Add release v2.8.1

Update daemonset manifest to mount /etc/machine-id

.ackrc

@@ -0,0 +1,2 @@
+--ignore-dir=vendor
+--ignore-dir=.pkg

.circleci/config.yml

@@ -0,0 +1,123 @@
+version: 2
+defaults: &defaults
+  docker:
+    - image: weaveworks/weavebuild:master-1dfe1f3b
+  working_directory: /go/src/github.com/weaveworks/weave
+
+jobs:
+  lint:
+    <<: *defaults
+    steps:
+      - checkout
+      - run: git submodule update --init
+      - run: make DEBUG=1 BUILD_IN_CONTAINER=false lint
+
+  unit-test:
+    <<: *defaults
+    parallelism: 2
+    steps:
+      - checkout
+      - run: COVERDIR=test/coverage make BUILD_IN_CONTAINER=false tests
+      - persist_to_workspace:
+          root: .
+          paths:
+          - test/coverage
+
+  build:
+    <<: *defaults
+    steps:
+      - checkout
+      - setup_remote_docker
+      - run: git submodule update --init
+      - run: make COVERAGE=true BUILD_IN_CONTAINER=false SUDO= exes all
+      - persist_to_workspace:
+          root: .
+          paths:
+          - weave.tar.gz
+          - tools/runner/runner
+          - test/tls/tls
+
+  smoke-tests:
+    machine:
+      image: circleci/classic:201709-01
+    working_directory: /home/circleci/src/github.com/weaveworks/weave
+    environment:
+      SRCDIR: /home/circleci/src/github.com/weaveworks/weave
+      CIRCLE_ARTIFACTS: /tmp/artifacts
+    parallelism: 2
+    steps:
+      - checkout
+      - run: mkdir $CIRCLE_ARTIFACTS
+      - run: git submodule update --init
+      - attach_workspace:
+          at: .
+      # kick off creation of test VMs
+      - run: bin/provision_test_vms.sh
+      # when VMs are ready, copy built software to them
+      - run: bin/circle-test-pre
+      - run:
+          command: bin/circle-test-smoke
+          no_output_timeout: 360s
+      # Destroy testing VMs:
+      - run:
+          command: bin/circle-destroy-vms
+          background: true
+      - persist_to_workspace:
+          root: .
+          paths:
+          - test/coverage
+      - store_artifacts:
+          path: /tmp/artifacts
+
+  gen-coverage:
+    <<: *defaults
+    environment:
+      CIRCLE_ARTIFACTS: /tmp/artifacts
+    steps:
+      - checkout
+      - run: mkdir $CIRCLE_ARTIFACTS
+      - attach_workspace:
+          at: .
+      - run: cd test; ./gen_coverage_reports.sh
+      - run: goveralls -repotoken $COVERALLS_REPO_TOKEN -coverprofile=test/profile.cov -service=circleci
+      - run: cp test/coverage.* $CIRCLE_ARTIFACTS
+      - store_artifacts:
+          path: /tmp/artifacts
+
+  deploy:
+    <<: *defaults
+    steps:
+      - checkout
+      - setup_remote_docker
+      # Register qemu hooks, rebuild without coverage and push to dockerhub
+      - deploy:
+          command: |
+            docker login -u $DOCKER_USER -p $DOCKER_PASS
+            docker run --rm --privileged multiarch/qemu-user-static:register --reset
+            wget https://github.com/estesp/manifest-tool/releases/download/v0.8.0/manifest-tool-linux-amd64
+            chmod +x manifest-tool-linux-amd64
+            make clean-bin
+            make publish MANIFEST_TOOL_CMD=./manifest-tool-linux-amd64 UPDATE_LATEST=latest-only SUDO= BUILD_IN_CONTAINER=false
+
+workflows:
+  version: 2
+  build_test:
+    jobs:
+      - lint
+      - unit-test
+      - build
+      - smoke-tests:
+          requires:
+            - lint
+            - unit-test
+            - build
+      - gen-coverage:
+          requires:
+            - unit-test
+            - smoke-tests
+      - deploy:
+          requires:
+            - smoke-tests
+          filters:
+            branches:
+              only: master

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,65 @@
+<!--
+Hi, thank you for opening an issue!
+Before hitting the button...
+
+** Is this a REQUEST FOR HELP? **
+If so, please have a look at:
+- our FAQ: https://www.weave.works/docs/net/latest/faq/
+- our troubleshooting page: https://www.weave.works/docs/net/latest/troubleshooting/
+- our help page, to choose the best channel (Slack, etc.) to reach out: https://www.weave.works/help/
+
+** Is this a FEATURE REQUEST? **
+If so, please search existing feature requests, and if you find a similar one, up-vote it and/or add your comments to it instead.
+If you did not find a similar one, please describe in details:
+- why: your use-case, specific constraints you may have, etc.
+- what: the feature/behaviour/change you would like to see in Weave Net
+Do not hesitate, when appropriate, to share the exact commands or API you would like, and/or to share a diagram (e.g.: asciiflow.com): "a picture is worth a thousand words".
+
+** Is this a BUG REPORT? **
+Please fill in as much of the template below as you can.
+
+Thank you!
+-->
+
+## What you expected to happen?
+
+## What happened?
+<!-- Error message, actual behaviour, etc. -->
+
+## How to reproduce it?
+<!-- Specific steps, as minimally and precisely as possible. -->
+
+## Anything else we need to know?
+<!-- Cloud provider? Hardware? How did you configure your cluster? Kubernetes YAML, KOPS, etc. -->
+
+## Versions:
+<!-- Please paste in the output of these commands; 'kubectl' only if using Kubernetes -->
+```
+$ weave version
+$ docker version
+$ uname -a
+$ kubectl version
+```
+
+## Logs:
+```
+$ docker logs weave
+```
+or, if using Kubernetes:
+```
+$ kubectl logs -n kube-system <weave-net-pod> weave
+```
+<!-- (If output is long, please consider a Gist.) -->
+<!-- Anything interesting or unusual output by the below, potentially relevant, commands?
+$ journalctl -u docker.service --no-pager
+$ journalctl -u kubelet --no-pager
+$ kubectl get events
+-->
+
+## Network:
+<!-- If your problem has anything to do with one network endpoint not being able to contact another, please run the following commands -->
+```
+$ ip route
+$ ip -4 -o addr
+$ sudo iptables-save
+```

.gitignore

@@ -25,6 +25,7 @@ _testmain.go
 *.prof
 profile.cov
 coverage.html
+.pkg
 
 # Emacs backup files
 *~
@@ -32,33 +33,46 @@ coverage.html
 # Vim backup files
 *.swp
 
+# Sed backup files
+*.bak
+
 # Project specific
 prog/weaver/weaver
 prog/weavedns/weavedns
 prog/weavehosts/weavehosts
-prog/weaveproxy/weaveproxy
 prog/sigproxy/sigproxy
 prog/weavewait/weavewait
 prog/weavewait/weavewait_noop
-prog/netcheck/netcheck
-prog/docker_tls_args/docker_tls_args
+prog/weavewait/weavewait_nomcast
+prog/weaveutil/weaveutil
+prog/*/Dockerfile.weaveworks
+prog/kube-utils/kube-utils
+prog/weave-kube/kube-utils
+prog/weave-npc/weave-npc
+prog/plugin/plugin
 testing/cover/cover
 testing/runner/runner
 releases
-.weaver.uptodate
-.weavedns.uptodate
-.weaveexec.uptodate
-weave.tar.gz
-prog/weaveexec/weave
+.*.uptodate
+weave*.tar.gz
+prog/weaver/weave
 prog/weaveexec/weavehosts
-prog/weaveexec/weaveproxy
 prog/weaveexec/weavewait
 prog/weaveexec/weavewait_noop
+prog/weaveexec/weavewait_nomcast
 prog/weaveexec/sigproxy
-prog/weaveexec/netcheck
-prog/weaveexec/docker_tls_args
-prog/weaveexec/docker*.tgz
+prog/weaver/weaveutil
+prog/weaveexec/docker*
 Vagrantfile.local
+test/tls/tls
 test/tls/*.pem
 test/coverage
 test/coverage.*
+test/images/network-tester/webserver
+*qemu-*-static
+terraform.tfstate
+terraform.tfstate.backup
+prog/net-plugin/rootfs/
+
+# Website
+site-build

.lintignore

@@ -0,0 +1,26 @@
+# IMPORTANT: Please only use GLOBs to ignore files and directories.
+
+# Do not lint the below bash scripts in Weave Net, in order to 
+# avoid breaking the build on make lint:
+bin/circle-deploy-issues
+bin/circle-deploy-master
+bin/circle-test-teardown
+bin/circle-test-unit
+bin/install-wordepress
+bin/multiweave
+bin/publish-site
+bin/release
+build/build.sh
+prog/weave-kube/launch.sh
+prog/weaveexec/symlink
+test/*_test.sh
+test/600_proxy_docker_py.sh
+test/assert.sh
+test/config.sh
+test/gce.sh
+test/gen_coverage_reports.sh
+test/run_all.sh
+test/sanity_check.sh
+test/setup.sh
+vendor/*.sh
+weave

.ruby-version

@@ -0,0 +1 @@
+2.6.2

.travis.yml

@@ -1,28 +0,0 @@
-language: go
-sudo: false
-go:
-  - 1.4
-
-env:
-  - PATH="${PATH}:${HOME}/.local/bin"
-
-addons:
-  apt:
-    packages:
-    - libpcap-dev
-
-install:
-  - go clean -i net
-  - go install -tags netgo std
-  - go get github.com/golang/lint/golint
-  - pip install --user --upgrade gsutil
-  - bin/setup-ci-secrets $encrypted_5ba036e89377_key $encrypted_5ba036e89377_iv
-  - make travis
-  - go get ./...
-
-script:
-  - make tests
-
-after_success:
-  - go get github.com/mattn/goveralls
-  - test "${TRAVIS_PULL_REQUEST}" = "false" && site/build-and-publish.sh

CONTRIBUTING.md

@@ -0,0 +1,51 @@
+Thanks for your interest in contributing to this project and for
+taking the time to read this guide.
+
+# Code of conduct
+
+**Be respectful:** disagreements between people are to be expected and are usually the sign of healthy debate and engagement. Disagreements can lead to frustration and even anger for some members. Turning to personal insults, intimidation or threatening behaviour does not improve the situation. Participants should thus take care to ensure all communications / interactions stay professional at all times.
+
+**Be considerate:** remember that the community has members with a diverse background, many of whom have English as a second language. What might appear impolite, may simply be a result of a lack of knowledge of the English language. Bear in mind that actions will have an impact on other community members and the project as a whole, so take potential consequences into account before pursuing a course of action.
+
+**Be forgiving:** humans are fallible and as such prone to make mistakes and inexplicably change their positions at times. Don't assume that other members are acting with malicious intent. Be prepared to forgive people who make mistakes and assist each other in learning from them. Playing a blame game doesn't help anyone.
+
+# Issues
+* Before reporting an issue make sure you search first if anybody has already reported a similar issue and whether or not it has been fixed.
+* Make sure your issue report sufficiently details the problem:
+ * If you set up weave in some way other than that described by our [main instructions](https://github.com/zettio/weave#installation), please mention that.
+ * Include step-by-step instructions to reproduce the issue.
+ * State the OS platform you are using, i.e. `uname -a`
+ * `iptables` rules and firewalls can have a great impact on any Linux network; please note whether you have set up any rules and/or are running a firewall on your machine(s).
+* If you want to tackle any open issue, make sure you let people know you are working on it.
+
+## Pull Requests
+* Please be generous describing your changes.
+* Although it is highly suggested to include tests, they are not a hard requirement in order to get your contributions accepted.
+* Keep pull requests small so core developers can review them quickly.
+* Keep each pull request focused on a specific topic.  If you have two things to change, create two pull requests. This helps reviewers to understand the meat of your contribution.
+
+## Managing Vendored Dependencies
+
+We copy all Go dependencies into the `vendor` subdirectory and use
+[`dep`](https://github.com/golang/dep) to manage them.
+
+If you add a dependency in the code, run `dep ensure` to include it in
+the config and vendor dir. Same if you remove a dependency from the code.
+
+To update a single dependency run `dep ensure -update github.com/foo/bar`
+
+To override `dep`'s choice of library version, you can add
+[rules](https://golang.github.io/dep/docs/daily-dep.html#rule-changes-in-gopkgtoml).
+Please add a comment saying why the override is necessary and when it can be
+removed.
+
+These operations result in staged but uncommitted changes to your
+branch; you will need to commit them as normal. Execute them in the
+root of your checkout.
+
+## Workflow
+See [WorkingOnWeave](https://github.com/weaveworks/weave/wiki/WorkingOnWeave)
+
+# Acknowledgements
+
+Much of this taken from https://github.com/cloudescape/gowsdl/blob/master/CONTRIBUTING.md

