From bfd500733912bbaa55594d1951f52a369ca617d7 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Thu, 18 Sep 2014 11:03:06 +0100 Subject: [PATCH 1/5] Don't test if symlink exists before 'rm -f' When the symlink's target doesn't exist, '[ -f' is false, so the symlink doesn't get removed. Since we do always want it to be removed, just call 'rm -f' anyway, which won't complain if the file doesn't exist. --- weaver/weave | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/weaver/weave b/weaver/weave index b7fa02d7..7aa4d14d 100755 --- a/weaver/weave +++ b/weaver/weave @@ -114,7 +114,7 @@ configure_container_networking() { NSPID=$DOCKERPID [ ! -d /var/run/netns ] && mkdir -p /var/run/netns - [ -f /var/run/netns/$NSPID ] && rm -f /var/run/netns/$NSPID + rm -f /var/run/netns/$NSPID ln -s /proc/$NSPID/ns/net /var/run/netns/$NSPID EXITCODE=1 @@ -136,7 +136,7 @@ configure_container_networking() { fi fi - [ -f /var/run/netns/$NSPID ] && rm -f /var/run/netns/$NSPID + rm -f /var/run/netns/$NSPID return $EXITCODE } From a75a0d870947f3b7d207e01edf6e78d920f492e3 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Thu, 18 Sep 2014 11:24:08 +0100 Subject: [PATCH 2/5] If and only if network setup because the container died, say so. This involves capturing stderr output from all the 'ip' commands so we can hide that output if we see the process died, or show it to the user if the process didn't die, in which case we don't know why we failed. --- weaver/weave | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/weaver/weave b/weaver/weave index 7aa4d14d..8da45d72 100755 --- a/weaver/weave +++ b/weaver/weave @@ -120,15 +120,16 @@ configure_container_networking() { EXITCODE=1 LOCAL_IFNAME="v${CONTAINER_IFNAME}pl${NSPID}" GUEST_IFNAME="v${CONTAINER_IFNAME}pg${NSPID}" - if ip link add name $LOCAL_IFNAME mtu $MTU type veth peer name $GUEST_IFNAME mtu $MTU ; then - if ip link set $LOCAL_IFNAME master $BRIDGE && \ - ip link set $LOCAL_IFNAME up && \ - ip link set $GUEST_IFNAME netns $NSPID + IP_TMPFILE=/tmp/weave_ip_output_$$ + if ip link add name $LOCAL_IFNAME mtu $MTU type veth peer name $GUEST_IFNAME mtu $MTU > $IP_TMPFILE 2>&1 ; then + if (ip link set $LOCAL_IFNAME master $BRIDGE && + ip link set $LOCAL_IFNAME up && + ip link set $GUEST_IFNAME netns $NSPID) > $IP_TMPFILE 2>&1 then - ip netns exec $NSPID ip link set $GUEST_IFNAME name $CONTAINER_IFNAME && \ - ip netns exec $NSPID ip addr add $2 dev $CONTAINER_IFNAME && \ - ip netns exec $NSPID ip link set $CONTAINER_IFNAME up && \ - (check_command_and_run ethtool ip netns exec $NSPID ethtool -K $3 tx off >/dev/null) && \ + (ip netns exec $NSPID ip link set $GUEST_IFNAME name $CONTAINER_IFNAME && + ip netns exec $NSPID ip addr add $2 dev $CONTAINER_IFNAME && + ip netns exec $NSPID ip link set $CONTAINER_IFNAME up && + check_command_and_run ethtool ip netns exec $NSPID ethtool -K $3 tx off) > $IP_TMPFILE 2>&1 && EXITCODE=0 else # failed before we assigned the veth to the container's namespace - delete it @@ -136,6 +137,16 @@ configure_container_networking() { fi fi + if [ "$EXITCODE" -ne 0 ] ; then + if ! ps -p $DOCKERPID > /dev/null 2>&1 ; then + echo "Container died during network set-up. ID $1" >&2 + else + echo "Failure during network set-up:" >&2 + cat $IP_TMPFILE + fi + fi + + rm -f $IP_TMPFILE rm -f /var/run/netns/$NSPID return $EXITCODE From c48ae19c5523129bd787d2b6186b91a05b7bdc4c Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Thu, 18 Sep 2014 11:47:47 +0100 Subject: [PATCH 3/5] Tidy up messages; ensure errors to