From 70dc8b027d5796148166427219fd5c453ebb2de1 Mon Sep 17 00:00:00 2001 From: Alex Chan Date: Thu, 28 May 2015 10:10:16 +0100 Subject: [PATCH 01/19] Minor spelling corrections in docs --- docs/architecture.txt | 10 +++++----- site/building.md | 2 +- site/weavedns.md | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/architecture.txt b/docs/architecture.txt index 4dba5c45..daa56730 100644 --- a/docs/architecture.txt +++ b/docs/architecture.txt @@ -160,7 +160,7 @@ if a node receives a packet that is bigger than the next MTU, it is required to drop the packet and send back an ICMP 3,4 packet which informs the sending node of the next hop MTU (RFC 1191). In theory, these ICMP packets should have all the reverse NAT and so forth -applied, to make it all the way back to the sender. In practise this +applied, to make it all the way back to the sender. In practice, this does often work, but in some cases all ICMP are sometimes blocked, often by idiots who don't understand that ICMP is really the error channel of all network traffic. @@ -187,16 +187,16 @@ If weave determines that fragmentation is reliable then when weave sniffs large packets (i.e. packets larger than the MTU and thus don't have DF set) then weave will encapsulate these packets as necessary and similarly send them out as-is, without DF set, trusting to the -network to do all necessary fragementation and reassembly. +network to do all necessary fragmentation and reassembly. -However, if weave determines that fragementation is not reliable +However, if weave determines that fragmentation is not reliable between any two peers then it will manually fragment larger packets correctly according to the IP spec, and will then send them between weave peers with the DF flag set (i.e. the fragmentation will ensure -that the encapsulatated traffic will not be greater than the PMTU +that the encapsulated traffic will not be greater than the PMTU between weave peers). Because the fragmentation is done according to the IP spec, we don't need to do reassembly ourselves - on the -receiving weave, we jus inject all the fragments and rely on the +receiving weave, we just inject all the fragments and rely on the stack to do reassembly. Sometimes PMTU discovery doesn't work as ICMP packets sometimes get diff --git a/site/building.md b/site/building.md index 5b8eeede..5f344a21 100644 --- a/site/building.md +++ b/site/building.md @@ -170,7 +170,7 @@ $ vagrant ssh -c 'make -C src/github.com/weaveworks/weave' ``` you should then find container snapshot tarballs in the top-level -directory. You can use these snapshots with `docker load` agains a +directory. You can use these snapshots with `docker load` against a different host, e.g. ```bash diff --git a/site/weavedns.md b/site/weavedns.md index d3b55d4a..59c97948 100644 --- a/site/weavedns.md +++ b/site/weavedns.md @@ -163,7 +163,7 @@ $ weave launch-dns 10.2.254.1/24 --domain="mycompany.local." The local domain should end with `local.`, since these names are link-local as per [RFC6762](https://tools.ietf.org/html/rfc6762), -(though this is not strictly neccessary). +(though this is not strictly necessary). ## Using weaveDNS without `weave run` From a29831b7fa127173b8dece2f14c0f3d352b6aacf Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Thu, 28 May 2015 13:36:32 +0100 Subject: [PATCH 02/19] expand weavedns example to cover multi-host --- site/weavedns.md | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/site/weavedns.md b/site/weavedns.md index 59c97948..b73d0180 100644 --- a/site/weavedns.md +++ b/site/weavedns.md @@ -52,9 +52,24 @@ not attempt to do load-balancing. Each weaveDNS container started with `launch-dns` needs