From 98a7d3fc99314b804b31ea4d62d349b1afe49194 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Thu, 3 Dec 2015 15:08:53 +0000 Subject: [PATCH 1/4] `weave run` and `weave attach` accept --no-multicast-route --- weave | 58 +++++++++++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 49 insertions(+), 9 deletions(-) diff --git a/weave b/weave index bd3c49dc..cc4beb64 100755 --- a/weave +++ b/weave @@ -59,7 +59,8 @@ weave connect [--replace] [ ...] weave forget ... weave status [targets | connections | peers | dns] weave report [-f ] -weave run [--with-dns | --without-dns] [--no-rewrite-hosts] +weave run [--with-dns | --without-dns] + [--no-rewrite-hosts] [--no-multicast-route] [ ...] ... weave start [ ...] weave attach [ ...] @@ -258,20 +259,42 @@ elif [ "$1" = "run" -a -z "$IS_LOCAL" ] ; then # because we are passing arbitrary arguments on to docker run, and # we can't rely on our baked-in docker to support those arguments. shift 1 + if [ "$1" != "--without-dns" ] ; then DNS_ARGS=$(exec_remote dns-args "$@" || true) fi shift $(dns_arg_count "$@") - if [ "$1" = "--no-rewrite-hosts" ] ; then + + REWRITE_HOSTS=1 + NO_MULTICAST_ROUTE= + while [ $# -gt 0 ]; do + case "$1" in + --no-rewrite-hosts) + REWRITE_HOSTS= + ;; + --no-multicast-route) + NO_MULTICAST_ROUTE=1 + ;; + *) + break + ;; + esac shift - else + done + + if [ -n "$REWRITE_HOSTS" ] ; then extra_hosts_args "$@" DNS_EXTRA_HOSTS_ARGS="--rewrite-hosts $DNS_EXTRA_HOSTS_ARGS" fi + + if [ -n "$NO_MULTICAST_ROUTE" ] ; then + ATTACH_ARGS="--no-multicast-route" + fi + collect_cidr_args "$@" shift $CIDR_ARG_COUNT CONTAINER=$(docker $DOCKER_CLIENT_ARGS run -e WEAVE_CIDR=none $DNS_ARGS -d "$@") - exec_remote attach $CIDR_ARGS --or-die $DNS_EXTRA_HOSTS_ARGS $CONTAINER >/dev/null + exec_remote attach $CIDR_ARGS --or-die $DNS_EXTRA_HOSTS_ARGS $ATTACH_ARGS $CONTAINER >/dev/null echo $CONTAINER exit 0 fi @@ -841,8 +864,10 @@ attach() { # multicast packets. Since RFC1122 prohibits sending of ICMP # errors for packets with multicast destinations, that causes # packets larger than the PMTU to be dropped silently. - if ! netnsenter ip route show | grep '^224\.0\.0\.0/4' >/dev/null ; then - netnsenter ip route add 224.0.0.0/4 dev $CONTAINER_IFNAME mtu lock $MTU + if [ -z "$NO_MULTICAST_ROUTE" ] ; then + if ! netnsenter ip route show | grep '^224\.0\.0\.0/4' >/dev/null ; then + netnsenter ip route add 224.0.0.0/4 dev $CONTAINER_IFNAME mtu lock $MTU + fi fi } @@ -1914,10 +1939,21 @@ EOF dns_args "$@" shift $(dns_arg_count "$@") REWRITE_HOSTS=1 - if [ "$1" = "--no-rewrite-hosts" ] ; then - REWRITE_HOSTS= + NO_MULTICAST_ROUTE= + while [ $# -gt 0 ]; do + case "$1" in + --no-rewrite-hosts) + REWRITE_HOSTS= + ;; + --no-multicast-route) + NO_MULTICAST_ROUTE=1 + ;; + *) + break + ;; + esac shift - fi + done collect_cidr_args "$@" shift $CIDR_ARG_COUNT CONTAINER=$(docker run -e WEAVE_CIDR=none $DNS_ARGS -d "$@") @@ -1954,6 +1990,7 @@ EOF attach) DNS_EXTRA_HOSTS= REWRITE_HOSTS= + NO_MULTICAST_ROUTE= collect_cidr_args "$@" shift $CIDR_ARG_COUNT while [ $# -gt 0 ]; do @@ -1971,6 +2008,9 @@ EOF --add-host=*) DNS_EXTRA_HOSTS="${1#*=} $DNS_EXTRA_HOSTS" ;; + --no-multicast-route) + NO_MULTICAST_ROUTE=1 + ;; *) break ;; From 367b73e6e39e63f1c0fb53daf4065882413955fe Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Fri, 11 Dec 2015 17:52:58 +0000 Subject: [PATCH 2/4] Introduce nomcast weavewait --- .gitignore | 2 ++ Makefile | 19 ++++++++++++++----- prog/weavewait/check_network.go | 9 ++------- prog/weavewait/check_network_iface.go | 12 ++++++++++++ prog/weavewait/check_network_iface_mcast.go | 12 ++++++++++++ prog/weavewait/noop.go | 7 ------- 6 files changed, 42 insertions(+), 19 deletions(-) create mode 100644 prog/weavewait/check_network_iface.go create mode 100644 prog/weavewait/check_network_iface_mcast.go delete mode 100644 prog/weavewait/noop.go diff --git a/.gitignore b/.gitignore index 438bc599..4d5f7002 100644 --- a/.gitignore +++ b/.gitignore @@ -40,6 +40,7 @@ prog/weaveproxy/weaveproxy prog/sigproxy/sigproxy prog/weavewait/weavewait prog/weavewait/weavewait_noop +prog/weavewait/weavewait_nomcast prog/netcheck/netcheck prog/docker_tls_args/docker_tls_args prog/plugin/plugin @@ -56,6 +57,7 @@ prog/weaveexec/weavehosts prog/weaveexec/weaveproxy prog/weaveexec/weavewait prog/weaveexec/weavewait_noop +prog/weaveexec/weavewait_nomcast prog/weaveexec/sigproxy prog/weaveexec/netcheck prog/weaveexec/docker_tls_args diff --git a/Makefile b/Makefile index 7680e1a7..cb468e93 100644 --- a/Makefile +++ b/Makefile @@ -14,13 +14,14 @@ WEAVEPROXY_EXE=prog/weaveproxy/weaveproxy SIGPROXY_EXE=prog/sigproxy/sigproxy WEAVEWAIT_EXE=prog/weavewait/weavewait WEAVEWAIT_NOOP_EXE=prog/weavewait/weavewait_noop +WEAVEWAIT_NOMCAST_EXE=prog/weavewait/weavewait_nomcast NETCHECK_EXE=prog/netcheck/netcheck DOCKERTLSARGS_EXE=prog/docker_tls_args/docker_tls_args DOCKERPLUGIN_EXE=prog/plugin/plugin RUNNER_EXE=tools/runner/runner TEST_TLS_EXE=test/tls/tls -EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(NETCHECK_EXE) $(DOCKERTLSARGS_EXE) $(DOCKERPLUGIN_EXE) $(TEST_TLS_EXE) +EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(NETCHECK_EXE) $(DOCKERTLSARGS_EXE) $(DOCKERPLUGIN_EXE) $(TEST_TLS_EXE) WEAVER_UPTODATE=.weaver.uptodate WEAVEEXEC_UPTODATE=.weaveexec.uptodate @@ -81,29 +82,37 @@ $(NETCHECK_EXE): prog/netcheck/netcheck.go # These next programs need separate rules as they fail the netgo check in # the main build stanza due to not importing net package $(SIGPROXY_EXE): prog/sigproxy/main.go -$(WEAVEWAIT_EXE): prog/weavewait/*.go net/*.go $(DOCKERTLSARGS_EXE): prog/docker_tls_args/*.go $(DOCKERPLUGIN_EXE): prog/plugin/*.go plugin/net/*.go plugin/ipam/*.go plugin/skel/*.go api/*.go common/docker/*.go $(TEST_TLS_EXE): test/tls/*.go -$(WEAVEWAIT_EXE) $(SIGPROXY_EXE) $(DOCKERTLSARGS_EXE) $(DOCKERPLUGIN_EXE) $(TEST_TLS_EXE): +$(SIGPROXY_EXE) $(DOCKERTLSARGS_EXE) $(DOCKERPLUGIN_EXE) $(TEST_TLS_EXE): go get -tags netgo ./$(@D) go build $(BUILD_FLAGS) -o $@ ./$(@D) +$(WEAVEWAIT_EXE): prog/weavewait/*.go net/*.go + go get -tags netgo ./$(@D) + go build $(BUILD_FLAGS) -tags "iface mcast" -o $@ ./$(@D) + +$(WEAVEWAIT_NOMCAST_EXE): prog/weavewait/*.go net/*.go + go get -tags netgo ./$(@D) + go