remove masquerading rules on 'weave stop/launch'

Leaving iptable masquerading rules behind is a bad idea when weave is
re-launched with different ip subnet settings. So now we remove the
rules on 'weave stop' and also on 'weave launch' (in case weave had
been stopped in ways other than 'weave stop').

To make the rule removal easier, we create the rules in a user-defined
WEAVE chain.

Note that this will break old weave installations, since the rules
created by those are left behind. Easiest upgrade path is to restart
the machine. Or, for the brave, run `iptables -t nat -S POSTROUTING | grep weave | sed 's/^\-A/-D/g' | while read line; do iptables -t nat $line; done`.

Fixes #48

weaver/weave

@@ -60,7 +60,7 @@ create_bridge() {
     ip link set dev $BRIDGE up
 }
 
-add_nat_rule() {
+run_iptables() {
     # -w is recent addition to iptables
     if [ -z "$CHECKED_IPTABLES_W" ] ; then
         if iptables -S -w >/dev/null 2>&1 ; then
@@ -69,15 +69,28 @@ add_nat_rule() {
         CHECKED_IPTABLES_W=1
     fi
 
-    if ! iptables $IPTABLES_W -t nat -C $1 >/dev/null 2>&1
+    iptables $IPTABLES_W "$@"
+}
+
+add_nat_rule() {
+    if ! run_iptables -t nat -C "$@" >/dev/null 2>&1
     then
-        iptables $IPTABLES_W -t nat -A $1 >/dev/null
+        run_iptables -t nat -A "$@" >/dev/null
     fi
 }
 
 setup_masquerading() {
-    add_nat_rule "POSTROUTING -o $BRIDGE ! -s $1 -j MASQUERADE"
-    add_nat_rule "POSTROUTING -s $1 ! -o $BRIDGE -j MASQUERADE"
+    if ! run_iptables -t nat -S WEAVE >/dev/null 2>&1
+    then
+        run_iptables -t nat -N WEAVE
+        add_nat_rule POSTROUTING -j WEAVE
+    fi
+    add_nat_rule WEAVE -o $BRIDGE ! -s $1 -j MASQUERADE
+    add_nat_rule WEAVE -s $1 ! -o $BRIDGE -j MASQUERADE
+}
+
+stop_masquerading() {
+    run_iptables -t nat -F WEAVE >/dev/null 2>&1 || true
 }
 
 # the following borrows from https://github.com/jpetazzo/pipework
@@ -135,6 +148,7 @@ case "$COMMAND" in
                 ;;
         esac
         create_bridge
+        stop_masquerading
         setup_masquerading $IPADDR
         # We set the router name to the bridge mac since that is
         # stable across re-creations of the containers.
@@ -200,6 +214,7 @@ case "$COMMAND" in
         fi
         docker rm -f weave >/dev/null 2>&1 || true
         check_command_and_run conntrack conntrack -D -p udp --dport 6783 >/dev/null 2>&1 || true
+        stop_masquerading
         ;;
     *)
         echo "Unknown weave command '$COMMAND'"