From e3c0807a186c4dbf27944c5d96877ddca2e69078 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Fri, 27 Mar 2015 15:36:10 +0000 Subject: [PATCH 01/19] Modify attach/detach helpers to take list of addresses --- weave | 50 +++++++++++++++++++++++++++++++------------------- 1 file changed, 31 insertions(+), 19 deletions(-) diff --git a/weave b/weave index cd13b1a5..5e8b4082 100755 --- a/weave +++ b/weave @@ -325,23 +325,33 @@ launch() { attach() { if ip netns exec $NETNS ip link show $CONTAINER_IFNAME >/dev/null 2>&1 ; then - # container already has the expected network interface, so assume we set it up already; - # just add the IP address. - if ip netns exec $NETNS ip addr show dev $CONTAINER_IFNAME | grep -F $1 >/dev/null ; then - # address was there already - return 0 - fi + for addr; do + # container already has the expected network interface, so assume we set it up already; + # just add the IP address. + if ip netns exec $NETNS ip addr show dev $CONTAINER_IFNAME | grep -F $addr >/dev/null ; then + # address was there already + continue + fi - if ! ip netns exec $NETNS ip addr add $1 dev $CONTAINER_IFNAME ; then - return 1 - fi + if ! ip netns exec $NETNS ip addr add $addr dev $CONTAINER_IFNAME ; then + return 1 + fi + done return 0 fi - if ! connect_container_to_bridge || - ! ip netns exec $NETNS ip addr add $1 dev $CONTAINER_IFNAME || - ! ip netns exec $NETNS ip link set $CONTAINER_IFNAME up ; then + if ! connect_container_to_bridge; then + return 1 + fi + + for addr; do + if ! ip netns exec $NETNS ip addr add $1 dev $CONTAINER_IFNAME; then + return 1 + fi + done + + if ! ip netns exec $NETNS ip link set $CONTAINER_IFNAME up ; then return 1 fi @@ -354,14 +364,16 @@ attach() { } detach() { - if ! ip netns exec $NETNS ip addr show dev $CONTAINER_IFNAME | grep -F $1 >/dev/null ; then - # address is not there, leave the device alone - return 0 - fi + for addr; do + if ! ip netns exec $NETNS ip addr show dev $CONTAINER_IFNAME | grep -F $addr >/dev/null ; then + # address is not there, leave the device alone + continue + fi - if ! ip netns exec $NETNS ip addr del $1 dev $CONTAINER_IFNAME ; then - return 1 - fi + if ! ip netns exec $NETNS ip addr del $addr dev $CONTAINER_IFNAME ; then + return 1 + fi + done if [ -n "$(ip netns exec $NETNS ip -f inet addr show dev $CONTAINER_IFNAME)" ] ; then # other addresses are left, leave the device alone From e6af8996e6035d9da709d59419bb6357781c27d6 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Fri, 27 Mar 2015 16:46:47 +0000 Subject: [PATCH 02/19] Attach and detach take multiple addresses --- weave | 44 ++++++++++++++++++++++++++++++++------------ 1 file changed, 32 insertions(+), 12 deletions(-) diff --git a/weave b/weave index 5e8b4082..7530ff87 100755 --- a/weave +++ b/weave @@ -21,8 +21,8 @@ usage() { echo "weave forget " echo "weave run [--with-dns] ..." echo "weave start " - echo "weave attach " - echo "weave detach " + echo "weave attach [ ...] " + echo "weave detach [ ...] " echo "weave expose " echo "weave hide " echo "weave ps" @@ -681,19 +681,39 @@ case "$COMMAND" in echo $CONTAINER ;; attach) - [ $# -eq 2 ] || usage - CIDR=$1 - validate_cidr $CIDR + [ $# -gt 1 ] || usage + CIDRS="" + while true; do + if is_cidr "$1"; then + CIDRS="$CIDRS $1" + shift 1 + else + CONTAINER_ID="$1" + break + fi + done create_bridge - with_container_netns $2 attach $CIDR >/dev/null - tell_dns PUT $2 $CIDR + with_container_netns $CONTAINER_ID attach $CIDRS >/dev/null + for CIDR in $CIDRS; do + tell_dns PUT $CONTAINER_ID $CIDR + done ;; detach) - [ $# -eq 2 ] || usage - CIDR=$1 - validate_cidr $CIDR - with_container_netns $2 detach $CIDR >/dev/null - tell_dns DELETE $2 $CIDR + [ $# -gt 1 ] || usage + CIDRS="" + while true; do + if is_cidr "$1"; then + CIDRS="$CIDRS $1" + shift 1 + else + CONTAINER_ID="$1" + break + fi + done + with_container_netns $CONTAINER_ID detach $CIDRS >/dev/null + for