build $(BUILD_FLAGS) -tags iface -o $@ ./$(@D) + $(WEAVEWAIT_NOOP_EXE): prog/weavewait/*.go go get -tags netgo ./$(@D) - go build $(BUILD_FLAGS) -tags noop -o $@ ./$(@D) + go build $(BUILD_FLAGS) -o $@ ./$(@D) $(WEAVER_UPTODATE): prog/weaver/Dockerfile $(WEAVER_EXE) $(SUDO) docker build -t $(WEAVER_IMAGE) prog/weaver touch $@ -$(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile prog/weaveexec/symlink $(DOCKER_DISTRIB) weave $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(NETCHECK_EXE) $(DOCKERTLSARGS_EXE) +$(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile prog/weaveexec/symlink $(DOCKER_DISTRIB) weave $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(NETCHECK_EXE) $(DOCKERTLSARGS_EXE) cp weave prog/weaveexec/weave cp $(SIGPROXY_EXE) prog/weaveexec/sigproxy cp $(WEAVEPROXY_EXE) prog/weaveexec/weaveproxy cp $(WEAVEWAIT_EXE) prog/weaveexec/weavewait cp $(WEAVEWAIT_NOOP_EXE) prog/weaveexec/weavewait_noop + cp $(WEAVEWAIT_NOMCAST_EXE) prog/weaveexec/weavewait_nomcast cp $(NETCHECK_EXE) prog/weaveexec/netcheck cp $(DOCKERTLSARGS_EXE) prog/weaveexec/docker_tls_args cp $(DOCKER_DISTRIB) prog/weaveexec/docker.tgz diff --git a/prog/weavewait/check_network.go b/prog/weavewait/check_network.go index 9c17bf8e..53b5385d 100644 --- a/prog/weavewait/check_network.go +++ b/prog/weavewait/check_network.go @@ -1,12 +1,7 @@ -// +build !noop +// +build !iface,!mcast package main -import ( - weavenet "github.com/weaveworks/weave/net" -) - func checkNetwork() error { - _, err := weavenet.EnsureInterfaceAndMcastRoute("ethwe") - return err + return nil } diff --git a/prog/weavewait/check_network_iface.go b/prog/weavewait/check_network_iface.go new file mode 100644 index 00000000..9a627af8 --- /dev/null +++ b/prog/weavewait/check_network_iface.go @@ -0,0 +1,12 @@ +// +build iface,!mcast + +package main + +import ( + weavenet "github.com/weaveworks/weave/net" +) + +func checkNetwork() error { + _, err := weavenet.EnsureInterface("ethwe") + return err +} diff --git a/prog/weavewait/check_network_iface_mcast.go b/prog/weavewait/check_network_iface_mcast.go new file mode 100644 index 00000000..898c3b3d --- /dev/null +++ b/prog/weavewait/check_network_iface_mcast.go @@ -0,0 +1,12 @@ +// +build iface,mcast + +package main + +import ( + weavenet "github.com/weaveworks/weave/net" +) + +func checkNetwork() error { + _, err := weavenet.EnsureInterfaceAndMcastRoute("ethwe") + return err +} diff --git a/prog/weavewait/noop.go b/prog/weavewait/noop.go deleted file mode 100644 index 2342311d..00000000 --- a/prog/weavewait/noop.go +++ /dev/null @@ -1,7 +0,0 @@ -// +build noop - -package main - -func checkNetwork() error { - return nil -} From ce25f58639490840ba2f6f1557a98004e9fa3bde Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Thu, 3 Dec 2015 15:09:23 +0000 Subject: [PATCH 3/4] `weave launch-proxy` accepts --no-multicast-route --- prog/weaveexec/Dockerfile | 2 ++ prog/weaveproxy/main.go | 1 + proxy/create_container_interceptor.go | 10 ++++++++-- proxy/proxy.go | 24 ++++++++++++++++-------- proxy/start_container_interceptor.go | 10 ++++++++-- weave | 