to be given its own, unique, IP address, in a subnet that is a) common to all weaveDNS containers, b) disjoint from the application subnets, and c) -not in use on any of the hosts. In our example the weaveDNS address is -in subnet 10.2.254.0/24 and the application containers are in -subnet 10.2.1.0/24. +not in use on any of the hosts. + +In our example the weaveDNS address is in subnet 10.2.254.0/24 and the +application containers are in subnet 10.2.1.0/24. So, to launch and +use weaveDNS on a second host we would run: + +```bash +host2$ weave launch $HOST1 +host2$ weave launch-dns 10.2.254.2/24 +host2$ shell2=$(weave run --with-dns 10.2.1.36/24 -ti -h ubuntu2.weave.local ubuntu) +host2$ docker attach $shell2 + +# ping pingme +... +``` + +Notice the different IP address in the 10.2.254.0/24 subnet we gave to +`weave launch-dns`, compared to what we supplied on the first host. WeaveDNS containers can be stopped with `stop-dns`. From 7ccf650e48678436e1f44b49f0d6ea914ba80b36 Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Thu, 28 May 2015 14:48:08 +0100 Subject: [PATCH 03/19] cosmetic --- site/weavedns.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/site/weavedns.md b/site/weavedns.md index b73d0180..8905bc90 100644 --- a/site/weavedns.md +++ b/site/weavedns.md @@ -39,7 +39,7 @@ $ weave run 10.2.1.25/24 -ti -h pingme.weave.local ubuntu $ shell1=$(weave run --with-dns 10.2.1.26/24 -ti -h ubuntu.weave.local ubuntu) $ docker attach $shell1 -# ping pingme +root@ubuntu:/# ping pingme ... ``` @@ -64,7 +64,7 @@ host2$ weave launch-dns 10.2.254.2/24 host2$ shell2=$(weave run --with-dns 10.2.1.36/24 -ti -h ubuntu2.weave.local ubuntu) host2$ docker attach $shell2 -# ping pingme +root@ubuntu2:/# ping pingme ... ``` From 415b9ead52e70bb2cb7a9feab8d637138bdef033 Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Sun, 31 May 2015 09:03:45 +0100 Subject: [PATCH 04/19] cosmetic --- site/troubleshooting.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site/troubleshooting.md b/site/troubleshooting.md index bca3fa28..2cbc0e07 100644 --- a/site/troubleshooting.md +++ b/site/troubleshooting.md @@ -126,7 +126,7 @@ not currently connected to. Each line contains some information about what went wrong the last time; whether it is attempting to connect or is waiting for a while before connecting again. -There may also be further sections for +There may also be further sections for [IP allocator](ipam.html#troubleshooting) and [weaveDNS](weavedns.html#troubleshooting). From 84c0daa0004e2a18a8ba1e49dfde94698a4f30a3 Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Mon, 1 Jun 2015 11:13:16 +0100 Subject: [PATCH 05/19] remove out-of-date info from ipam docs --- site/ipam.md | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/site/ipam.md b/site/ipam.md index e1ca81b9..836e980f 100644 --- a/site/ipam.md +++ b/site/ipam.md @@ -103,18 +103,8 @@ host3 has caught fire, we can go to one of the other hosts and run: Weave will take all the IP address ranges owned by host3 and transfer them to be owned by host1. The name "host3" is resolved via the 'nickname' feature of weave, which defaults to the local host -name. You can see the full set of range assignments in the output from -`weave status`, which will show the internal hex ID and nickname in -brackets, like this: - - Ring [10.2.1.1, 10.2.1.255) - 10.2.1.1 -> 96:e9:e2:2e:2d:bc (host1) (version: 3, free: 126) - 10.2.1.128 -> ea:84:25:9b:31:2e (host2) (version: 2, free: 64) - 10.2.1.192 -> ea:6c:21:09:cf:f0 (host3) (version: 1, free: 62) - -So, in our example, we could equivalently do: - - host1$ weave rmpeer ea:6c:21:09:cf:f0 +name. Alternatively, one can supply