From 3607cf2d7a2fbc201e41439004d54f34a2860a8b Mon Sep 17 00:00:00 2001
From: Martynas Pumputis <martynasp@gmail.com>
Date: Tue, 28 Feb 2017 16:27:21 +0000
Subject: [PATCH] Add check for xt_set module

The check is based on actually trying to install an iptables rule
which uses the module.
---
 prog/weave-kube/launch.sh          | 16 +++++++++++++++-
 prog/weaveexec/Dockerfile.template |  1 +
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/prog/weave-kube/launch.sh b/prog/weave-kube/launch.sh
index 8a3484d7..e7f79331 100755
--- a/prog/weave-kube/launch.sh
+++ b/prog/weave-kube/launch.sh
@@ -3,7 +3,20 @@
 set -e
 
 modprobe_safe() {
-    modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel"
+    modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel" >&2
+}
+
+# Check whether xt_set actually exists
+xt_set_exists() {
+    ipset create weave-kube-test hash:ip
+    iptables -t filter -N WEAVE-KUBE-TEST
+    if ! iptables -A WEAVE-KUBE-TEST -m set --match-set weave-kube-test src -j DROP; then
+        NOT_EXIST=1
+    fi
+    iptables -F WEAVE-KUBE-TEST
+    iptables -X WEAVE-KUBE-TEST
+    ipset destroy weave-kube-test
+    [ -z "$NOT_EXIST" ] || (echo "\"xt_set\" does not exist" >&2 && return 1)
 }
 
 # Default if not supplied - same as weave net default
@@ -23,6 +36,7 @@ EXPECT_NPC=${EXPECT_NPC:-1}
 if [ "${EXPECT_NPC}" != "0" ]; then
     modprobe_safe br_netfilter
     modprobe_safe xt_set
+    xt_set_exists
 fi
 
 # kube-proxy requires that bridged traffic passes through netfilter
diff --git a/prog/weaveexec/Dockerfile.template b/prog/weaveexec/Dockerfile.template
index 90c87de8..09d76848 100644
--- a/prog/weaveexec/Dockerfile.template
+++ b/prog/weaveexec/Dockerfile.template
@@ -19,6 +19,7 @@ RUN apk add --update \
     curl \
     ethtool \
     iptables \
+    ipset \
     iproute2 \
     util-linux \
     conntrack-tools \