Fix egress port iptables rule when no ports are specified

[zachomedia]

What this PR does / why we need it:

This PR corrects the iptables flag for network policy egress rules when no ports are defined. Without this fix, the rule added to AZURE-NPM-EGRESS-PORT (since it checks the dst ip instead of src ip of the pod) doesn't match and therefore doesn't go to the AZURE-NPM-EGRESS-TO table which would allow the traffic.

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #

Special notes for your reviewer:
None.

Release note:

[sylus]

Hey @saiyan86 is it possible to get this in? Network policy just doesn't work as expected without this fix.

Thanks a bunch!

[saiyan86]

@zachomedia @sylus Thanks a lot for contributing! #307 should address this along with a bunch of other changes.

[zachomedia]

@saiyan86 I took at look at the resulting change and it looks like the bug is likely still there https://github.com/Azure/azure-container-networking/blob/master/npm/parse.go#L576 still has IptablesDstFlag instead of IptablesSrcFlag.

I'll see if I can try out the newer version on a cluster and confirm it's still there.

[zachomedia]

@saiyan86 I just confirmed that this bug is still present in the latest version (v1.0.18).

[saiyan86]

@zachomedia Can you share a network policy that triggers this bug? All of my current tests passed.

[zachomedia]

First, apply a deny-all rule:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

Then allow traffic to mirror.csclub.uwaterloo.ca (129.97.134.71):

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-csc-mirror
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 129.97.134.71/32

After applying the second rule, it should allow you to communicate with mirror.csclub.uwaterloo.ca (on port 80, for example). However, it doesn't work.

If you specify specific ports, for example:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-csc-mirror
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - ports:
    - port: 80
      protocol: TCP
    - port: 443
      protocol: TCP
  - to:
    - ipBlock:
        cidr: 129.97.134.71/32

Then everything works as expected.

[saiyan86]

fixed in #315