From c0e2deb5a0d6bea3529c3bc8e677be22f4e3d3e7 Mon Sep 17 00:00:00 2001
From: Martynas Pumputis <martynasp@gmail.com>
Date: Sat, 26 May 2018 20:16:33 +0200
Subject: [PATCH] npc: Add WEAVE-NPC-EGRESS-ACCEPT chain

For improving readability of NPC rules. The chain marks to-be-allowed egress
traffic.
---
 npc/constants.go       | 1 +
 npc/namespace.go       | 2 +-
 npc/rule.go            | 2 +-
 prog/weave-npc/main.go | 9 +++++++++
 4 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/npc/constants.go b/npc/constants.go
index 0e41dfe8..6c94dcc9 100644
--- a/npc/constants.go
+++ b/npc/constants.go
@@ -10,6 +10,7 @@ const (
 	EgressChain        = "WEAVE-NPC-EGRESS"
 	EgressDefaultChain = "WEAVE-NPC-EGRESS-DEFAULT"
 	EgressCustomChain  = "WEAVE-NPC-EGRESS-CUSTOM"
+	EgressMarkChain    = "WEAVE-NPC-EGRESS-ACCEPT"
 	EgressMark         = "0x40000/0x40000"
 
 	IpsetNamePrefix = "weave-"
diff --git a/npc/namespace.go b/npc/namespace.go
index f3a946e1..f3972474 100644
--- a/npc/namespace.go
+++ b/npc/namespace.go
@@ -449,7 +449,7 @@ func bypassRuleIngress(nsIpsetName ipset.Name, namespace string) []string {
 
 func bypassRuleEgress(nsIpsetName ipset.Name, namespace string) [][]string {
 	return [][]string{
-		{"-m", "set", "--match-set", string(nsIpsetName), "src", "-j", "MARK", "--set-xmark", EgressMark, "-m", "comment", "--comment", "DefaultAllow isolation for namespace: " + namespace},
+		{"-m", "set", "--match-set", string(nsIpsetName), "src", "-j", EgressMarkChain, "-m", "comment", "--comment", "DefaultAllow isolation for namespace: " + namespace},
 		{"-m", "set", "--match-set", string(nsIpsetName), "src", "-j", "RETURN", "-m", "comment", "--comment", "DefaultAllow isolation for namespace: " + namespace},
 	}
 }
diff --git a/npc/rule.go b/npc/rule.go
index 37238c72..a08a3a20 100644
--- a/npc/rule.go
+++ b/npc/rule.go
@@ -72,7 +72,7 @@ func (spec *ruleSpec) iptRuleSpecs() [][]string {
 	// egressPolicy
 	ruleMark := make([]string, len(spec.args))
 	copy(ruleMark, spec.args)
-	ruleMark = append(ruleMark, "-j", "MARK", "--set-xmark", EgressMark)
+	ruleMark = append(ruleMark, "-j", EgressMarkChain)
 	ruleReturn := make([]string, len(spec.args))
 	copy(ruleReturn, spec.args)
 	ruleReturn = append(ruleReturn, "-j", "RETURN")
diff --git a/prog/weave-npc/main.go b/prog/weave-npc/main.go
index 4edfe9f4..dcda5813 100644
--- a/prog/weave-npc/main.go
+++ b/prog/weave-npc/main.go
@@ -57,6 +57,10 @@ func resetIPTables(ipt *iptables.IPTables) error {
 		return err
 	}
 
+	if err := ipt.ClearChain(npc.TableFilter, npc.EgressMarkChain); err != nil {
+		return err
+	}
+
 	if err := ipt.ClearChain(npc.TableFilter, npc.EgressCustomChain); err != nil {
 		return err
 	}
@@ -136,6 +140,11 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 		return err
 	}
 
+	if err := ipt.Append(npc.TableFilter, npc.EgressMarkChain,
+		"-j", "MARK", "--set-xmark", npc.EgressMark); err != nil {
+		return err
+	}
+
 	if err := ipt.Append(npc.TableFilter, npc.EgressChain,
 		"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "RETURN"); err != nil {
 		return err