reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,695 Commits 7 Branches 85 Tags
5ff22a1a77e919e64c756ab5e2c2defe7d0165c2
Commit Graph
124 Commits
Author SHA1 Message Date
Bryan Boreham 5ff22a1a77 Review feedback: tidied up function names 2018-06-04 13:28:28 +00:00
Bryan Boreham 1ee4039681 Add build constraint for go1.10 onwards 2018-05-03 07:15:36 +01:00
Bryan Boreham c2c14410d2 Remove subprocess for changing netns 
Now that Go 1.10 has removed the issue which made us do this.
 2018-04-30 23:40:59 +01:00
Bryan Boreham 4da998ab45 Move to lower-case logrus import 2018-04-27 14:34:48 +01:00
Martynas Pumputis 9a5514ffe0 Add comment about the FORWARD rule order 
Should help debugging.
 2018-01-20 14:44:40 +01:00
Martynas Pumputis 439b4ad190 Improve naming of ensureRulesAtTop function 2018-01-20 12:51:31 +01:00
Martynas Pumputis 9a9c06966b Bring the weave bridge isolation iptables rule to the top 
Make the rule creation to use the same mechanism (via ensureRules)
as other rules from filter/FORWARD. Otherwise, the rule is preceded
by "-j WEAVE-EXPOSE" rule which can break the subnet isolation.
 2018-01-20 12:47:11 +01:00
Bryan Boreham 5a1361167e Move our rules to the top of the FORWARD chain 
We want our DROP rule to be executed ahead of any ACCEPT rules which
might have been added by another program on the system.
 2018-01-11 15:35:19 +00:00
Martynas Pumputis 921ffefd90 Ensure the order of filter/FORWARD iptables rules 2018-01-05 08:33:50 +01:00
Martynas Pumputis 2a12053122 Do not skip bridge initialization if such exists 
EnsureBridge used to skip creation and initialization of the weave
bridge and friends if such existed. This caused problems when
EnsureBridge failed before completing all init steps and so, subsequent
weaver could not work without "weave reset".

This change makes EnsureBridge idempotent.
 2017-12-17 18:51:05 +01:00
Martynas Pumputis 25cff16bd1 Create WEAVE-EXPOSE iptables chain 
Docker 1.13 has changed a default policy of FORWARD chain to DROP
(https://github.com/moby/moby/pull/28257) which makes containers
inaccessible from a remote host when the bridge is exposed.

The change breaks e.g. the AWSVPC mode. To overcome this we install
an explicit rule for accepting forwarded ingress traffic to an
exposed subnet which is appended to the WEAVE-EXPOSE chain.

The chain is a target of the rule "-t filter -A FORWARD -o weave".
 2017-10-17 12:08:43 +01:00
Martynas Pumputis ade6738789 Handle "weave expose" in weaver 
The change makes "weave expose" to call the "/expose" HTTP
endpoint implemented in router which exposes the bridge.

Such architectural change required as we need to know whether NPC is
enabled when exposing the bridge and weaver knows this fact the best.

