From 6739e6c1664f5253d75d6a270f5514cdec803712 Mon Sep 17 00:00:00 2001
From: Bryan Boreham <bjboreham@gmail.com>
Date: Tue, 19 May 2015 17:33:38 +0100
Subject: [PATCH 1/3] iptables rule to drop traffic from docker0 bridge to
 weave bridge

---
 weave | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/weave b/weave
index 338b40b4..a2637e7c 100755
--- a/weave
+++ b/weave
@@ -260,6 +260,8 @@ create_bridge() {
         ip link add name v${CONTAINER_IFNAME}du mtu $MTU type dummy
         ip link set dev v${CONTAINER_IFNAME}du master $BRIDGE
         ip link del dev v${CONTAINER_IFNAME}du
+        # Drop traffic from Docker bridge to Weave; it can break subnet isolation
+        run_iptables -t filter -I FORWARD -i $DOCKER_BRIDGE -o $BRIDGE -j DROP
         # Work around the situation where there are no rules allowing traffic
         # across our bridge. E.g. ufw
         add_iptables_rule filter FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT
@@ -282,6 +284,7 @@ destroy_bridge() {
     if [ -d /sys/class/net/$BRIDGE ] ; then
         ip link del dev $BRIDGE
     fi
+    run_iptables -t filter -D FORWARD -i $DOCKER_BRIDGE -o $BRIDGE -j DROP 2>/dev/null || true
     run_iptables -t filter -D FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT 2>/dev/null || true
     run_iptables -t nat -F WEAVE >/dev/null 2>&1 || true
     run_iptables -t nat -D POSTROUTING -j WEAVE >/dev/null 2>&1 || true

From 4ee32cc12dc0bef9b8d15c3757573b7bdb5a5271 Mon Sep 17 00:00:00 2001
From: Bryan Boreham <bjboreham@gmail.com>
Date: Tue, 19 May 2015 18:15:59 +0100
Subject: [PATCH 2/3] Extend smoke test for new drop rule Note that we have to
 wrap the '!' in 'sh -c' to get the negation to work as expected.

---
 test/130_expose_test.sh | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/test/130_expose_test.sh b/test/130_expose_test.sh
index abe38b0f..9bfc238a 100755
--- a/test/130_expose_test.sh
+++ b/test/130_expose_test.sh
@@ -25,10 +25,9 @@ check_container_connectivity() {
     exec_on1 "c1 $PING $C2"
     exec_on1 "c3 $PING $C4"
     exec_on1 "c5 $PING $C6"
-    # fails due to #620
-    # exec_on1 "c3 ! $PING $C1"
-    # exec_on1 "c5 ! $PING $C1"
-    # exec_on1 "c5 ! $PING $C3"
+    exec_on1 "c3 sh -c \"! $PING $C1\""
+    exec_on1 "c5 sh -c \"! $PING $C1\""
+    exec_on1 "c5 sh -c \"! $PING $C3\""
 }
 
 start_suite "exposing weave network to host"

From 906be31483a08d08a23272424ab1d5884ea3cad1 Mon Sep 17 00:00:00 2001
From: Bryan Boreham <bjboreham@gmail.com>
Date: Wed, 20 May 2015 11:08:39 +0100
Subject: [PATCH 3/3] Regularise the ping tests across different subnets

---
 test/130_expose_test.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/test/130_expose_test.sh b/test/130_expose_test.sh
index 9bfc238a..9ea46c68 100755
--- a/test/130_expose_test.sh
+++ b/test/130_expose_test.sh
@@ -21,13 +21,14 @@ exec_on1() {
     assert_raises "exec_on  $HOST1 $@"
 }
 
+# Containers in the same subnet should be able to talk; different subnet not.
 check_container_connectivity() {
     exec_on1 "c1 $PING $C2"
     exec_on1 "c3 $PING $C4"
     exec_on1 "c5 $PING $C6"
-    exec_on1 "c3 sh -c \"! $PING $C1\""
+    exec_on1 "c1 sh -c \"! $PING $C3\""
+    exec_on1 "c3 sh -c \"! $PING $C5\""
     exec_on1 "c5 sh -c \"! $PING $C1\""
-    exec_on1 "c5 sh -c \"! $PING $C3\""
 }
 
 start_suite "exposing weave network to host"