From a57cf4bc8303d664a74545738c519f641092c1e8 Mon Sep 17 00:00:00 2001
From: Martynas Pumputis <martynasp@gmail.com>
Date: Tue, 28 Feb 2017 11:19:13 +0000
Subject: [PATCH 1/2] Ignore modprobe errors in weave-kube/launch.sh

weave-kube is run by alpine image which uses busybox. modprobe of
busybox will return the "module not found" error [1], if a module is
built-in, which is an opposite behavior to modprobe distributed in
mainstream distros (e.g. ubuntu).

[1]: https://bugs.busybox.net/show_bug.cgi?id=5270
---
 prog/weave-kube/launch.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/prog/weave-kube/launch.sh b/prog/weave-kube/launch.sh
index 16cd5d57..8a3484d7 100755
--- a/prog/weave-kube/launch.sh
+++ b/prog/weave-kube/launch.sh
@@ -2,6 +2,10 @@
 
 set -e
 
+modprobe_safe() {
+    modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel"
+}
+
 # Default if not supplied - same as weave net default
 IPALLOC_RANGE=${IPALLOC_RANGE:-10.32.0.0/12}
 HTTP_ADDR=${WEAVE_HTTP_ADDR:-127.0.0.1:6784}
@@ -17,8 +21,8 @@ EXPECT_NPC=${EXPECT_NPC:-1}
 
 # Ensure we have the required modules for NPC
 if [ "${EXPECT_NPC}" != "0" ]; then
-    modprobe br_netfilter
-    modprobe xt_set
+    modprobe_safe br_netfilter
+    modprobe_safe xt_set
 fi
 
 # kube-proxy requires that bridged traffic passes through netfilter

From 3607cf2d7a2fbc201e41439004d54f34a2860a8b Mon Sep 17 00:00:00 2001
From: Martynas Pumputis <martynasp@gmail.com>
Date: Tue, 28 Feb 2017 16:27:21 +0000
Subject: [PATCH 2/2] Add check for xt_set module

The check is based on actually trying to install an iptables rule
which uses the module.
---
 prog/weave-kube/launch.sh          | 16 +++++++++++++++-
 prog/weaveexec/Dockerfile.template |  1 +
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/prog/weave-kube/launch.sh b/prog/weave-kube/launch.sh
index 8a3484d7..e7f79331 100755
--- a/prog/weave-kube/launch.sh
+++ b/prog/weave-kube/launch.sh
@@ -3,7 +3,20 @@
 set -e
 
 modprobe_safe() {
-    modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel"
+    modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel" >&2
+}
+
+# Check whether xt_set actually exists
+xt_set_exists() {
+    ipset create weave-kube-test hash:ip
+    iptables -t filter -N WEAVE-KUBE-TEST
+    if ! iptables -A WEAVE-KUBE-TEST -m set --match-set weave-kube-test src -j DROP; then
+        NOT_EXIST=1
+    fi
+    iptables -F WEAVE-KUBE-TEST
+    iptables -X WEAVE-KUBE-TEST
+    ipset destroy weave-kube-test
+    [ -z "$NOT_EXIST" ] || (echo "\"xt_set\" does not exist" >&2 && return 1)
 }
 
 # Default if not supplied - same as weave net default
@@ -23,6 +36,7 @@ EXPECT_NPC=${EXPECT_NPC:-1}
 if [ "${EXPECT_NPC}" != "0" ]; then
     modprobe_safe br_netfilter
     modprobe_safe xt_set
+    xt_set_exists
 fi
 
 # kube-proxy requires that bridged traffic passes through netfilter
diff --git a/prog/weaveexec/Dockerfile.template b/prog/weaveexec/Dockerfile.template
index 90c87de8..09d76848 100644
--- a/prog/weaveexec/Dockerfile.template
+++ b/prog/weaveexec/Dockerfile.template
@@ -19,6 +19,7 @@ RUN apk add --update \
     curl \
     ethtool \
     iptables \
+    ipset \
     iproute2 \
     util-linux \
     conntrack-tools \