Label tier default action when programming dataplane rules (#10023)

* label end of tier in iptables/nftables

* change the bpf policy program

* Fix UTs

Author: mazdakn

felix/bpf/polprog/pol_prog_builder.go

@@ -504,7 +504,7 @@ func (p *Builder) writeTiers(tiers []Tier, destLeg matchLeg, allowLabel string)
 		if action == TierEndUndef {
 			action = TierEndDeny
 		}
-		p.b.AddCommentF("End of tier %s", tier.Name)
+		p.b.AddCommentF("End of tier %s: %s", tier.Name, tier.EndAction)
 		log.Debugf("End of tier %d %q: %s", p.tierID, tier.Name, action)
 		p.writeRule(Rule{
 			Rule:    &proto.Rule{},

felix/dataplane/linux/endpoint_mgr_test.go

@@ -363,7 +363,7 @@ func chainsForIfaces(ipVersion uint8,
 					{
 						Match:   iptables.Match().MarkClear(16),
 						Action:  iptables.DropAction{},
-						Comment: []string{"Drop if no policies passed packet"},
+						Comment: []string{fmt.Sprintf("End of tier %v. Drop if no policies passed packet", tierName)},
 					},
 				}...)
 			}
@@ -473,7 +473,7 @@ func chainsForIfaces(ipVersion uint8,
 					{
 						Match:   iptables.Match().MarkClear(16),
 						Action:  iptables.DropAction{},
-						Comment: []string{"Drop if no policies passed packet"},
+						Comment: []string{fmt.Sprintf("End of tier %v. Drop if no policies passed packet", tierName)},
 					},
 				}...)
 			}

felix/rules/endpoints.go

@@ -698,9 +698,12 @@ func (r *DefaultRuleRenderer) endpointIptablesChain(
 						})
 					}
 					rules = append(rules, generictables.Rule{
-						Match:   r.NewMatch().MarkClear(r.MarkPass),
-						Action:  r.IptablesFilterDenyAction(),
-						Comment: []string{fmt.Sprintf("%s if no policies passed packet", r.IptablesFilterDenyAction())},
+						Match:  r.NewMatch().MarkClear(r.MarkPass),
+						Action: r.IptablesFilterDenyAction(),
+						Comment: []string{fmt.Sprintf("End of tier %s. %s if no policies passed packet",
+							tier.Name,
+							r.IptablesFilterDenyAction()),
+						},
 					})
 				} else if r.FlowLogsEnabled {
 					// If we do not require an end of tier drop (i.e. because all of the policies in the tier are