a peer name as shown in `weave +status`. ## Troubleshooting From 4f86a20824b46973ee21f9a96d89c7e8282a357d Mon Sep 17 00:00:00 2001 From: Paul Bellamy Date: Mon, 1 Jun 2015 14:26:33 +0100 Subject: [PATCH 06/19] Add release 0.11.1 to CHANGELOG --- CHANGELOG.md | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6b3c77ea..849eef43 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,45 @@ +## Release 0.11.1 + +This is a bug fix release, addressing the following issues: + +- The IP Allocator could crash in some relatively rare + circumstances. #782/#783. +- When the proxy failed to attach a container to the weave network, + there was no failure indication and descriptive error anywhere, and + the application process would still start. Now an error is reported + to the client (i.e. typically the Docker CLI), recorded in the proxy + logs, and the container is terminated. #788/#799. +- `weave launch-proxy --with-ipam` failed to configure the entrypoint + and DNS unless a (possibly blank) `WEAVE_CIDR` was + specified. Affected containers could start the application process + w/o the weave network interface being available, and without + functioning name resolution for the weaveDNS domain. + #744/#747/#751/#752 +- The `weave status` output for the IP Allocator was misleadingly + conveying a sense of brokenness when no IP allocation requests had + been made yet. #787/#801 +- When invoking `weave launch-proxy` twice, the second invocation + would output a blank line and terminate with a success exit + status. Now it reports that the proxy is already running and exits + with a non-zero status. #767/#780 +- `weave launch-proxy` was not respecting WEAVEPROXY_DOCKER_ARGS, so + any user-supplied custom configuration for the weaveproxy container + was ignored. #755/#780 +- The proxy was not intercepting API calls to the unversioned (1.0) + Docker Remote API. Hence none of the weave functionality was + available when Docker clients were using that version of the + API. #770/#774/#777,#809 +- The proxy would crash when certain elements of the + `/containers/create` JSON were missing. We are not aware of any + Docker clients doing this, but it's been fixed regardless. #778/#777 + +More details in the [change +log](https://github.com/weaveworks/weave/issues?q=milestone%3A0.11.1). + +*NB: This release does not change the weave protocol version. +Therefore, when upgrading an existing 0.11 installation incrementally, +connectivity between peers will be retained.* + ## Release 0.11.0 **Highlights**: From bee5c300db21638008da090362cca18ecf945619 Mon Sep 17 00:00:00 2001 From: Fintan Ryan Date: Fri, 29 May 2015 15:16:50 +0100 Subject: [PATCH 07/19] Docs look and feel update --- site/Gemfile.lock | 70 +++++ site/_config.yml | 3 + site/_includes/footer.html | 58 ++++ site/_includes/header-navbaronly.html | 23 ++ site/_includes/tracking.html | 12 + site/_layouts/default.html | 59 ++-- site/images/blacktocat.png | Bin 1428 -> 0 bytes site/javascripts/main.js | 1 - site/stylesheets/pygment_trac.css | 70 ----- site/stylesheets/stylesheet.css | 431 -------------------------- 10 files changed, 196 insertions(+), 531 deletions(-) create mode 100644 site/Gemfile.lock create mode 100644 site/_includes/footer.html create mode 100644 site/_includes/header-navbaronly.html create mode 100644 site/_includes/tracking.html delete mode 100644 site/images/blacktocat.png delete mode 100644 site/javascripts/main.js delete mode 100644 site/stylesheets/pygment_trac.css delete mode 100644 site/stylesheets/stylesheet.css diff --git a/site/Gemfile.lock b/site/Gemfile.lock new file mode 100644 index 00000000..631ca428 --- /dev/null +++ b/site/Gemfile.lock @@ -0,0 +1,70 @@ +GEM + remote: https://rubygems.org/ + specs: + blankslate (2.1.2.4) + celluloid (0.16.0) + timers (~> 4.0.0) + classifier-reborn (2.0.3) + fast-stemmer (~> 1.0) + coffee-script (2.3.0) + coffee-script-source + execjs + coffee-script-source (1.9.1) + colorator (0.1) + execjs (2.3.0) + fast-stemmer (1.0.2) + ffi (1.9.6) + hitimes (1.2.2) + jekyll (2.5.3) + classifier-reborn (~> 2.0) + colorator (~> 0.1) + jekyll-coffeescript (~> 1.0) + jekyll-gist (~> 1.0) + jekyll-paginate (~> 1.0) + jekyll-sass-converter (~> 1.0) + jekyll-watch (~> 1.1) + kramdown (~> 1.3) + liquid (~> 2.6.1) + mercenary (~> 0.3.3) + pygments.rb (~> 0.6.0) + redcarpet (~> 3.1) + safe_yaml (~> 1.0) + toml (~> 0.1.0) + jekyll-coffeescript (1.0.1) + coffee-script (~> 2.2) + jekyll-gist (1.1.0) + jekyll-paginate (1.1.0) + jekyll-sass-converter (1.3.0) + sass (~> 3.2) + jekyll-watch (1.2.1) + listen (~> 2.7) + kramdown (1.5.0) + liquid (2.6.2) + listen (2.8.5) + celluloid (>= 0.15.2) + rb-fsevent (>= 0.9.3) + rb-inotify (>= 0.9) + mercenary (0.3.5) + parslet (1.5.0) + blankslate (~> 2.0) + posix-spawn (0.3.10) + pygments.rb (0.6.2) + posix-spawn (~> 0.3.6) + yajl-ruby (~> 1.2.0) + rb-fsevent (0.9.4) + rb-inotify (0.9.5) + ffi (>= 0.5.0) + redcarpet (3.2.2) + safe_yaml (1.0.4) + sass (3.4.13) + timers (4.0.1) + hitimes + toml (0.1.2) + parslet (~> 1.5.0) + yajl-ruby (1.2.1) + +PLATFORMS + ruby + +DEPENDENCIES + jekyll diff --git a/site/_config.yml b/site/_config.yml index 1d373602..50f2974d 100644 --- a/site/_config.yml +++ b/site/_config.yml @@ -8,3 +8,6 @@ exclude: - 'Gemfile.lock' - 'params.json' - 'build-and-publish.sh' + +google: + analytics: "UA-57286487-1" diff --git a/site/_includes/footer.html b/site/_includes/footer.html new file mode 100644 index 00000000..ad664672 --- /dev/null +++ b/site/_includes/footer.html @@ -0,0 +1,58 @@ + + +
+
+
+ Company
+ About Weave
+ + + Blog
+
+ Community
+ Partners
+ Code
+
+
+ Documentation
+ Docs
+ Getting Started Guides
+ Help and Support
+ Blog
+
+
+ Get in Touch
+ help@weave.works
+ Twitter
+ Github
+ Linkedin
+ GooglePlus
+
+
+
+
+
+
+

© Weaveworks 2014 ‐ 2015

+
+
+
+ + + + + diff --git a/site/_includes/header-navbaronly.html b/site/_includes/header-navbaronly.html new file mode 100644 index 00000000..cd9b4c60 --- /dev/null +++ b/site/_includes/header-navbaronly.html @@ -0,0 +1,23 @@ +
+ +
diff --git a/site/_includes/tracking.html b/site/_includes/tracking.html new file mode 100644 index 00000000..eaeac412 --- /dev/null +++ b/site/_includes/tracking.html @@ -0,0 +1,12 @@ +{% if site.google.analytics %} + +{% endif %} diff --git a/site/_layouts/default.html b/site/_layouts/default.html index 67ee8d50..2071fd1b 100644 --- a/site/_layouts/default.html +++ b/site/_layouts/default.html @@ -1,43 +1,44 @@ - - - - weave {% if page.title %} | {{ page.title }} {% endif %} - + + + + + + + + + + + + + + + + + + {% include tracking.html %} + + - -
-
- View on GitHub + {% include header-navbaronly.html %} -

weave

-

The Docker Network

- -
-
- - -
-
+
+
{{ content }} -
+ +

+ {% include footer.html %} - -

- - - - + diff --git a/site/images/blacktocat.png b/site/images/blacktocat.png deleted file mode 100644 index 6e264fe57a2e35a2855405ac7d4102c3f6ddcdae..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1428 zcmeAS@N?(olHy`uVBq!ia0vp^av;pX1|+Qw)-3{3k|nMYCBgY=CFO}lsSJ)O`AMk? zp1FzXsX?iUDV2pMQ*9U+n3Xa^B1$5BeXNr6bM+EIYV;~{3xK*A7;Nk-3KEmEQ%e+* zQqwc@Y?a>c-mj#PnPRIHZt82`Ti~3Uk?B!Ylp0*+7m{3+ootz+WN)WnQ(*-(AUCxn zQK2F?C$HG5!d3}vt`(3C64qBz04piUwpD^SD#ABF!8yMuRl!uxKsVXI%s|1+P|wiV z#N6CmN5ROz&_Lh7NZ-&%*U;R`*vQJjKmiJrfVLH-q*(>IxIyg#@@$ndN=gc>^!3Zj z%k|2Q_413-^$jg8EkR}&8R-I5=oVMzl_XZ^<`pZ$OmImpPAEg{v+u2}(t{7puX=A(aKG z`a!A1`K3k4z=%sz23b{L-^Aq1JP;qO z-q+X4Gq1QLF)umQ)5TT^Xo6m5W{Q=eg`=5?o13Glvx}*rp{t>#shg3DvyriZv5}jZ ztD`wguSMv>2~2MaLa!4}y`ZF!TL84#CABECEH%ZgC_h&L>}9J=EN(GzcCm0X zaRr%YgxxI=y(w7S0@dq`Q?EYIG5Vm0MT%&c5HR(CnDAr^T6f1avxRvmvnsN+?