diff --git a/README.md b/README.md index 9886e4e7..20202d17 100644 --- a/README.md +++ b/README.md @@ -86,9 +86,10 @@ We repeat similar steps on $HOST2... The only difference, apart from the choice of IP address for the application container, is that we tell our weave that it should peer -with the weave on $HOST1 (specified as the IP address or hostname by -which $HOST2 can reach it). NB: if there is a firewall between $HOST1 -and $HOST2, you must open port 6783 for TCP and UDP. +with the weave on $HOST1 (specified as the IP address or hostname, and +optional `:port`, by which $HOST2 can reach it). NB: if there is a +firewall between $HOST1 and $HOST2, you must open port 6783 for TCP +and UDP. Note that we could instead have told the weave on $HOST1 to connect to $HOST2, or told both about each other. Order does not matter here; diff --git a/Vagrantfile b/Vagrantfile index 5ef24b19..c621d770 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -6,7 +6,7 @@ pkgs = "lxc-docker golang ethtool libpcap-dev git mercurial" Vagrant.configure(VAGRANTFILE_API_VERSION) do |config| config.vm.box = "phusion/ubuntu-14.04-amd64" config.vm.box_url = "https://oss-binaries.phusionpassenger.com/vagrant/boxes/latest/ubuntu-14.04-amd64-vbox.box" - + config.vm.network "private_network", ip: vm_ip config.vm.synced_folder "./", "/home/vagrant/src/github.com/zettio/weave" diff --git a/weave b/weave index cc8f9986..a4994867 100755 --- a/weave +++ b/weave @@ -3,7 +3,7 @@ set -e usage() { echo "Usage:" - echo "weave launch [-password ] ..." + echo "weave launch [-password ] ..." echo "weave run ..." echo "weave start " echo "weave attach " @@ -15,7 +15,8 @@ usage() { echo "weave stop" echo "weave reset" echo - echo "where is of the form /" + echo "where is of the form /, and" + echo " is of the form [:]" exit 1 } @@ -33,9 +34,12 @@ command_exists () { [ $# -gt 0 ] || usage IMAGE=zettio/weave +CONTAINER_NAME=weave BRIDGE=weave CONTAINER_IFNAME=ethwe MTU=65535 +PORT=6783 +HTTP_PORT=6784 COMMAND=$1 @@ -51,6 +55,19 @@ check_command_and_run() { fi } +is_cidr() { + # The regexp here is far from precise, but good enough. + echo "$1" | grep -E '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/[0-9]{1,2}$' >/dev/null +} + +validate_cidr() { + if ! is_cidr "$1" ; then + echo "Invalid CIDR: $1" >&2 + echo "CIDR must of be of form /, e.g. 10.0.1.1/24" >&2 + exit 1 + fi +} + run_iptables() { # -w is recent addition to iptables if [ -z "$CHECKED_IPTABLES_W" ] ; then @@ -228,7 +245,7 @@ detach() { return 1 fi - if [ -n "$(ip netns exec $NETNS ip -f inet addr show dev ethwe)" ] ; then + if [ -n "$(ip netns exec $NETNS ip -f inet addr show dev $CONTAINER_IFNAME)" ] ; then # other addresses are left, leave the device alone return 0 fi @@ -239,20 +256,20 @@ detach() { case "$COMMAND" in launch) - case $(docker inspect --format '{{ .State.Running }} {{ .Config.Image }}' weave 2>/dev/null) in + case $(docker inspect --format '{{ .State.Running }} {{ .Config.Image }}' $CONTAINER_NAME 2>/dev/null) in "true $IMAGE") echo "Weave is already running." >&2 exit 1 ;; "false $IMAGE") - docker rm weave >/dev/null + docker rm $CONTAINER_NAME >/dev/null ;; true*) - echo "Found another running container named 'weave'. Aborting." >&2 + echo "Found another running container named '$CONTAINER_NAME'. Aborting." >&2 exit 1 ;; false*) - echo "Found another container named 'weave'. Aborting." >&2 + echo "Found another container named '$CONTAINER_NAME'. Aborting." >&2 exit 1 ;; esac @@ -264,21 +281,21 @@ case "$COMMAND" in # (eth0, wlan0, etc) so the name becomes stable across host # restarts. MACADDR=`cat /sys/class/net/$BRIDGE/address` - # Backward compatibility... Note that the regexp here is far - # from precise, but good enough. - if echo "$1" | grep -E '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/[0-9]{1,2}$' >/dev/null ; then - echo "WARNING: $1 parameter swallowed; 'weave launch' no longer takes a CIDR as the first parameter" >&2 + # backward compatibility... + if is_cidr "$1" ; then + echo "WARNING: $1 parameter ignored; 'weave launch' no longer takes a CIDR as the first parameter" >&2 shift 1 fi # Set WEAVE_DOCKER_ARGS in the environment in order to supply # additional parameters, such as resource limits, to docker # when launching the weave container. - CONTAINER=$(docker run --privileged -d --name=weave -p 6783:6783/tcp -p 6783:6783/udp $WEAVE_DOCKER_ARGS $IMAGE -name $MACADDR "$@" | tail -n 1) + CONTAINER=$(docker run --privileged -d --name=$CONTAINER_NAME -p $PORT:$PORT/tcp -p $PORT:$PORT/udp $WEAVE_DOCKER_ARGS $IMAGE -name $MACADDR "$@" | tail -n 1) with_container_netns $CONTAINER launch echo $CONTAINER ;; status) - if ! DOCKERIP=$(docker inspect --format='{{ .NetworkSettings.IPAddress }}' weave 2>/dev/null) ; then + [ $# -eq 0 ] || usage + if ! DOCKERIP=$(docker inspect --format='{{ .NetworkSettings.IPAddress }}' $CONTAINER_NAME 2>/dev/null) ; then echo "Weave is not running." >&2 exit 1 fi @@ -287,17 +304,18 @@ case "$COMMAND" in exit 1 fi if command_exists wget ; then - wget -O - -q $DOCKERIP:6784/status + wget -O - -q $DOCKERIP:$HTTP_PORT/status elif command_exists curl ; then - curl $DOCKERIP:6784/status + curl $DOCKERIP:$HTTP_PORT/status else echo "Cannot find wget or curl. Install one of them for 'weave status' to function." >&2 exit 1 fi ;; version) + [ $# -eq 0 ] || usage # Try the running container first; if no luck try the image - if ! DOCKERIMAGE=$(docker inspect --format='{{ .Image }}' weave 2>/dev/null) ; then + if ! DOCKERIMAGE=$(docker inspect --format='{{ .Image }}' $CONTAINER_NAME 2>/dev/null) ; then if ! DOCKERIMAGE=$(docker inspect --format='{{ .Id }}' $IMAGE 2>/dev/null) ; then echo "Unable to find $IMAGE image." >&2 exit 1 @@ -307,6 +325,7 @@ case "$COMMAND" in ;; run) [ $# -gt 0 ] || usage + validate_cidr $1 CIDR=$1 shift 1 create_bridge @@ -315,23 +334,27 @@ case "$COMMAND" in echo $CONTAINER ;; start) - [ $# -gt 1 ] || usage + [ $# -eq 2 ] || usage + validate_cidr $1 create_bridge CONTAINER=$(docker start $2) with_container_netns $CONTAINER attach $1 echo $CONTAINER ;; attach) - [ $# -gt 1 ] || usage + [ $# -eq 2 ] || usage + validate_cidr $1 create_bridge with_container_netns $2 attach $1 ;; detach) - [ $# -gt 1 ] || usage + [ $# -eq 2 ] || usage + validate_cidr $1 with_container_netns $2 detach $1 ;; expose) - [ $# -gt 0 ] || usage + [ $# -eq 1 ] || usage + validate_cidr $1 create_bridge if ! ip addr show dev $BRIDGE | grep -qF $1 then @@ -341,7 +364,8 @@ case "$COMMAND" in fi ;; hide) - [ $# -gt 0 ] || usage + [ $# -eq 1 ] || usage + validate_cidr $1 create_bridge if ip addr show dev $BRIDGE | grep -qF $1 then @@ -351,16 +375,18 @@ case "$COMMAND" in fi ;; stop) - if ! docker kill weave >/dev/null 2>&1 ; then + [ $# -eq 0 ] || usage + if ! docker kill $CONTAINER_NAME >/dev/null 2>&1 ; then echo "Weave is not running." fi - docker rm -f weave >/dev/null 2>&1 || true - check_command_and_run conntrack conntrack -D -p udp --dport 6783 >/dev/null 2>&1 || true + docker rm -f $CONTAINER_NAME >/dev/null 2>&1 || true + check_command_and_run conntrack conntrack -D -p udp --dport $PORT >/dev/null 2>&1 || true ;; reset) - docker kill weave >/dev/null 2>&1 || true - docker rm -f weave >/dev/null 2>&1 || true - check_command_and_run conntrack conntrack -D -p udp --dport 6783 >/dev/null 2>&1 || true + [ $# -eq 0 ] || usage + docker kill $CONTAINER_NAME >/dev/null 2>&1 || true + docker rm -f $CONTAINER_NAME >/dev/null 2>&1 || true + check_command_and_run conntrack conntrack -D -p udp --dport $PORT >/dev/null 2>&1 || true destroy_bridge ;; *)