From f067c7d44eeebbadfa0ed37d54809c8eb649acb3 Mon Sep 17 00:00:00 2001
From: Bryan Boreham <bjboreham@gmail.com>
Date: Wed, 14 Dec 2016 11:47:05 +0000
Subject: [PATCH 1/2] Add rule to allow multicast at top level

---
 prog/weave-npc/main.go | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/prog/weave-npc/main.go b/prog/weave-npc/main.go
index 1437f85e..ec513d12 100644
--- a/prog/weave-npc/main.go
+++ b/prog/weave-npc/main.go
@@ -27,6 +27,7 @@ var (
 	version     = "unreleased"
 	metricsAddr string
 	logLevel    string
+	allowMcast  bool
 )
 
 func handleError(err error) { common.CheckFatal(err) }
@@ -58,6 +59,13 @@ func resetIPTables(ipt *iptables.IPTables) error {
 		return err
 	}
 
+	if allowMcast {
+		if err := ipt.Append(npc.TableFilter, npc.MainChain,
+			"-d", "224.0.0.0/4", "-j", "ACCEPT"); err != nil {
+			return err
+		}
+	}
+
 	if err := ipt.Append(npc.TableFilter, npc.MainChain,
 		"-m", "state", "--state", "NEW", "-j", string(npc.DefaultChain)); err != nil {
 		return err
@@ -166,6 +174,7 @@ func main() {
 
 	rootCmd.PersistentFlags().StringVar(&metricsAddr, "metrics-addr", ":6781", "metrics server bind address")
 	rootCmd.PersistentFlags().StringVar(&logLevel, "log-level", "debug", "logging level (debug, info, warning, error)")
+	rootCmd.PersistentFlags().BoolVar(&allowMcast, "allow-mcast", true, "allow all multicast traffic")
 
 	handleError(rootCmd.Execute())
 }

From 6a8313068549c739d21e3f6ed06b086265886d89 Mon Sep 17 00:00:00 2001
From: Bryan Boreham <bjboreham@gmail.com>
Date: Mon, 30 Jan 2017 18:14:57 +0000
Subject: [PATCH 2/2] Document multicast behaviour of weave-npc

---
 site/kube-addon.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/site/kube-addon.md b/site/kube-addon.md
index 7dc08df4..284270b7 100644
--- a/site/kube-addon.md
+++ b/site/kube-addon.md
@@ -79,6 +79,13 @@ Kubernetes see the
 and the [NetworkPolicy API object
 definition](http://kubernetes.io/docs/api-reference/extensions/v1beta1/definitions/#_v1beta1_networkpolicy).
 
+**Note:** as of version 1.9 of Weave Net, the Network Policy
+  Controller allows all multicast traffic. Since a single multicast
+  address may be used by multiple pods, we cannot implement rules to
+  isolate them individually.  You can turn this behaviour off (block
+  all multicast traffic) by adding `--allow-mcast` as an argument to
+  `weave-npc` in the YAML configuration.
+
 ###<a name="blocked-connections"></a> Troubleshooting Blocked Connections
 
 If you suspect that legitimate traffic is being blocked by the Weave Network Policy Controller, the first thing to do is check the `weave-npc` container's logs.