npc: Add WEAVE-NPC-EGRESS-ACCEPT chain

For improving readability of NPC rules. The chain marks to-be-allowed egress
traffic.

npc/constants.go

@@ -10,6 +10,7 @@ const (
 	EgressChain        = "WEAVE-NPC-EGRESS"
 	EgressDefaultChain = "WEAVE-NPC-EGRESS-DEFAULT"
 	EgressCustomChain  = "WEAVE-NPC-EGRESS-CUSTOM"
+	EgressMarkChain    = "WEAVE-NPC-EGRESS-ACCEPT"
 	EgressMark         = "0x40000/0x40000"
 
 	IpsetNamePrefix = "weave-"

npc/namespace.go

@@ -449,7 +449,7 @@ func bypassRuleIngress(nsIpsetName ipset.Name, namespace string) []string {
 
 func bypassRuleEgress(nsIpsetName ipset.Name, namespace string) [][]string {
 	return [][]string{
-		{"-m", "set", "--match-set", string(nsIpsetName), "src", "-j", "MARK", "--set-xmark", EgressMark, "-m", "comment", "--comment", "DefaultAllow isolation for namespace: " + namespace},
+		{"-m", "set", "--match-set", string(nsIpsetName), "src", "-j", EgressMarkChain, "-m", "comment", "--comment", "DefaultAllow isolation for namespace: " + namespace},
 		{"-m", "set", "--match-set", string(nsIpsetName), "src", "-j", "RETURN", "-m", "comment", "--comment", "DefaultAllow isolation for namespace: " + namespace},
 	}
 }

npc/rule.go

@@ -72,7 +72,7 @@ func (spec *ruleSpec) iptRuleSpecs() [][]string {
 	// egressPolicy
 	ruleMark := make([]string, len(spec.args))
 	copy(ruleMark, spec.args)
-	ruleMark = append(ruleMark, "-j", "MARK", "--set-xmark", EgressMark)
+	ruleMark = append(ruleMark, "-j", EgressMarkChain)
 	ruleReturn := make([]string, len(spec.args))
 	copy(ruleReturn, spec.args)
 	ruleReturn = append(ruleReturn, "-j", "RETURN")

prog/weave-npc/main.go

@@ -57,6 +57,10 @@ func resetIPTables(ipt *iptables.IPTables) error {
 		return err
 	}
 
+	if err := ipt.ClearChain(npc.TableFilter, npc.EgressMarkChain); err != nil {
+		return err
+	}
+
 	if err := ipt.ClearChain(npc.TableFilter, npc.EgressCustomChain); err != nil {
 		return err
 	}
@@ -136,6 +140,11 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 		return err
 	}
 
+	if err := ipt.Append(npc.TableFilter, npc.EgressMarkChain,
+		"-j", "MARK", "--set-xmark", npc.EgressMark); err != nil {
+		return err
+	}
+
 	if err := ipt.Append(npc.TableFilter, npc.EgressChain,
 		"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "RETURN"); err != nil {
 		return err