Unfortunately, this change makes impossible to "weave expose"
when weaver is not running.
 2017-10-17 12:08:43 +01:00
Bryan Boreham 35c017a787 Remove explicit error check at end of functions to placate lint 
It's sad because this changes a regular pattern into an irregular one,
which will create spurious diffs if more work is added at the end of
the function.  Still, this is easier than fixing the lint runner to
ignore the report.
 2017-10-04 13:40:13 +00:00
Martynas Pumputis f37377264b Fix fallback to pcap based bridge when odp is not supported 
The fix ensures that if odp is not supported (usually due to
missing openvswitch, vxlan or vport-vxlan kernel modules),
weaver will create the pcap based bridge instead of crashing.
 2017-06-27 18:38:21 +02:00
Bryan Boreham 28aa181480 Move setting up addresses for a container, into weaveutil-invoked function 
This means we only change netns by execing nsenter: changing netns in
Go is unsafe for long-running processes like the proxy.
 2017-06-16 13:19:08 +00:00
Bryan Boreham 97e0fcb765 Refactor: move SetupIface code from weaveutil to net package 2017-06-16 13:19:08 +00:00
Bryan Boreham 37526728e0 Merge branch '1.9' 2017-05-30 13:55:49 +00:00
Avi Deitcher c05955d598 First cut of adding hairpin functionality to weave 2017-05-30 10:30:49 +00:00
Bryan Boreham 6928929bc9 Install rules allowing outward traffic in npc mode 2017-05-19 15:16:02 +00:00
Bryan Boreham 3cb6569d55 Don't clear WEAVE-NPC chain here; it is controlled by weave-npc. 
We don't get a very useful error object back from go-iptables and I
didn't feel like parsing the message, so just ignore all errors.
It would be racy to try to check if WEAVE-NPC existed before calling
NewChain.
 2017-05-18 09:29:33 +00:00
Bryan Boreham f517a09f0f Create WEAVE-NPC chain in the correct table 2017-04-26 17:04:36 +00:00
Bryan Boreham 4f7d476907 Only do set-up on bridge/datapath devices once at creation time 
This is a change to the previous behaviour, but makes the code easier
to read and seems more sensible.
 2017-04-24 16:48:19 +00:00
Bryan Boreham a731d47d97 Rename bridge detection/creation functions 2017-04-24 16:42:05 +00:00
Bryan Boreham 44beed4027 Refactor decision logic for initial bridge type 2017-04-24 16:26:16 +00:00
Bryan Boreham a7feb41e62 Replace switch statements with Bridge polymorphism 2017-04-20 15:57:49 +00:00
Bryan Boreham fddb3ee06e Review feedback 2017-04-20 15:57:49 +00:00
Bryan Boreham ae625a18c8 Move awsvpc bridge expose from weave script to Go code 2017-04-17 19:41:47 +00:00
Bryan Boreham 41a261bdcd Add conversion from CIDR to IPNet 2017-04-17 19:41:47 +00:00
Bryan Boreham f05bb6c4e0 Don't assume we always run in in host pid space 
Pass the path to the proc filesystem down
 2017-04-17 19:41:47 +00:00
Bryan Boreham c8e0c12d34 Move AWSVPC sysctls into Go code 2017-04-17 19:41:47 +00:00
Bryan Boreham ab380ed2c1 Set weave bridge address and mtu 
including the dance with the dummy interface to get MTU set high
 2017-04-17 19:41:47 +00:00
Bryan Boreham 9494f0655d More meaningful errors 2017-04-17 19:41:47 +00:00
Bryan Boreham abadbf883a AWSVPC mode now part of BridgeConfig 2017-04-17 19:41:47 +00:00
Bryan Boreham 833eb6166f Add AWSVPC bridge type 2017-04-17 19:41:47 +00:00
Bryan Boreham dd232775e6 Move expect-npc setup from weave script to Go code 2017-04-17 19:41:47 +00:00
Bryan Boreham 8051f51d46 Move bridge-creation code from weave script into Go code 
via weaveutil create-bridge function
 2017-04-17 19:41:47 +00:00
Bryan Boreham 6fd9f471ff Bridge setup iptables rules 2017-04-17 19:41:47 +00:00
Bryan Boreham 2d037d874c MTU selection closer to weave script 
Note that if initFastdp sets the MTU for the datapath then the same
value is used for the bridge also.
 2017-04-17 19:41:47 +00:00
Bryan Boreham 8e5384ee01 Create pcap veth for no-fastdp operation 2017-04-17 19:41:47 +00:00
Adam Harrison 7dd37d2a13 Add functions to create bridge 2017-04-17 19:41:47 +00:00
Adam Harrison 36521b04a2 Utility function to enforce docker bridge addr_assign_type 2017-04-17 19:41:47 +00:00
Martynas Pumputis 7478e78ab7 Add NSPathByPidWithRoot 
The function is used in a case when /proc is bind mounted to
other than /proc dir.
 2017-04-12 13:05:40 +00:00
Bryan Boreham 5f6c5f6692 Ensure boltDB pathname is constructed uniformly 
Keep the concatenation of the prefix and filename inside the boltdb
package, so we can't get it wrong outside.
 2017-04-11 15:45:04 +00:00
Bryan Boreham e2d644b86b Peer Discovery via a web service 2017-04-10 14:09:06 +00:00
Martynas Pumputis 50985dee90 Enable ESN in fastdp-crypto 2017-01-31 17:21:01 +00:00
Martynas Pumputis 60323d0960 Add fastdp crypto 2017-01-31 17:21:01 +00:00
Bryan Boreham 929167366a Don't fail if only half the system IDs are blank 2017-01-19 15:57:21 +00:00
Bryan Boreham ebcb7f6108 Use persisted peer name if it matches old-style ID 2017-01-11 13:14:35 +00:00
Bryan Boreham 70a20b4d26 Generate peer name / mac address in Go 2017-01-11 13:12:30 +00:00
Bryan Boreham 6ef302b8a1 Extract FindBridgeIP to net package 2016-12-23 11:57:04 +00:00