reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

drop IP/network from 'weave launch'

Browse Source 
plus a whole bunch of other small changes to weave script which I'll
eventually extract into separate commits.
This commit is contained in:
Matthias Radestock committed 2014-10-24 10:11:43 +01:00
1 parent 041a4c5f6c
commit 46b0cc35f1
1 file changed
+51 -45
Download Patch File Download Diff File Expand all files Collapse all files
weave
+51 -45
View File
@@ -3,7 +3,7 @@ set -e
usage() {
echo "Usage:"
echo "weave launch <cidr> [-password <password>] <peer_host> ..."
echo "weave launch [-password <password>] <peer_host> ..."
echo "weave run <cidr> <docker run args> ..."
echo "weave attach <cidr> <container_id>"
echo "weave detach <cidr> <container_id>"
@@ -72,8 +72,14 @@ add_iptables_rule() {
fi
}
add_nat_rule() {
add_iptables_rule nat "$@"
# Delete a rule from iptables, if it exist
delete_iptables_rule() {
IPTABLES_TABLE="$1"
shift 1
if run_iptables -t $IPTABLES_TABLE -C "$@" >/dev/null 2>&1
then
run_iptables -t $IPTABLES_TABLE -D "$@" >/dev/null
fi
}
create_bridge() {
@@ -92,6 +98,9 @@ create_bridge() {
# Work around the situation where there are no rules allowing traffic
# across our bridge. E.g. ufw
add_iptables_rule filter FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT
# create a chain for masquerading
run_iptables -t nat -N WEAVE >/dev/null 2>&1 || true
add_iptables_rule nat POSTROUTING -j WEAVE
}
ip link set dev $BRIDGE up
}
@@ -101,16 +110,6 @@ destroy_bridge() {
ip link del dev $BRIDGE
fi
run_iptables -t filter -D FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT 2>/dev/null || true
}
setup_masquerading() {
run_iptables -t nat -N WEAVE >/dev/null 2>&1 || true
add_nat_rule POSTROUTING -j WEAVE
add_nat_rule WEAVE -o $BRIDGE ! -s $1 -j MASQUERADE
add_nat_rule WEAVE -s $1 ! -o $BRIDGE -j MASQUERADE
}
stop_masquerading() {
run_iptables -t nat -F WEAVE >/dev/null 2>&1 || true
run_iptables -t nat -D POSTROUTING -j WEAVE >/dev/null 2>&1 || true
run_iptables -t nat -X WEAVE >/dev/null 2>&1 || true
@@ -118,7 +117,7 @@ stop_masquerading() {
# the following borrows from https://github.com/jpetazzo/pipework
with_container_netns () {
CONTAINER="$2"
CONTAINER="$1"
CONTAINER_PID=$(docker inspect --format='{{ .State.Pid }}' $CONTAINER)
if [ "$CONTAINER_PID" = 0 ] ; then
@@ -143,6 +142,7 @@ with_container_netns () {
# Run the wrapped command
STATUS=0
shift 1
if ! "$@" >$IP_TMPFILE 2>&1 ; then
STATUS=1
if [ "$(docker inspect --format='{{ .State.Pid }}' $CONTAINER)" != "$CONTAINER_PID" ] ; then
@@ -157,19 +157,34 @@ with_container_netns () {
return $STATUS
}
# Attach Container-ID $1 to the weave network at CIDR address $2,
# creating a virtual ethernet device if necessary.
# Also turn off tx offload on device $3 inside the namespace.
launch() {
if ! ip link add name $LOCAL_IFNAME mtu $MTU type veth peer name $GUEST_IFNAME mtu $MTU ; then
return 1
fi
if ! ip link set $GUEST_IFNAME netns $NETNS ; then
# failed before we assigned the veth to the container's
# namespace - delete it
ip link del $LOCAL_IFNAME type veth || true
return 1
fi
ip link set $LOCAL_IFNAME master $BRIDGE
ip link set $LOCAL_IFNAME up
ip netns exec $NETNS ip link set $GUEST_IFNAME name $CONTAINER_IFNAME
ip netns exec $NETNS ip link set $CONTAINER_IFNAME up
check_command_and_run ethtool ip netns exec $NETNS ethtool -K eth0 tx off >/dev/null
