From a31d8c4d8001ab05210c7f6716f288f6819a7f4f Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Tue, 30 Sep 2014 15:23:23 +0100 Subject: [PATCH 1/5] Refactor add_nat_rule into add_iptables_rule that is more general --- weaver/weave | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/weaver/weave b/weaver/weave index fe83ad52..4f2e6d6d 100755 --- a/weaver/weave +++ b/weaver/weave @@ -82,13 +82,20 @@ run_iptables() { iptables $IPTABLES_W "$@" } -add_nat_rule() { - if ! run_iptables -t nat -C "$@" >/dev/null 2>&1 +# Add a rule to iptables, if it doesn't exist already +add_iptables_rule() { + IPTABLES_TABLE="$1" + shift 1 + if ! run_iptables -t $IPTABLES_TABLE -C "$@" >/dev/null 2>&1 then - run_iptables -t nat -A "$@" >/dev/null + run_iptables -t $IPTABLES_TABLE -A "$@" >/dev/null fi } +add_nat_rule() { + add_iptables_rule nat $@ +} + setup_masquerading() { run_iptables -t nat -N WEAVE >/dev/null 2>&1 || true add_nat_rule POSTROUTING -j WEAVE From c3fdee766ff69bb90ca1c43b05731ea16f5c9056 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Tue, 30 Sep 2014 15:24:30 +0100 Subject: [PATCH 2/5] Add iptables rule to forward traffic across the bridge, to avoid ufw blocking it --- weaver/weave | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/weaver/weave b/weaver/weave index 4f2e6d6d..a44f2883 100755 --- a/weaver/weave +++ b/weaver/weave @@ -60,6 +60,9 @@ create_bridge() { ip link del dev v${CONTAINER_IFNAME}du # disable offloading check_command_and_run ethtool ethtool -K $BRIDGE tx off >/dev/null + # Work round the situation where there are no rules allowing traffic + # across our bridge. E.g. ufw + add_iptables_rule filter FORWARD -i weave -o weave -j ACCEPT } ip link set dev $BRIDGE up } @@ -68,6 +71,7 @@ destroy_bridge() { if [ -d /sys/class/net/$BRIDGE ] ; then ip link del dev $BRIDGE fi + iptables -t filter -D FORWARD -i weave -o weave -j ACCEPT 2>/dev/null || true } run_iptables() { From a09a229b44d78c934f4c39b1adbc27d7767980a8 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Tue, 30 Sep 2014 16:02:06 +0100 Subject: [PATCH 3/5] Improve robustness --- weaver/weave | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/weaver/weave b/weaver/weave index a44f2883..f9452dfd 100755 --- a/weaver/weave +++ b/weaver/weave @@ -60,7 +60,7 @@ create_bridge() { ip link del dev v${CONTAINER_IFNAME}du # disable offloading check_command_and_run ethtool ethtool -K $BRIDGE tx off >/dev/null - # Work round the situation where there are no rules allowing traffic + # Work around the situation where there are no rules allowing traffic # across our bridge. E.g. ufw add_iptables_rule filter FORWARD -i weave -o weave -j ACCEPT } @@ -71,7 +71,7 @@ destroy_bridge() { if [ -d /sys/class/net/$BRIDGE ] ; then ip link del dev $BRIDGE fi - iptables -t filter -D FORWARD -i weave -o weave -j ACCEPT 2>/dev/null || true + run_iptables -t filter -D FORWARD -i weave -o weave -j ACCEPT 2>/dev/null || true } run_iptables() { @@ -97,7 +97,7 @@ add_iptables_rule() { } add_nat_rule() { - add_iptables_rule nat $@ + add_iptables_rule nat "$@" } setup_masquerading() { From 4d5faafd0cae360cb1ad190389ccfebc9304450f Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Tue, 30 Sep 2014 16:09:56 +0100 Subject: [PATCH 4/5] refactor: order functions by dependency --- weaver/weave | 52 ++++++++++++++++++++++++++-------------------------- 1 file changed, 26 insertions(+), 26 deletions(-) diff --git a/weaver/weave b/weaver/weave index f9452dfd..d50ee277 100755 --- a/weaver/weave +++ b/weaver/weave @@ -47,6 +47,32 @@ check_command_and_run() { fi } +run_iptables() { + # -w is recent addition to iptables + if [ -z "$CHECKED_IPTABLES_W" ] ; then + if iptables -S -w >/dev/null 2>&1 ; then + IPTABLES_W=-w + fi + CHECKED_IPTABLES_W=1 + fi + + iptables $IPTABLES_W "$@" +} + +# Add a rule to iptables, if it doesn't exist already +add_iptables_rule() { + IPTABLES_TABLE="$1" + shift 1 + if ! run_iptables -t $IPTABLES_TABLE -C "$@" >/dev/null 2>&1 + then + run_iptables -t $IPTABLES_TABLE -A "$@" >/dev/null + fi +} + +add_nat_rule() { + add_iptables_rule nat "$@" +} + create_bridge() { [ ! -d /sys/class/net/$BRIDGE ] && { ip link add dev $BRIDGE type bridge @@ -74,32 +100,6 @@ destroy_bridge() { run_iptables -t filter -D FORWARD -i weave -o weave -j ACCEPT 2>/dev/null || true } -run_iptables() { - # -w is recent addition to iptables - if [ -z "$CHECKED_IPTABLES_W" ] ; then - if iptables -S -w >/dev/null 2>&1 ; then - IPTABLES_W=-w - fi - CHECKED_IPTABLES_W=1 - fi - - iptables $IPTABLES_W "$@" -} - -# Add a rule to iptables, if it doesn't exist already -add_iptables_rule() { - IPTABLES_TABLE="$1" - shift 1 - if ! run_iptables -t $IPTABLES_TABLE -C "$@" >/dev/null 2>&1 - then - run_iptables -t $IPTABLES_TABLE -A "$@" >/dev/null - fi -} - -add_nat_rule() { - add_iptables_rule nat "$@" -} - setup_masquerading() { run_iptables -t nat -N WEAVE >/dev/null 2>&1 || true add_nat_rule POSTROUTING -j WEAVE From f4a5012dc7dd96381eab87811a69da6e8e93e4e4 Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Tue, 30 Sep 2014 16:11:29 +0100 Subject: [PATCH 5/5] refactor: keep bridge name abstract --- weaver/weave | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/weaver/weave b/weaver/weave index d50ee277..26423cb2 100755 --- a/weaver/weave +++ b/weaver/weave @@ -88,7 +88,7 @@ create_bridge() { check_command_and_run ethtool ethtool -K $BRIDGE tx off >/dev/null # Work around the situation where there are no rules allowing traffic # across our bridge. E.g. ufw - add_iptables_rule filter FORWARD -i weave -o weave -j ACCEPT + add_iptables_rule filter FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT } ip link set dev $BRIDGE up } @@ -97,7 +97,7 @@ destroy_bridge() { if [ -d /sys/class/net/$BRIDGE ] ; then ip link del dev $BRIDGE fi - run_iptables -t filter -D FORWARD -i weave -o weave -j ACCEPT 2>/dev/null || true + run_iptables -t filter -D FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT 2>/dev/null || true } setup_masquerading() {