CIDR in $CIDRS; do + tell_dns DELETE $CONTAINER_ID $CIDR + done ;; expose) [ $# -eq 1 ] || usage From a60490fb88a697e37916eadadf3c5a9defd95170 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Fri, 27 Mar 2015 17:47:17 +0000 Subject: [PATCH 03/19] Start takes multiple addresses --- weave | 44 +++++++++++++++++++++----------------------- 1 file changed, 21 insertions(+), 23 deletions(-) diff --git a/weave b/weave index 7530ff87..da320b74 100755 --- a/weave +++ b/weave @@ -346,7 +346,7 @@ attach() { fi for addr; do - if ! ip netns exec $NETNS ip addr add $1 dev $CONTAINER_IFNAME; then + if ! ip netns exec $NETNS ip addr add $addr dev $CONTAINER_IFNAME; then return 1 fi done @@ -671,27 +671,29 @@ case "$COMMAND" in echo -n $DNS_ARGS ;; start) - [ $# -eq 2 ] || usage - CIDR=$1 - validate_cidr $CIDR + [ $# -gt 1 ] || usage + CIDRS="" + while is_cidr "$1"; do + CIDRS="$CIDRS $1" + shift 1 + done + CONTAINER_ID="$1" create_bridge - CONTAINER=$(docker start $2) - with_container_netns $CONTAINER attach $CIDR >/dev/null - tell_dns PUT $CONTAINER $CIDR + CONTAINER=$(docker start $CONTAINER_ID) + with_container_netns $CONTAINER_ID attach $CIDRS >/dev/null + for CIDR in $CIDRS; do + tell_dns PUT $CONTAINER_ID $CIDR + done echo $CONTAINER ;; attach) [ $# -gt 1 ] || usage CIDRS="" - while true; do - if is_cidr "$1"; then - CIDRS="$CIDRS $1" - shift 1 - else - CONTAINER_ID="$1" - break - fi + while is_cidr "$1"; do + CIDRS="$CIDRS $1" + shift 1 done + CONTAINER_ID="$1" create_bridge with_container_netns $CONTAINER_ID attach $CIDRS >/dev/null for CIDR in $CIDRS; do @@ -701,15 +703,11 @@ case "$COMMAND" in detach) [ $# -gt 1 ] || usage CIDRS="" - while true; do - if is_cidr "$1"; then - CIDRS="$CIDRS $1" - shift 1 - else - CONTAINER_ID="$1" - break - fi + while is_cidr "$1"; do + CIDRS="$CIDRS $1" + shift 1 done + CONTAINER_ID="$1" with_container_netns $CONTAINER_ID detach $CIDRS >/dev/null for CIDR in $CIDRS; do tell_dns DELETE $CONTAINER_ID $CIDR From a8f2ba0e7ff7b74439f12fa024e491f71318cf19 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Fri, 27 Mar 2015 17:54:16 +0000 Subject: [PATCH 04/19] Run takes multiple addresses --- weave | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/weave b/weave index da320b74..8cabd47e 100755 --- a/weave +++ b/weave @@ -653,16 +653,20 @@ case "$COMMAND" in DNS_ARGS=$(exec_remote dns-args "$@") [ "$1" = "--with-dns" ] && shift 1 fi - CIDR=$1 - shift 1 - validate_cidr $CIDR + CIDRS="" + while is_cidr "$1"; do + CIDRS="$CIDRS $1" + shift 1 + done CONTAINER=$(docker run $DNS_ARGS -d "$@") if [ "$LOCAL" = "--local" ]; then create_bridge - with_container_netns $CONTAINER attach $CIDR >/dev/null - tell_dns PUT $CONTAINER $CIDR + with_container_netns $CONTAINER attach $CIDRS >/dev/null + for CIDR in $CIDRS; do + tell_dns PUT $CONTAINER_ID $CIDR + done else - exec_remote attach $CIDR $CONTAINER + exec_remote attach $CIDRS $CONTAINER fi echo $CONTAINER ;; From ff0e015f849eaf3b5fcebfe3442ba102fc8373a9 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Fri, 27 Mar 2015 17:55:46 +0000 Subject: [PATCH 05/19] Update usage --- weave | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/weave b/weave index 8cabd47e..8423ca75 100755 --- a/weave +++ b/weave @@ -19,8 +19,8 @@ usage() { echo "weave launch-dns " echo "weave connect " echo "weave forget " - echo "weave run [--with-dns] ..." - echo "weave start " + echo "weave run [--with-dns] [ ...] ..." + echo "weave start [ ...] " echo "weave attach [ ...] " echo "weave detach [ ...] " echo "weave expose " From 37e6647b0bd233779695dbd17f0b6e3ebb550485 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Mon, 30 Mar 2015 12:58:20 +0100 Subject: [PATCH 06/19] Implement integration tests --- test/500_weave_multi_cidr_test.sh | 75 +++++++++++++++++++++++++++++++ 1 file changed, 75 insertions(+) create mode 100755 test/500_weave_multi_cidr_test.sh diff --git