From a07e3301b1a8330f697acfdd591cd2b50d5d4144 Mon Sep 17 00:00:00 2001
From: Bryan Boreham <bjboreham@gmail.com>
Date: Thu, 10 Nov 2016 17:02:57 +0000
Subject: [PATCH] Add 'weave expose' NAT iptables rules inside CNI plugin

This avoids a race between the plugin and the script
---
 net/veth.go               | 18 ++++++++++++++++++
 plugin/net/cni.go         |  3 +++
 prog/weave-kube/launch.sh |  3 ---
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/net/veth.go b/net/veth.go
index f33d7b58..d0c81d0b 100644
--- a/net/veth.go
+++ b/net/veth.go
@@ -271,3 +271,21 @@ func subnets(addrs []netlink.Addr) map[string]struct{} {
 	}
 	return subnets
 }
+
+func ExposeNAT(ipnet net.IPNet) error {
+	ipt, err := iptables.New()
+	if err != nil {
+		return err
+	}
+	cidr := ipnet.String()
+	if err := ipt.AppendUnique("nat", "WEAVE", "-s", cidr, "-d", "224.0.0.0/4", "-j", "RETURN"); err != nil {
+		return err
+	}
+	if err := ipt.AppendUnique("nat", "WEAVE", "-d", cidr, "!", "-s", cidr, "-j", "MASQUERADE"); err != nil {
+		return err
+	}
+	if err := ipt.AppendUnique("nat", "WEAVE", "-s", cidr, "!", "-d", cidr, "-j", "MASQUERADE"); err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/plugin/net/cni.go b/plugin/net/cni.go
index 92e96c59..3145e49d 100644
--- a/plugin/net/cni.go
+++ b/plugin/net/cni.go
@@ -84,6 +84,9 @@ func (c *CNIPlugin) CmdAdd(args *skel.CmdArgs) error {
 			if err := assignBridgeIP(conf.BrName, bridgeIPResult.IP4.IP); err != nil {
 				return fmt.Errorf("unable to assign IP address to bridge: %s", err)
 			}
+			if err := weavenet.ExposeNAT(bridgeIPResult.IP4.IP); err != nil {
+				return fmt.Errorf("unable to create NAT rules: %s", err)
+			}
 			bridgeIP = bridgeIPResult.IP4.IP.IP
 		} else if err != nil {
 			return err
diff --git a/prog/weave-kube/launch.sh b/prog/weave-kube/launch.sh
index 7c82e8ef..0bb9dcd9 100755
--- a/prog/weave-kube/launch.sh
+++ b/prog/weave-kube/launch.sh
@@ -152,7 +152,4 @@ done
     reclaim_ips "_" $IPS
 done
 
-# Expose the weave network so host processes can communicate with pods
-/home/weave/weave --local expose $WEAVE_EXPOSE_IP
-
 wait $WEAVE_PID