-j}Z~1)Zr#rqzrt`edmo44*B<0=C4>mrxHF6$p zVws~UocMfeI`gB8pYMLYTzA87`NOI2w2B*JM5L`^AkN4AFQu&S+6ULTPjv;vzl4& z-eaK_F|D4~l3hzBSF~icNT@MID=v+_X`vpuvf=8+S(|^vlRdHe0<)v-^wiVR3w=TQ)uFA9F z>vmq Date: Mon, 1 Jun 2015 13:23:23 +0100 Subject: [PATCH 08/19] [docs] re-ordering proxy doc sections --- site/proxy.md | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/site/proxy.md b/site/proxy.md index 27bca6c8..a7e06981 100644 --- a/site/proxy.md +++ b/site/proxy.md @@ -56,21 +56,6 @@ Multiple IP addresses and networks can be supplied in the `WEAVE_CIDR` variable by space-separating them, as in `WEAVE_CIDR="10.2.1.1/24 10.2.2.1/24"`. -## Usage with WeaveDNS - -Containers started via the proxy can be automatically configured to -use WeaveDNS for name resolution. To accomplish this we need to launch -the proxy with the `--with-dns` option - - host1$ weave launch - host1$ weave launch-dns 10.2.254.1/24 - host1$ weave launch-proxy --with-dns - -With this done, any containers launched through the proxy will use -weaveDNS for name resolution. WeaveDNS is used in addition to any dns -servers specified via the `--dns` option. More details on weaveDNS can -be found in the [weaveDNS documentation](weavedns.html). - ## Usage with IPAM To automatically assign a unique IP address to a container, weave must @@ -94,6 +79,21 @@ option. For example: More details on IPAM can be found in the [IPAM documentation](ipam.html). +## Usage with WeaveDNS + +Containers started via the proxy can be automatically configured to +use WeaveDNS for name resolution. To accomplish this we need to launch +the proxy with the `--with-dns` option + + host1$ weave launch + host1$ weave launch-dns 10.2.254.1/24 + host1$ weave launch-proxy --with-dns + +With this done, any containers launched through the proxy will use +weaveDNS for name resolution. WeaveDNS is used in addition to any dns +servers specified via the `--dns` option. More details on weaveDNS can +be found in the [weaveDNS documentation](weavedns.html). + ## Limitations * The proxy does not currently support TLS. From c917b261f7aef801972433a268a0ee9abce8b157 Mon Sep 17 00:00:00 2001 From: Paul Bellamy Date: Wed, 3 Jun 2015 15:59:40 +0100 Subject: [PATCH 09/19] Capitalizing and standardizing titles of pages in the docs. Also re-wording to make them match the page title. --- site/boot2docker.md | 2 +- site/building.md | 2 ++ site/features.md | 4 ++-- site/how-it-works.md | 4 ++-- site/index.md | 2 +- site/proxy.md | 2 +- site/systemd.md | 4 +++- site/troubleshooting.md | 2 +- site/weavedns-design.md | 4 ++-- site/weavedns.md | 2 +- 10 files changed, 16 insertions(+), 12 deletions(-) diff --git a/site/boot2docker.md b/site/boot2docker.md index ac10553b..9835cb48 100644 --- a/site/boot2docker.md +++ b/site/boot2docker.md @@ -3,7 +3,7 @@ title: Installing Weave with Boot2Docker layout: default --- -## Installation with Boot2Docker +# Installing Weave with Boot2Docker If you are running Docker inside the Boot2Docker VM, e.g. because you are on a Mac, then the following changes are required to the weave diff --git a/site/building.md b/site/building.md index 5f344a21..4a4704aa 100644 --- a/site/building.md +++ b/site/building.md @@ -3,6 +3,8 @@ title: Building Weave layout: default --- +# Building Weave + You only need to build weave if you want to work on the weave codebase (or you just enjoy building software). diff --git a/site/features.md b/site/features.md index 