1 + 6 files changed, 36 insertions(+), 12 deletions(-) diff --git a/prog/weaveexec/Dockerfile b/prog/weaveexec/Dockerfile index 2b44f344..f700f20a 100644 --- a/prog/weaveexec/Dockerfile +++ b/prog/weaveexec/Dockerfile @@ -6,6 +6,7 @@ LABEL works.weave.role=system WORKDIR /home/weave VOLUME /w VOLUME /w-noop +VOLUME /w-nomcast ENTRYPOINT ["/home/weave/sigproxy", "/home/weave/weave"] RUN apk add --update \ @@ -22,4 +23,5 @@ ADD ./weave ./sigproxy ./weaveproxy ./symlink /home/weave/ ADD ./netcheck ./docker_tls_args /usr/bin/ ADD ./weavewait /w/w ADD ./weavewait_noop /w-noop/w +ADD ./weavewait_nomcast /w-nomcast/w ADD ./docker.tgz / diff --git a/prog/weaveproxy/main.go b/prog/weaveproxy/main.go index 9db07cd5..6de9a8b4 100644 --- a/prog/weaveproxy/main.go +++ b/prog/weaveproxy/main.go @@ -40,6 +40,7 @@ func main() { mflag.BoolVar(&c.TLSConfig.Verify, []string{"#tlsverify", "-tlsverify"}, false, "Use TLS and verify the remote") mflag.BoolVar(&c.WithDNS, []string{"-with-dns", "w"}, false, "instruct created containers to always use weaveDNS as their nameserver") mflag.BoolVar(&c.WithoutDNS, []string{"-without-dns"}, false, "instruct created containers to never use weaveDNS as their nameserver") + mflag.BoolVar(&c.NoMulticastRoute, []string{"-no-multicast-route"}, false, "do not add a multicast route via the weave interface when attaching containers") mflag.Parse() if justVersion { diff --git a/proxy/create_container_interceptor.go b/proxy/create_container_interceptor.go index 7f4bc84e..b13d16f3 100644 --- a/proxy/create_container_interceptor.go +++ b/proxy/create_container_interceptor.go @@ -53,8 +53,14 @@ func (i *createContainerInterceptor) InterceptRequest(r *http.Request) error { Log.Infof("Leaving container alone because %s", err) } else { Log.Infof("Creating container with WEAVE_CIDR \"%s\"", strings.Join(cidrs, " ")) - if err := addVolume(hostConfig, i.proxy.weaveWaitVolume, "/w", "ro"); err != nil { - return err + if i.proxy.NoMulticastRoute { + if err := addVolume(hostConfig, i.proxy.weaveWaitNomcastVolume, "/w", "ro"); err != nil { + return err + } + } else { + if err := addVolume(hostConfig, i.proxy.weaveWaitVolume, "/w", "ro"); err != nil { + return err + } } if err := i.setWeaveWaitEntrypoint(container); err != nil { return err diff --git a/proxy/proxy.go b/proxy/proxy.go index bf14cb76..9c8b15f7 100644 --- a/proxy/proxy.go +++ b/proxy/proxy.go @@ -60,6 +60,7 @@ type Config struct { Version string WithDNS bool WithoutDNS bool + NoMulticastRoute bool } type wait struct { @@ -71,13 +72,14 @@ type wait struct { type Proxy struct { sync.Mutex Config - client *docker.Client - dockerBridgeIP string - hostnameMatchRegexp *regexp.Regexp - weaveWaitVolume string - weaveWaitNoopVolume string - normalisedAddrs []string - waiters map[*http.Request]*wait + client *docker.Client + dockerBridgeIP string + hostnameMatchRegexp *regexp.Regexp + weaveWaitVolume string + weaveWaitNoopVolume string + weaveWaitNomcastVolume string + normalisedAddrs []string + waiters map[*http.Request]*wait } func NewProxy(c Config) (*Proxy, error) { @@ -146,7 +148,10 @@ func (proxy *Proxy) findWeaveWaitVolumes() error { if proxy.weaveWaitVolume, err = proxy.findVolume("/w"); err != nil { return err } - proxy.weaveWaitNoopVolume, err = proxy.findVolume("/w-noop") + if proxy.weaveWaitNoopVolume, err = proxy.findVolume("/w-noop"); err != nil { + return err + } + proxy.weaveWaitNomcastVolume, err = proxy.findVolume("/w-nomcast") return err } @@ -430,6 +435,9 @@ func (proxy *Proxy) attach(container *docker.Container, orDie bool) error { } } } + if proxy.NoMulticastRoute { + args = append(args, "--no-multicast-route") + } if orDie { args = append(args, "--or-die") } diff --git a/proxy/start_container_interceptor.go b/proxy/start_container_interceptor.go index 6e68059e..678fbacf 100644 --- a/proxy/start_container_interceptor.go +++ b/proxy/start_container_interceptor.go @@ -41,8 +41,14 @@ func (i *startContainerInterceptor) InterceptRequest(r *http.Request) error { return err } } else { - if err := addVolume(hostConfig, i.proxy.weaveWaitVolume, "/w", "ro"); err != nil { - return err + if i.proxy.NoMulticastRoute { + if err := addVolume(hostConfig, i.proxy.weaveWaitNomcastVolume, "/w", "ro"); err != nil { + return err + } + } else { + if err := addVolume(hostConfig, i.proxy.weaveWaitVolume, "/w", "ro"); err != nil { + return err + } } if dnsDomain := i.proxy.getDNSDomain(); dnsDomain != "" { if err := i.proxy.setWeaveDNS(hostConfig, container.Config.Hostname, dnsDomain); err != nil { diff --git a/weave b/weave index cc4beb64..c9e7399d 100755 --- a/weave +++ b/weave @@ -48,6 +48,7 @@ weave launch-router [--password ] [--nickname ] [--no-discovery] [--init-peer-count ] ... weave launch-proxy [-H ] [--with-dns | --without-dns] [--no-default-ipalloc] [--no-rewrite-hosts] + [--no-multicast-route] [--hostname-from-label ] [--hostname-match ] [--hostname-replacement ] From 96f69583e7f6056136945589c37c98565a9a7539 Mon Sep 17 00:00:00 2001 From: Adam Harrison Date: Thu, 3 Dec 2015 15:32:03 +0000 Subject: [PATCH 4/4] Smoke test --no-multicast-route --- test/195_no_multicast_route_1_test.sh | 30 +++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100755 test/195_no_multicast_route_1_test.sh diff --git a/test/195_no_multicast_route_1_test.sh b/test/195_no_multicast_route_1_test.sh new file mode 100755 index 00000000..1aedd257 --- /dev/null +++ b/test/195_no_multicast_route_1_test.sh @@ -0,0 +1,30 @@ +#! /bin/bash + +. ./config.sh + +show_multicast_route_on() { + exec_on $1 $2 ip route show 224.0.0.0/4 +} + +start_suite "--no-multicast-route operation" + +# Ensure containers run either way have no multicast route +weave_on $HOST1 launch-router +weave_on $HOST1 launch-proxy --no-multicast-route + +start_container $HOST1 --no-multicast-route --name c1 +proxy_start_container $HOST1 --name c2 + +assert "show_multicast_route_on $HOST1 c1" +assert "show_multicast_route_on $HOST1 c2" + +# Ensure current proxy options are obeyed on container start +docker_on $HOST1 stop c2 +weave_on $HOST1 stop-proxy +weave_on $HOST1 launch-proxy + +proxy docker_on $HOST1 start c2 + +assert "show_multicast_route_on $HOST1 c2" "224.0.0.0/4 dev ethwe " + +end_suite