fwaas:Error not thrown when setting protocol is icmp and destination /source port while creating firewall rule

[Rajkumar]

Error not thrown when setting protocol as icmp and destination /source port while creating firewall rule

Steps to Reproduce:
create firewall rule with protocol as icmp and destination port as 20

Actual Results:
It is creating firewal rule with protocol as icmp and destination port as 20 in cli. However since icmp protocol doesn't use source/destination port , It was taken only as ICMP in the output of iptable-save in router

Expected Results:
the cli should throw error

-A neutron-l3-agent-FORWARD -o qr-+ -j neutron-l3-agent-iv426dd1dbb
-A neutron-l3-agent-FORWARD -i qr-+ -j neutron-l3-agent-ov426dd1dbb
-A neutron-l3-agent-FORWARD -o qr-+ -j neutron-l3-agent-fwaas-defau
-A neutron-l3-agent-FORWARD -i qr-+ -j neutron-l3-agent-fwaas-defau
-A neutron-l3-agent-INPUT -d 127.0.0.1/32 -p tcp -m tcp --dport 9697 -j ACCEPT
-A neutron-l3-agent-fwaas-defau -j DROP
-A neutron-l3-agent-iv426dd1dbb -m state --state INVALID -j DROP
-A neutron-l3-agent-iv426dd1dbb -m state --state RELATED,ESTABLISHED -j ACCEPT
-A neutron-l3-agent-iv426dd1dbb -p icmp -j DROP------------------------------------------------------------------------->taken as only icmp
-A neutron-l3-agent-ov426dd1dbb -m state --state INVALID -j DROP
-A neutron-l3-agent-ov426dd1dbb -m state --state RELATED,ESTABLISHED -j ACCEPT
-A neutron-l3-agent-ov426dd1dbb -p icmp -j DROP

root@IH-HL-OSC:~# fwrc --name r9 --protocol icmp --destination-port 20 --action deny
Created a new firewall_rule:
+------------------------+--------------------------------------+
| Field | Value |
+------------------------+--------------------------------------+
| action | deny |
| description | |
| destination_ip_address | |
| destination_port | 20 |-------------------------------------------------> port 20 also taken
| enabled | True |
| firewall_policy_id | |
| id | 29bca0ca-17c8-4fc8-a816-c14ce2824bed |
| ip_version | 4 |
| name | r9 |
| position | |
| protocol | icmp |
| shared | False |
| source_ip_address | |
| source_port | |
| tenant_id | 8aac6cceec774dec8821d76e0c1bdd8c |
+------------------------+--------------------------------------+

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/99372

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/99372
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=b2a6e558d82f22623e439b8c0380f05afc778f6c
Submitter: Jenkins
Branch: master

commit b2a6e558d82f22623e439b8c0380f05afc778f6c
Author: Elena Ezhova <email address hidden>
Date: Wed Jun 11 17:25:40 2014 +0400

    Check port value when creating firewall rule with icmp protocol

    If a firewall rule was created with setting protocol as icmp
    and using source/destination port no error was thrown, even though
    source/destination port parameters are not used by icmp.

    This patch adds a validation method that checks passed parameters
    and throws an exception if they are incompatible.

    Change-Id: I90a765856896395fcb6e9ddbd888b7bd80480674
    Closes-Bug: 1327955