From 89e820d62e6dd67f6eb5f457d01b38c0e496bfd8 Mon Sep 17 00:00:00 2001
From: Martynas Pumputis <martynasp@gmail.com>
Date: Tue, 15 May 2018 21:35:44 +0200
Subject: [PATCH] npc: Create WEAVE-NPC-EGRESS chain with the base rules

The following rules are provisioned by weave-npc:

-A WEAVE-NPC-EGRESS -m state --state RELATED,ESTABLISHED -j RETURN
-A WEAVE-NPC-EGRESS -m set ! --match-set weave-local-pods src -j RETURN
-A WEAVE-NPC-EGRESS -d 224.0.0.0/4 -j RETURN
-A WEAVE-NPC-EGRESS -m state --state NEW -j WEAVE-NPC-EGRESS-DEFAULT
-A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j WEAVE-NPC-EGRESS-CUSTOM
-A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j NFLOG --nflog-group 86
-A WEAVE-NPC-EGRESS -m mark ! --mark 0x40000/0x40000 -j DROP

-A WEAVE-NPC-EGRESS-CUSTOM <rulespec> -j MARK --set-xmark 0x40000/0x40000
-A WEAVE-NPC-EGRESS-CUSTOM <rulespec> -j RETURN

-A WEAVE-NPC-EGRESS-DEFAULT <rulespec> -j MARK --set-xmark 0x40000/0x40000
-A WEAVE-NPC-EGRESS-DEFAULT <rulespec> -j RETURN

For each rule we create two (mark and return). We cannot just accept
a packet if it matches any rule, as a packet might need to traverse
the ingress npc as well which happens later in the chain (in some cases
we cannot detect whether packet is ingress or egress, so we need to
check both chains).
---
 npc/constants.go       |  5 ++++
 prog/weave-npc/main.go | 65 ++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 67 insertions(+), 3 deletions(-)

diff --git a/npc/constants.go b/npc/constants.go
index 2722c57f..0e41dfe8 100644
--- a/npc/constants.go
+++ b/npc/constants.go
@@ -7,6 +7,11 @@ const (
 	DefaultChain = "WEAVE-NPC-DEFAULT"
 	IngressChain = "WEAVE-NPC-INGRESS"
 
+	EgressChain        = "WEAVE-NPC-EGRESS"
+	EgressDefaultChain = "WEAVE-NPC-EGRESS-DEFAULT"
+	EgressCustomChain  = "WEAVE-NPC-EGRESS-CUSTOM"
+	EgressMark         = "0x40000/0x40000"
+
 	IpsetNamePrefix = "weave-"
 
 	LocalIpset = IpsetNamePrefix + "local-pods"
diff --git a/prog/weave-npc/main.go b/prog/weave-npc/main.go
index d9922de9..4edfe9f4 100644
--- a/prog/weave-npc/main.go
+++ b/prog/weave-npc/main.go
@@ -53,7 +53,23 @@ func resetIPTables(ipt *iptables.IPTables) error {
 		return err
 	}
 
-	return ipt.ClearChain(npc.TableFilter, npc.MainChain)
+	if err := ipt.ClearChain(npc.TableFilter, npc.MainChain); err != nil {
+		return err
+	}
+
+	if err := ipt.ClearChain(npc.TableFilter, npc.EgressCustomChain); err != nil {
+		return err
+	}
+
+	if err := ipt.ClearChain(npc.TableFilter, npc.EgressDefaultChain); err != nil {
+		return err
+	}
+
+	if err := ipt.ClearChain(npc.TableFilter, npc.EgressChain); err != nil {
+		return err
+	}
+
+	return nil
 }
 
 func resetIPSets(ips ipset.Interface) error {
@@ -115,8 +131,51 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 	if err := ips.Create(npc.LocalIpset, ipset.HashIP); err != nil {
 		return err
 	}
-	return ipt.Append(npc.TableFilter, npc.MainChain,
-		"-m", "set", "!", "--match-set", npc.LocalIpset, "dst", "-j", "ACCEPT")
+	if err := ipt.Append(npc.TableFilter, npc.MainChain,
+		"-m", "set", "!", "--match-set", npc.LocalIpset, "dst", "-j", "ACCEPT"); err != nil {
+		return err
+	}
+
+	if err := ipt.Append(npc.TableFilter, npc.EgressChain,
+		"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "RETURN"); err != nil {
+		return err
+	}
+	if allowMcast {
+		if err := ipt.Append(npc.TableFilter, npc.EgressChain,
+			"-d", "224.0.0.0/4", "-j", "RETURN"); err != nil {
+			return err
+		}
+	}
+	if err := ipt.Append(npc.TableFilter, npc.EgressChain,
+		"-m", "state", "--state", "NEW",
+		"-j", string(npc.EgressDefaultChain)); err != nil {
+		return err
+	}
+	if err := ipt.Append(npc.TableFilter, npc.EgressChain,
+		"-m", "state", "--state", "NEW",
+		"-m", "set", "!", "--match-set", npc.LocalIpset, "src",
+		"-j", "RETURN"); err != nil {
+		return err
+	}
+	if err := ipt.Append(npc.TableFilter, npc.EgressChain,
+		"-m", "state", "--state", "NEW",
+		"-m", "mark", "!", "--mark", npc.EgressMark,
+		"-j", string(npc.EgressCustomChain)); err != nil {
+		return err
+	}
+	if err := ipt.Append(npc.TableFilter, npc.EgressChain,
+		"-m", "state", "--state", "NEW",
+		"-m", "mark", "!", "--mark", npc.EgressMark,
+		"-j", "NFLOG", "--nflog-group", "86"); err != nil {
+		return err
+	}
+	if err := ipt.Append(npc.TableFilter, npc.EgressChain,
+		"-m", "mark", "!", "--mark", npc.EgressMark,
+		"-j", "DROP"); err != nil {
+		return err
+	}
+
+	return nil
 }
 
 func root(cmd *cobra.Command, args []string) {