reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move expect-npc setup from weave script to Go code

Browse Source
This commit is contained in:
Bryan Boreham committed 2017-04-17 19:41:47 +00:00
1 parent a8eb7966b6
commit dd232775e6
3 files changed
+32 -39
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

net/bridge.go
+28 -5
View File
@@ -173,6 +173,7 @@ type BridgeConfig struct {
DatapathName string
NoFastdp bool
NoBridgedFastdp bool
ExpectNPC bool
MTU int
Mac string
Port int
@@ -349,14 +350,36 @@ func configureIPTables(config *BridgeConfig) error {
}
}
// Work around the situation where there are no rules allowing traffic
// across our bridge. E.g. ufw
if err = ipt.AppendUnique("filter", "FORWARD", "-i", config.WeaveBridgeName, "-o", config.WeaveBridgeName, "-j", "ACCEPT"); err != nil {
return err
if config.ExpectNPC {
// Steer traffic via the NPC
ipt.NewChain("filter", "WEAVE-NPC") // ignoring errors such as 'chain already exists'
if err = ipt.AppendUnique("filter", "FORWARD", "-o", config.WeaveBridgeName, "-j", "WEAVE-NPC"); err != nil {
return err
}
if err = ipt.AppendUnique("filter", "FORWARD", "-o", config.WeaveBridgeName, "-m", "state", "--state", "NEW", "-j", "NFLOG", "--nflog-group", "86"); err != nil {
return err
}
if err = ipt.AppendUnique("filter", "FORWARD", "-o", config.WeaveBridgeName, "-j", "DROP"); err != nil {
return err
}
} else {
// Work around the situation where there are no rules allowing traffic
// across our bridge. E.g. ufw
if err = ipt.AppendUnique("filter", "FORWARD", "-i", config.WeaveBridgeName, "-o", config.WeaveBridgeName, "-j", "ACCEPT"); err != nil {
return err
}
// Forward from weave to the rest of the world
if err = ipt.AppendUnique("filter", "FORWARD", "-i", config.WeaveBridgeName, "!", "-o", config.WeaveBridgeName, "-j", "ACCEPT"); err != nil {
return err
}
// and allow replies back
if err = ipt.AppendUnique("filter", "FORWARD", "-o", config.WeaveBridgeName, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT"); err != nil {
return err
}
}
// create a chain for masquerading
ipt.NewChain("nat", "WEAVE")
ipt.NewChain("nat", "WEAVE") // ignoring errors such as 'chain already exists'
if err = ipt.AppendUnique("nat", "POSTROUTING", "-j", "WEAVE"); err != nil {
return err
}
prog/weaveutil/bridge.go
+3 -2
View File
@@ -17,8 +17,8 @@ func detectBridgeType(args []string) error {
}
func createBridge(args []string) error {
if len(args) != 8 {
cmdUsage("create-bridge", "<docker-bridge-name> <weave-bridge-name> <datapath-name> <mtu> <port> <mac> <no-fastdp> <no-bridged-fastdp>")
if len(args) != 9 {
cmdUsage("create-bridge", "<docker-bridge-name> <weave-bridge-name> <datapath-name> <mtu> <port> <mac> <no-fastdp> <no-bridged-fastdp> <expect-npc>")
}
mtu, err := strconv.Atoi(args[3])
@@ -38,6 +38,7 @@ func createBridge(args []string) error {
Mac: args[5],
NoFastdp: args[6] != "",
NoBridgedFastdp: args[7] != "",
ExpectNPC: args[8] == "--expect-npc",
}
bridgeType, err := weavenet.CreateBridge(&config)
fmt.Println(bridgeType.String())
weave
+1 -32
View File
@@ -326,21 +326,6 @@ run_iptables() {
iptables $IPTABLES_W "$@"
}
# Add a rule to iptables, if it doesn't exist already
add_iptables_rule() {
IPTABLES_TABLE="$1"
shift 1
if ! run_iptables -t $IPTABLES_TABLE -C "$@" >/dev/null 2>&1 ; then
## Loop until we get an exit code other than "temporarily unavailable"
while true ; do
run_iptables -t $IPTABLES_TABLE -A "$@" >/dev/null && return 0
if [ $? != 4 ] ; then
return 1
fi
done
fi
}
# Insert a rule in iptables, if it doesn't exist already
insert_iptables_rule() {
IPTABLES_TABLE="$1"
@@ -445,26 +430,10 @@ try_create_bridge() {
WEAVEDB_DIR_PATH="$HOST_ROOT/$(docker inspect -f '{{with index .Mounts 0}}{{.Source}}{{end}}' $DB_CONTAINER_NAME 2>/dev/null)"
fi
MAC=$(util_op unique-id "$WEAVEDB_DIR_PATH/weave" "$HOST_ROOT")
BRIDGE_TYPE=$(util_op create-bridge "$DOCKER_BRIDGE" "$BRIDGE" "$DATAPATH" "$WEAVE_MTU" "$PORT" "$MAC" "$WEAVE_NO_FASTDP" "$WEAVE_NO_BRIDGED_FASTDP")
BRIDGE_TYPE=$(util_op create-bridge "$DOCKER_BRIDGE" "$BRIDGE" "$DATAPATH" "$WEAVE_MTU" "$PORT" "$MAC" "$WEAVE_NO_FASTDP" "$WEAVE_NO_BRIDGED_FASTDP" "$1")
# Set some variables that are expected by code that comes later
[ "$BRIDGE_TYPE" != "fastdp" ] || DATAPATH="$BRIDGE"
MTU=${WEAVE_MTU:-$(cat /sys/class/net/$BRIDGE/mtu)}
if [ "$1" = "--expect-npc" ] ; then # matches usage in weave-kube launch.sh
# Steer traffic via the NPC
run_iptables -N WEAVE-NPC >/dev/null 2>&1 || true
add_iptables_rule filter FORWARD -o $BRIDGE -j WEAVE-NPC
add_iptables_rule filter FORWARD -o $BRIDGE -m state --state NEW -j NFLOG --nflog-group 86
add_iptables_rule filter FORWARD -o $BRIDGE -j DROP
else
# Work around the situation where there are no rules allowing traffic
# across our bridge. E.g. ufw
add_iptables_rule filter FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT
fi
# Forward from weave to the rest of the world
add_iptables_rule filter FORWARD -i $BRIDGE ! -o $BRIDGE -j ACCEPT
# and allow replies back
add_iptables_rule filter FORWARD -o $BRIDGE -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
}
create_bridge() {