firewall: support ingressPolicy=(open|same-bridge) for isolating bridges as in Docker

This commit adds a new parameter `ingressPolicy` (`string`) to the `firewall` plugin.
The supported values are `open` and `same-bridge`.

- `open` is the default and does NOP.

- `same-bridge` creates "CNI-ISOLATION-STAGE-1" and "CNI-ISOLATION-STAGE-2"
that are similar to Docker libnetwork's "DOCKER-ISOLATION-STAGE-1" and
"DOCKER-ISOLATION-STAGE-2" rules.

e.g., when `ns1` and `ns2` are connected to bridge `cni1`, and `ns3` is
connected to bridge `cni2`, the `same-bridge` ingress policy disallows
communications between `ns1` and `ns3`, while allowing communications
between `ns1` and `ns2`.

Please refer to the comment lines in `ingresspolicy.go` for the actual iptables rules.

The `same-bridge` ingress policy is expected to be used in conjunction
with `bridge` plugin. May not work as expected with other "main" plugins.

It should be also noted that the `same-bridge` ingress policy executes
raw `iptables` commands directly, even when the `backend` is set to `firewalld`.
We could potentially use the "direct" API of firewalld [1] to execute
iptables via firewalld, but it doesn't seem to have a clear benefit over just directly
executing raw iptables commands.
(Anyway, we have been already executing raw iptables commands in the `portmap` plugin)

[1] https://firewalld.org/documentation/direct/options.html

This commit replaces the `isolation` plugin proposal (issue 573, PR 574).
The design of `ingressPolicy` was discussed in the comments of the withdrawn PR 574 ,
but `same-network` was renamed to `same-bridge` then.

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

plugins/meta/firewall/firewall.go

@@ -46,8 +46,27 @@ type FirewallNetConf struct {
 	// the firewalld backend is used but the zone is not given, it defaults
 	// to 'trusted'
 	FirewalldZone string `json:"firewalldZone,omitempty"`
+
+	// IngressPolicy is an optional ingress policy.
+	// Defaults to "open".
+	IngressPolicy IngressPolicy `json:"ingressPolicy,omitempty"`
 }
 
+// IngressPolicy is an ingress policy string.
+type IngressPolicy = string
+
+const (
+	// IngressPolicyOpen ("open"): all inbound connections to the container are accepted.
+	// IngressPolicyOpen is the default ingress policy.
+	IngressPolicyOpen IngressPolicy = "open"
+
+	// IngressPolicySameBridge ("same-bridge"): connections from the same bridge are accepted, others are blocked.
+	// This is similar to how Docker libnetwork works.
+	// IngressPolicySameBridge executes `iptables` regardless to the value of `Backend`.
+	// IngressPolicySameBridge may not work as expected for non-bridge networks.
+	IngressPolicySameBridge IngressPolicy = "same-bridge"
+)
+
 type FirewallBackend interface {
 	Add(*FirewallNetConf, *current.Result) error
 	Del(*FirewallNetConf, *current.Result) error
@@ -129,6 +148,10 @@ func cmdAdd(args *skel.CmdArgs) error {
 		return err
 	}
 
+	if err := setupIngressPolicy(conf, result); err != nil {
+		return err
+	}
+
 	if result == nil {
 		result = &current.Result{
 			CNIVersion: current.ImplementedSpecVersion,
@@ -153,6 +176,10 @@ func cmdDel(args *skel.CmdArgs) error {
 		return err
 	}
 
+	if err := teardownIngressPolicy(conf, result); err != nil {
+		return err
+	}
+
 	return nil
 }