Merge pull request #2747 from weaveworks/issues/2689-npc-mcast-simple

Add rule to allow multicast at top level

prog/weave-npc/main.go

@@ -27,6 +27,7 @@ var (
 	version     = "unreleased"
 	metricsAddr string
 	logLevel    string
+	allowMcast  bool
 )
 
 func handleError(err error) { common.CheckFatal(err) }
@@ -58,6 +59,13 @@ func resetIPTables(ipt *iptables.IPTables) error {
 		return err
 	}
 
+	if allowMcast {
+		if err := ipt.Append(npc.TableFilter, npc.MainChain,
+			"-d", "224.0.0.0/4", "-j", "ACCEPT"); err != nil {
+			return err
+		}
+	}
+
 	if err := ipt.Append(npc.TableFilter, npc.MainChain,
 		"-m", "state", "--state", "NEW", "-j", string(npc.DefaultChain)); err != nil {
 		return err
@@ -166,6 +174,7 @@ func main() {
 
 	rootCmd.PersistentFlags().StringVar(&metricsAddr, "metrics-addr", ":6781", "metrics server bind address")
 	rootCmd.PersistentFlags().StringVar(&logLevel, "log-level", "debug", "logging level (debug, info, warning, error)")
+	rootCmd.PersistentFlags().BoolVar(&allowMcast, "allow-mcast", true, "allow all multicast traffic")
 
 	handleError(rootCmd.Execute())
 }

site/kube-addon.md

@@ -79,6 +79,13 @@ Kubernetes see the
 and the [NetworkPolicy API object
 definition](http://kubernetes.io/docs/api-reference/extensions/v1beta1/definitions/#_v1beta1_networkpolicy).
 
+**Note:** as of version 1.9 of Weave Net, the Network Policy
+  Controller allows all multicast traffic. Since a single multicast
+  address may be used by multiple pods, we cannot implement rules to
+  isolate them individually.  You can turn this behaviour off (block
+  all multicast traffic) by adding `--allow-mcast` as an argument to
+  `weave-npc` in the YAML configuration.
+
 ###<a name="blocked-connections"></a> Troubleshooting Blocked Connections
 
 If you suspect that legitimate traffic is being blocked by the Weave Network Policy Controller, the first thing to do is check the `weave-npc` container's logs.