Move egress logging rule beside drop rule

Otherwise we might log a blocked connection even though the packet
was not dropped.

npc/controller.go

@@ -158,12 +158,15 @@ func (npc *controller) AddNetworkPolicy(ctx context.Context, obj interface{}) er
 			return err
 		}
 		if egressNetworkPolicy {
-			npc.defaultEgressDrop = true
+			if err := npc.ipt.Append(TableFilter, chains.EgressChain,
+				"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", EgressMark, "-j", "NFLOG", "--nflog-group", "86"); err != nil {
+				return fmt.Errorf("Failed to add iptable egress log rule: %w", err)
+			}
 			if err := npc.ipt.Append(TableFilter, chains.EgressChain,
 				"-m", "mark", "!", "--mark", EgressMark, "-j", "DROP"); err != nil {
-				npc.defaultEgressDrop = false
 				return fmt.Errorf("Failed to add iptable rule to drop egress traffic from the pods by default due to %s", err.Error())
 			}
+			npc.defaultEgressDrop = true
 		}
 	}
 

prog/weave-npc/main.go

@@ -193,7 +193,6 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 	ruleSpecs = append(ruleSpecs, [][]string{
 		{"-m", "state", "--state", "NEW", "-j", chains.EgressDefaultChain},
 		{"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", npc.EgressMark, "-j", chains.EgressCustomChain},
-		{"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", npc.EgressMark, "-j", "NFLOG", "--nflog-group", "86"},
 	}...)
 	if err := net.AddChainWithRules(ipt, npc.TableFilter, chains.EgressChain, ruleSpecs); err != nil {
 		return err