a/test/500_weave_multi_cidr_test.sh b/test/500_weave_multi_cidr_test.sh new file mode 100755 index 00000000..b6ed9687 --- /dev/null +++ b/test/500_weave_multi_cidr_test.sh @@ -0,0 +1,75 @@ +#! /bin/bash + +. ./config.sh + +start_suite "Weave run/start/attach/detach with multiple cidr arguments" + +# Cleanup from previous run +weave_on $HOST1 stop || true +weave_on $HOST1 stop-dns || true +docker_on $HOST1 rm -f multicidr || true + +weave_on $HOST1 launch +weave_on $HOST1 launch-dns 10.254.254.254/24 + +# status +weave_status_on() { + HOST=$1; shift + + DOCKER_HOST=tcp://$HOST:2375 $WEAVE status +} + +# weave_ps_on +weave_ps_on() { + HOST=$1; shift + + DOCKER_HOST=tcp://$HOST:2375 $WEAVE ps +} + +# assert_container_cidrs [ ...] +assert_container_cidrs() { + HOST=$1; shift + CID=$1; shift + CIDRS=$@ + + # Assert container has attached CIDRs + assert_raises "weave_ps_on $HOST | grep \"^$CID [^ ]* $CIDRS$\"" +} + +# assert_zone_records [ ...] +assert_zone_records() { + HOST=$1; shift + CID=$1; shift + FQDN=$1; shift + + # Assert correct number of records exist + assert "weave_status_on $HOST | grep \"^$CID\" | wc -l" $# + + # Assert correct records exist + for IP in $@; do + assert_raises "weave_status_on $HOST | grep \"^$CID $IP $FQDN$\"" + done +} + +# Run container with three cidrs +CID=$(DOCKER_HOST=tcp://$host:2375 $WEAVE run 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 -t --name multicidr -h multicidr.weave.local ubuntu | cut -b 1-12) +assert_container_cidrs $HOST1 $CID 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 +assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.0.1 10.0.0.2 10.0.0.3 + +# Remove two of them +weave_on $HOST1 detach 10.0.0.2/24 10.0.0.3/24 $CID +assert_container_cidrs $HOST1 $CID 10.0.0.1/24 +assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.0.1 + +# Put them both back +weave_on $HOST1 attach 10.0.0.2/24 10.0.0.3/24 $CID +assert_container_cidrs $HOST1 $CID 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 +assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.0.1 10.0.0.2 10.0.0.3 + +# Stop the container, restart with three IPs +docker_on $HOST1 stop $CID +weave_on $HOST1 start 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 $CID +assert_container_cidrs $HOST1 $CID 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 +assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.0.1 10.0.0.2 10.0.0.3 + +end_suite \ No newline at end of file From 2acefd7df353bfbcfc5bbac9556e186a8dcbf413 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Mon, 30 Mar 2015 13:09:11 +0100 Subject: [PATCH 07/19] Disable LF -> CRLF conversion when attached to Docker pseudoterminal --- weave | 1 + 1 file changed, 1 insertion(+) diff --git a/weave b/weave index 8423ca75..9d8866eb 100755 --- a/weave +++ b/weave @@ -70,6 +70,7 @@ exec_remote() { if [ "$1" = "--local" ]; then LOCAL="$1" shift 1 + [ -t 0 ] && stty -onlcr elif [ "$1" != "run" ]; then exec_remote "$@" exit $? From f8649eeecce8b41414714ab252de3796a0187490 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Mon, 30 Mar 2015 14:38:57 +0100 Subject: [PATCH 08/19] Modify tell_dns helper to take list of addresses --- weave | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/weave b/weave index 9d8866eb..b378252f 100755 --- a/weave +++ b/weave @@ -420,15 +420,21 @@ http_call_ip() { # Perform operation $1 on container ID $2 to local DNS database at address $3 # This function is only called where we know $2 is a valid container name tell_dns() { + METHOD="$1" + CONTAINER_ID="$2" + shift 2 + if ! status=$(docker inspect --format='{{.State.Running}}' $DNS_CONTAINER_NAME 2>/dev/null) || [ "$status" != "true" ] ; then # weavedns not running - silently return return fi # get the long form of the container ID - CONTAINER=$(docker inspect --format='{{.Id}}' $2 2>/dev/null) + CONTAINER=$(docker inspect --format='{{.Id}}' $CONTAINER_ID 2>/dev/null) # extract IP address and routing prefix from CIDR MORE_ARGS=$(docker inspect --format='--data-urlencode fqdn={{.Config.Hostname}}.