From 86958be6cfb4690aa853fa66c66a69f062a1d38b Mon Sep 17 00:00:00 2001
From: Martynas Pumputis <martynasp@gmail.com>
Date: Wed, 30 May 2018 13:12:44 +0200
Subject: [PATCH] npc: Add --use-legacy-netpol flag to weaver

Egress does not work in the legacy netpol mode, so in the legacy case
we don't have to create the egress traffic steering rules. Otherwise,
some traffic will be blocked.
---
 net/bridge.go       | 19 ++++++++++---------
 prog/weaver/main.go |  1 +
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/net/bridge.go b/net/bridge.go
index 07567a15..d511b757 100644
--- a/net/bridge.go
+++ b/net/bridge.go
@@ -216,6 +216,7 @@ type BridgeConfig struct {
 	NoBridgedFastdp  bool
 	AWSVPC           bool
 	NPC              bool
+	LegacyNPC        bool
 	MTU              int
 	Mac              string
 	Port             int
@@ -461,20 +462,20 @@ func configureIPTables(config *BridgeConfig, ips ipset.Interface) error {
 		// Ignore error because chains might already exist
 		// TODO(brb): use constants for WEAVE-NPC* chains
 		_ = ipt.NewChain("filter", "WEAVE-NPC")
-		_ = ipt.NewChain("filter", "WEAVE-NPC-EGRESS")
-
-		// TODO(brb): this rule might slow down packet processing; consider removing at it applies only
-		// to node-local traffic.
-		if err = ipt.AppendUnique("filter", "INPUT", "-i", config.WeaveBridgeName, "-j", "WEAVE-NPC-EGRESS"); err != nil {
-			return err
+		if !config.LegacyNPC {
+			_ = ipt.NewChain("filter", "WEAVE-NPC-EGRESS")
+			if err = ipt.AppendUnique("filter", "INPUT", "-i", config.WeaveBridgeName, "-j", "WEAVE-NPC-EGRESS"); err != nil {
+				return err
+			}
+			fwdRules = append(fwdRules, []string{
+				"-i", config.WeaveBridgeName,
+				"-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'",
+				"-j", "WEAVE-NPC-EGRESS"})
 		}
 
 		// If WEAVE-NPC chain doesn't exist then creating a rule in the chain will fail
 		fwdRules = append(fwdRules,
 			[][]string{
-				{"-i", config.WeaveBridgeName,
-					"-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'",
-					"-j", "WEAVE-NPC-EGRESS"},
 				{"-o", config.WeaveBridgeName,
 					"-m", "comment", "--comment", "NOTE: this must go before '-j KUBE-FORWARD'",
 					"-j", "WEAVE-NPC"},
diff --git a/prog/weaver/main.go b/prog/weaver/main.go
index 79c1b65a..93622c5a 100644
--- a/prog/weaver/main.go
+++ b/prog/weaver/main.go
@@ -182,6 +182,7 @@ func main() {
 	mflag.StringVar(&bridgeConfig.WeaveBridgeName, []string{"-weave-bridge"}, "weave", "name of weave bridge")
 	mflag.StringVar(&bridgeConfig.DockerBridgeName, []string{"-docker-bridge"}, "", "name of Docker bridge")
 	mflag.BoolVar(&bridgeConfig.NPC, []string{"-expect-npc"}, false, "set up iptables rules for npc")
+	mflag.BoolVar(&bridgeConfig.LegacyNPC, []string{"-use-legacy-netpol"}, false, "use legacy network policies (pre k8s 1.7 vsn)")
 	mflag.StringVar(&routerName, []string{"-name"}, "", "name of router (defaults to MAC of interface)")
 	mflag.StringVar(&nickName, []string{"-nickname"}, "", "nickname of peer (defaults to hostname)")
 	mflag.StringVar(&password, []string{"-password"}, "", "network password")