From 6c58bd78157877b16b824563aa42a2524cd0c2c7 Mon Sep 17 00:00:00 2001 From: Martynas Pumputis Date: Thu, 1 Nov 2018 18:58:59 +0200 Subject: [PATCH] net: Do not set bridge hw addr when creating it Prior "bridge: Change local fdb entries whenever mac address of bridge device changes" [1], FDB entry for a bridge was not inserted when creating the bridge and it could only be inserted when a hw address of the bridge was changed. Therefore, on an older than the 3.14 kernel containers were not able to reach the "weave" bridge w/o setting the promiscuous mode on. This should have hit hard Kubernetes users as the weave bridge in their case is used as a default gateway, and thus it works only after manually enabling the promiscuous mode. Additionally, w/o the promiscuous mode a packet sent from a container and destined to the gateway is flooded on all ports, so it can reach the "datapath" device resulting in the "Vetoed installation of hairpin flow" error. [1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4b816d8ba1c1917842dc3de97cbf8ef116e043e --- net/bridge.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/bridge.go b/net/bridge.go index e6fb747c..2eee80f2 100644 --- a/net/bridge.go +++ b/net/bridge.go @@ -304,7 +304,10 @@ func (b bridgeImpl) initPrep(config *BridgeConfig) error { linkAttrs := netlink.NewLinkAttrs() linkAttrs.Name = config.WeaveBridgeName - linkAttrs.HardwareAddr = mac + // NB: Do not set MAC addr when creating the bridge, set it manually + // afterwards instead. Otherwise, on an older than 3.14 kernel FDB + // entry won't be created which results in containers not being able to + // reach the bridge w/o promiscuous mode. if config.MTU == 0 { config.MTU = 65535 }