{{.Config.Domainname}}.' $CONTAINER 2>/dev/null) && true - http_call $DNS_CONTAINER_NAME $DNS_HTTP_PORT $1 /name/$CONTAINER/${3%/*} $MORE_ARGS || true + for addr; do + http_call $DNS_CONTAINER_NAME $DNS_HTTP_PORT $METHOD /name/$CONTAINER/${addr%/*} $MORE_ARGS || true + done } # Tell the newly-started weaveDNS about existing weave IPs @@ -663,9 +669,7 @@ case "$COMMAND" in if [ "$LOCAL" = "--local" ]; then create_bridge with_container_netns $CONTAINER attach $CIDRS >/dev/null - for CIDR in $CIDRS; do - tell_dns PUT $CONTAINER_ID $CIDR - done + tell_dns PUT $CONTAINER_ID $CIDRS else exec_remote attach $CIDRS $CONTAINER fi @@ -686,9 +690,7 @@ case "$COMMAND" in create_bridge CONTAINER=$(docker start $CONTAINER_ID) with_container_netns $CONTAINER_ID attach $CIDRS >/dev/null - for CIDR in $CIDRS; do - tell_dns PUT $CONTAINER_ID $CIDR - done + tell_dns PUT $CONTAINER_ID $CIDRS echo $CONTAINER ;; attach) @@ -701,9 +703,7 @@ case "$COMMAND" in CONTAINER_ID="$1" create_bridge with_container_netns $CONTAINER_ID attach $CIDRS >/dev/null - for CIDR in $CIDRS; do - tell_dns PUT $CONTAINER_ID $CIDR - done + tell_dns PUT $CONTAINER_ID $CIDRS ;; detach) [ $# -gt 1 ] || usage @@ -714,9 +714,7 @@ case "$COMMAND" in done CONTAINER_ID="$1" with_container_netns $CONTAINER_ID detach $CIDRS >/dev/null - for CIDR in $CIDRS; do - tell_dns DELETE $CONTAINER_ID $CIDR - done + tell_dns DELETE $CONTAINER_ID $CIDRS ;; expose) [ $# -eq 1 ] || usage From 74f2cd09bcefa427e83d09acb11e5ee434612acf Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Mon, 30 Mar 2015 14:43:16 +0100 Subject: [PATCH 09/19] Use all caps variable names --- weave | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/weave b/weave index b378252f..a3916e01 100755 --- a/weave +++ b/weave @@ -326,15 +326,15 @@ launch() { attach() { if ip netns exec $NETNS ip link show $CONTAINER_IFNAME >/dev/null 2>&1 ; then - for addr; do + for ADDR; do # container already has the expected network interface, so assume we set it up already; # just add the IP address. - if ip netns exec $NETNS ip addr show dev $CONTAINER_IFNAME | grep -F $addr >/dev/null ; then + if ip netns exec $NETNS ip addr show dev $CONTAINER_IFNAME | grep -F $ADDR >/dev/null ; then # address was there already continue fi - if ! ip netns exec $NETNS ip addr add $addr dev $CONTAINER_IFNAME ; then + if ! ip netns exec $NETNS ip addr add $ADDR dev $CONTAINER_IFNAME ; then return 1 fi done @@ -346,8 +346,8 @@ attach() { return 1 fi - for addr; do - if ! ip netns exec $NETNS ip addr add $addr dev $CONTAINER_IFNAME; then + for ADDR; do + if ! ip netns exec $NETNS ip addr add $ADDR dev $CONTAINER_IFNAME; then return 1 fi done @@ -365,13 +365,13 @@ attach() { } detach() { - for addr; do - if ! ip netns exec $NETNS ip addr show dev $CONTAINER_IFNAME | grep -F $addr >/dev/null ; then + for ADDR; do + if ! ip netns exec $NETNS ip addr show dev $CONTAINER_IFNAME | grep -F $ADDR >/dev/null ; then # address is not there, leave the device alone continue fi - if ! ip netns exec $NETNS ip addr del $addr dev $CONTAINER_IFNAME ; then + if ! ip netns exec $NETNS ip addr del $ADDR dev $CONTAINER_IFNAME ; then return 1 fi done @@ -432,8 +432,8 @@ tell_dns() { CONTAINER=$(docker inspect --format='{{.Id}}' $CONTAINER_ID 2>/dev/null) # extract IP address and routing prefix from CIDR MORE_ARGS=$(docker inspect --format='--data-urlencode fqdn={{.Config.Hostname}}.{{.Config.Domainname}}.' $CONTAINER 2>/dev/null) && true - for addr; do - http_call $DNS_CONTAINER_NAME $DNS_HTTP_PORT $METHOD /name/$CONTAINER/${addr%/*} $MORE_ARGS || true + for ADDR; do + http_call $DNS_CONTAINER_NAME $DNS_HTTP_PORT $METHOD /name/$CONTAINER/${ADDR%/*} $MORE_ARGS || true done } From 3026b5d29100edf52320870bb914097b56d7a101 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Mon, 30 Mar 2015 15:54:54 +0100 Subject: [PATCH 10/19] Test tidyup --- test/500_weave_multi_cidr_test.