Add a filter chain to allow persistent rules

Allow users to configure firewall policies in way that persists
docker operations/restarts. Docker will not delete or modify any
pre-existing rules from the DOCKER-FORWARD-TOP filter chain. This
allows the user to create in advance any rules required to further
restrict access from/to the containers.

Fixes moby/moby/issues/29184
Fixes moby/moby/issues/23987
Related to moby/moby/issues/24848

Signed-off-by: Jacob Wen <jian.w.wen@oracle.com>

drivers/bridge/setup_ip_tables.go

@@ -13,6 +13,7 @@ import (
 const (
 	DockerChain    = "DOCKER"
 	IsolationChain = "DOCKER-ISOLATION"
+	fwdTopChain    = "DOCKER-FORWARD-TOP"
 )
 
 func setupIPChains(config *configuration) (*iptables.ChainInfo, *iptables.ChainInfo, *iptables.ChainInfo, error) {
@@ -56,6 +57,15 @@ func setupIPChains(config *configuration) (*iptables.ChainInfo, *iptables.ChainI
 		return nil, nil, nil, err
 	}
 
+	_, err = iptables.NewChain(fwdTopChain, iptables.Filter, false)
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("failed to create FILTER isolation chain: %v", err)
+	}
+
+	if err := addReturnRule(fwdTopChain); err != nil {
+		return nil, nil, nil, err
+	}
+
 	return natChain, filterChain, isolationChain, nil
 }
 
@@ -122,6 +132,13 @@ func (n *bridgeNetwork) setupIPTables(config *networkConfiguration, i *bridgeInt
 		return err
 	}
 
+	d.Lock()
+	err = ensureJumpRule("FORWARD", fwdTopChain)
+	d.Unlock()
+	if err != nil {
+		return err
+	}
+
 	return nil
 }