9645d19e..84ebbf7f 100644 --- a/site/features.md +++ b/site/features.md @@ -1,9 +1,9 @@ --- -title: Weave features +title: Weave Features layout: default --- -# Weave features +# Weave Features Weave has a few more features beyond those illustrated by the [basic example](https://github.com/weaveworks/weave#example): diff --git a/site/how-it-works.md b/site/how-it-works.md index 704f92c2..c707dd6c 100644 --- a/site/how-it-works.md +++ b/site/how-it-works.md @@ -1,9 +1,9 @@ --- -title: How Weave works +title: How Weave Works layout: default --- -## How does it work? +# How Weave Works * [Overview](#overview) * [Encapsulation](#encapsulation) diff --git a/site/index.md b/site/index.md index 57264417..2b23f795 100644 --- a/site/index.md +++ b/site/index.md @@ -3,7 +3,7 @@ title: weave, the Docker network layout: default --- -# weave documentation +# Weave Documentation * [Introduction, Installation and Example](https://github.com/weaveworks/weave#readme) * [Getting Started Guides](http://weave.works/guides/) diff --git a/site/proxy.md b/site/proxy.md index a7e06981..7cc16989 100644 --- a/site/proxy.md +++ b/site/proxy.md @@ -3,7 +3,7 @@ title: Weave Proxy layout: default --- -# Proxy +# Weave Proxy Instead of the `weave` command-line utility, you may prefer to use the standard [Docker command-line diff --git a/site/systemd.md b/site/systemd.md index 95d4c758..85e8806c 100644 --- a/site/systemd.md +++ b/site/systemd.md @@ -1,8 +1,10 @@ --- -title: Using Weave with systemd +title: Using Weave with Systemd layout: default --- +# Using Weave with Systemd + Having installed `weave` as per [readme][], you might wish to configure the init daemon to start it on boot. Most recent Linux distribution releases are shipping with [systemd][]. The information below should provide you with some diff --git a/site/troubleshooting.md b/site/troubleshooting.md index 2cbc0e07..524312db 100644 --- a/site/troubleshooting.md +++ b/site/troubleshooting.md @@ -3,7 +3,7 @@ title: Troubleshooting Weave layout: default --- -## Troubleshooting +# Troubleshooting Weave Check what version of weave you are running with diff --git a/site/weavedns-design.md b/site/weavedns-design.md index 5c09afc3..fe70df18 100644 --- a/site/weavedns-design.md +++ b/site/weavedns-design.md @@ -1,9 +1,9 @@ --- -title: WeaveDNS Design Notes +title: WeaveDNS (service discovery) Design Notes layout: default --- -# Weave DNS (service discovery) design +# WeaveDNS (service discovery) Design Notes The model is that each host has a service that is notified of hostnames and weave addresses for containers on the host. It binds to diff --git a/site/weavedns.md b/site/weavedns.md index 8905bc90..eaa8cc1e 100644 --- a/site/weavedns.md +++ b/site/weavedns.md @@ -3,7 +3,7 @@ title: Automatic Discovery with WeaveDNS layout: default --- -# Weave DNS server +# Automatic Discovery with WeaveDNS The Weave DNS server answers name queries in a Weave network. This provides a simple way for containers to find each other: just give From 441e58e42211b26ff7e12d96d3bd066741ad81af Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Wed, 3 Jun 2015 18:10:38 +0100 Subject: [PATCH 10/19] excise reference to crypto implementation from main docs It's too scary for the uninitiated. --- site/features.md | 5 +---- site/systemd.md | 2 +- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/site/features.md b/site/features.md index 84ebbf7f..0af34526 100644 --- a/site/features.md +++ b/site/features.md @@ -157,10 +157,7 @@ or _NOTE: The command line option takes precedence over the environment variable._ -The same password must be specified for all weave peers; it is a -component in the creation of