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test/500_weave_multi_cidr_test.sh b/test/500_weave_multi_cidr_test.sh index b6ed9687..28bc99dd 100755 --- a/test/500_weave_multi_cidr_test.sh +++ b/test/500_weave_multi_cidr_test.sh @@ -52,7 +52,7 @@ assert_zone_records() { } # Run container with three cidrs -CID=$(DOCKER_HOST=tcp://$host:2375 $WEAVE run 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 -t --name multicidr -h multicidr.weave.local ubuntu | cut -b 1-12) +CID=$(DOCKER_HOST=tcp://$HOST1:2375 $WEAVE run 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 -t --name multicidr -h multicidr.weave.local ubuntu | cut -b 1-12) assert_container_cidrs $HOST1 $CID 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.0.1 10.0.0.2 10.0.0.3 @@ -62,7 +62,7 @@ assert_container_cidrs $HOST1 $CID 10.0.0.1/24 assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.0.1 # Put them both back -weave_on $HOST1 attach 10.0.0.2/24 10.0.0.3/24 $CID +weave_on $HOST1 attach 10.0.0.2/24 10.0.0.3/24 $CID assert_container_cidrs $HOST1 $CID 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.0.1 10.0.0.2 10.0.0.3 From 1c7ed9e16a28fb6342b26e26bf9d327b9e15dc34 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Mon, 30 Mar 2015 16:08:38 +0100 Subject: [PATCH 11/19] Update documentation --- site/features.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/site/features.md b/site/features.md index d95922b7..fbe9f2fa 100644 --- a/site/features.md +++ b/site/features.md @@ -128,6 +128,12 @@ sharing it between applications: host1# weave attach 10.2.1.1/24 $C host1# weave attach 10.2.2.1/24 $C +Finally, multiple addresses can be attached or detached with a single +invocation: + + host1# weave attach 10.2.1.1/24 10.3.1.1/24 10.4.1.1/24 $C + host1# weave detach 10.2.1.1/24 10.3.1.1/24 10.4.1.1/24 $C + ### Security In order to connect containers across untrusted networks, weave peers From 7f54922ada0bd832e083732910e27ec050392ab3 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Mon, 30 Mar 2015 16:27:01 +0100 Subject: [PATCH 12/19] Update documentation --- site/features.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/site/features.md b/site/features.md index fbe9f2fa..04fbb897 100644 --- a/site/features.md +++ b/site/features.md @@ -90,6 +90,14 @@ each other but not the containers of our first application... This isolation-through-subnets scheme is an example of carrying over a well-known technique from the 'on metal' days to containers. +If desired, a container can be attached to multiple subnets when it is +started: + + host1# weave run 10.2.2.1/24 10.2.3.1/24 -t -i ubuntu + +In this case, all of the addresses are added to the container's +weave interface before it is brought up. + NB: By default docker permits communication between containers on the same host, via their docker-assigned IP addresses. For complete isolation between application containers, that feature needs to be From c1089e84473209ce35303973295f85aac5ad9894 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Mon, 30 Mar 2015 17:31:37 +0100 Subject: [PATCH 13/19] Update documentation --- site/features.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/site/features.md b/site/features.md index 04fbb897..1d89b26c 100644 --- a/site/features.md +++ b/site/features.md @@ -95,9 +95,6 @@ started: host1# weave run 10.2.2.1/24 10.2.3.1/24 -t -i ubuntu -In this case, all of the addresses are added to the container's -weave interface before it is brought up. - NB: By default docker permits communication between containers on the same host, via their docker-assigned IP addresses. For complete isolation between application containers, that feature needs to be From 772e29834098d029482f14ed0adca6a603afda80 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Mon, 