From 46b0cc35f1e30ad67ab88cc46d7c3ef40e7aaa38 Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Fri, 24 Oct 2014 10:11:43 +0100 Subject: [PATCH] drop IP/network from 'weave launch' plus a whole bunch of other small changes to weave script which I'll eventually extract into separate commits. --- weave | 96 +++++++++++++++++++++++++++++++---------------------------- 1 file changed, 51 insertions(+), 45 deletions(-) diff --git a/weave b/weave index e83d11e4..fa6378df 100755 --- a/weave +++ b/weave @@ -3,7 +3,7 @@ set -e usage() { echo "Usage:" - echo "weave launch [-password ] ..." + echo "weave launch [-password ] ..." echo "weave run ..." echo "weave attach " echo "weave detach " @@ -72,8 +72,14 @@ add_iptables_rule() { fi } -add_nat_rule() { - add_iptables_rule nat "$@" +# Delete a rule from iptables, if it exist +delete_iptables_rule() { + IPTABLES_TABLE="$1" + shift 1 + if run_iptables -t $IPTABLES_TABLE -C "$@" >/dev/null 2>&1 + then + run_iptables -t $IPTABLES_TABLE -D "$@" >/dev/null + fi } create_bridge() { @@ -92,6 +98,9 @@ create_bridge() { # Work around the situation where there are no rules allowing traffic # across our bridge. E.g. ufw add_iptables_rule filter FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT + # create a chain for masquerading + run_iptables -t nat -N WEAVE >/dev/null 2>&1 || true + add_iptables_rule nat POSTROUTING -j WEAVE } ip link set dev $BRIDGE up } @@ -101,16 +110,6 @@ destroy_bridge() { ip link del dev $BRIDGE fi run_iptables -t filter -D FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT 2>/dev/null || true -} - -setup_masquerading() { - run_iptables -t nat -N WEAVE >/dev/null 2>&1 || true - add_nat_rule POSTROUTING -j WEAVE - add_nat_rule WEAVE -o $BRIDGE ! -s $1 -j MASQUERADE - add_nat_rule WEAVE -s $1 ! -o $BRIDGE -j MASQUERADE -} - -stop_masquerading() { run_iptables -t nat -F WEAVE >/dev/null 2>&1 || true run_iptables -t nat -D POSTROUTING -j WEAVE >/dev/null 2>&1 || true run_iptables -t nat -X WEAVE >/dev/null 2>&1 || true @@ -118,7 +117,7 @@ stop_masquerading() { # the following borrows from https://github.com/jpetazzo/pipework with_container_netns () { - CONTAINER="$2" + CONTAINER="$1" CONTAINER_PID=$(docker inspect --format='{{ .State.Pid }}' $CONTAINER) if [ "$CONTAINER_PID" = 0 ] ; then @@ -143,6 +142,7 @@ with_container_netns () { # Run the wrapped command STATUS=0 + shift 1 if ! "$@" >$IP_TMPFILE 2>&1 ; then STATUS=1 if [ "$(docker inspect --format='{{ .State.Pid }}' $CONTAINER)" != "$CONTAINER_PID" ] ; then @@ -157,19 +157,34 @@ with_container_netns () { return $STATUS } -# Attach Container-ID $1 to the weave network at CIDR address $2, -# creating a virtual ethernet device if necessary. -# Also turn off tx offload on device $3 inside the namespace. +launch() { + if ! ip link add name $LOCAL_IFNAME mtu $MTU type veth peer name $GUEST_IFNAME mtu $MTU ; then + return 1 + fi + if ! ip link set $GUEST_IFNAME netns $NETNS ; then + # failed before we assigned the veth to the container's + # namespace - delete it + ip link del $LOCAL_IFNAME type veth || true + return 1 + fi + + ip link set $LOCAL_IFNAME master $BRIDGE + ip link set $LOCAL_IFNAME up + ip netns exec $NETNS ip link set $GUEST_IFNAME name $CONTAINER_IFNAME + ip netns exec $NETNS ip link set $CONTAINER_IFNAME up + check_command_and_run ethtool ip netns exec $NETNS ethtool -K eth0 tx off >/dev/null +} + attach() { if ip link show $LOCAL_IFNAME >/dev/null 2>&1 ; then # veth name already exists, so assume we set it up already; # just add the IP address. - if ip netns exec $NETNS ip addr show dev $CONTAINER_IFNAME | grep -F $2 >/dev/null ; then + if ip netns exec $NETNS ip addr show dev $CONTAINER_IFNAME | grep -F $1 >/dev/null ; then # address was there already return 0 fi - if ! ip netns exec $NETNS ip addr add $2 dev $CONTAINER_IFNAME ; then + if ! ip netns exec $NETNS ip addr add $1 dev $CONTAINER_IFNAME ; then return 1 fi @@ -190,9 +205,9 @@ attach() { fi if ! ip netns exec $NETNS ip link set $GUEST_IFNAME name $CONTAINER_IFNAME || - ! ip netns exec $NETNS ip addr add $2 dev $CONTAINER_IFNAME || + ! ip netns exec $NETNS ip addr add $1 dev $CONTAINER_IFNAME || ! ip netns exec $NETNS ip link set $CONTAINER_IFNAME up || - ! check_command_and_run ethtool ip netns exec $NETNS ethtool -K $3 tx off >/dev/null ; then + ! check_command_and_run ethtool ip netns exec $NETNS ethtool -K $CONTAINER_IFNAME tx off >/dev/null ; then return 1 fi @@ -205,15 +220,13 @@ attach() { ip netns exec $NETNS ip route add 224.0.0.0/4 dev $CONTAINER_IFNAME } -# Detach Container-ID $1 at CIDR address $2 from the weave network -# removing the virtual ethernet device if there are no more addresses detach() { - if ! ip netns exec $NETNS ip addr show dev $CONTAINER_IFNAME | grep -F $2 >/dev/null ; then + if ! ip netns exec $NETNS ip addr show dev $CONTAINER_IFNAME | grep -F $1 >/dev/null ; then # address is not there, leave the device alone return 0 fi - if ! ip netns exec $NETNS ip addr del $2 dev $CONTAINER_IFNAME ; then + if ! ip netns exec $NETNS ip addr del $1 dev $CONTAINER_IFNAME ; then return 1 fi @@ -228,9 +241,6 @@ detach() { case "$COMMAND" in launch) - [ $# -gt 0 ] || usage - IPADDR=$1 - shift 1 case $(docker inspect --format '{{ .State.Running }} {{ .Config.Image }}' weave 2>/dev/null) in "true $IMAGE") echo "Weave is already running." >&2 @@ -249,8 +259,6 @@ case "$COMMAND" in ;; esac create_bridge - stop_masquerading - setup_masquerading $IPADDR # We set the router name to the bridge mac since that is # stable across re-creations of the containers. # @@ -262,7 +270,7 @@ case "$COMMAND" in # additional parameters, such as resource limits, to docker # when launching the weave container. CONTAINER=$(docker run --privileged -d --name=weave -p 6783:6783/tcp -p 6783:6783/udp $WEAVE_DOCKER_ARGS $IMAGE -name $MACADDR "$@" | tail -n 1) - with_container_netns attach $CONTAINER $IPADDR eth0 + with_container_netns $CONTAINER launch echo $CONTAINER ;; status) @@ -295,40 +303,40 @@ case "$COMMAND" in ;; run) [ $# -gt 0 ] || usage - IPADDR=$1 + CIDR=$1 shift 1 create_bridge CONTAINER=$(docker run -d "$@" | tail -n 1) - with_container_netns attach $CONTAINER $IPADDR $CONTAINER_IFNAME + with_container_netns $CONTAINER attach $CIDR echo $CONTAINER ;; attach) [ $# -gt 1 ] || usage create_bridge - with_container_netns attach $2 $1 $CONTAINER_IFNAME + with_container_netns $2 attach $1 ;; detach) [ $# -gt 1 ] || usage - with_container_netns detach $2 $1 + with_container_netns $2 detach $1 ;; expose) [ $# -gt 0 ] || usage - IPADDR=$1 - shift 1 create_bridge - if ! ip addr show dev $BRIDGE | grep -qF $IPADDR + if ! ip addr show dev $BRIDGE | grep -qF $1 then - ip addr add dev $BRIDGE $IPADDR + ip addr add dev $BRIDGE $1 + add_iptables_rule nat WEAVE -o $BRIDGE ! -s $1 -j MASQUERADE + add_iptables_rule nat WEAVE -s $1 ! -o $BRIDGE -j MASQUERADE fi ;; hide) [ $# -gt 0 ] || usage - IPADDR=$1 - shift 1 create_bridge - if ip addr show dev $BRIDGE | grep -qF $IPADDR + if ip addr show dev $BRIDGE | grep -qF $1 then - ip addr del dev $BRIDGE $IPADDR + ip addr del dev $BRIDGE $1 + delete_iptables_rule nat WEAVE -o $BRIDGE ! -s $1 -j MASQUERADE + delete_iptables_rule nat WEAVE -s $1 ! -o $BRIDGE -j MASQUERADE fi ;; stop) @@ -337,13 +345,11 @@ case "$COMMAND" in fi docker rm -f weave >/dev/null 2>&1 || true check_command_and_run conntrack conntrack -D -p udp --dport 6783 >/dev/null 2>&1 || true - stop_masquerading ;; reset) docker kill weave >/dev/null 2>&1 || true docker rm -f weave >/dev/null 2>&1 || true check_command_and_run conntrack conntrack -D -p udp --dport 6783 >/dev/null 2>&1 || true - stop_masquerading destroy_bridge ;; *)