CONTRIBUTORS

@@ -1,5 +0,0 @@
-This file lists all individuals having contributed content to the
-repository.
-
-Matthew Sackman <matthew@wellquite.org>
-Matthias Radestock <matthias.radestock@gmail.com>

COPYING.LGPL-3

@@ -0,0 +1,175 @@
+./test/assert.sh is a copy of
+
+	https://github.com/lehmannro/assert.sh/blob/master/assert.sh
+
+Since it was imported from its original source, it has only received
+cosmetic modifications. As it is licensed under the LGPL-3, here's the
+license text in its entirety:
+
+
+
+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.

DEPENDENCIES

@@ -0,0 +1,3 @@
+DOCKER_VERSION=19.03.1
+KUBERNETES_VERSION=1.14.0
+KUBERNETES_CNI_VERSION=0.7.5

Gopkg.toml

@@ -0,0 +1,34 @@
+# Pin to version before sctp was added, because latest libnetwork is
+# incompatible with latest sctp
+[[constraint]]
+  name = "github.com/docker/libnetwork"
+  revision = "119badbd"
+
+# Encourage dep not to use the docker-1.9 version
+[[constraint]]
+  name = "github.com/fsouza/go-dockerclient"
+  version = "1"
+
+# Use recent version: last tagged version is years old
+[[constraint]]
+  branch = "master"
+  name = "github.com/prometheus/client_golang"
+
+# For compatibility with fsouza/go-dockerclient
+[[constraint]]
+  branch = "master"
+  name = "github.com/docker/docker"
+
+# Most recent release tag is incompatible with docker/docker; see https://github.com/docker/distribution/issues/2503
+[[override]]
+  branch = "master"
+  name = "github.com/docker/distribution"
+
+# v8.0.0 removes juju/ratelimit licensed under LGPL3
+[[constraint]]
+  name = "k8s.io/client-go"
+  revision = "v8.0.0"
+
+[prune]
+  go-tests = true
+  unused-packages = true

LICENSE

@@ -176,7 +176,7 @@
 
    END OF TERMS AND CONDITIONS
 
-   Copyright 2014-2015 Weaveworks Ltd.
+   Copyright 2014-2017 Weaveworks Ltd.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

Makefile

@@ -1,148 +1,441 @@
-PUBLISH=publish_weave publish_weaveexec
-
 .DEFAULT: all
-.PHONY: all update tests lint publish $(PUBLISH) clean clean-bin prerequisites build travis run-smoketests
+.PHONY: all exes testrunner update tests lint publish-one-arch $(PUBLISH) clean clean-bin clean-work-dir prerequisites build run-smoketests
 
 # If you can use docker without being root, you can do "make SUDO="
-SUDO=sudo
+SUDO=$(shell docker info >/dev/null 2>&1 || echo "sudo -E")
+BUILD_IN_CONTAINER=true
+RM=--rm
+RUN_FLAGS=-ti
+COVERAGE=
 
-DOCKERHUB_USER=weaveworks
-WEAVE_VERSION=git-$(shell git rev-parse --short=12 HEAD)
+# This specifies the architecture we're building for
+ARCH?=amd64
 
+# We're using QEMU to be able to build Docker images for other architectures
+# from amd64 machines.
+QEMU_VERSION=v2.7.0
+
+# A list of all supported architectures here. Should be named as Go is naming platforms
+# All supported architectures must have an "ifeq" block below that customizes the parameters
+ALL_ARCHITECTURES=amd64 arm arm64 ppc64le s390x
+ML_PLATFORMS=linux/amd64,linux/arm,linux/arm64,linux/ppc64le,linux/s390x
+
+ifeq ($(ARCH),amd64)
+# The architecture to use when downloading the docker binary
+	WEAVEEXEC_DOCKER_ARCH?=x86_64
+
+# The name of the alpine baseimage to use as the base for weave images
+	ALPINE_BASEIMAGE?=alpine:3.10
+
+# The extension for the made images
+# Specifying none means for example weaveworks/weave:latest
+	ARCH_EXT?=
+
+# The name of the gcc we're using for compiling C code
+	CC=gcc
+
+# Optional parameters that can be passed when linking C code into the Go binary
+	CGO_LDFLAGS=
+endif
+ifeq ($(ARCH),arm)
+# The architecture to use when downloading the docker binary
+	WEAVEEXEC_DOCKER_ARCH?=armel
+
+# Using the (semi-)official alpine image
+	ALPINE_BASEIMAGE?=arm32v6/alpine:3.8
+
+# arm images have the -arm suffix, for instance weaveworks/weave-arm:latest
+	ARCH_EXT?=-arm
+
+# The name of the gcc binary
+	CC=arm-linux-gnueabihf-gcc
+
+# The architecture name to use when downloading a prebuilt QEMU binary
+	QEMUARCH=arm
+
+# In the weaveworks/build image; libpcap libraries for arm are placed here
+# Tell the gcc linker to search for libpcap here
+	CGO_LDFLAGS="-L/usr/local/lib/$(CC)"
+endif
+ifeq ($(ARCH),arm64)
+# Use the arm 32-bit docker client variant
+	WEAVEEXEC_DOCKER_ARCH?=armel
+
+# Using the (semi-)official alpine image
+	ALPINE_BASEIMAGE?=arm64v8/alpine:3.8
+
+# arm64 images have the -arm64 suffix, for instance weaveworks/weave-arm64:latest
+	ARCH_EXT?=-arm64
+
+# The name of the gcc binary
+	CC=aarch64-linux-gnu-gcc
+
+# The architecture name to use when downloading a prebuilt QEMU binary
+	QEMUARCH=aarch64
+
+# In the weaveworks/build image; libpcap libraries for arm64 are placed here
+# Tell the gcc linker to search for libpcap here
+	CGO_LDFLAGS="-L/usr/local/lib/$(CC)"
+endif
+ifeq ($(ARCH),ppc64le)
+# The architecture to use when downloading the docker binary
+	WEAVEEXEC_DOCKER_ARCH?=ppc64le
+
+# Using the (semi-)official alpine image
+	ALPINE_BASEIMAGE?=ppc64le/alpine:3.8
+
+# ppc64le images have the -ppc64le suffix, for instance weaveworks/weave-ppc64le:latest
+	ARCH_EXT?=-ppc64le
+
+# The name of the gcc binary
+	CC=powerpc64le-linux-gnu-gcc
+
+# The architecture name to use when downloading a prebuilt QEMU binary
+	QEMUARCH=ppc64le
+
+# In the weaveworks/build image; libpcap libraries for ppc64le are placed here
+# Tell the gcc linker to search for libpcap here
+	CGO_LDFLAGS="-L/usr/local/lib/$(CC)"
+endif
+ifeq ($(ARCH),s390x)
+# The architecture to use when downloading the docker binary
+	WEAVEEXEC_DOCKER_ARCH?=s390x
+
+# Using the (semi-)official alpine image
+	ALPINE_BASEIMAGE?=s390x/alpine:3.6
+
+# s390x images have the -s390x suffix, for instance weaveworks/weave-s390x:latest
+	ARCH_EXT?=-s390x
+
+# The name of the gcc binary
+	CC=s390x-linux-gnu-gcc
+
+# The architecture name to use when downloading a prebuilt QEMU binary
+	QEMUARCH=s390x
+
+# In the weaveworks/build image; libpcap libraries for s390x are placed here
+# Tell the gcc linker to search for libpcap here
+	CGO_LDFLAGS="-L/usr/local/lib/$(CC)"
+endif
+
+# The name of the user that this Makefile should produce image artifacts for. Can/should be overridden
+DOCKERHUB_USER?=weaveworks
+# The default version that's chosen when pushing the images. Can/should be overridden
+GIT_REVISION=$(shell git rev-parse HEAD)
+WEAVE_VERSION?=git-$(shell git rev-parse --short=12 HEAD)
+# Docker Store does not allow the "latest" tag.
+NET_PLUGIN_LATEST=latest_release
+
+# Paths to all relevant binaries that should be compiled
 WEAVER_EXE=prog/weaver/weaver
-WEAVEPROXY_EXE=prog/weaveproxy/weaveproxy
 SIGPROXY_EXE=prog/sigproxy/sigproxy
+KUBEUTILS_EXE=prog/kube-utils/kube-utils
+WEAVENPC_EXE=prog/weave-npc/weave-npc
 WEAVEWAIT_EXE=prog/weavewait/weavewait
 WEAVEWAIT_NOOP_EXE=prog/weavewait/weavewait_noop
-NETCHECK_EXE=prog/netcheck/netcheck
-DOCKERTLSARGS_EXE=prog/docker_tls_args/docker_tls_args
+WEAVEWAIT_NOMCAST_EXE=prog/weavewait/weavewait_nomcast
+WEAVEUTIL_EXE=prog/weaveutil/weaveutil
 RUNNER_EXE=tools/runner/runner
+# Get this from https://github.com/estesp/manifest-tool/releases
+MANIFEST_TOOL_CMD=manifest-tool
+TEST_TLS_EXE=test/tls/tls
+NETWORKTESTER_EXE=test/images/network-tester/webserver
 
-EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(NETCHECK_EXE) $(DOCKERTLSARGS_EXE)
+# All binaries together in a list
+EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(KUBEUTILS_EXE) $(WEAVENPC_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVEUTIL_EXE) $(RUNNER_EXE) $(TEST_TLS_EXE) $(NETWORKTESTER_EXE)
 
-WEAVER_UPTODATE=.weaver.uptodate
-WEAVEEXEC_UPTODATE=.weaveexec.uptodate
+# These stamp files are used to mark the current state of the build; whether an image has been built or not
+BUILD_UPTODATE=.build.uptodate
+WEAVER_UPTODATE=.weaver$(ARCH_EXT).uptodate
+WEAVEEXEC_UPTODATE=.weaveexec$(ARCH_EXT).uptodate
+PLUGIN_UPTODATE=.net-plugin$(ARCH_EXT).uptodate
+WEAVEKUBE_UPTODATE=.weavekube$(ARCH_EXT).uptodate
+WEAVENPC_UPTODATE=.weavenpc$(ARCH_EXT).uptodate
+WEAVEDB_UPTODATE=.weavedb.uptodate
+NETWORKTESTER_UPTODATE=.networktester$(ARCH_EXT).uptodate
 
