add --physdev-is-bridged flag when using physdev module for iptables

[murali-reddy]

add --physdev-is-bridged flag when using physdev module for iptables rules created by weave-npc to prevent warning in kernel logs

Fixes #3449

Since previous iptables chains rules are flushed on weave pod start, fix works for both fresh install and upgrades.

[murali-reddy]

@bboreham I fixed (99e360c) below failing test (test/840_weave_kube_3_test.sh) with earlier commit.

# Check we can ping between the Weave bridge IPs on each host
HOST1EXPIP=$($SSH $HOST1 "weave expose" || true)
HOST2EXPIP=$($SSH $HOST2 "weave expose" || true)
HOST3EXPIP=$($SSH $HOST3 "weave expose" || true)
assert_raises "run_on $HOST1 $PING $HOST2EXPIP"
assert_raises "run_on $HOST2 $PING $HOST1EXPIP"
assert_raises "run_on $HOST3 $PING $HOST2EXPIP"

Using -m physdev --physdev-is-bridged fixes #3349, but it has side affect where a node can not access the weave bridge IP of any remote node. A node accessing remote node bridge Ip, does not get bridged but routed to host IP(as its local) hence missing below exception resulting in packet drop.

-A WEAVE-NPC-EGRESS -m physdev --physdev-in vethwe-bridge --physdev-is-bridged -j RETURN
Not sure if these tests are required. At least from Kubernetes networking requirements point of view we don't need to care about the ip assigned to bridge IP. Is connectivity between weave bridge IP's needed across the nodes?

[bboreham]

The weave bridge ip is used for “service import” which has been a feature since nearly the beginning.

I think it would be ok to say “you can’t have service import and network policy at the same time”.

That said, I don’t quite understand your statement of the problem. The sending node doesn’t know what the destination IP is, does it? Is the problem on the receiving node?

[bboreham]

LGTM!

[murali-reddy]

I have finished sanity testing for various scenarios for any possible regression due to addition of new rule. its good to be get merged.

-A WEAVE-NPC-EGRESS -m addrtype --dst-type LOCAL -j RETURN