From 2f1359ae9fa78e5390cd8274c511624d012821f7 Mon Sep 17 00:00:00 2001
From: Matthias Radestock <matthias.radestock@gmail.com>
Date: Mon, 15 Sep 2014 11:34:57 +0100
Subject: [PATCH] remove masquerading rules on 'weave stop/launch' Leaving
 iptable masquerading rules behind is a bad idea when weave is re-launched
 with different ip subnet settings. So now we remove the rules on 'weave stop'
 and also on 'weave launch' (in case weave had been stopped in ways other than
 'weave stop').

To make the rule removal easier, we create the rules in a user-defined
WEAVE chain.

Note that this will break old weave installations, since the rules
created by those are left behind. Easiest upgrade path is to restart
the machine. Or, for the brave, run `iptables -t nat -S POSTROUTING | grep weave | sed 's/^\-A/-D/g' | while read line; do iptables -t nat $line; done`.

Fixes #48
---
 weaver/weave | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/weaver/weave b/weaver/weave
index 33f7d83e..4a954777 100755
--- a/weaver/weave
+++ b/weaver/weave
@@ -60,7 +60,7 @@ create_bridge() {
     ip link set dev $BRIDGE up
 }
 
-add_nat_rule() {
+run_iptables() {
     # -w is recent addition to iptables
     if [ -z "$CHECKED_IPTABLES_W" ] ; then
         if iptables -S -w >/dev/null 2>&1 ; then
@@ -69,15 +69,28 @@ add_nat_rule() {
         CHECKED_IPTABLES_W=1
     fi
 
-    if ! iptables $IPTABLES_W -t nat -C $1 >/dev/null 2>&1
+    iptables $IPTABLES_W "$@"
+}
+
+add_nat_rule() {
+    if ! run_iptables -t nat -C "$@" >/dev/null 2>&1
     then
-        iptables $IPTABLES_W -t nat -A $1 >/dev/null
+        run_iptables -t nat -A "$@" >/dev/null
     fi
 }
 
 setup_masquerading() {
-    add_nat_rule "POSTROUTING -o $BRIDGE ! -s $1 -j MASQUERADE"
-    add_nat_rule "POSTROUTING -s $1 ! -o $BRIDGE -j MASQUERADE"
+    if ! run_iptables -t nat -S WEAVE >/dev/null 2>&1
+    then
+        run_iptables -t nat -N WEAVE
+        add_nat_rule POSTROUTING -j WEAVE
+    fi
+    add_nat_rule WEAVE -o $BRIDGE ! -s $1 -j MASQUERADE
+    add_nat_rule WEAVE -s $1 ! -o $BRIDGE -j MASQUERADE
+}
+
+stop_masquerading() {
+    run_iptables -t nat -F WEAVE >/dev/null 2>&1 || true
 }
 
 # the following borrows from https://github.com/jpetazzo/pipework
@@ -135,6 +148,7 @@ case "$COMMAND" in
                 ;;
         esac
         create_bridge
+        stop_masquerading
         setup_masquerading $IPADDR
         # We set the router name to the bridge mac since that is
         # stable across re-creations of the containers.
@@ -200,6 +214,7 @@ case "$COMMAND" in
         fi
         docker rm -f weave >/dev/null 2>&1 || true
         check_command_and_run conntrack conntrack -D -p udp --dport 6783 >/dev/null 2>&1 || true
+        stop_masquerading
         ;;
     *)
         echo "Unknown weave command '$COMMAND'"