30 Mar 2015 17:49:44 +0100 Subject: [PATCH 14/19] Factor out CIDR arg parsing --- weave | 56 +++++++++++++++++++++++++++----------------------------- 1 file changed, 27 insertions(+), 29 deletions(-) diff --git a/weave b/weave index a3916e01..558ebd21 100755 --- a/weave +++ b/weave @@ -138,6 +138,16 @@ validate_cidr() { fi } +collect_cidr_args() { + CIDR_ARGS="" + CIDR_COUNT=0 + while is_cidr "$1"; do + CIDR_ARGS="$CIDR_ARGS $1" + CIDR_COUNT=$(($CIDR_COUNT + 1)) + shift 1 + done +} + run_iptables() { # -w is recent addition to iptables if [ -z "$CHECKED_IPTABLES_W" ] ; then @@ -660,18 +670,15 @@ case "$COMMAND" in DNS_ARGS=$(exec_remote dns-args "$@") [ "$1" = "--with-dns" ] && shift 1 fi - CIDRS="" - while is_cidr "$1"; do - CIDRS="$CIDRS $1" - shift 1 - done + collect_cidr_args "$@" + shift $CIDR_COUNT CONTAINER=$(docker run $DNS_ARGS -d "$@") if [ "$LOCAL" = "--local" ]; then create_bridge - with_container_netns $CONTAINER attach $CIDRS >/dev/null - tell_dns PUT $CONTAINER_ID $CIDRS + with_container_netns $CONTAINER attach $CIDR_ARGS >/dev/null + tell_dns PUT $CONTAINER_ID $CIDR_ARGS else - exec_remote attach $CIDRS $CONTAINER + exec_remote attach $CIDR_ARGS $CONTAINER fi echo $CONTAINER ;; @@ -681,40 +688,31 @@ case "$COMMAND" in ;; start) [ $# -gt 1 ] || usage - CIDRS="" - while is_cidr "$1"; do - CIDRS="$CIDRS $1" - shift 1 - done + collect_cidr_args "$@" + shift $CIDR_COUNT CONTAINER_ID="$1" create_bridge CONTAINER=$(docker start $CONTAINER_ID) - with_container_netns $CONTAINER_ID attach $CIDRS >/dev/null - tell_dns PUT $CONTAINER_ID $CIDRS + with_container_netns $CONTAINER_ID attach $CIDR_ARGS >/dev/null + tell_dns PUT $CONTAINER_ID $CIDR_ARGS echo $CONTAINER ;; attach) [ $# -gt 1 ] || usage - CIDRS="" - while is_cidr "$1"; do - CIDRS="$CIDRS $1" - shift 1 - done + collect_cidr_args "$@" + shift $CIDR_COUNT CONTAINER_ID="$1" create_bridge - with_container_netns $CONTAINER_ID attach $CIDRS >/dev/null - tell_dns PUT $CONTAINER_ID $CIDRS + with_container_netns $CONTAINER_ID attach $CIDR_ARGS >/dev/null + tell_dns PUT $CONTAINER_ID $CIDR_ARGS ;; detach) [ $# -gt 1 ] || usage - CIDRS="" - while is_cidr "$1"; do - CIDRS="$CIDRS $1" - shift 1 - done + collect_cidr_args "$@" + shift $CIDR_COUNT CONTAINER_ID="$1" - with_container_netns $CONTAINER_ID detach $CIDRS >/dev/null - tell_dns DELETE $CONTAINER_ID $CIDRS + with_container_netns $CONTAINER_ID detach $CIDR_ARGS >/dev/null + tell_dns DELETE $CONTAINER_ID $CIDR_ARGS ;; expose) [ $# -eq 1 ] || usage From b4f71df7313cc4536bf2fd25e4f0541b6d290ecf Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Mon, 30 Mar 2015 17:50:26 +0100 Subject: [PATCH 15/19] Fix unrelated script error --- weave | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/weave b/weave index 558ebd21..b3d2c4ff 100755 --- a/weave +++ b/weave @@ -676,7 +676,7 @@ case "$COMMAND" in if [ "$LOCAL" = "--local" ]; then create_bridge with_container_netns $CONTAINER attach $CIDR_ARGS >/dev/null - tell_dns PUT $CONTAINER_ID $CIDR_ARGS + tell_dns PUT $CONTAINER $CIDR_ARGS else exec_remote attach $CIDR_ARGS $CONTAINER fi From 94823187cae8ff4d821648cb2d676c75e17261d9 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Mon, 30 Mar 2015 18:03:20 +0100 Subject: [PATCH 16/19] Fix function comment --- test/500_weave_multi_cidr_test.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/500_weave_multi_cidr_test.sh b/test/500_weave_multi_cidr_test.sh index 28bc99dd..dbd42da9 100755 --- a/test/500_weave_multi_cidr_test.sh +++ b/test/500_weave_multi_cidr_test.sh @@ -12,7 +12,7 @@ docker_on $HOST1 rm -f multicidr || true weave_on $HOST1 launch weave_on $HOST1 launch-dns 10.254.254.254/24 -# status +# weave_status_on weave_status_on() { HOST=$1; shift From dc49f78588fd26e28e0fca45c98f21a0ccd6c345 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Tue, 31 Mar 2015 11:48:51 +0100 Subject: [PATCH 17/19] Expose