From 2d3e070288b67859060eeff8eb78a4b55519dbb4 Mon Sep 17 00:00:00 2001
From: Bryan Boreham <bjboreham@gmail.com>
Date: Thu, 18 May 2017 17:44:09 +0000
Subject: [PATCH] Let through connections from local pods to non-local pods

This means we only filter connections at the destination end,
which is a better match for the ingress-only rules.
---
 npc/constants.go       |  2 ++
 npc/namespace.go       |  4 ++++
 prog/weave-npc/main.go | 10 ++++++++++
 3 files changed, 16 insertions(+)

diff --git a/npc/constants.go b/npc/constants.go
index 7ab01f7b..2722c57f 100644
--- a/npc/constants.go
+++ b/npc/constants.go
@@ -8,4 +8,6 @@ const (
 	IngressChain = "WEAVE-NPC-INGRESS"
 
 	IpsetNamePrefix = "weave-"
+
+	LocalIpset = IpsetNamePrefix + "local-pods"
 )
diff --git a/npc/namespace.go b/npc/namespace.go
index 65b00eec..e4d85615 100644
--- a/npc/namespace.go
+++ b/npc/namespace.go
@@ -88,6 +88,7 @@ func (ns *ns) addPod(obj *coreapi.Pod) error {
 		return nil
 	}
 
+	ns.ips.AddEntry(LocalIpset, obj.Status.PodIP)
 	return ns.podSelectors.addToMatching(obj.ObjectMeta.Labels, obj.Status.PodIP)
 }
 
@@ -100,10 +101,12 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
 	}
 
 	if hasIP(oldObj) && !hasIP(newObj) {
+		ns.ips.DelEntry(LocalIpset, oldObj.Status.PodIP)
 		return ns.podSelectors.delFromMatching(oldObj.ObjectMeta.Labels, oldObj.Status.PodIP)
 	}
 
 	if !hasIP(oldObj) && hasIP(newObj) {
+		ns.ips.AddEntry(LocalIpset, newObj.Status.PodIP)
 		return ns.podSelectors.addToMatching(newObj.ObjectMeta.Labels, newObj.Status.PodIP)
 	}
 
@@ -139,6 +142,7 @@ func (ns *ns) deletePod(obj *coreapi.Pod) error {
 		return nil
 	}
 
+	ns.ips.DelEntry(LocalIpset, obj.Status.PodIP)
 	return ns.podSelectors.delFromMatching(obj.ObjectMeta.Labels, obj.Status.PodIP)
 }
 
diff --git a/prog/weave-npc/main.go b/prog/weave-npc/main.go
index b533b053..c3d3e14e 100644
--- a/prog/weave-npc/main.go
+++ b/prog/weave-npc/main.go
@@ -112,6 +112,16 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 		return err
 	}
 
+	// If the destination address is not any of the local pods, let it through
+	if err := ips.Create(npc.LocalIpset, ipset.HashIP); err != nil {
+		return err
+	}
+	if err := ipt.Append(npc.TableFilter, npc.MainChain,
+		"-m", "set", "--match-set", npc.LocalIpset, "src",
+		"-m", "set", "!", "--match-set", npc.LocalIpset, "dst", "-j", "ACCEPT"); err != nil {
+		return err
+	}
+
 	return nil
 }