-IMAGES_UPTODATE=$(WEAVER_UPTODATE) $(WEAVEEXEC_UPTODATE)
+IMAGES_UPTODATE=$(WEAVER_UPTODATE) $(WEAVEEXEC_UPTODATE) $(WEAVEKUBE_UPTODATE) $(WEAVENPC_UPTODATE) $(NETWORKTESTER_UPTODATE)
 
-WEAVER_IMAGE=$(DOCKERHUB_USER)/weave
-WEAVEEXEC_IMAGE=$(DOCKERHUB_USER)/weaveexec
+# The names of the images. Note that the images for other architectures than amd64 have a suffix in the image name.
+WEAVER_IMAGE=$(DOCKERHUB_USER)/weave$(ARCH_EXT)
+WEAVEEXEC_IMAGE=$(DOCKERHUB_USER)/weaveexec$(ARCH_EXT)
+WEAVEKUBE_IMAGE=$(DOCKERHUB_USER)/weave-kube$(ARCH_EXT)
+WEAVENPC_IMAGE=$(DOCKERHUB_USER)/weave-npc$(ARCH_EXT)
+BUILD_IMAGE=weaveworks/weavebuild
+WEAVEDB_IMAGE=$(DOCKERHUB_USER)/weavedb
+PLUGIN_IMAGE=$(DOCKERHUB_USER)/net-plugin
+NETWORKTESTER_IMAGE=$(DOCKERHUB_USER)/network-tester
 
-IMAGES=$(WEAVER_IMAGE) $(WEAVEEXEC_IMAGE)
+IMAGES=$(WEAVER_IMAGE) $(WEAVEEXEC_IMAGE) $(WEAVEKUBE_IMAGE) $(WEAVENPC_IMAGE) $(WEAVEDB_IMAGE) $(NETWORKTESTER_IMAGE)
 
-WEAVE_EXPORT=weave.tar.gz
+PLUGIN_WORK_DIR="prog/net-plugin/rootfs"
+PLUGIN_BUILD_IMG="plugin-builder"
 
-WEAVEEXEC_DOCKER_VERSION=1.6.2
-DOCKER_DISTRIB=prog/weaveexec/docker-$(WEAVEEXEC_DOCKER_VERSION).tgz
-DOCKER_DISTRIB_URL=https://get.docker.com/builds/Linux/x86_64/docker-$(WEAVEEXEC_DOCKER_VERSION).tgz
-NETGO_CHECK=@strings $@ | grep cgo_stub\\\.go >/dev/null || { \
-	rm $@; \
-	echo "\nYour go standard library was built without the 'netgo' build tag."; \
-	echo "To fix that, run"; \
-	echo "    sudo go clean -i net"; \
-	echo "    sudo go install -tags netgo std"; \
-	false; \
-}
-BUILD_FLAGS=-ldflags "-extldflags \"-static\" -X main.version $(WEAVE_VERSION)" -tags netgo
+PUBLISH=publish_weave publish_weaveexec publish_weave-kube publish_weave-npc
+PUSH_ML=push_ml_weave push_ml_weaveexec push_ml_weave-kube push_ml_weave-npc
+
+WEAVE_EXPORT=weave$(ARCH_EXT).tar.gz
+
+# The flags we are passing to go build. -extldflags -static for making a static binary, 
+# -X main.version for telling the Go binary which version it is,
+# -s -w drop symbol tables used by debuggers (not Go's internal symbol info)
+# -tags "osusergo netgo" to use native Go UID and DNS implementations
+BUILD_FLAGS=-ldflags "-extldflags -static -X main.version=$(WEAVE_VERSION) -s -w" -tags "osusergo netgo"
 
 PACKAGE_BASE=$(shell go list -e ./)
 
-all: $(WEAVE_EXPORT) $(RUNNER_EXE)
+all: $(WEAVE_EXPORT)
+testrunner: $(RUNNER_EXE) $(TEST_TLS_EXE)
 
-travis: $(EXES)
+$(WEAVER_EXE) $(WEAVEUTIL_EXE): common/*.go common/*/*.go net/*.go net/*/*.go
+$(WEAVER_EXE): router/*.go ipam/*.go ipam/*/*.go db/*.go nameserver/*.go prog/weaver/*.go
+$(WEAVER_EXE): api/*.go plugin/*.go plugin/*/*
+$(WEAVER_EXE):  proxy/*.go
+$(WEAVEUTIL_EXE): prog/weaveutil/*.go net/*.go plugin/net/*.go plugin/ipam/*.go db/*.go
+$(SIGPROXY_EXE): prog/sigproxy/*.go
+$(KUBEUTILS_EXE): prog/kube-utils/*.go
+$(WEAVENPC_EXE): prog/weave-npc/*.go npc/*.go npc/*/*.go
+$(TEST_TLS_EXE): test/tls/*.go
+$(RUNNER_EXE): tools/runner/*.go
+$(WEAVEWAIT_NOOP_EXE): prog/weavewait/*.go
+$(WEAVEWAIT_EXE): prog/weavewait/*.go net/*.go
+$(WEAVEWAIT_NOMCAST_EXE): prog/weavewait/*.go net/*.go
+$(NETWORKTESTER_EXE): test/images/network-tester/*.go
+tests: tools/.git
+lint: tools/.git
 
-update:
-	go get -u -f -v -tags netgo $(addprefix ./,$(dir $(EXES)))
+ifeq ($(BUILD_IN_CONTAINER),true)
 
-$(WEAVER_EXE) $(WEAVEPROXY_EXE): common/*.go common/*/*.go net/*.go
+# This make target compiles all binaries inside of the weaveworks/build container
+# It bind-mounts the source into the container and passes all important variables
+exes $(EXES) tests lint: $(BUILD_UPTODATE)
+	$(SUDO) docker run $(RM) $(RUN_FLAGS) \
+	    -v $(shell pwd):/go/src/github.com/weaveworks/weave \
+		-e GOARCH=$(ARCH) -e CGO_ENABLED=1 -e GOOS=linux -e CIRCLECI -e CIRCLE_BUILD_NUM -e CIRCLE_NODE_TOTAL -e CIRCLE_NODE_INDEX -e COVERDIR -e SLOW -e DEBUG \
+		$(BUILD_IMAGE) COVERAGE=$(COVERAGE) WEAVE_VERSION=$(WEAVE_VERSION) CC=$(CC) QEMUARCH=$(QEMUARCH) CGO_LDFLAGS=$(CGO_LDFLAGS) $@
+	touch $@
+
+else
+
+exes: $(EXES)
+
+$(WEAVER_EXE):
 ifeq ($(COVERAGE),true)
-	$(eval COVERAGE_MODULES := $(shell (go list ./$(@D); go list -f '{{join .Deps "\n"}}' ./$(@D) | grep "^$(PACKAGE_BASE)/") | paste -s -d,))
-	go get -t -tags netgo ./$(@D)
+	$(eval COVERAGE_MODULES := $(shell (go list ./$(@D); go list -f '{{join .Deps "\n"}}' ./$(@D) | grep "^$(PACKAGE_BASE)/") | grep -v "^$(PACKAGE_BASE)/vendor/" | paste -s -d,))
 	go test -c -o ./$@ $(BUILD_FLAGS) -v -covermode=atomic -coverpkg $(COVERAGE_MODULES) ./$(@D)/
 else
-	go get -tags netgo ./$(@D)
 	go build $(BUILD_FLAGS) -o $@ ./$(@D)
 endif
-	$(NETGO_CHECK)
 
-$(NETCHECK_EXE): common/*.go common/*/*.go net/*.go
-	go get -tags netgo ./$(@D)
+$(WEAVEUTIL_EXE) $(KUBEUTILS_EXE) $(WEAVENPC_EXE) $(NETWORKTESTER_EXE):
 	go build $(BUILD_FLAGS) -o $@ ./$(@D)
-	$(NETGO_CHECK)
 
-$(WEAVER_EXE): router/*.go mesh/*.go ipam/*.go ipam/*/*.go nameserver/*.go prog/weaver/*.go
-$(WEAVEPROXY_EXE): proxy/*.go prog/weaveproxy/main.go
-$(NETCHECK_EXE): prog/netcheck/netcheck.go
+$(WEAVEWAIT_EXE):
+	go build $(BUILD_FLAGS) -tags "osusergo netgo iface mcast" -o $@ ./$(@D)
 
-# Sigproxy and weavewait need separate rules as they fail the netgo check in
+$(WEAVEWAIT_NOMCAST_EXE):
+	go build $(BUILD_FLAGS) -tags "osusergo netgo iface" -o $@ ./$(@D)
+
+# These programs need a separate rule as they fail the netgo check in
 # the main build stanza due to not importing net package
-$(SIGPROXY_EXE): prog/sigproxy/main.go
-$(WEAVEWAIT_EXE): prog/weavewait/*.go net/*.go
-$(DOCKERTLSARGS_EXE): prog/docker_tls_args/*.go
-
-$(WEAVEWAIT_EXE) $(SIGPROXY_EXE) $(DOCKERTLSARGS_EXE):
-	go get -tags netgo ./$(@D)
+$(SIGPROXY_EXE) $(TEST_TLS_EXE) $(WEAVEWAIT_NOOP_EXE) $(RUNNER_EXE):
 	go build $(BUILD_FLAGS) -o $@ ./$(@D)
 
-$(WEAVEWAIT_NOOP_EXE): prog/weavewait/*.go
-	go get -tags netgo ./$(@D)
-	go build $(BUILD_FLAGS) -tags noop -o $@ ./$(@D)
+tests:
+	./tools/test -no-go-get -netgo -timeout 8m
 
-$(WEAVER_UPTODATE): prog/weaver/Dockerfile $(WEAVER_EXE)
-	$(SUDO) docker build -t $(WEAVER_IMAGE) prog/weaver
+lint:
+	./tools/lint -nocomment -notestpackage
+
+endif
+
+# This rule makes sure the build image is up-to-date.
+# It also makes sure the multiarch hooks are reqistered in the kernel so the QEMU emulation works
+$(BUILD_UPTODATE): build/* tools/.git
+	$(SUDO) docker build -t $(BUILD_IMAGE) build/
+	$(SUDO) docker tag $(BUILD_IMAGE) $(BUILD_IMAGE):$(shell tools/image-tag)
+	$(SUDO) docker run --rm --privileged multiarch/qemu-user-static:register --reset
 	touch $@
 