}
attach() {
if ip link show $LOCAL_IFNAME >/dev/null 2>&1 ; then
# veth name already exists, so assume we set it up already;
# just add the IP address.
if ip netns exec $NETNS ip addr show dev $CONTAINER_IFNAME | grep -F $2 >/dev/null ; then
if ip netns exec $NETNS ip addr show dev $CONTAINER_IFNAME | grep -F $1 >/dev/null ; then
# address was there already
return 0
fi
if ! ip netns exec $NETNS ip addr add $2 dev $CONTAINER_IFNAME ; then
if ! ip netns exec $NETNS ip addr add $1 dev $CONTAINER_IFNAME ; then
return 1
fi
@@ -190,9 +205,9 @@ attach() {
fi
if ! ip netns exec $NETNS ip link set $GUEST_IFNAME name $CONTAINER_IFNAME ||
! ip netns exec $NETNS ip addr add $2 dev $CONTAINER_IFNAME ||
! ip netns exec $NETNS ip addr add $1 dev $CONTAINER_IFNAME ||
! ip netns exec $NETNS ip link set $CONTAINER_IFNAME up ||
! check_command_and_run ethtool ip netns exec $NETNS ethtool -K $3 tx off >/dev/null ; then
! check_command_and_run ethtool ip netns exec $NETNS ethtool -K $CONTAINER_IFNAME tx off >/dev/null ; then
return 1
fi
@@ -205,15 +220,13 @@ attach() {
ip netns exec $NETNS ip route add 224.0.0.0/4 dev $CONTAINER_IFNAME
}
# Detach Container-ID $1 at CIDR address $2 from the weave network
# removing the virtual ethernet device if there are no more addresses
detach() {
if ! ip netns exec $NETNS ip addr show dev $CONTAINER_IFNAME | grep -F $2 >/dev/null ; then
if ! ip netns exec $NETNS ip addr show dev $CONTAINER_IFNAME | grep -F $1 >/dev/null ; then
# address is not there, leave the device alone
return 0
fi
if ! ip netns exec $NETNS ip addr del $2 dev $CONTAINER_IFNAME ; then
if ! ip netns exec $NETNS ip addr del $1 dev $CONTAINER_IFNAME ; then
return 1
fi
@@ -228,9 +241,6 @@ detach() {
case "$COMMAND" in
launch)
[ $# -gt 0 ] || usage
IPADDR=$1
shift 1
case $(docker inspect --format '{{ .State.Running }} {{ .Config.Image }}' weave 2>/dev/null) in
"true $IMAGE")
echo "Weave is already running." >&2
@@ -249,8 +259,6 @@ case "$COMMAND" in
;;
esac
create_bridge
stop_masquerading
setup_masquerading $IPADDR
# We set the router name to the bridge mac since that is
# stable across re-creations of the containers.
#
@@ -262,7 +270,7 @@ case "$COMMAND" in
# additional parameters, such as resource limits, to docker
# when launching the weave container.
CONTAINER=$(docker run --privileged -d --name=weave -p 6783:6783/tcp -p 6783:6783/udp $WEAVE_DOCKER_ARGS $IMAGE -name $MACADDR "$@" | tail -n 1)
with_container_netns attach $CONTAINER $IPADDR eth0
with_container_netns $CONTAINER launch
echo $CONTAINER
;;
status)
@@ -295,40 +303,40 @@ case "$COMMAND" in
;;
run)
[ $# -gt 0 ] || usage
IPADDR=$1
CIDR=$1
shift 1
create_bridge
CONTAINER=$(docker run -d "$@" | tail -n 1)
with_container_netns attach $CONTAINER $IPADDR $CONTAINER_IFNAME
with_container_netns $CONTAINER attach $CIDR
echo $CONTAINER
;;
attach)
[ $# -gt 1 ] || usage
create_bridge
with_container_netns attach $2 $1 $CONTAINER_IFNAME
with_container_netns $2 attach $1
;;
detach)
[ $# -gt 1 ] || usage
with_container_netns detach $2 $1
with_container_netns $2 detach $1
;;
expose)
[ $# -gt 0 ] || usage
IPADDR=$1
shift 1
create_bridge
if ! ip addr show dev $BRIDGE | grep -qF $IPADDR
if ! ip addr show dev $BRIDGE | grep -qF $1
then
ip addr add dev $BRIDGE $IPADDR
ip addr add dev $BRIDGE $1
add_iptables_rule nat WEAVE -o $BRIDGE ! -s $1 -j MASQUERADE
add_iptables_rule nat WEAVE -s $1 ! -o $BRIDGE -j MASQUERADE
fi
;;
hide)
[ $# -gt 0 ] || usage
IPADDR=$1
shift 1
create_bridge
if ip addr show dev $BRIDGE | grep -qF $IPADDR
if ip addr show dev $BRIDGE | grep -qF $1
then
ip addr del dev $BRIDGE $IPADDR
ip addr del dev $BRIDGE $1
delete_iptables_rule nat WEAVE -o $BRIDGE ! -s $1 -j MASQUERADE
delete_iptables_rule nat WEAVE -s $1 ! -o $BRIDGE -j MASQUERADE
fi
;;
stop)
@@ -337,13 +345,11 @@ case "$COMMAND" in
fi
docker rm -f weave >/dev/null 2>&1 || true
check_command_and_run conntrack conntrack -D -p udp --dport 6783 >/dev/null 2>&1 || true
stop_masquerading
;;
reset)
docker kill weave >/dev/null 2>&1 || true
docker rm -f weave >/dev/null 2>&1 || true
check_command_and_run conntrack conntrack -D -p udp --dport 6783 >/dev/null 2>&1 || true
stop_masquerading
destroy_bridge
;;
*)