Allow negation of interfaces for iptables rules

Based on matching functionality in Kiam
Introduced by uswitch/kiam#54

README.md

@@ -146,6 +146,7 @@ different than `docker0` depending on which virtual network you use e.g.
 * for kops (on kubenet), use `cbr0`
 * for CNI, use `cni0`
 * for [EKS](https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html)/[amazon-vpc-cni-k8s](https://github.com/aws/amazon-vpc-cni-k8s), even with calico installed uses `eni+`. (Each pod gets an interface like `eni4c0e15dfb05`)
+  * If using security groups per pod however, you will need to instead use `!eth0` as pods making use of security groups per pod [will use](https://aws.amazon.com/blogs/containers/introducing-security-groups-for-pods/) `vlan` interfaces as well as the `eni+` interfaces used for other pods.
 * for weave use `weave`
 * for flannel use `cni0`
 * for [kube-router](https://github.com/cloudnativelabs/kube-router) use `kube-bridge`

iptables/iptables.go

@@ -24,21 +24,32 @@ func AddRule(appPort, metadataAddress, hostInterface, hostIP string) error {
 		return err
 	}
 
+	ruleSpec := []string{"-p", "tcp", "-d", metadataAddress, "--dport", "80",
+		"-j", "DNAT", "--to-destination", hostIP + ":" + appPort,
+	}
+	if strings.HasPrefix(hostInterface, "!") {
+		ruleSpec = append(ruleSpec, "!")
+	}
+	ruleSpec = append(ruleSpec, "-i", strings.TrimPrefix(hostInterface, "!"))
 	return ipt.AppendUnique(
-		"nat", "PREROUTING", "-p", "tcp", "-d", metadataAddress, "--dport", "80",
-		"-j", "DNAT", "--to-destination", hostIP+":"+appPort, "-i", hostInterface,
+		"nat", "PREROUTING", ruleSpec...,
 	)
 }
 
 // checkInterfaceExists validates the interface passed exists for the given system.
-// checkInterfaceExists ignores wildcard networks.
+// checkInterfaceExists ignores wildcard and negated networks.
 func checkInterfaceExists(hostInterface string) error {
 
 	if strings.Contains(hostInterface, "+") {
 		// wildcard networks ignored
 		return nil
 	}
 
+	if strings.HasPrefix(hostInterface, "!") {
+		// negated networks ignored
+		return nil
+	}
+
 	_, err := net.InterfaceByName(hostInterface)
 	return err
 }

iptables/iptables_test.go

@@ -36,6 +36,13 @@ func TestCheckInterfaceExistsPassesWithPlus(t *testing.T) {
 	}
 }
 
+func TestCheckInterfaceExistsPassesWithNegated(t *testing.T) {
+	ifc := "!eth0"
+	if err := checkInterfaceExists(ifc); err != nil {
+		t.Error("Should pass with negated interface(s). Interface received:", ifc)
+	}
+}
+
 func TestAddRule(t *testing.T) {
 	t.Skip()
 }