-$(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile $(DOCKER_DISTRIB) weave $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(NETCHECK_EXE) $(DOCKERTLSARGS_EXE)
-	cp weave prog/weaveexec/weave
+# Creates the Dockerfile.your-user-here file from the template
+# Also replaces all placeholders with real values
+# If the architecture is amd64, it deletes all CROSS_BUILD lines
+# but otherwise, it only removes the "CROSS_BUILD_" placeholder and downloads QEMU
+%/Dockerfile.$(DOCKERHUB_USER): %/Dockerfile.template
+	echo "DOCKERHUB_USER|$(DOCKERHUB_USER)|g;s|ARCH_EXT|$(ARCH_EXT)|g;s|ALPINE_BASEIMAGE|$(ALPINE_BASEIMAGE)|g;s|QEMUARCH|$(QEMUARCH)"
+	sed -e "s|DOCKERHUB_USER|$(DOCKERHUB_USER)|g;s|ARCH_EXT|$(ARCH_EXT)|g;s|ALPINE_BASEIMAGE|$(ALPINE_BASEIMAGE)|g;s|QEMUARCH|$(QEMUARCH)|g" $^ > $@
+ifeq ($(ARCH),amd64)
+# When building "normally" for amd64, remove the whole line, it has no part in the amd64 image
+	sed -i.bak "/CROSS_BUILD_/d" $@
+else
+# When cross-building, only the placeholder "CROSS_BUILD_" should be removed
+# Register /usr/bin/qemu-ARCH-static as the handler for ARM and ppc64le binaries in the kernel
+	curl -sSL https://github.com/multiarch/qemu-user-static/releases/download/$(QEMU_VERSION)/x86_64_qemu-$(QEMUARCH)-static.tar.gz | tar -xz -C $(shell dirname $@)
+	cd $(shell dirname $@) && sha256sum -c $(shell pwd)/build/shasums/qemu-$(QEMUARCH)-static.sha256sum
+	sed -i.bak "s/CROSS_BUILD_//g" $@
+endif
+
+# The targets below builds the weave images
+$(WEAVER_UPTODATE): prog/weaver/Dockerfile.$(DOCKERHUB_USER) $(WEAVER_EXE) weave $(WEAVEUTIL_EXE)
+	cp $(WEAVEUTIL_EXE) prog/weaver/weaveutil
+	cp weave prog/weaver/weave
+	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker build --build-arg=revision=$(GIT_REVISION) -f prog/weaver/Dockerfile.$(DOCKERHUB_USER) -t $(WEAVER_IMAGE) prog/weaver
+	touch $@
+
+$(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile.$(DOCKERHUB_USER) prog/weaveexec/symlink $(SIGPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVER_UPTODATE)
 	cp $(SIGPROXY_EXE) prog/weaveexec/sigproxy
-	cp $(WEAVEPROXY_EXE) prog/weaveexec/weaveproxy
 	cp $(WEAVEWAIT_EXE) prog/weaveexec/weavewait
 	cp $(WEAVEWAIT_NOOP_EXE) prog/weaveexec/weavewait_noop
-	cp $(NETCHECK_EXE) prog/weaveexec/netcheck
-	cp $(DOCKERTLSARGS_EXE) prog/weaveexec/docker_tls_args
-	cp $(DOCKER_DISTRIB) prog/weaveexec/docker.tgz
-	$(SUDO) docker build -t $(WEAVEEXEC_IMAGE) prog/weaveexec
+	cp $(WEAVEWAIT_NOMCAST_EXE) prog/weaveexec/weavewait_nomcast
+	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker build --build-arg=revision=$(GIT_REVISION) -f prog/weaveexec/Dockerfile.$(DOCKERHUB_USER) -t $(WEAVEEXEC_IMAGE) prog/weaveexec
 	touch $@
 
-$(WEAVE_EXPORT): $(IMAGES_UPTODATE)
-	$(SUDO) docker save $(addsuffix :latest,$(IMAGES)) | gzip > $@
+# Builds Docker plugin.
+$(PLUGIN_UPTODATE): prog/net-plugin/launch.sh prog/net-plugin/config.json $(WEAVER_UPTODATE)
+	-$(SUDO) docker rm -f $(PLUGIN_BUILD_IMG) 2>/dev/null
+	$(SUDO) docker create --name=$(PLUGIN_BUILD_IMG) $(WEAVER_IMAGE) true
+	rm -rf $(PLUGIN_WORK_DIR)
+	mkdir $(PLUGIN_WORK_DIR)
+	$(SUDO) docker export $(PLUGIN_BUILD_IMG) | tar -x -C $(PLUGIN_WORK_DIR)
+	$(SUDO) docker rm -f $(PLUGIN_BUILD_IMG)
+	cp prog/net-plugin/launch.sh $(PLUGIN_WORK_DIR)/home/weave/launch.sh
+	-$(SUDO) docker plugin disable $(PLUGIN_IMAGE):$(WEAVE_VERSION) 2>/dev/null
+	-$(SUDO) docker plugin rm $(PLUGIN_IMAGE):$(WEAVE_VERSION) 2>/dev/null
+	$(SUDO) docker plugin create $(PLUGIN_IMAGE):$(WEAVE_VERSION) prog/net-plugin
+	-$(SUDO) docker plugin disable $(PLUGIN_IMAGE):$(NET_PLUGIN_LATEST) 2>/dev/null
+	-$(SUDO) docker plugin rm $(PLUGIN_IMAGE):$(NET_PLUGIN_LATEST) 2>/dev/null
+	$(SUDO) docker plugin create $(PLUGIN_IMAGE):$(NET_PLUGIN_LATEST) prog/net-plugin
+	touch $@
 
-$(DOCKER_DISTRIB):
-	curl -o $(DOCKER_DISTRIB) $(DOCKER_DISTRIB_URL)
+$(WEAVEKUBE_UPTODATE): prog/weave-kube/Dockerfile.$(DOCKERHUB_USER) prog/weave-kube/launch.sh $(KUBEUTILS_EXE) $(WEAVER_UPTODATE)
+	cp $(KUBEUTILS_EXE) prog/weave-kube/
+	$(SUDO) docker build --build-arg=revision=$(GIT_REVISION) -f prog/weave-kube/Dockerfile.$(DOCKERHUB_USER) -t $(WEAVEKUBE_IMAGE) prog/weave-kube
+	touch $@
 
-tests: tools/.git
-	tools/test
+$(WEAVENPC_UPTODATE): prog/weave-npc/Dockerfile.$(DOCKERHUB_USER) $(WEAVENPC_EXE) prog/weave-npc/ulogd.conf
+	$(SUDO) docker build --build-arg=revision=$(GIT_REVISION) -f prog/weave-npc/Dockerfile.$(DOCKERHUB_USER) -t $(WEAVENPC_IMAGE) prog/weave-npc
+	touch $@
 
-lint: tools/.git
-	tools/lint -nocomment -notestpackage .
+$(WEAVEDB_UPTODATE): prog/weavedb/Dockerfile
+	$(SUDO) docker build --build-arg=revision=$(GIT_REVISION) -t $(WEAVEDB_IMAGE) prog/weavedb
+	touch $@
+
+$(NETWORKTESTER_UPTODATE): test/images/network-tester/Dockerfile $(NETWORKTESTER_EXE)
+	$(SUDO) docker build -t $(NETWORKTESTER_IMAGE) test/images/network-tester
+	touch $@
+
+$(WEAVE_EXPORT): $(IMAGES_UPTODATE) $(WEAVEDB_UPTODATE)
+	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker save $(addsuffix :latest,$(IMAGES)) | gzip > $@
 
 tools/.git:
 	git submodule update --init
 
-$(RUNNER_EXE): tools/.git
-	make -C tools/runner
+# CODE FOR PUBLISHING THE IMAGES
 
-$(PUBLISH): publish_%: $(IMAGES_UPTODATE)
-	$(SUDO) docker tag -f $(DOCKERHUB_USER)/$* $(DOCKERHUB_USER)/$*:$(WEAVE_VERSION)
-	$(SUDO) docker push   $(DOCKERHUB_USER)/$*:$(WEAVE_VERSION)
-ifneq ($(UPDATE_LATEST),false)
-	$(SUDO) docker push   $(DOCKERHUB_USER)/$*:latest
+# Push plugin
+plugin_publish: $(PLUGIN_UPTODATE)
+	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker plugin push $(PLUGIN_IMAGE):$(WEAVE_VERSION)
+# "$(NET_PLUGIN_LATEST)" means "stable release" here, so only push that if explicitly told to
+ifeq ($(UPDATE_LATEST),true)
+	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker plugin push $(PLUGIN_IMAGE):$(NET_PLUGIN_LATEST)
 endif
 
-publish: $(PUBLISH)
+# This target first runs "make publish" for each architecture
+# Then it pushes the manifest lists
+publish: $(addprefix sub-publish-,$(ALL_ARCHITECTURES)) $(WEAVEDB_UPTODATE)
+	$(MAKE) DOCKER_HOST=$(DOCKER_HOST) DOCKERHUB_USER=$(DOCKERHUB_USER) WEAVE_VERSION=$(WEAVE_VERSION) UPDATE_LATEST=$(UPDATE_LATEST) $(PUSH_ML)
+ifeq ($(PUBLISH_WEAVEDB),true)
+	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker push $(DOCKERHUB_USER)/weavedb:latest
+endif
+
+sub-publish-%:
+	$(MAKE) ARCH=$* DOCKER_HOST=$(DOCKER_HOST) clean-bin
+	$(MAKE) ARCH=$* DOCKER_HOST=$(DOCKER_HOST) DOCKERHUB_USER=$(DOCKERHUB_USER) WEAVE_VERSION=$(WEAVE_VERSION) UPDATE_LATEST=$(UPDATE_LATEST) $(IMAGES_UPTODATE)
+	$(MAKE) ARCH=$* DOCKER_HOST=$(DOCKER_HOST) DOCKERHUB_USER=$(DOCKERHUB_USER) WEAVE_VERSION=$(WEAVE_VERSION) UPDATE_LATEST=$(UPDATE_LATEST) publish-one-arch
+
+publish-one-arch: $(PUBLISH)
+
+# This rule handles the pushing of the built images
+$(PUBLISH): publish_%: $(IMAGES_UPTODATE)
+# Tag :latest with the real version
+	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker tag  $(DOCKERHUB_USER)/$*$(ARCH_EXT) $(DOCKERHUB_USER)/$*$(ARCH_EXT):$(WEAVE_VERSION)
+# Push the image with the arch suffix for arm, arm64 and ppc64le, and without suffix for amd64
+	$(MAKE) DOCKER_HOST=$(DOCKER_HOST) DOCKERHUB_USER=$(DOCKERHUB_USER) WEAVE_VERSION=$(WEAVE_VERSION) UPDATE_LATEST=$(UPDATE_LATEST) push_$*$(ARCH_EXT)
+
+ifeq ($(ARCH),amd64)
+# If the architecture is amd64, add the -amd64 suffix.
+	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker tag  $(DOCKERHUB_USER)/$*:$(WEAVE_VERSION) $(DOCKERHUB_USER)/$*-amd64:$(WEAVE_VERSION)
+# If the version is latest, tag the -amd64 with latest as well
+ifneq ($(UPDATE_LATEST),false)
+	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker tag  $(DOCKERHUB_USER)/$*-amd64:$(WEAVE_VERSION) $(DOCKERHUB_USER)/$*-amd64:latest
+endif
+# Push the image with the -amd64-suffix so BINARY-ARCH-named images exist for all arches, so manifest lists may be made and ARCH is replaceable in scripts
+	$(MAKE) DOCKER_HOST=$(DOCKER_HOST) DOCKERHUB_USER=$(DOCKERHUB_USER) WEAVE_VERSION=$(WEAVE_VERSION) UPDATE_LATEST=$(UPDATE_LATEST) push_$*-amd64
+endif
+
+# This target pushes an image, and if UPDATE_LATEST is anything but false, also updates the latest tag
+# It takes one parameter, the image name
+push_%:
+	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker push $(DOCKERHUB_USER)/$*:$(WEAVE_VERSION)
+ifneq ($(UPDATE_LATEST),false)
+	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker push $(DOCKERHUB_USER)/$*:latest
+endif
+
+# This target pushes a manifest list; it takes one parameter, the image name.
+# The variable UPDATE_LATEST controls whether it updates the versioned tag and/or the latest tag
+$(PUSH_ML): push_ml_%:
+ifneq ($(UPDATE_LATEST),latest-only)
+	$(MANIFEST_TOOL_CMD) push from-args --platforms $(ML_PLATFORMS) --template $(DOCKERHUB_USER)/$*-ARCH:$(WEAVE_VERSION) --target $(DOCKERHUB_USER)/$*:$(WEAVE_VERSION)
+endif
+ifneq ($(UPDATE_LATEST),false)
+# Push the manifest list to :latest as well
+	$(MANIFEST_TOOL_CMD) push from-args --platforms $(ML_PLATFORMS) --template $(DOCKERHUB_USER)/$*-ARCH:latest --target $(DOCKERHUB_USER)/$*:latest
+endif
+
+clean-work-dir:
+	rm -rf $(PLUGIN_WORK_DIR)
 