ephemeral session keys for connections -between peers. See the [crypto documentation](how-it-works.html#crypto) -for more details. +The same password must be specified for all weave peers. ### Host network integration diff --git a/site/systemd.md b/site/systemd.md index 85e8806c..7f4bda07 100644 --- a/site/systemd.md +++ b/site/systemd.md @@ -69,4 +69,4 @@ context with the commands shown below. You will need to have the [readme]: https://github.com/weaveworks/weave/blob/master/README.md#installation [connect]: features.html#dynamic-topologies [systemd]: http://www.freedesktop.org/wiki/Software/systemd/ -[encryption]: how-it-works.html#crypto +[encryption]: features.html#security From 62ee70f388e2e66bf340fa22b93237c8814c9840 Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Wed, 3 Jun 2015 17:09:27 +0100 Subject: [PATCH 11/19] recommend strong password Closes #641. --- site/features.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/site/features.md b/site/features.md index 0af34526..29ac03bb 100644 --- a/site/features.md +++ b/site/features.md @@ -157,6 +157,13 @@ or _NOTE: The command line option takes precedence over the environment variable._ +The password needs to be reasonably strong to guard against brute +forcing by an attacker attempting to establish connections to a +peer. We recommend at least 50 bits of entropy. An easy way to +generate a random password which satsifies this requirement is + + < /dev/urandom tr -dc A-Za-z0-9 | head -c9 ; echo + The same password must be specified for all weave peers. ### Host network integration From 6bf0feeffc1e71bbbc669286d247a9549789dc17 Mon Sep 17 00:00:00 2001 From: David Kaltschmidt Date: Fri, 5 Jun 2015 17:36:30 +0200 Subject: [PATCH 12/19] Wrapping content area to allow for sticky footer --- site/_includes/footer.html | 5 +++-- site/_includes/header-navbaronly.html | 2 +- site/_layouts/default.html | 16 +++++++++------- 3 files changed, 13 insertions(+), 10 deletions(-) diff --git a/site/_includes/footer.html b/site/_includes/footer.html index ad664672..67af71c0 100644 --- a/site/_includes/footer.html +++ b/site/_includes/footer.html @@ -1,6 +1,6 @@ - -
+
+
Company
@@ -37,6 +37,7 @@
+
diff --git a/site/_layouts/default.html b/site/_layouts/default.html index 2071fd1b..7ea03b94 100644 --- a/site/_layouts/default.html +++ b/site/_layouts/default.html @@ -32,13 +32,15 @@ {% include header-navbaronly.html %} -
-
- {{ content }} -
-
-

- {% include footer.html %} +

+
+
+ {{ content }} +
+
+
+ + {% include footer.html %} From 106f1c443421229630d11eb412e527f053337c12 Mon Sep 17 00:00:00 2001 From: Ilya Dmitrichenko Date: Fri, 5 Jun 2015 13:11:17 +0100 Subject: [PATCH 13/19] Respect `DOCKER_CLIENT_ARGS` in `weave run` (close #855) --- weave | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/weave b/weave index dfff47ec..32d896c7 100755 --- a/weave +++ b/weave @@ -142,7 +142,7 @@ if [ "$1" = "run" ]; then fi collect_cidr_args "$@" shift $CIDR_COUNT - CONTAINER=$(docker run $DNS_ARGS -d "$@") + CONTAINER=$(docker $DOCKER_CLIENT_ARGS run $DNS_ARGS -d "$@") exec_remote attach $CIDR_ARGS $CONTAINER echo $CONTAINER exit 0 From 5f4756aa809f1ab7df596c0357c08ef13c1c2c0a Mon Sep 17 00:00:00 2001 From: Alvaro Saurin Date: Thu, 4 Jun 2015 13:32:53 +0200 Subject: [PATCH 14/19] Do not overwrite negLocal entries in the cache Unit tests --- nameserver/cache.go | 22 ++++++++++++++++------ nameserver/cache_test.go | 24 ++++++++++++++++++------ 2 files changed, 34 insertions(+), 12 deletions(-) diff --git a/nameserver/cache.go b/nameserver/cache.go index 644814f0..30937375 100644 --- a/nameserver/cache.go +++ b/nameserver/cache.go @@ -5,13 +5,14 @@ import ( "container/heap" "errors" "fmt" - "github.com/benbjohnson/clock" - "github.com/miekg/dns" - . "github.com/weaveworks/weave/common" "math" "math/rand" "sync" "time" + + "github.com/benbjohnson/clock" + "github.com/miekg/dns" + . "github.com/weaveworks/weave/common" ) var ( @@ -145,9 +146,12 @@ func (e *cacheEntry) setReply(reply *dns.Msg, ttl int, flags uint8, now time.Tim prevValidUntil = e.validUntil } - e.Status = stResolved - e.Flags = flags - e.putTime = now + // make sure we do not overwrite noLocalReplies entries + if flags&CacheNoLocalReplies != 0 { + if e.Flags&CacheNoLocalReplies != 0 { + return false + } + } if ttl != nullTTL { e.validUntil = now.Add(time.Second * time.Duration(ttl)) @@ -161,8 +165,14 @@ func (e *cacheEntry) setReply(reply *dns.Msg, ttl int, flags uint8, now time.Tim } } e.validUntil = now.Add(time.Second * time.Duration(minTTL)) + } else { + Warning.Printf("[cache] no valid TTL could be calculated") } + e.Status = stResolved + e.Flags = flags + e.putTime = now + if reply != nil { e.reply = *reply e.ReplyLen = reply.Len() diff --git a/nameserver/cache_test.go b/nameserver/cache_test.go index b53d7529..9e4c5584 100644 --- a/nameserver/cache_test.go +++ b/nameserver/cache_test.go @@ -2,13 +2,14 @@ package nameserver import ( "fmt" + "net" + "testing" + "time" + "github.com/benbjohnson/clock" "github.com/miekg/dns" . "github.com/weaveworks/weave/common" wt "github.com/weaveworks/weave/testing" - "net" - "testing" - "time" ) // Check that the cache keeps its intended capacity constant @@ -195,12 +196,23 @@ func TestCacheEntries(t *testing.T) { question3 := &questionMsg3.Question[0] t.Logf("Checking that a entry with CacheNoLocalReplies return an error") - l.Put(questionMsg3, nil, nullTTL, CacheNoLocalReplies) + l.Put(questionMsg3, nil, negLocalTTL, CacheNoLocalReplies) resp, err = l.Get(questionMsg3, minUDPSize) wt.AssertNil(t, resp, "Get() response with CacheNoLocalReplies") - wt.AssertNotNil(t, err, "Get() error with CacheNoLocalReplies") + wt.AssertTrue(t, err == errNoLocalReplies, "Get() error with CacheNoLocalReplies") - clk.Add(time.Second * time.Duration(negLocalTTL+1)) + t.Logf("Checking that more Put's do not make the negative TTL longer") + clk.Add(time.Duration(negLocalTTL/2) * time.Second) + l.Put(questionMsg3, nil, negLocalTTL, CacheNoLocalReplies) + clk.Add(time.Duration(1) * time.Second) + l.Put(questionMsg3, nil, negLocalTTL, CacheNoLocalReplies) + clk.Add(time.Duration(1) * time.Second) + l.Put(questionMsg3, nil, negLocalTTL, CacheNoLocalReplies) + resp, err = l.Get(questionMsg3, minUDPSize) + wt.AssertNil(t, resp, "Get() response with CacheNoLocalReplies") + wt.AssertTrue(t, err == errNoLocalReplies, "Get() error with CacheNoLocalReplies") + + clk.Add(time.Duration(negLocalTTL/2) * time.Second) t.Logf("Checking that we get an expired response after %f seconds", negLocalTTL) resp, err = l.Get(questionMsg3, minUDPSize) wt.AssertNil(t, resp, "expired Get() response with CacheNoLocalReplies") From b7f69c77f162d5903869c6804de0dfe88c3ad708 Mon Sep 17 00:00:00 2001 From: David Kaltschmidt Date: Mon, 8 Jun 2015 13:19:58 +0200 Subject: [PATCH 15/19] [site] header markup needs change after refactor due to change in stylesheet in website repo this change does not affect current deployment, but has to be deployed when the website is deployed again --- site/_includes/header-navbaronly.html | 2 +- site/_layouts/default.html | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/site/_includes/header-navbaronly.html b/site/_includes/header-navbaronly.html index 8f54bb0b..393938ba 100644 --- a/site/_includes/header-navbaronly.html +++ b/site/_includes/header-navbaronly.html @@ -1,4 +1,4 @@ -
+