and hide take multiple addresses --- site/features.md | 6 +++++ test/500_weave_multi_cidr_test.sh | 19 +++++++++++++ weave | 44 ++++++++++++++++--------------- 3 files changed, 48 insertions(+), 21 deletions(-) diff --git a/site/features.md b/site/features.md index 1d89b26c..906a9152 100644 --- a/site/features.md +++ b/site/features.md @@ -184,6 +184,12 @@ will work. And, more interestingly, will work too, which is talking to a container that resides on `$HOST1`. +Multiple subnet addresses can be exposed or hidden with a single +invocation: + + host2# weave expose 10.2.1.102/24 10.3.1.102/24 + host2# weave hide 10.2.1.102/24 10.3.1.102/24 + ### Service export Services running in containers on a weave network can be made diff --git a/test/500_weave_multi_cidr_test.sh b/test/500_weave_multi_cidr_test.sh index dbd42da9..c280127a 100755 --- a/test/500_weave_multi_cidr_test.sh +++ b/test/500_weave_multi_cidr_test.sh @@ -51,6 +51,17 @@ assert_zone_records() { done } +# assert_bridge_cidrs [ ...] +assert_bridge_cidrs() { + HOST=$1; shift + DEV=$1; shift + CIDRS=$@ + + BRIDGE_CIDRS=$($SSH $HOST ip addr show dev $DEV | grep -o 'inet .*' | cut -d ' ' -f 2) + + assert "echo $BRIDGE_CIDRS" "$CIDRS" +} + # Run container with three cidrs CID=$(DOCKER_HOST=tcp://$HOST1:2375 $WEAVE run 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 -t --name multicidr -h multicidr.weave.local ubuntu | cut -b 1-12) assert_container_cidrs $HOST1 $CID 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 @@ -72,4 +83,12 @@ weave_on $HOST1 start 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 $CID assert_container_cidrs $HOST1 $CID 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.0.1 10.0.0.2 10.0.0.3 +# Expose some cidrs +weave_on $HOST1 expose 10.0.0.4/24 10.0.0.5/24 10.0.0.6/24 +assert_bridge_cidrs $HOST1 weave 10.0.0.4/24 10.0.0.5/24 10.0.0.6/24 + +# Hide some cidrs +weave_on $HOST1 hide 10.0.0.5/24 10.0.0.6/24 +assert_bridge_cidrs $HOST1 weave 10.0.0.4/24 + end_suite \ No newline at end of file diff --git a/weave b/weave index b3d2c4ff..fbaed1ad 100755 --- a/weave +++ b/weave @@ -715,29 +715,31 @@ case "$COMMAND" in tell_dns DELETE $CONTAINER_ID $CIDR_ARGS ;; expose) - [ $# -eq 1 ] || usage - CIDR=$1 - validate_cidr $CIDR - create_bridge --without-ethtool - if ! ip addr show dev $BRIDGE | grep -qF $CIDR - then - ip addr add dev $BRIDGE $CIDR - arp_update $BRIDGE $CIDR - add_iptables_rule nat WEAVE -o $BRIDGE ! -s $CIDR -j MASQUERADE - add_iptables_rule nat WEAVE -s $CIDR ! -o $BRIDGE -j MASQUERADE - fi + [ $# -gt 0 ] || usage + for CIDR; do + validate_cidr $CIDR + create_bridge --without-ethtool + if ! ip addr show dev $BRIDGE | grep -qF $CIDR + then + ip addr add dev $BRIDGE $CIDR + arp_update $BRIDGE $CIDR + add_iptables_rule nat WEAVE -o $BRIDGE ! -s $CIDR -j MASQUERADE + add_iptables_rule nat WEAVE -s $CIDR ! -o $BRIDGE -j MASQUERADE + fi + done ;; hide) - [ $# -eq 1 ] || usage - CIDR=$1 - validate_cidr $CIDR - create_bridge --without-ethtool - if ip addr show dev $BRIDGE | grep -qF $CIDR - then - ip addr del dev $BRIDGE $CIDR - delete_iptables_rule nat WEAVE -o $BRIDGE ! -s $CIDR -j MASQUERADE - delete_iptables_rule nat WEAVE -s $CIDR ! -o $BRIDGE -j MASQUERADE - fi + [ $# -gt 0 ] || usage + for CIDR; do + validate_cidr $CIDR + create_bridge --without-ethtool + if ip addr show dev $BRIDGE | grep -qF $CIDR + then + ip addr del dev $BRIDGE $CIDR + delete_iptables_rule nat WEAVE -o $BRIDGE ! -s $CIDR -j MASQUERADE + delete_iptables_rule nat WEAVE -s $CIDR ! -o $BRIDGE -j MASQUERADE + fi + done ;; stop) [ $# -eq 0 ] || usage From aa88dfca11935e8e29559b2aa27e020eb8b3511f Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Tue, 31 Mar 2015 12:09:22 +0100 Subject: [PATCH 18/19] Tests use distinct subnets --- test/500_weave_multi_cidr_test.sh | 34 +++++++++++++++---------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/test/500_weave_multi_cidr_test.sh