorrect behaviorWhen 'default egress policy' is set to 'allow' in the network offering, any egress rule that is added will 'deny' the traffic overriding the default behaviour.

Conversely, when 'default egress policy' is set to 'deny' in the network offering, any egress rule that is added will 'allow' the traffic overriding the default behaviour.

While this works for 'tcp', 'udp' as expected, for 'icmp' protocol its always set to ALLOW. This patch keeps all protocols behaviour consistent.

Results of running test/integration/component/test_egress_fw_rules.py.  With out the patch test_02_egress_fr2 test was failing. This patch fixes the test_02_egress_fr2  scenario.
-----------------------------------------------------------------------------------------------------
Test By-default the communication from guest n/w to public n/w is NOT allowed. ... === TestName: test_01_1_egress_fr1 | Status : SUCCESS ===
ok
Test By-default the communication from guest n/w to public n/w is allowed. ... === TestName: test_01_egress_fr1 | Status : SUCCESS ===
ok
Test Allow Communication using Egress rule with CIDR + Port Range + Protocol. ... === TestName: test_02_1_egress_fr2 | Status : SUCCESS ===
ok
Test Allow Communication using Egress rule with CIDR + Port Range + Protocol. ... === TestName: test_02_egress_fr2 | Status : SUCCESS ===
ok
Test Communication blocked with network that is other than specified ... === TestName: test_03_1_egress_fr3 | Status : SUCCESS ===
ok
Test Communication blocked with network that is other than specified ... === TestName: test_03_egress_fr3 | Status : SUCCESS ===
ok
Test Create Egress rule and check the Firewall_Rules DB table ... === TestName: test_04_1_egress_fr4 | Status : SUCCESS ===
ok
Test Create Egress rule and check the Firewall_Rules DB table ... === TestName: test_04_egress_fr4 | Status : SUCCESS ===
ok
Test Create Egress rule and check the IP tables ... SKIP: Skip
Test Create Egress rule and check the IP tables ... SKIP: Skip
Test Create Egress rule without CIDR ... === TestName: test_06_1_egress_fr6 | Status : SUCCESS ===
ok
Test Create Egress rule without CIDR ... === TestName: test_06_egress_fr6 | Status : SUCCESS ===
ok
Test Create Egress rule without End Port ... === TestName: test_07_1_egress_fr7 | Status : EXCEPTION ===
ERROR
Test Create Egress rule without End Port ... === TestName: test_07_egress_fr7 | Status : SUCCESS ===
ok
Test Port Forwarding and Egress Conflict ... SKIP: Skip
Test Port Forwarding and Egress Conflict ... SKIP: Skip
Test Delete Egress rule ... === TestName: test_09_1_egress_fr9 | Status : SUCCESS ===
ok
Test Delete Egress rule ... === TestName: test_09_egress_fr9 | Status : SUCCESS ===
ok
Test Invalid CIDR and Invalid Port ranges ... === TestName: test_10_1_egress_fr10 | Status : SUCCESS ===
ok
Test Invalid CIDR and Invalid Port ranges ... === TestName: test_10_egress_fr10 | Status : SUCCESS ===
ok
Test Regression on Firewall + PF + LB + SNAT ... === TestName: test_11_1_egress_fr11 | Status : SUCCESS ===
ok
Test Regression on Firewall + PF + LB + SNAT ... === TestName: test_11_egress_fr11 | Status : SUCCESS ===
ok
Test Reboot Router ... === TestName: test_12_1_egress_fr12 | Status : SUCCESS ===
ok
Test Reboot Router ... === TestName: test_12_egress_fr12 | Status : EXCEPTION ===
ERROR
Test Redundant Router : Master failover ... === TestName: test_13_1_egress_fr13 | Status : SUCCESS ===
ok
Test Redundant Router : Master failover ... === TestName: test_13_egress_fr13 | Status : SUCCESS ===
ok
-----------------------------------------------------------------------------------------------------

* pr/1666:
  fix egress rule incorrect behavior

Signed-off-by: Rajani Karuturi <rajani.karuturi@accelerite.com>
 		2016-09-21 14:54:31 +05:30
..
bindir Move the system vm to a separate maven project. 2013-09-20 18:31:02 +08:00
certs Move the system vm to a separate maven project. 2013-09-20 18:31:02 +08:00
conf CLOUDSTACK-9062: Improve S3 implementation. 2015-11-19 15:29:10 +01:00
conf.dom0 CLOUDSTACK-9105: Logging enhancement: Handle/reference to track API calls end to end in the MS logs 2015-12-04 12:45:57 +05:30
css console-proxy add support of AltGr key and FR azerty keyboard 2014-12-08 18:05:43 +05:30
distro CLOUDSTACK-6220: Take 2, Fix cloudstack init scripts so that they 2014-03-10 16:11:52 -06:00
images Move the system vm to a separate maven project. 2013-09-20 18:31:02 +08:00
js CLOUDSTACK-9164: Prevent firefox's quick search from opening in VM console 2016-04-25 11:37:43 +05:30
libexec Move the system vm to a separate maven project. 2013-09-20 18:31:02 +08:00
patches/debian Merge pull request #1666 from murali-reddy/egress_rules 2016-09-21 14:54:31 +05:30
scripts Add Java Default Certificat Authorities into the keystore if using a custom cert SSL 2016-05-25 06:34:15 +01:00
test/python Fixed defaultroute on VPC routers in CsRoute and CsAddress 2015-08-24 13:35:29 +02:00
ui Move the system vm to a separate maven project. 2013-09-20 18:31:02 +08:00
vm-script Move the system vm to a separate maven project. 2013-09-20 18:31:02 +08:00
pom.xml Updating pom.xml version numbers for release 4.9.1.0-SNAPSHOT 2016-08-19 13:53:39 +05:30
systemvm-descriptor.xml Remove duplicate scripts and move the remaining items to the systemvm project 2013-10-14 08:02:35 +02:00