 clean-bin:
-	-$(SUDO) docker rmi $(IMAGES)
-	go clean -r $(addprefix ./,$(dir $(EXES)))
-	rm -f $(EXES) $(IMAGES_UPTODATE) $(WEAVE_EXPORT)
+	-$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker rmi $(IMAGES)
+	find prog -type f -name "Dockerfile.*" -not -name "Dockerfile.template" -print | xargs rm -f
+	find prog -type f -name "*qemu-*" -print | xargs rm -f
+	go clean ./...
+	rm -rf $(EXES) $(IMAGES_UPTODATE) $(WEAVEDB_UPTODATE) weave*.tar.gz .cache
 
-clean: clean-bin
-	rm -rf test/tls/*.pem test/coverage.* test/coverage
+clean: clean-bin clean-work-dir
+	-$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker rmi $(BUILD_IMAGE)
+	rm -rf test/tls/*.pem test/coverage.* test/coverage $(BUILD_UPTODATE)
 
 build:
-	$(SUDO) go clean -i net
-	$(SUDO) go install -tags netgo std
 	$(MAKE)
 
-run-smoketests: all
+run-smoketests: all testrunner
 	cd test && ./setup.sh && ./run_all.sh
+
+integration-tests: all testrunner
+# Usage:
+#   $ make \
+#     NAME="<prefix used to name VMs and other resources>" \
+#     PROVIDER="<provider among {vagrant|gcp|aws|do}>" \
+#     NUM_HOSTS="<# test machines>" \
+#     PLAYBOOK="<filename>" \
+#     RUNNER_ARGS="<...>" \
+#     TESTS="<...>" \  # Can be set to only run one or a few tests instead of the full test suite.
+#     DOCKER_VERSION=<...> \
+#     KUBERNETES_VERSION=<...> \
+#     KUBERNETES_CNI_VERSION=<...> \
+#     <...> # See also run-integration-test.sh for all variables and individual functions.
+#     integration-tests
+#
+	RUNNER_ARGS="-parallel" ./test/run-integration-tests.sh
+
+# This target is only intended for use in Netlify CI environment for generating preview pages on feature branches and pull requests.
+# We need to obtain website repository (checked out under `site-build`) and place `site` directory into the context (`site-build/_weave_net_docs`).
+# We then run make in `site-build` and Netlify will publish the output (`site-build/_site`).
+netlify-site-preview:
+	@mkdir -p site-build
+	@curl --user $(WEBSITE_GITHUB_USER) --silent 'https://codeload.github.com/weaveworks/website-next/tar.gz/$(WEBSITE_BRANCH)' \
+	  | tar --extract --gunzip --directory site-build --strip 1
+	@cp -r site site-build/_weave_net_docs
+	@$(MAKE) -C site-build netlify_ensure_install
+	@$(MAKE) -C site-build BUILD_ENV=netlify

NOTICE

@@ -1,3 +1,3 @@
 Weave
-Copyright 2014-2015 Weaveworks Ltd.
+Copyright 2014-2016 Weaveworks Ltd.
 This product includes software developed at Weaveworks Ltd.

README.md

@@ -1,174 +1,41 @@
-# Weave - weaving containers into applications
+# Weave Net - Weaving Containers into Applications
 
-[![Build Status](https://travis-ci.org/weaveworks/weave.svg?branch=master)](https://travis-ci.org/weaveworks/weave) [![Integration Tests](https://circleci.com/gh/weaveworks/weave/tree/master.svg?style=shield&circle-token=4933c7dabb3d0383e62117565cb9d16df7b1a811)](https://circleci.com/gh/weaveworks/weave) [![Coverage Status](https://coveralls.io/repos/weaveworks/weave/badge.svg)](https://coveralls.io/r/weaveworks/weave)
+[![Integration Tests](https://circleci.com/gh/weaveworks/weave/tree/master.svg?style=shield)](https://circleci.com/gh/weaveworks/weave)
+[![Coverage Status](https://coveralls.io/repos/weaveworks/weave/badge.svg)](https://coveralls.io/r/weaveworks/weave)
+[![Go Report Card](https://goreportcard.com/badge/github.com/weaveworks/weave)](https://goreportcard.com/report/github.com/weaveworks/weave)
+[![Docker Pulls](https://img.shields.io/docker/pulls/weaveworks/weave.svg?maxAge=604800)](https://hub.docker.com/r/weaveworks/weave/)
 
 # About Weaveworks
 
-[Weaveworks](http://weave.works) is the company that develops Weave -
-the most productive way for developers to connect, observe and control
-Docker containers. To learn about our products, including getting
-started tutorials, visit our [website](http://weave.works) and
-[documentation](http://docs.weave.works) or continue to read about
-some of the more technical aspects of Weave in this readme.
+[Weaveworks](https://www.weave.works) is the company that delivers the most productive way for developers to connect, observe and control Docker containers.
 
-# Weave
+This repository contains [Weave Net](https://www.weave.works/products/weave-net/), the first product developed by Weaveworks, with over 8 million downloads to date. Weave Net enables you to get started with Docker clusters and portable apps in a fraction of the time required by other solutions.
 
-Weave creates a virtual network that connects Docker containers
-deployed across multiple hosts and enables their automatic discovery.
+## Weave Cloud:
 
-![Weave Virtual Network](/docs/virtual-network.png?raw=true "Weave Virtual Network")
+[Weave Cloud](https://www.weave.works/product/cloud/) is software-as-a-service that simplifies deployment, monitoring and management for containers and microservices. It extends and complements popular orchestrators, and enables developers and DevOps to realize faster deployments, insightful monitoring, visualization and networking.
 
-Applications use the network just as if the containers were all
-plugged into the same network switch, with no need to configure port
-mappings, links, etc. Services provided by application containers on
-the weave network can be made accessible to the outside world,
-regardless of where those containers are running. Similarly, existing
-internal systems can be exposed to application containers irrespective
-of their location.
+Weave Cloud is built using these Open Source projects: [Weave Scope](https://www.weave.works/products/weave-scope/), a powerful container visualization tool that automatically maps Docker containers and their interactions, [Weave Cortex](https://github.com/weaveworks/cortex), a horizontally-scalable version of Prometheus, and [Weave Flux](https://www.weave.works/products/weave-flux/), a continuous deployment tool that works with Kubernetes.
 
-![Weave Deployment](/docs/deployment.png?raw=true "Weave Deployment")
+# Weave Net
 
-Weave can traverse firewalls and operate in partially connected
-networks. Traffic can be encrypted, allowing hosts to be connected
-across an untrusted network.
+Weave Net creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. With Weave Net, portable microservices-based applications consisting of multiple containers can run anywhere: on one host, multiple hosts or even across cloud providers and data centers. Applications use the network just as if the containers were all plugged into the same network switch, without having to configure port mappings, ambassadors or links.
 
-With weave you can easily construct applications consisting of
-multiple containers, running anywhere.
+Services provided by application containers on the Weave network can be exposed to the outside world, regardless of where they are running. Similarly, existing internal systems can be opened to accept connections from application containers irrespective of their location.
 
-Weave works alongside Docker's existing (single host) networking
-capabilities, so these can continue to be used by containers.
+## <a name="help"></a>Getting help
 
-## Installation
+If you have any questions about, feedback for or a problem with Weave Net:
 
-Ensure you are running Linux (kernel 3.8 or later) and have Docker
-(version 1.6.0 or later) installed. Then install weave with
+- Read [the Weave Net docs](https://www.weave.works/docs/net/latest/overview).
+- Invite yourself to the <a href="https://slack.weave.works/" target="_blank">Weave Users Slack</a>.
+  - The channel for contributors and developers of Weave Net is [#net-dev](https://weave-community.slack.com/messages/net-dev/).
+- Join the <a href="https://www.meetup.com/pro/Weave/"> Weave User Group </a> and get invited to online talks, hands-on training and meetups in your area.
+- [File an issue](https://github.com/weaveworks/weave/issues/new).
 
-    sudo curl -L git.io/weave -o /usr/local/bin/weave
-    sudo chmod a+x /usr/local/bin/weave
+Your feedback is always welcome!
 
-For usage on OSX (with Docker Machine) you first need to make sure
-that a VM is running and configured, as shown in [the Docker Machine
-documentation](https://docs.docker.com/installation/mac/#from-your-shell).
-Then you can launch weave directly from the OSX host.
+## Further Information
 
