npc: Add rule type (ingress, egress)

npc/analyser.go

@@ -45,13 +45,13 @@ func (ns *ns) analysePolicyLegacy(policy *extnapi.NetworkPolicy) (
 			// From is not provided, this rule matches all sources (traffic not restricted by source).
 			if ingressRule.Ports == nil {
 				// Ports is not provided, this rule matches all ports (traffic not restricted by port).
-				rule := newRuleSpec(nil, nil, dstSelector, nil)
+				rule := newRuleSpec(ingress, nil, nil, dstSelector, nil)
 				rules[rule.key] = rule
 			} else {
 				// Ports is present and contains at least one item, then this rule allows traffic
 				// only if the traffic matches at least one port in the ports list.
 				withNormalisedProtoAndPortLegacy(ingressRule.Ports, func(proto, port string) {
-					rule := newRuleSpec(&proto, nil, dstSelector, &port)
+					rule := newRuleSpec(ingress, &proto, nil, dstSelector, &port)
 					rules[rule.key] = rule
 				})
 			}
@@ -77,13 +77,13 @@ func (ns *ns) analysePolicyLegacy(policy *extnapi.NetworkPolicy) (
 
 				if ingressRule.Ports == nil {
 					// Ports is not provided, this rule matches all ports (traffic not restricted by port).
-					rule := newRuleSpec(nil, srcSelector, dstSelector, nil)
+					rule := newRuleSpec(ingress, nil, srcSelector, dstSelector, nil)
 					rules[rule.key] = rule
 				} else {
 					// Ports is present and contains at least one item, then this rule allows traffic
 					// only if the traffic matches at least one port in the ports list.
 					withNormalisedProtoAndPortLegacy(ingressRule.Ports, func(proto, port string) {
-						rule := newRuleSpec(&proto, srcSelector, dstSelector, &port)
+						rule := newRuleSpec(ingress, &proto, srcSelector, dstSelector, &port)
 						rules[rule.key] = rule
 					})
 				}
@@ -128,11 +128,11 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) (
 
 		if allSources {
 			if allPorts {
-				rule := newRuleSpec(nil, nil, dstSelector, nil)
+				rule := newRuleSpec(ingress, nil, nil, dstSelector, nil)
 				rules[rule.key] = rule
 			} else {
 				withNormalisedProtoAndPort(ingressRule.Ports, func(proto, port string) {
-					rule := newRuleSpec(&proto, nil, dstSelector, &port)
+					rule := newRuleSpec(ingress, &proto, nil, dstSelector, &port)
 					rules[rule.key] = rule
 				})
 			}
@@ -158,11 +158,11 @@ func (ns *ns) analysePolicy(policy *networkingv1.NetworkPolicy) (
 				}
 
 				if allPorts {
-					rule := newRuleSpec(nil, srcSelector, dstSelector, nil)
+					rule := newRuleSpec(ingress, nil, srcSelector, dstSelector, nil)
 					rules[rule.key] = rule
 				} else {
 					withNormalisedProtoAndPort(ingressRule.Ports, func(proto, port string) {
-						rule := newRuleSpec(&proto, srcSelector, dstSelector, &port)
+						rule := newRuleSpec(ingress, &proto, srcSelector, dstSelector, &port)
 						rules[rule.key] = rule
 					})
 				}

npc/rule.go

@@ -10,12 +10,20 @@ import (
 	"github.com/weaveworks/weave/npc/iptables"
 )
 
+type ruleType byte
+
+const (
+	ingress ruleType = iota
+	egress
+)
+
 type ruleSpec struct {
-	key  string
-	args []string
+	key      string
+	args     []string
+	ruleType ruleType
 }
 
-func newRuleSpec(proto *string, srcHost *selectorSpec, dstHost *selectorSpec, dstPort *string) *ruleSpec {
+func newRuleSpec(ruleType ruleType, proto *string, srcHost *selectorSpec, dstHost *selectorSpec, dstPort *string) *ruleSpec {
 	args := []string{}
 	if proto != nil {
 		args = append(args, "-p", *proto)
@@ -41,7 +49,7 @@ func newRuleSpec(proto *string, srcHost *selectorSpec, dstHost *selectorSpec, ds
 	args = append(args, "-m", "comment", "--comment", fmt.Sprintf("%s -> %s", srcComment, dstComment))
 	key := strings.Join(args, " ")
 
-	return &ruleSpec{key, args}
+	return &ruleSpec{key, args, ruleType}
 }
 
 type ruleSet struct {
@@ -58,8 +66,12 @@ func (rs *ruleSet) deprovision(user types.UID, current, desired map[string]*rule
 		if _, found := desired[key]; !found {
 			delete(rs.users[key], user)
 			if len(rs.users[key]) == 0 {
-				common.Log.Infof("deleting rule: %v", spec.args)
-				if err := rs.ipt.Delete(TableFilter, IngressChain, spec.args...); err != nil {
+				chain := IngressChain
+				if spec.ruleType == egress {
+					chain = EgressCustomChain
+				}
+				common.Log.Infof("deleting rule %v from %q chain", spec.args, chain)
+				if err := rs.ipt.Delete(TableFilter, chain, spec.args...); err != nil {
 					return err
 				}
 				delete(rs.users, key)
@@ -74,8 +86,12 @@ func (rs *ruleSet) provision(user types.UID, current, desired map[string]*ruleSp
 	for key, spec := range desired {
 		if _, found := current[key]; !found {
 			if _, found := rs.users[key]; !found {
-				common.Log.Infof("adding rule: %v", spec.args)
-				if err := rs.ipt.Append(TableFilter, IngressChain, spec.args...); err != nil {
+				chain := IngressChain
+				if spec.ruleType == egress {
+					chain = EgressCustomChain
+				}
+				common.Log.Infof("adding rule %v to %q chain", spec.args, chain)
+				if err := rs.ipt.Append(TableFilter, chain, spec.args...); err != nil {
 					return err
 				}
 				rs.users[key] = make(map[types.UID]struct{})

npc/rule_test.go

@@ -9,7 +9,7 @@ func TestRegressionHandleNil3095(t *testing.T) {
 	// Test for handling nil values
 	// https://github.com/weaveworks/weave/issues/3095
 
-	rs := newRuleSpec(nil, nil, nil, nil)
+	rs := newRuleSpec(ingress, nil, nil, nil, nil)
 
 	require.NotEqual(t, rs.key, "")