From 76a974f88bcf1c9293a190834e047f6739fcd5ba Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Fri, 24 Oct 2014 16:07:06 +0100 Subject: [PATCH 1/6] refactor: maintain abstraction --- weave | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/weave b/weave index 176461c5..3ab4bdbd 100755 --- a/weave +++ b/weave @@ -207,7 +207,7 @@ detach() { return 1 fi - if [ -n "$(ip netns exec $NETNS ip -f inet addr show dev ethwe)" ] ; then + if [ -n "$(ip netns exec $NETNS ip -f inet addr show dev $CONTAINER_IFNAME)" ] ; then # other addresses are left, leave the device alone return 0 fi From ce631e7f28d2b2a58168cb14dfa333706a48423b Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Fri, 24 Oct 2014 16:56:58 +0100 Subject: [PATCH 2/6] stricter param count checking --- weave | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/weave b/weave index 3ab4bdbd..302c7ffb 100755 --- a/weave +++ b/weave @@ -256,6 +256,7 @@ case "$COMMAND" in echo $CONTAINER ;; status) + [ $# -eq 0 ] || usage if ! DOCKERIP=$(docker inspect --format='{{ .NetworkSettings.IPAddress }}' weave 2>/dev/null) ; then echo "Weave is not running." >&2 exit 1 @@ -274,6 +275,7 @@ case "$COMMAND" in fi ;; version) + [ $# -eq 0 ] || usage # Try the running container first; if no luck try the image if ! DOCKERIMAGE=$(docker inspect --format='{{ .Image }}' weave 2>/dev/null) ; then if ! DOCKERIMAGE=$(docker inspect --format='{{ .Id }}' $IMAGE 2>/dev/null) ; then @@ -293,23 +295,23 @@ case "$COMMAND" in echo $CONTAINER ;; start) - [ $# -gt 1 ] || usage + [ $# -eq 2 ] || usage create_bridge CONTAINER=$(docker start $2) with_container_netns $CONTAINER attach $1 $CONTAINER_IFNAME echo $CONTAINER ;; attach) - [ $# -gt 1 ] || usage + [ $# -eq 2 ] || usage create_bridge with_container_netns $2 attach $1 $CONTAINER_IFNAME ;; detach) - [ $# -gt 1 ] || usage + [ $# -eq 2 ] || usage with_container_netns $2 detach $1 ;; expose) - [ $# -gt 0 ] || usage + [ $# -eq 1 ] || usage create_bridge if ! ip addr show dev $BRIDGE | grep -qF $1 then @@ -317,7 +319,7 @@ case "$COMMAND" in fi ;; hide) - [ $# -gt 0 ] || usage + [ $# -eq 1 ] || usage create_bridge if ip addr show dev $BRIDGE | grep -qF $1 then @@ -325,6 +327,7 @@ case "$COMMAND" in fi ;; stop) + [ $# -eq 0 ] || usage if ! docker kill weave >/dev/null 2>&1 ; then echo "Weave is not running." fi @@ -333,6 +336,7 @@ case "$COMMAND" in stop_masquerading ;; reset) + [ $# -eq 0 ] || usage docker kill weave >/dev/null 2>&1 || true docker rm -f weave >/dev/null 2>&1 || true check_command_and_run conntrack conntrack -D -p udp --dport 6783 >/dev/null 2>&1 || true From e265f041827c2e0d4b67d1cfb3cb73a19c4aab3b Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Sat, 25 Oct 2014 17:13:44 +0100 Subject: [PATCH 3/6] cosmetic: remove trailing whitespace --- Vagrantfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Vagrantfile b/Vagrantfile index 5ef24b19..c621d770 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -6,7 +6,7 @@ pkgs = "lxc-docker golang ethtool libpcap-dev git mercurial" Vagrant.configure(VAGRANTFILE_API_VERSION) do |config| config.vm.box = "phusion/ubuntu-14.04-amd64" config.vm.box_url = "https://oss-binaries.phusionpassenger.com/vagrant/boxes/latest/ubuntu-14.04-amd64-vbox.box" - + config.vm.network "private_network", ip: vm_ip config.vm.synced_folder "./", "/home/vagrant/src/github.com/zettio/weave" From e9c5b2c3eaad5b836a0de0a17212051e01daf693 Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Sat, 25 Oct 2014 19:42:52 +0100 Subject: [PATCH 4/6] refactor: extract weave ports and container name into constants --- weave | 33 ++++++++++++++++++--------------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/weave b/weave index 302c7ffb..f0bde4a1 100755 --- a/weave +++ b/weave @@ -33,9 +33,12 @@ command_exists () { [ $# -gt 0 ] || usage IMAGE=zettio/weave +CONTAINER_NAME=weave BRIDGE=weave CONTAINER_IFNAME=ethwe MTU=65535 +PORT=6783 +HTTP_PORT=6784 COMMAND=$1 @@ -221,20 +224,20 @@ case "$COMMAND" in [ $# -gt 0 ] || usage CIDR=$1 shift 1 - case $(docker inspect --format '{{ .State.Running }} {{ .Config.Image }}' weave 2>/dev/null) in + case $(docker inspect --format '{{ .State.Running }} {{ .Config.Image }}' $CONTAINER_NAME 2>/dev/null) in "true $IMAGE") echo "Weave is already running." >&2 exit 1 ;; "false $IMAGE") - docker rm weave >/dev/null + docker rm $CONTAINER_NAME >/dev/null ;; true*) - echo "Found another running container named 'weave'. Aborting." >&2 + echo "Found another running container named '$CONTAINER_NAME'. Aborting." >&2 exit 1 ;; false*) - echo "Found another container named 'weave'. Aborting." >&2 + echo "Found another container named '$CONTAINER_NAME'. Aborting." >&2 exit 1 ;; esac @@ -251,13 +254,13 @@ case "$COMMAND" in # Set WEAVE_DOCKER_ARGS in the environment in order to supply # additional parameters, such as resource limits, to docker # when launching the weave container. - CONTAINER=$(docker run --privileged -d --name=weave -p 6783:6783/tcp -p 6783:6783/udp $WEAVE_DOCKER_ARGS $IMAGE -name $MACADDR "$@" | tail -n 1) + CONTAINER=$(docker run --privileged -d --name=$CONTAINER_NAME -p $PORT:$PORT/tcp -p $PORT:$PORT/udp $WEAVE_DOCKER_ARGS $IMAGE -name $MACADDR "$@" | tail -n 1) with_container_netns $CONTAINER attach $CIDR eth0 echo $CONTAINER ;; status) [ $# -eq 0 ] || usage - if ! DOCKERIP=$(docker inspect --format='{{ .NetworkSettings.IPAddress }}' weave 2>/dev/null) ; then + if ! DOCKERIP=$(docker inspect --format='{{ .NetworkSettings.IPAddress }}' $CONTAINER_NAME 2>/dev/null) ; then echo "Weave is not running." >&2 exit 1 fi @@ -266,9 +269,9 @@ case "$COMMAND" in exit 1 fi if command_exists wget ; then - wget -O - -q $DOCKERIP:6784/status + wget -O - -q $DOCKERIP:$HTTP_PORT/status elif command_exists curl ; then - curl $DOCKERIP:6784/status + curl $DOCKERIP:$HTTP_PORT/status else echo "Cannot find wget or curl. Install one of them for 'weave status' to function." >&2 exit 1 @@ -277,7 +280,7 @@ case "$COMMAND" in version) [ $# -eq 0 ] || usage # Try the running container first; if no luck try the image - if ! DOCKERIMAGE=$(docker inspect --format='{{ .Image }}' weave 2>/dev/null) ; then + if ! DOCKERIMAGE=$(docker inspect --format='{{ .Image }}' $CONTAINER_NAME 2>/dev/null) ; then if ! DOCKERIMAGE=$(docker inspect --format='{{ .Id }}' $IMAGE 2>/dev/null) ; then echo "Unable to find $IMAGE image." >&2 exit 1 @@ -328,18 +331,18 @@ case "$COMMAND" in ;; stop) [ $# -eq 0 ] || usage - if ! docker kill weave >/dev/null 2>&1 ; then + if ! docker kill $CONTAINER_NAME >/dev/null 2>&1 ; then echo "Weave is not running." fi - docker rm -f weave >/dev/null 2>&1 || true - check_command_and_run conntrack conntrack -D -p udp --dport 6783 >/dev/null 2>&1 || true + docker rm -f $CONTAINER_NAME >/dev/null 2>&1 || true + check_command_and_run conntrack conntrack -D -p udp --dport $PORT >/dev/null 2>&1 || true stop_masquerading ;; reset) [ $# -eq 0 ] || usage - docker kill weave >/dev/null 2>&1 || true - docker rm -f weave >/dev/null 2>&1 || true - check_command_and_run conntrack conntrack -D -p udp --dport 6783 >/dev/null 2>&1 || true + docker kill $CONTAINER_NAME >/dev/null 2>&1 || true + docker rm -f $CONTAINER_NAME >/dev/null 2>&1 || true + check_command_and_run conntrack conntrack -D -p udp --dport $PORT >/dev/null 2>&1 || true stop_masquerading destroy_bridge ;; From 007b68c206e5a63b3888c22591e8dd12fef30562 Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Sat, 25 Oct 2014 19:51:06 +0100 Subject: [PATCH 5/6] explain that peer can be specified as fqdn and contain optional port Closes #137. --- README.md | 6 +++--- weave | 5 +++-- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index c0560220..d6183f66 100644 --- a/README.md +++ b/README.md @@ -87,9 +87,9 @@ We repeat similar steps on $HOST2... The only difference, apart from the choice of IP addresses for the weave router and the application container, is that we tell our weave that it should peer with the weave on $HOST1 (specified as the IP -address or hostname by which $HOST2 can reach it). NB: if there is a -firewall between $HOST1 and $HOST2, you must open port 6783 for TCP -and UDP. +address or hostname, and optional `:port`, by which $HOST2 can reach +it). NB: if there is a firewall between $HOST1 and $HOST2, you must +open port 6783 for TCP and UDP. Note that we could instead have told the weave on $HOST1 to connect to $HOST2, or told both about each other. Order does not matter here; diff --git a/weave b/weave index f0bde4a1..8b9ca3a6 100755 --- a/weave +++ b/weave @@ -3,7 +3,7 @@ set -e usage() { echo "Usage:" - echo "weave launch [-password ] ..." + echo "weave launch [-password ] ..." echo "weave run ..." echo "weave start " echo "weave attach " @@ -15,7 +15,8 @@ usage() { echo "weave stop" echo "weave reset" echo - echo "where is of the form /" + echo "where is of the form /, and" + echo " is of the form [:]" exit 1 } From d8bea832d3ff43da5adbfbcbf4941d0236adcb36 Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Sat, 25 Oct 2014 22:04:36 +0100 Subject: [PATCH 6/6] validate CIDR This isn't meant to be precise but supposed to guard against silly mistakes. Closes #116. --- weave | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/weave b/weave index 8b9ca3a6..de850089 100755 --- a/weave +++ b/weave @@ -55,6 +55,15 @@ check_command_and_run() { fi } +validate_cidr() { + # The regexp here is far from precise, but good enough. + if ! echo "$1" | grep -E '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/[0-9]{1,2}$' >/dev/null ; then + echo "Invalid CIDR: $1" >&2 + echo "CIDR must of be of form /, e.g. 10.0.1.1/24" >&2 + exit 1 + fi +} + run_iptables() { # -w is recent addition to iptables if [ -z "$CHECKED_IPTABLES_W" ] ; then @@ -223,6 +232,7 @@ detach() { case "$COMMAND" in launch) [ $# -gt 0 ] || usage + validate_cidr $1 CIDR=$1 shift 1 case $(docker inspect --format '{{ .State.Running }} {{ .Config.Image }}' $CONTAINER_NAME 2>/dev/null) in @@ -291,6 +301,7 @@ case "$COMMAND" in ;; run) [ $# -gt 0 ] || usage + validate_cidr $1 CIDR=$1 shift 1 create_bridge @@ -300,6 +311,7 @@ case "$COMMAND" in ;; start) [ $# -eq 2 ] || usage + validate_cidr $1 create_bridge CONTAINER=$(docker start $2) with_container_netns $CONTAINER attach $1 $CONTAINER_IFNAME @@ -307,15 +319,18 @@ case "$COMMAND" in ;; attach) [ $# -eq 2 ] || usage + validate_cidr $1 create_bridge with_container_netns $2 attach $1 $CONTAINER_IFNAME ;; detach) [ $# -eq 2 ] || usage + validate_cidr $1 with_container_netns $2 detach $1 ;; expose) [ $# -eq 1 ] || usage + validate_cidr $1 create_bridge if ! ip addr show dev $BRIDGE | grep -qF $1 then @@ -324,6 +339,7 @@ case "$COMMAND" in ;; hide) [ $# -eq 1 ] || usage + validate_cidr $1 create_bridge if ip addr show dev $BRIDGE | grep -qF $1 then