Metaswitch/calico — pull request #33 by localpref (2014-11-10 01:40:46+00:00)
Title: ipset, 0.0.0.0/0 and ICMP woes

I've tried to fix the felix crashes on using security groups with 0.0.0.0 and/or "ALL ICMP", plus fixed the non-working iptables match for net,port ipsets. Note that "ALL ICMP" essentially doesn't appear to work nicely with ipset (because ipset requires :type/code notation for icmp as opposed to :port in tcp/udp etc), and using 0/0 does not have the same effect as in tcp/udp... I'm sure there is a better way, but for know, this works & does not crash felix.

The chosen workaround for "all icmp" is to replace the single non-working `icmp:0/0` rule with about 20 individual entries, one for each icmp:codename known to ipset...

On top of that, whenever 0.0.0.0/0 or ::/0 is encountered, a warning is logged and it is then transparently replaced with rules for 0/1 and 128/1 or ::/1 and 80::/1, respectively.