reweave/weave
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,549 Commits 7 Branches 85 Tags
v2.1.0
Commit Graph
114 Commits
Author SHA1 Message Date
Martynas Pumputis 25cff16bd1 Create WEAVE-EXPOSE iptables chain 
Docker 1.13 has changed a default policy of FORWARD chain to DROP
(https://github.com/moby/moby/pull/28257) which makes containers
inaccessible from a remote host when the bridge is exposed.

The change breaks e.g. the AWSVPC mode. To overcome this we install
an explicit rule for accepting forwarded ingress traffic to an
exposed subnet which is appended to the WEAVE-EXPOSE chain.

The chain is a target of the rule "-t filter -A FORWARD -o weave".
 2017-10-17 12:08:43 +01:00
Martynas Pumputis ade6738789 Handle "weave expose" in weaver 
The change makes "weave expose" to call the "/expose" HTTP
endpoint implemented in router which exposes the bridge.

Such architectural change required as we need to know whether NPC is
enabled when exposing the bridge and weaver knows this fact the best.

Unfortunately, this change makes impossible to "weave expose"
when weaver is not running.
 2017-10-17 12:08:43 +01:00
Bryan Boreham 35c017a787 Remove explicit error check at end of functions to placate lint 
It's sad because this changes a regular pattern into an irregular one,
which will create spurious diffs if more work is added at the end of
the function.  Still, this is easier than fixing the lint runner to
ignore the report.
 2017-10-04 13:40:13 +00:00
Martynas Pumputis f37377264b Fix fallback to pcap based bridge when odp is not supported 
The fix ensures that if odp is not supported (usually due to
missing openvswitch, vxlan or vport-vxlan kernel modules),
weaver will create the pcap based bridge instead of crashing.
 2017-06-27 18:38:21 +02:00
Bryan Boreham 28aa181480 Move setting up addresses for a container, into weaveutil-invoked function 
This means we only change netns by execing nsenter: changing netns in
Go is unsafe for long-running processes like the proxy.
 2017-06-16 13:19:08 +00:00
Bryan Boreham 97e0fcb765 Refactor: move SetupIface code from weaveutil to net package 2017-06-16 13:19:08 +00:00
Bryan Boreham 37526728e0 Merge branch '1.9' 2017-05-30 13:55:49 +00:00
Avi Deitcher c05955d598 First cut of adding hairpin functionality to weave 2017-05-30 10:30:49 +00:00
Bryan Boreham 6928929bc9 Install rules allowing outward traffic in npc mode 2017-05-19 15:16:02 +00:00
Bryan Boreham 3cb6569d55 Don't clear WEAVE-NPC chain here; it is controlled by weave-npc. 
We don't get a very useful error object back from go-iptables and I
didn't feel like parsing the message, so just ignore all errors.
It would be racy to try to check if WEAVE-NPC existed before calling
NewChain.
 2017-05-18 09:29:33 +00:00
Bryan Boreham f517a09f0f Create WEAVE-NPC chain in the correct table 2017-04-26 17:04:36 +00:00
Bryan Boreham 4f7d476907 Only do set-up on bridge/datapath devices once at creation time 
This is a change to the previous behaviour, but makes the code easier
to read and seems more sensible.
 2017-04-24 16:48:19 +00:00
Bryan Boreham a731d47d97 Rename bridge detection/creation functions 2017-04-24 16:42:05 +00:00
Bryan Boreham 44beed4027 Refactor decision logic for initial bridge type 2017-04-24 16:26:16 +00:00
Bryan Boreham a7feb41e62 Replace switch statements with Bridge polymorphism 2017-04-20 15:57:49 +00:00
Bryan Boreham fddb3ee06e Review feedback 2017-04-20 15:57:49 +00:00
Bryan Boreham ae625a18c8 Move awsvpc bridge expose from weave script to Go code 2017-04-17 19:41:47 +00:00
Bryan Boreham 41a261bdcd Add conversion from CIDR to IPNet 2017-04-17 19:41:47 +00:00
Bryan Boreham f05bb6c4e0 Don't assume we always run in in host pid space 
Pass the path to the proc filesystem down