to stderr --- weaver/weave | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/weaver/weave b/weaver/weave index 8da45d72..9b1d8b83 100755 --- a/weaver/weave +++ b/weaver/weave @@ -129,7 +129,7 @@ configure_container_networking() { (ip netns exec $NSPID ip link set $GUEST_IFNAME name $CONTAINER_IFNAME && ip netns exec $NSPID ip addr add $2 dev $CONTAINER_IFNAME && ip netns exec $NSPID ip link set $CONTAINER_IFNAME up && - check_command_and_run ethtool ip netns exec $NSPID ethtool -K $3 tx off) > $IP_TMPFILE 2>&1 && + check_command_and_run ethtool ip netns exec $NSPID ethtool -K $3 tx off > /dev/null) > $IP_TMPFILE 2>&1 && EXITCODE=0 else # failed before we assigned the veth to the container's namespace - delete it @@ -139,10 +139,10 @@ configure_container_networking() { if [ "$EXITCODE" -ne 0 ] ; then if ! ps -p $DOCKERPID > /dev/null 2>&1 ; then - echo "Container died during network set-up. ID $1" >&2 + echo "Container $1 died" >&2 else echo "Failure during network set-up:" >&2 - cat $IP_TMPFILE + cat $IP_TMPFILE >&2 fi fi From 86644f7615ad22c3853b0b0b75c83b8af02d7829 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Thu, 18 Sep 2014 11:55:47 +0100 Subject: [PATCH 4/5] cosmetic --- weaver/weave | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/weaver/weave b/weaver/weave index 9b1d8b83..0d4e1fb3 100755 --- a/weaver/weave +++ b/weaver/weave @@ -121,15 +121,15 @@ configure_container_networking() { LOCAL_IFNAME="v${CONTAINER_IFNAME}pl${NSPID}" GUEST_IFNAME="v${CONTAINER_IFNAME}pg${NSPID}" IP_TMPFILE=/tmp/weave_ip_output_$$ - if ip link add name $LOCAL_IFNAME mtu $MTU type veth peer name $GUEST_IFNAME mtu $MTU > $IP_TMPFILE 2>&1 ; then + if ip link add name $LOCAL_IFNAME mtu $MTU type veth peer name $GUEST_IFNAME mtu $MTU >$IP_TMPFILE 2>&1 ; then if (ip link set $LOCAL_IFNAME master $BRIDGE && ip link set $LOCAL_IFNAME up && - ip link set $GUEST_IFNAME netns $NSPID) > $IP_TMPFILE 2>&1 + ip link set $GUEST_IFNAME netns $NSPID) >$IP_TMPFILE 2>&1 then (ip netns exec $NSPID ip link set $GUEST_IFNAME name $CONTAINER_IFNAME && ip netns exec $NSPID ip addr add $2 dev $CONTAINER_IFNAME && ip netns exec $NSPID ip link set $CONTAINER_IFNAME up && - check_command_and_run ethtool ip netns exec $NSPID ethtool -K $3 tx off > /dev/null) > $IP_TMPFILE 2>&1 && + check_command_and_run ethtool ip netns exec $NSPID ethtool -K $3 tx off >/dev/null) >$IP_TMPFILE 2>&1 && EXITCODE=0 else # failed before we assigned the veth to the container's namespace - delete it @@ -138,7 +138,7 @@ configure_container_networking() { fi if [ "$EXITCODE" -ne 0 ] ; then - if ! ps -p $DOCKERPID > /dev/null 2>&1 ; then + if ! ps -p $DOCKERPID >/dev/null 2>&1 ; then echo "Container $1 died" >&2 else echo "Failure during network set-up:" >&2 From 0ed57bad674b47392099c8f3fa965a3c7af66225 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Thu, 18 Sep 2014 11:56:15 +0100 Subject: [PATCH 5/5] rm tempfile before we use it, to avoid attack via symlink --- weaver/weave | 1 + 1 file changed, 1 insertion(+) diff --git a/weaver/weave b/weaver/weave index 0d4e1fb3..1c52da6c 100755 --- a/weaver/weave +++ b/weaver/weave @@ -121,6 +121,7 @@ configure_container_networking() { LOCAL_IFNAME="v${CONTAINER_IFNAME}pl${NSPID}" GUEST_IFNAME="v${CONTAINER_IFNAME}pg${NSPID}" IP_TMPFILE=/tmp/weave_ip_output_$$ + rm -f $IP_TMPFILE if ip link add name $LOCAL_IFNAME mtu $MTU type veth peer name $GUEST_IFNAME mtu $MTU >$IP_TMPFILE 2>&1 ; then if (ip link set $LOCAL_IFNAME master $BRIDGE && ip link set $LOCAL_IFNAME up &&