-CoreOS users see [here](https://github.com/fintanr/weave-gs/blob/master/coreos-simple/user-data) for an example of installing weave using cloud-config.
-
-Amazon ECS users see
-[here](https://github.com/weaveworks/guides/blob/master/aws-ecs/LATESTAMIs.md)
-for the latest Weave AMIs and
-[here](http://weave.works/guides/service-discovery-with-weave-aws-ecs.html) to get started with Weave on ECS.
-
-Weave respects the environment variable `DOCKER_HOST`, so you can run
-it locally to control a weave network on a remote host.
-
-## Quick Start Screencast
-
-<a href="https://youtu.be/kihQCCT1ykE" alt="Click to watch the screencast" target="_blank">
-  <img src="/docs/hello-screencast.png" />
-</a>
-
-## Example
-
-Say you have docker running on two hosts, accessible to each other as
-`$HOST1` and `$HOST2`, and want to deploy an application consisting of
-two containers, one on each host.
-
-On $HOST1 we run:
-
-    host1$ weave launch
-    host1$ eval $(weave env)
-    host1$ docker run --name a1 -ti ubuntu
-
-> NB: If the first command results in an error like
-> `http:///var/run/docker.sock/v1.19/containers/create: dial unix
-> /var/run/docker.sock: permission denied. Are you trying to connect
-> to a TLS-enabled daemon without TLS?` then you likely need to be
-> 'root' in order to connect to the Docker daemon. If so, run the
-> above and all subsequent commands in a *single* root shell (e.g. one
-> created with `sudo -s`). Do *not* prefix individual commands with
-> `sudo`, since some commands modify environment entries and hence
-> they all need to be executed from the same shell.
-
-The first line runs weave. The second line configures our environment
-so that containers launched via the docker command line are
-automatically attached to the weave network. Finally, we run our
-application container.
-
-That's it! If our application consists of more than one container on
-this host we simply launch them with `docker run` as appropriate.
-
-Next we repeat similar steps on `$HOST2`...
-
-    host2$ weave launch $HOST1
-    host2$ eval $(weave env)
-    host2$ docker run --name a2 -ti ubuntu
-
-The only difference, apart from the name of the application container,
-is that we tell our weave that it should peer with the weave on
-`$HOST1` (specified as the IP address or hostname, and optional
-`:port`, by which `$HOST2` can reach it). NB: if there is a firewall
-between `$HOST1` and `$HOST2`, you must permit traffic to the weave
-control port (TCP 6783) and data ports (UDP 6783/6784).
-
-Note that we could instead have told the weave on `$HOST1` to connect to
-`$HOST2`, or told both about each other. Order does not matter here;
-weave automatically (re)connects to peers when they become
-available. Also, we can tell weave to connect to multiple peers by
-supplying multiple addresses, separated by spaces. And we can
-[add peers dynamically](http://docs.weave.works/weave/latest_release/features.html#dynamic-topologies).
-
-Weave must be started once per host. The relevant container images are
-pulled down on demand, but if you wish you can preload them by running
-`weave setup` - this is particularly useful for automated deployments,
-and ensures that there are no delays during later operations.
-
-Now that we've got everything set up, let's see whether our containers
-can talk to each other...
-
-In the container started on `$HOST1`...
-
-    root@a1:/# ping -c 1 -q a2
-    PING a2.weave.local (10.40.0.2) 56(84) bytes of data.
-    --- a2.weave.local ping statistics ---
-    1 packets transmitted, 1 received, 0% packet loss, time 0ms
-    rtt min/avg/max/mdev = 0.341/0.341/0.341/0.000 ms
-
-Similarly, in the container started on `$HOST2`...
-
-    root@a2:/# ping -c 1 -q a1
-    PING a1.weave.local (10.32.0.2) 56(84) bytes of data.
-    --- a1.weave.local ping statistics ---
-    1 packets transmitted, 1 received, 0% packet loss, time 0ms
-    rtt min/avg/max/mdev = 0.366/0.366/0.366/0.000 ms
-
-So there we have it, two containers on separate hosts happily talking
-to each other.
-
-## Find out more
-
- * [Documentation homepage](http://docs.weave.works/weave/latest_release/)
- * [Getting Started Guides](http://weave.works/guides/)
- * [Features](http://docs.weave.works/weave/latest_release/features.html)
- * [Troubleshooting](http://docs.weave.works/weave/latest_release/troubleshooting.html)
- * [Building](http://docs.weave.works/weave/latest_release/building.html)
- * [How it works](http://docs.weave.works/weave/latest_release/how-it-works.html)
-
-## Contact Us
-
-Found a bug, want to suggest a feature, or have a question?  You can
-[File an issue](https://github.com/weaveworks/weave/issues).  And
-there is a [Weave Users Google
-Group](https://groups.google.com/a/weave.works/forum/#!forum/weave-users),
-which you can post to by email at weave-users@weave.works.  Or you can
-contact Weaveworks directly at help@weave.works. When reporting a
-bug, please include which version of weave you are running, as shown
-by `weave version`.
-
-Follow on Twitter:
-[@weaveworks](https://twitter.com/weaveworks).
-
-Read the Weave blog:
-[Weaveblog](http://weaveblog.com/).
-
-IRC:
-[#weavenetwork](https://botbot.me/freenode/weavenetwork/)
+* [Installing Weave Net](https://www.weave.works/docs/net/latest/install/installing-weave)
+* [Weave Net Product Overview](https://www.weave.works/products/weave-net)

SECURITY.md

@@ -0,0 +1,14 @@
+# Security Policy
+
+At Weaveworks we take security very seriously, and value our close relationship with members of the security community.
+
+## Supported Versions
+
+As an Open Source project, only the latest code has all fixes and security patches.
+If you require a higher level of commitment, please [contact Weaveworks](https://www.weave.works/contact/) to discuss.
+
+## Reporting a Vulnerability
+
+To submit a security bug report please e-mail us at security@weave.works.
+
+We also operate a Bug Bounty programme; see https://www.weave.works/bug-bounty/

VENDORED_CODE.md

@@ -0,0 +1,17 @@
+# Use of vendored code in Weave Net
+
+Weave Net is licensed under the [Apache 2.0 license](LICENSE).
+
+Some vendored code is under different licenses though, all of them ship the
+entire license text they are under.
+
+- https://github.com/weaveworks/go-checkpoint
+  can be found in the ./vendor/ directory, is under MPL-2.0.
+
+- Pulled in by dependencies are  
+  https://github.com/hashicorp/golang-lru (MPL-2.0)  
+  https://github.com/hashicorp/go-cleanhttp (MPL-2.0)  
+  https://github.com/opencontainers/go-digest (docs are under CC by-sa 4.0)
+
+[One file used in tests](COPYING.LGPL-3) is under LGPL-3, that's why we ship
+the license text in this repository.

Vagrantfile

@@ -1,41 +1,36 @@
-VAGRANTFILE_API_VERSION = "2"
-
-require './vagrant-common.rb'
+require File.expand_path(File.join(File.dirname(__FILE__), 'vagrant-common.rb'))
 
 vm_ip = "172.16.0.3" # arbitrary private IP
 
-pkgs = %w(
-  docker-engine
-  aufs-tools
-  build-essential
-  ethtool
-  iputils-arping
-  libpcap-dev
-  git
-  mercurial
-  bc
-)
-
 Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
 
-  config.vm.box = "ubuntu/ubuntu-15.04-amd64"
-  config.vm.box_url = "https://cloud-images.ubuntu.com/vagrant/vivid/current/vivid-server-cloudimg-amd64-vagrant-disk1.box"
+  config.vm.box = VAGRANT_IMAGE
 
   config.vm.network "private_network", ip: vm_ip
   config.vm.provider :virtualbox do |vb|
-    vb.customize ["modifyvm", :id, "--natdnshostresolver1", "off"]
-    vb.customize ["modifyvm", :id, "--natdnsproxy1", "off"]
+    vb.memory = 2048
+    configure_nat_dns(vb)
   end
 
+  # Disable default Vagrant shared folder, which we don't need:
   config.vm.synced_folder ".", "/vagrant", disabled: true
+  # Keep Weave Net sources' in sync:
   config.vm.synced_folder ".", "/home/vagrant/src/github.com/weaveworks/weave"
+  # Create a convenience symlink to $HOME/src/github.com/weaveworks/weave
+  config.vm.provision :shell, :inline => 'ln -sf ~vagrant/src/github.com/weaveworks/weave ~vagrant/'
 
-  install_build_deps config.vm, pkgs
-  install_go_toochain config.vm
-  tweak_user_env config.vm
-  tweak_docker_daemon config.vm
+  # Set SSH keys up to be able to run smoke tests straightaway:
+  config.vm.provision "file", source: "~/.vagrant.d/insecure_private_key", destination: "/home/vagrant/src/github.com/weaveworks/weave/test/insecure_private_key"
+  # Grant permissions on sources:
+  config.vm.provision :shell, :inline => 'sudo chown -R vagrant:vagrant ~vagrant/src', :privileged => false
   cleanup config.vm
 
+  config.vm.provision 'ansible' do |ansible|
+    ansible.playbook = 'tools/config_management/setup_weave-net_dev.yml'
+    ansible.extra_vars = {
+      go_version: GO_VERSION
+    }.merge(ansibleize(get_dependencies_version_from_file_and_env()))
+  end
 end
 
 begin

api/dns.go

@@ -0,0 +1,22 @@
+package api
+
+import (
+	"fmt"
+	"net/url"
+)
+
+func (client *Client) DNSDomain() (string, error) {
+	return client.httpVerb("GET", "/domain", nil)
+}
+
+func (client *Client) RegisterWithDNS(ID string, fqdn string, ip string) error {
+	data := url.Values{}
+	data.Add("fqdn", fqdn)
+	_, err := client.httpVerb("PUT", fmt.Sprintf("/name/%s/%s", ID, ip), data)
+	return err
+}
+
+func (client *Client) DeregisterWithDNS(ID string, ip string) error {
+	_, err := client.httpVerb("DELETE", fmt.Sprintf("/name/%s/%s", ID, ip), nil)
+	return err
+}

api/ipam.go

@@ -0,0 +1,87 @@
+package api
+
+import (
+	"fmt"
+	"net"
+	"net/url"
+)
+
+// Special token used in place of a container identifier when:
+// - the caller does not know the container ID, or
+// - the caller is unsure whether IPAM was previously told the container ID.
+//
+// While addresses are typically stored under their container IDs, when this
+// token is used, the address will be stored under its own string, something
+// which should be kept in mind if the entry needs to be removed at any point.
+const NoContainerID string = "_"
+
+func (client *Client) ipamOp(ID string, op string, values url.Values) (*net.IPNet, error) {
+	ip, err := client.httpVerb(op, fmt.Sprintf("/ip/%s", ID), values)
+	if err != nil {
+		return nil, err
+	}
+	return parseIP(ip)
+}
+
+func ipamValues(checkAlive bool) url.Values {
+	values := make(url.Values)
+	if checkAlive {
+		values.Set("check-alive", "true")
+	}
+	return values
+}
+
+// returns an IP for the ID given, allocating a fresh one if necessary
+func (client *Client) AllocateIP(ID string, checkAlive bool) (*net.IPNet, error) {
+	return client.ipamOp(ID, "POST", ipamValues(checkAlive))
+}
+
+func (client *Client) AllocateIPInSubnet(ID string, subnet *net.IPNet, checkAlive bool) (*net.IPNet, error) {
+	ip, err := client.httpVerb("POST", fmt.Sprintf("/ip/%s/%s", ID, subnet), ipamValues(checkAlive))
+	if err != nil {
+		return nil, err
+	}
+	return parseIP(ip)
+}
+
+// returns an IP for the ID given, or nil if one has not been
+// allocated
+func (client *Client) LookupIP(ID string) (*net.IPNet, error) {
+	return client.ipamOp(ID, "GET", nil)
+}
+
+// Claim a specific IP on behalf of the ID
+func (client *Client) ClaimIP(ID string, cidr *net.IPNet, checkAlive bool) error {
+	_, err := client.httpVerb("PUT", fmt.Sprintf("/ip/%s/%s", ID, cidr), ipamValues(checkAlive))
+	return err
+}
+
+// release all IPs owned by an ID
+func (client *Client) ReleaseIPsFor(ID string) error {
+	_, err := client.httpVerb("DELETE", fmt.Sprintf("/ip/%s", ID), nil)
+	return err
+}
+
+// release all IP space owned by a peer
+func (client *Client) RmPeer(peerName string) (string, error) {
+	result, err := client.httpVerb("DELETE", fmt.Sprintf("/peer/%s", peerName), nil)
+	return result, err
+}
+
+func (client *Client) DefaultSubnet() (*net.IPNet, error) {
+	cidr, err := client.httpVerb("GET", fmt.Sprintf("/ipinfo/defaultsubnet"), nil)
+	if err != nil {
+		return nil, err
+	}
+	_, ipnet, err := net.ParseCIDR(cidr)
+	return ipnet, err
+}
+
+func parseIP(body string) (*net.IPNet, error) {
+	ip, ipnet, err := net.ParseCIDR(string(body))
+	if err != nil {
+		return nil, err
+	}
+	ipnet.IP = ip
+	return ipnet, nil
+}