 2017-04-17 19:41:47 +00:00
Bryan Boreham c8e0c12d34 Move AWSVPC sysctls into Go code 2017-04-17 19:41:47 +00:00
Bryan Boreham ab380ed2c1 Set weave bridge address and mtu 
including the dance with the dummy interface to get MTU set high
 2017-04-17 19:41:47 +00:00
Bryan Boreham 9494f0655d More meaningful errors 2017-04-17 19:41:47 +00:00
Bryan Boreham abadbf883a AWSVPC mode now part of BridgeConfig 2017-04-17 19:41:47 +00:00
Bryan Boreham 833eb6166f Add AWSVPC bridge type 2017-04-17 19:41:47 +00:00
Bryan Boreham dd232775e6 Move expect-npc setup from weave script to Go code 2017-04-17 19:41:47 +00:00
Bryan Boreham 8051f51d46 Move bridge-creation code from weave script into Go code 
via weaveutil create-bridge function
 2017-04-17 19:41:47 +00:00
Bryan Boreham 6fd9f471ff Bridge setup iptables rules 2017-04-17 19:41:47 +00:00
Bryan Boreham 2d037d874c MTU selection closer to weave script 
Note that if initFastdp sets the MTU for the datapath then the same
value is used for the bridge also.
 2017-04-17 19:41:47 +00:00
Bryan Boreham 8e5384ee01 Create pcap veth for no-fastdp operation 2017-04-17 19:41:47 +00:00
Adam Harrison 7dd37d2a13 Add functions to create bridge 2017-04-17 19:41:47 +00:00
Adam Harrison 36521b04a2 Utility function to enforce docker bridge addr_assign_type 2017-04-17 19:41:47 +00:00
Martynas Pumputis 7478e78ab7 Add NSPathByPidWithRoot 
The function is used in a case when /proc is bind mounted to
other than /proc dir.
 2017-04-12 13:05:40 +00:00
Bryan Boreham 5f6c5f6692 Ensure boltDB pathname is constructed uniformly 
Keep the concatenation of the prefix and filename inside the boltdb
package, so we can't get it wrong outside.
 2017-04-11 15:45:04 +00:00
Bryan Boreham e2d644b86b Peer Discovery via a web service 2017-04-10 14:09:06 +00:00
Martynas Pumputis 50985dee90 Enable ESN in fastdp-crypto 2017-01-31 17:21:01 +00:00
Martynas Pumputis 60323d0960 Add fastdp crypto 2017-01-31 17:21:01 +00:00
Bryan Boreham 929167366a Don't fail if only half the system IDs are blank 2017-01-19 15:57:21 +00:00
Bryan Boreham ebcb7f6108 Use persisted peer name if it matches old-style ID 2017-01-11 13:14:35 +00:00
Bryan Boreham 70a20b4d26 Generate peer name / mac address in Go 2017-01-11 13:12:30 +00:00
Bryan Boreham 6ef302b8a1 Extract FindBridgeIP to net package 2016-12-23 11:57:04 +00:00
Bryan Boreham bb1cca713d Merge branch '1.8' 2016-12-08 12:27:40 +00:00
Bryan Boreham 1d80a8d676 Merge pull request #2674 from weaveworks/issues/2650-fix-looping-flows 
Detect looping flows
 2016-12-08 12:27:15 +00:00
Martynas Pumputis baa8f229f7 Detect enabling of hairpin mode on vethwe-bridge 
Enabled hairpin mode on vethwe-bridge was one of the root causes
for installing looping flows in the fastdp mode.

Also, it confused the weave custom L2 bridge, as the bridge treats
a bounced back packet, e.g. ARP brodcast request, as a local one
(the case for "Captured a packet associated with remote host").
 2016-12-08 11:37:52 +00:00
Adam Harrison ac4957e15c Merge branch '1.8' 2016-12-06 11:30:32 +00:00
Bryan Boreham ee6596e21c Run iptables commands in a loop 
in case they get  "temporarily unavailable" exit
 2016-12-05 11:11:20 +00:00
Bryan Boreham d5f1c233bf Remove punctuation from the end of error messages 
to placate the linter
 2016-11-18 10:40:41 +00:00
Bryan Boreham a07e3301b1 Add 'weave expose' NAT iptables rules inside CNI plugin 
This avoids a race between the plugin and the script
 2016-11-14 12:37:42 +00:00
Bryan Boreham 5630a01a8c Implement CNI plugin via weaveutil 2016-11-03 17:42:39 +00:00
Martynas Pumputis 9754da15d6 Encode "list-netdevs" output in JSON 2016-10-20 18:18:57 +01:00
Martynas Pumputis e611f04f41 Move NetDev utils from common/ to net/ 2016-10-19 17:03:30 +01:00