b/test/500_weave_multi_cidr_test.sh index c280127a..bd1532c2 100755 --- a/test/500_weave_multi_cidr_test.sh +++ b/test/500_weave_multi_cidr_test.sh @@ -63,32 +63,32 @@ assert_bridge_cidrs() { } # Run container with three cidrs -CID=$(DOCKER_HOST=tcp://$HOST1:2375 $WEAVE run 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 -t --name multicidr -h multicidr.weave.local ubuntu | cut -b 1-12) -assert_container_cidrs $HOST1 $CID 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 -assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.0.1 10.0.0.2 10.0.0.3 +CID=$(DOCKER_HOST=tcp://$HOST1:2375 $WEAVE run 10.0.1.1/24 10.0.2.1/24 10.0.3.1/24 -t --name multicidr -h multicidr.weave.local ubuntu | cut -b 1-12) +assert_container_cidrs $HOST1 $CID 10.0.1.1/24 10.0.2.1/24 10.0.3.1/24 +assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.1.1 10.0.2.1 10.0.3.1 # Remove two of them -weave_on $HOST1 detach 10.0.0.2/24 10.0.0.3/24 $CID -assert_container_cidrs $HOST1 $CID 10.0.0.1/24 -assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.0.1 +weave_on $HOST1 detach 10.0.1.1/24 10.0.3.1/24 $CID +assert_container_cidrs $HOST1 $CID 10.0.2.1/24 +assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.2.1 # Put them both back -weave_on $HOST1 attach 10.0.0.2/24 10.0.0.3/24 $CID -assert_container_cidrs $HOST1 $CID 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 -assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.0.1 10.0.0.2 10.0.0.3 +weave_on $HOST1 attach 10.0.1.1/24 10.0.3.1/24 $CID +assert_container_cidrs $HOST1 $CID 10.0.2.1/24 10.0.1.1/24 10.0.3.1/24 +assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.2.1 10.0.1.1 10.0.3.1 # Stop the container, restart with three IPs docker_on $HOST1 stop $CID -weave_on $HOST1 start 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 $CID -assert_container_cidrs $HOST1 $CID 10.0.0.1/24 10.0.0.2/24 10.0.0.3/24 -assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.0.1 10.0.0.2 10.0.0.3 +weave_on $HOST1 start 10.0.1.1/24 10.0.2.1/24 10.0.3.1/24 $CID +assert_container_cidrs $HOST1 $CID 10.0.1.1/24 10.0.2.1/24 10.0.3.1/24 +assert_zone_records $HOST1 $CID multicidr.weave.local. 10.0.1.1 10.0.2.1 10.0.3.1 # Expose some cidrs -weave_on $HOST1 expose 10.0.0.4/24 10.0.0.5/24 10.0.0.6/24 -assert_bridge_cidrs $HOST1 weave 10.0.0.4/24 10.0.0.5/24 10.0.0.6/24 +weave_on $HOST1 expose 10.0.1.2/24 10.0.2.2/24 10.0.3.2/24 +assert_bridge_cidrs $HOST1 weave 10.0.1.2/24 10.0.2.2/24 10.0.3.2/24 # Hide some cidrs -weave_on $HOST1 hide 10.0.0.5/24 10.0.0.6/24 -assert_bridge_cidrs $HOST1 weave 10.0.0.4/24 +weave_on $HOST1 hide 10.0.1.2/24 10.0.3.2/24 +assert_bridge_cidrs $HOST1 weave 10.0.2.2/24 -end_suite \ No newline at end of file +end_suite From 0912cd416debaf8b9747b04e090e364d9a5dd6f2 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Tue, 31 Mar 2015 12:23:34 +0100 Subject: [PATCH 19/19] Use consistent subnets in documentation --- site/features.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/site/features.md b/site/features.md index 906a9152..2b732a07 100644 --- a/site/features.md +++ b/site/features.md @@ -136,8 +136,8 @@ sharing it between applications: Finally, multiple addresses can be attached or detached with a single invocation: - host1# weave attach 10.2.1.1/24 10.3.1.1/24 10.4.1.1/24 $C - host1# weave detach 10.2.1.1/24 10.3.1.1/24 10.4.1.1/24 $C + host1# weave attach 10.2.1.1/24 10.2.2.1/24 10.2.3.1/24 $C + host1# weave detach 10.2.1.1/24 10.2.2.1/24 10.2.3.1/24 $C ### Security @@ -187,8 +187,8 @@ will work too, which is talking to a container that resides on `$HOST1`. Multiple subnet addresses can be exposed or hidden with a single invocation: - host2# weave expose 10.2.1.102/24 10.3.1.102/24 - host2# weave hide 10.2.1.102/24 10.3.1.102/24 + host2# weave expose 10.2.1.102/24 10.2.2.102/24 + host2# weave hide 10.2.1.102/24 10.2.2.102/24 ### Service export