api/router.go

@@ -0,0 +1,19 @@
+package api
+
+import (
+	"fmt"
+	"net"
+	"net/url"
+)
+
+// Expose calls the router to assign the given IP addr to the weave bridge.
+func (client *Client) Expose(ipAddr *net.IPNet) error {
+	_, err := client.httpVerb("POST", fmt.Sprintf("/expose/%s", ipAddr), nil)
+	return err
+}
+
+// ReplacePeers replace the current set of peers
+func (client *Client) ReplacePeers(peers []string) error {
+	_, err := client.httpVerb("POST", "/connect", url.Values{"replace": {"true"}, "peer": peers})
+	return err
+}

api/weaveapi.go

@@ -0,0 +1,99 @@
+package api
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+const (
+	WeaveHTTPHost = "127.0.0.1"
+	WeaveHTTPPort = 6784
+)
+
+type Client struct {
+	baseURL string
+	log     Logger
+}
+
+func (client *Client) httpVerb(verb string, url string, values url.Values) (string, error) {
+	url = client.baseURL + url
+	client.log.Debugf("weave %s to %s with %v", verb, url, values)
+	var body io.Reader
+	if values != nil {
+		body = strings.NewReader(values.Encode())
+	}
+	req, err := http.NewRequest(verb, url, body)
+	if err != nil {
+		return "", err
+	}
+	if values != nil {
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	rbody, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return "", err
+	}
+	if resp.StatusCode == http.StatusOK || resp.StatusCode == http.StatusNoContent {
+		return string(rbody), nil
+	}
+	return "", errors.New(resp.Status + ": " + string(rbody))
+}
+
+func NewClient(addr string, log Logger) *Client {
+	host := WeaveHTTPHost
+	port := fmt.Sprintf("%d", WeaveHTTPPort)
+	switch parts := strings.Split(addr, ":"); len(parts) {
+	case 0:
+	case 1:
+		if parts[0] != "" {
+			host = parts[0]
+		}
+	case 2:
+		if parts[0] != "" {
+			host = parts[0]
+		}
+		if parts[1] != "" {
+			port = parts[1]
+		}
+	default:
+		return &Client{baseURL: fmt.Sprintf("http://%s", addr), log: log}
+	}
+	return &Client{baseURL: fmt.Sprintf("http://%s:%s", host, port), log: log}
+}
+
+func (client *Client) Connect(remote string) error {
+	_, err := client.httpVerb("POST", "/connect", url.Values{"peer": {remote}})
+	return err
+}
+
+// IsReady returns true if the API server is up and running
+// (note it returns StatusServiceUnavailable until all parts are ready,
+// but callers of this function are expected to be ok with a partial service)
+func (client *Client) IsReady() bool {
+	resp, err := http.Get(client.baseURL + "/status")
+	return err == nil &&
+		(resp.StatusCode == http.StatusOK || resp.StatusCode == http.StatusServiceUnavailable)
+}
+
+// WaitAPIServer waits until the API server is ready to serve.
+func (client *Client) WaitAPIServer(n int) {
+	for i := 0; i < n && !client.IsReady(); i++ {
+		time.Sleep(2 * time.Second)
+	}
+}
+
+type Logger interface {
+	Infof(string, ...interface{})
+	Debugf(string, ...interface{})
+}

bin/circle-deploy-master

@@ -0,0 +1,8 @@
+#!/bin/bash
+
+set -e
+
+docker login -u $DOCKER_USER -p $DOCKER_PASS
+make clean-bin
+# CircleCI doesn't let us install the qemu module to do ARM docker builds
+make publish ALL_ARCHITECTURES=amd64 UPDATE_LATEST=latest-only SUDO= BUILD_IN_CONTAINER=false

bin/circle-destroy-vms

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+set -e
+
+source "$SRCDIR/bin/circle-env"
+cd "$SRCDIR/test"
+./run-integration-tests.sh destroy

bin/circle-env

@@ -0,0 +1,11 @@
+# Set environment variables here because CircleCI can't expand $FOO in 'env' section
+
+export PATH="$PATH:$HOME/.local/bin:/opt/google-cloud-sdk/bin"
+export CLOUDSDK_CORE_DISABLE_PROMPTS=1
+# Base name of VMs for integration tests:
+export NAME=test-$CIRCLE_BUILD_NUM-$CIRCLE_NODE_INDEX
+export TEST_VMS_PROV_AND_CONF_LOCK_FILE=$CIRCLE_ARTIFACTS/test_vms_provisioned_and_configured.txt
+export TEST_VMS_READY_LOCK_FILE=$CIRCLE_ARTIFACTS/test_vms_ready.txt
+# Google Cloud Platorm images for integration tests:
+export USE_IMAGE=1
+export DISK_NAME_PREFIX=test-$CIRCLE_BUILD_NUM-0

bin/circle-test-pre

@@ -0,0 +1,29 @@
+#!/bin/bash
+
+set -e
+
+# Signal failures in lock file, in order to fail fast:
+function signal_failure() {
+    echo "KO" >"$TEST_VMS_READY_LOCK_FILE"
+    exit 1
+}
+trap signal_failure ERR
+
+source "$(dirname "$0")/wait_for.sh"
+
+[ -n "$SECRET_KEY" ] || {
+    echo "Cannot run smoke tests: no secret key"
+    exit 1
+}
+
+source "$SRCDIR/bin/circle-env"
+
+# Provisioning from image typically take 90 seconds, 
+# but if we are creating a GCP image, it can take more than 10 minutes:
+wait_for 900 "$TEST_VMS_PROV_AND_CONF_LOCK_FILE"
+
+# Upload built binaries to testing VMs:
+cd "$SRCDIR/test" # Ensures we generate Terraform state files in the right folder, for later use by integration tests.
+./run-integration-tests.sh setup
+echo "OK" >"$TEST_VMS_READY_LOCK_FILE"
+echo "Test VMs now ready. $(date)."

bin/circle-test-smoke

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+set -e
+
+source "$(dirname "$0")/wait_for.sh"
+
+[ -n "$SECRET_KEY" ] || {
+    echo "Cannot run smoke tests: no secret key"
+    exit 1
+}
+
+source "$SRCDIR/bin/circle-env"
+
+# Provisioning from image typically take 90 seconds, 
+# but if we are creating a GCP image, it can take more than 10 minutes:
+wait_for 900 "$TEST_VMS_READY_LOCK_FILE"
+
+# Run integration tests:
+export COVERAGE=true
+export WEAVE_NET_SANITY_CHECKS_FILES="$CIRCLE_ARTIFACTS/weave_net_sanity_check_*.log"
+cd "$SRCDIR/test" # Ensures we generate code coverage files in the right folder, and use the Terraform state of previously provisionned VMs.
+./run-integration-tests.sh test

bin/multiweave

@@ -14,7 +14,8 @@ set -e
 START=${FIRST_WEAVE:-1}
 COUNT=${NUM_WEAVES:-28}
 FINISH=$((START+COUNT-1))
-PORT=6783
+
+SUBNET=192.168.7
 
 weavedir=$(dirname $0)/..
 
@@ -26,29 +27,42 @@ random_mac() {
     od -txC -An -N6 /dev/urandom | ( read a b c d e f && printf "%02x:$b:$c:$d:$e:$f" $((0x$a & ~1 | 2)) )
 }
 
+weave() {
+    i=$1
+    shift
+    WEAVE_CONTAINER_NAME=weave$i WEAVE_HTTP_ADDR=$SUBNET.$i:6784 $weavedir/weave "$@"
+}
+
 case "$1" in
     launch)
         shift 1
+        echo $(date -R) launching
+        ip link show multiweave >/dev/null 2>&1 || sudo ip link add name multiweave type bridge
         for i in $(seq $START $FINISH); do
-            WEAVE_CONTAINER_NAME=weave$i WEAVE_PORT=$((5000+i)) $weavedir/weave launch-router --iface '' --name $(random_mac) --nickname weave$i --port $PORT --no-dns "$@"
+            IP=$SUBNET.$i
+            sudo ip addr add $IP/24 dev multiweave
+            weave $i launch --datapath '' --iface '' --no-dns --host $IP \
+                --name $(random_mac) --nickname weave$i "$@"
         done
-        if [ $START -ne 1 ] ; then
-            status=$(docker inspect --format='{{.State.Running}} {{.NetworkSettings.IPAddress}}' weave$((START-1)))
-            PREV="${status#true }"
-        fi
+        echo $(date -R) connecting
+        [ $START -gt 1 ] || START=2
         for i in $(seq $START $FINISH); do
-            if [ -n "$PREV" ] ; then
-                echo connecting weave$i to $PREV
-                WEAVE_CONTAINER_NAME=weave$i $weavedir/weave connect $PREV
-            fi
-            status=$(docker inspect --format='{{.State.Running}} {{.NetworkSettings.IPAddress}}' weave$i)
-            PREV="${status#true }"
+            TO=$SUBNET.$((i-1))
+            echo connecting weave$i to $TO
+            weave $i connect $TO
         done
+        echo $(date -R) done
         ;;
     stop)
-        for i in $(seq $START $FINISH); do
+        for i in $(seq $FINISH -1 $START); do
+            IP=$SUBNET.$i
             echo Stopping weave$i
-            WEAVE_CONTAINER_NAME=weave$i $weavedir/weave stop-router
+            weave $i stop
+            sudo ip addr del $IP/24 dev multiweave || true
         done
+        [ -z "$(ip -4 -o addr show multiweave)" ] && sudo ip link del multiweave
+        ;;
+    *)
+            weave "$@"
         ;;
 esac

bin/provision_test_vms.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+
+set -e
+
+# Signal failures in lock file, in order to fail fast:
+function signal_failure() {
+    echo "KO" >"$TEST_VMS_PROV_AND_CONF_LOCK_FILE"
+    exit 1
+}
+trap signal_failure ERR
+
+function install_terraform() {
+    curl -fsS https://releases.hashicorp.com/terraform/0.11.14/terraform_0.11.14_linux_amd64.zip | gunzip >terraform && chmod +x terraform && sudo mv terraform /usr/bin
+}
+
+[ -n "$SECRET_KEY" ] || {
+    echo "Cannot run smoke tests: no secret key"
+    exit 1
+}
+
+source "$SRCDIR/bin/circle-env"
+
+install_terraform
+
+# Only attempt to create GCP image in first container, wait for it to be created otherwise:
+[ "$CIRCLE_NODE_INDEX" != "0" ] && export CREATE_IMAGE=0
+
+# Provision and configure testing VMs:
+cd "$SRCDIR/test" # Ensures we generate Terraform state files in the right folder, for later use by integration tests.
+./run-integration-tests.sh configure
+echo "OK" >"$TEST_VMS_PROV_AND_CONF_LOCK_FILE"
+echo "Test VMs now provisioned and configured. $(date)."

bin/release

@@ -88,7 +88,10 @@ build() {
 
     ## Inject the version numbers and build the distributables
     ## (library versions?)
-    sed -i "/SCRIPT_VERSION=/ c\SCRIPT_VERSION=\"$VERSION\"" ./weave
+    sed -i.bak "/SCRIPT_VERSION=/ c\SCRIPT_VERSION=\"$VERSION\"" ./weave
+    sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.8.yaml
+    sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.9.yaml
+    sed -i.bak -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.11.yaml
     make SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER
 
     if make tests; then
@@ -157,6 +160,27 @@ draft() {
         --name "weave" \
         --file "./weave"
 
