From 8c52698222c401df0d3ea9f310c118e669083a1f Mon Sep 17 00:00:00 2001
From: Bryan Boreham <bjboreham@gmail.com>
Date: Wed, 26 Aug 2020 10:02:32 +0000
Subject: [PATCH] Move egress logging rule beside drop rule

Otherwise we might log a blocked connection even though the packet
was not dropped.
---
 npc/controller.go      | 7 +++++--
 prog/weave-npc/main.go | 1 -
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/npc/controller.go b/npc/controller.go
index f2d7b67f..92ff76e3 100644
--- a/npc/controller.go
+++ b/npc/controller.go
@@ -158,12 +158,15 @@ func (npc *controller) AddNetworkPolicy(ctx context.Context, obj interface{}) er
 			return err
 		}
 		if egressNetworkPolicy {
-			npc.defaultEgressDrop = true
+			if err := npc.ipt.Append(TableFilter, chains.EgressChain,
+				"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", EgressMark, "-j", "NFLOG", "--nflog-group", "86"); err != nil {
+				return fmt.Errorf("Failed to add iptable egress log rule: %w", err)
+			}
 			if err := npc.ipt.Append(TableFilter, chains.EgressChain,
 				"-m", "mark", "!", "--mark", EgressMark, "-j", "DROP"); err != nil {
-				npc.defaultEgressDrop = false
 				return fmt.Errorf("Failed to add iptable rule to drop egress traffic from the pods by default due to %s", err.Error())
 			}
+			npc.defaultEgressDrop = true
 		}
 	}
 
diff --git a/prog/weave-npc/main.go b/prog/weave-npc/main.go
index ba307bb5..cfc48145 100644
--- a/prog/weave-npc/main.go
+++ b/prog/weave-npc/main.go
@@ -193,7 +193,6 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 	ruleSpecs = append(ruleSpecs, [][]string{
 		{"-m", "state", "--state", "NEW", "-j", chains.EgressDefaultChain},
 		{"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", npc.EgressMark, "-j", chains.EgressCustomChain},
-		{"-m", "state", "--state", "NEW", "-m", "mark", "!", "--mark", npc.EgressMark, "-j", "NFLOG", "--nflog-group", "86"},
 	}...)
 	if err := net.AddChainWithRules(ipt, npc.TableFilter, chains.EgressChain, ruleSpecs); err != nil {
 		return err