+    github-release upload \
+        --user $GITHUB_USER \
+        --repo weave \
+        --tag $LATEST_TAG \
+        --name "weave-daemonset-k8s-1.8.yaml" \
+        --file "./prog/weave-kube/weave-daemonset-k8s-1.8.yaml"
+
+    github-release upload \
+        --user $GITHUB_USER \
+        --repo weave \
+        --tag $LATEST_TAG \
+        --name "weave-daemonset-k8s-1.9.yaml" \
+        --file "./prog/weave-kube/weave-daemonset-k8s-1.9.yaml"
+ 
+    github-release upload \
+        --user $GITHUB_USER \
+        --repo weave \
+        --tag $LATEST_TAG \
+        --name "weave-daemonset-k8s-1.11.yaml" \
+        --file "./prog/weave-kube/weave-daemonset-k8s-1.11.yaml"
+
     echo "** Draft $TYPE $RELEASE_NAME $VERSION created at"
     echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/$LATEST_TAG"
 }
@@ -165,14 +189,18 @@ publish() {
     setup
     cd $PWD/$RELEASE_DIR
 
-    UPDATE_LATEST=false
+    IS_MAINLINE=false
     if [ "$RELEASE_TYPE" = 'MAINLINE' ] ; then
-        UPDATE_LATEST=true
+        IS_MAINLINE=true
     fi
 
     if [ "$RELEASE_TYPE" = 'PRERELEASE' ] ; then
+        echo "== Building and pushing plugin"
+        make UPDATE_LATEST=false SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER plugin_publish
+        echo "** Plugin built and pushed"
+
         echo "== Tagging and pushing images on docker hub as user $DOCKERHUB_USER"
-        make UPDATE_LATEST=$UPDATE_LATEST SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER publish
+        make UPDATE_LATEST=$IS_MAINLINE SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER publish
         echo "** Docker images tagged and pushed"
 
         echo "== Publishing pre-release on GitHub"
@@ -203,8 +231,12 @@ publish() {
         fi
         echo '** Sanity checks OK for publishing tag' $LATEST_TAG as $DOCKERHUB_USER/weave:$VERSION
 
+        echo "== Building and pushing plugin"
+        make UPDATE_LATEST=true SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER plugin_publish
+        echo "** Plugin built and pushed"
+
         echo "== Tagging and pushing images on docker hub as user $DOCKERHUB_USER"
-        make UPDATE_LATEST=$UPDATE_LATEST SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER publish
+        make PUBLISH_WEAVEDB=$IS_MAINLINE UPDATE_LATEST=$IS_MAINLINE SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER publish
         echo "** Docker images tagged and pushed"
 
         echo "== Publishing release on GitHub"
@@ -236,6 +268,27 @@ publish() {
             --name "weave" \
             --file "./weave"
 
+        github-release upload \
+            --user $GITHUB_USER \
+            --repo weave \
+            --tag latest_release \
+            --name "weave-daemonset-k8s-1.8.yaml" \
+            --file "./prog/weave-kube/weave-daemonset-k8s-1.8.yaml"
+
+         github-release upload \
+            --user $GITHUB_USER \
+            --repo weave \
+            --tag latest_release \
+            --name "weave-daemonset-k8s-1.9.yaml" \
+            --file "./prog/weave-kube/weave-daemonset-k8s-1.9.yaml"
+
+         github-release upload \
+            --user $GITHUB_USER \
+            --repo weave \
+            --tag latest_release \
+            --name "weave-daemonset-k8s-1.11.yaml" \
+            --file "./prog/weave-kube/weave-daemonset-k8s-1.11.yaml"
+
         echo "** Release $RELEASE_NAME $VERSION published at"
         echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/$LATEST_TAG"
         echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/latest_release"

bin/setup-ci-secrets

@@ -1,57 +0,0 @@
-#!/bin/sh
-
-## This is the shape of unencrypted `do-setup-ci-secrets`
-## 
-## cat > /tmp/boto_gsutil_cert.pem << EOF
-## -----BEGIN PRIVATE KEY-----
-## <...>
-## -----END PRIVATE KEY-----
-## EOF
-## 
-## cat > ~/.boto << EOF
-## [Credentials]
-## gs_service_client_id = <...>
-## gs_service_key_file = /tmp/boto_gsutil_cert.pem
-## 
-## [Boto]
-## https_validate_certificates = True
-## 
-## [GSUtil]
-## content_language = en
-## default_api_version = 2
-## default_project_id = <...>
-## EOF
-
-openssl base64 -d << EOF \
-  | openssl aes-256-cbc -d -K $1 -iv $2 \
-    -out bin/do-setup-ci-secrets
-mOYNzNsAdwva0LbB2YFMY9VgL0SITFu1bPrbOujyLtOrBNjmOYbzR5d/sG+ARMFr
-7NZ5OKcvMbItllz0n7TtNkzkCOMztMC870Wcx3nGJzbBephdcYwos4tBlp5bihTU
-AXgxLUiDT1broYAFKnbE1aZC/XyNxuLTN+nXJWIWeijaXTgvhkEEm3tab+z7ioCb
-tlg71W1BrUuocctAJAuVwH/uTZAaXaJGJj1s2S7F2DrFnG6sFlrp8rnCucPLWKnC
-4IwJFC5saR5gxK6wECffwmwbpeXVOoQ58OgzxoZTEyAr9nhVbaBt5UZz3tfHlx8W
-Rn5jHehACw5kg5eMtGPqMEksJ63LX4h3mfSTLJXJHEmOrzCRpFrigVrsbA408U2u
-8jJTHJmKrGfwBh5ZFzBg6NuV4VplOp+ZquJLgegv2WH/iu/ciopXqB2YDCdx5ZBi
-nHV2Puth7kjS4EMCKUGfeqpesjL9Djb8cygzv/J3ZBmLjNH9dqlSXWy2DcFZA1Iy
-pFTTHkVU3w5sNz3nYOuT2UPQvULBW0FUndDKX6olyVa0mlxPwGBP9N3yGg918/rw
-7rNV/r54lA334F5QMhDrVxar6sl9wfLA+Z+8qemBbNFlLog1uQGhuwWK2nFu1tRM
-9uyvQIq0oq5NHKpogWc7NEuk7CPe1JyfRIcbMVj8+ilmKjUPB2HPC43IDmKt9/56
-rY3IXAcxZ/ClGfGpeNHXqop9T/WhfaowponOZFcdGSUddG0OswqkTE4KIv71mgTF
-jXooMkTQBOG+gBnCe+8bCRdRCG3anxHX74za4dGD58cOJtl6DYWnjWuR91NWnxdT
-1Zr3iUe41txg9hCNY9LHo2QHGLPxe6pmNnSClQ1mcFhuY6NF8RmCX3HAGKJQkxJb
-vpLGbXTXjAIFgIYgLNgKP2RLvCif/LmSWgkvE3ZU9GXtCUbm6xgJodwOqXiI9uuO
-4H4+/vpGHnSFENiclkgMFrLG4yiMu8ArgmnCBzg9E2AoOX5zCrh/2ZRTU8Dk4mt7
-jUd5SKQLsjB9QtB+y3tRO7zY9RDvR6iBOPRsjx6t8EJMCfPb06KchfMJw+VGxvMM
-48jtmepREFnhd/8XDRGnw5bznjRuwohGik8BToltjIviMkkpifKWaLwlaOiDXaHh
-VBFNXnUKvOBwRMU+PZqv4+DP2qff1gSXnGKqA5GIURYrK9P7TqHHNTnmjBdfJLzc
-0x+W1DTiYhLT2vrLrkEpZ99o6qrg+lwvjat6IsJF8xoQEo4pLD/ZRPJ0WzoDyctT
-oWZ5rMsN1TzTvJrBrTAWIJyhIzZcuNwChMrU6qogMr0fd6TSxWhWn0sOJ5y8AaTR
-ej4JHx0qroS/9JPmgFYU61pX3c0ypdef/sSHWG23mcFzLTgwe2d4ty9VakypZy3T
-sXCl6EHVVXlUFWhY4zQCjdZpYJv/rtoKL1BL4fPE2NV5WTjCL2GNvaO5SfHR7pA0
-yQJR/iU+cS2n8UXsWNjyV+/qEn6+QXuyVHGLbxyH8EeqlliAbyHsc2rzVI8Xctzo
-W5DuIqxwHAkNNurhmx27ktIIQ6HhaCp028SWwvLttkbBBgF4v1mmd4u/2bKbKjUd
-dOaetaIUx1hU9OAeaePvVkeTDcc3mlFtPARCS9Fqj16hgJQ43onZyC0H1K2WAxmU
-GsmzjCHlTNquzFTuuQihYGZKfsWIh9z6HEOkvNJ3VEQ=
-EOF
-
-exec sh bin/do-setup-ci-secrets

bin/setup-circleci-secrets

@@ -1,115 +0,0 @@
-#!/bin/bash
-
-set -eu
-
-# openssl enc -in do-setup-circleci-secrets.orig -out setup-circleci-secrets.orig -e -aes256 -pass stdin
-# openssl base64 < setup-circleci-secrets.orig
-
-openssl base64 -d << EOF \
-  | openssl enc \
-    -out bin/do-setup-circleci-secrets \
-		-d -aes256 -pass pass:$1
-U2FsdGVkX1/3QHnDgpZn0srp+GiEQBTlag0CBdsw6Bp6iaIKy6Jy8gFshrsmvl3+
-c+7hn1nqsBVpzVH0S5QA3Ex5nx9rl7/dcGoogsySFcwMmBFcauT0UTMK1bvX0Hqx
-QrshYSndUkww72KA7EsSnjR1BBJWm3AhCDOTIcnO6nQhig1Fc+SBEj5FGS5xTQ5Z
-/8hDsKf54Ms49vOO6QeE5w5ndZ+k7IvVJfq9Evhb7htD20RntDhR86foAwMnLV7R
-Wh9qAqI3gnRq0GmbeRKaHmB7pcLq9f0OdScqM/Tn1D+q0556fqJjBziXpZiGbxVs
-DxEp8zDJ8yNDAi0Wb2NXjoA79SXJ8Q7iTieaST4y2OmXQpY+Vw8RVDXxi6ERyVnH
-41OeMzyLm0qvCoMl32pe1sSG5DRCUiAm7wOtDTVvNDRqmGJYUgwwexyayecJI1wQ
-LlhYLJavUvw3UGDZOld8BaMQhfOKBVCdFrjmA4HuVxmOf3029qkgzOCSZiQVNqs+
-fvM6J05zBuk+GPy8YInvRkzfxum/x00vmUyGjMs/lHDFfrmYDFK3ux41EoVqvWLG
-S5uYxdZJFdR3Xsrs+sMr51XNBQGMmz6KoEEzFYyHs5fZgtdpRdPAuQS1m6FqgZyi
-wSz6+EKsALtmGorEp+CF8JN5YzKJCrKzNkg0fILBqsqmJZGP64lmX69950lRLNGM
-/l3KVR2zH31b4AnnzTcvldVSCKDXjaMw3JA2Ce/MK6XhOWOcpEv4oDt/62lbhUKP
-QUQTPbfpQRvVfBcoIrfAm3ghi/CZc2TDVEuD7DhasLTZD3r7LoK261BWC9O5Wubi
-vlXuFIF+uyrpTDf6EJKE/+XywtArppffMP6RkHu1Iqnd8JtsqPaIZsmMmZbjgb6j
-BX4ZLb5U9R7jYoSgIke4+u6geFcrMQ+Lny4r7MxXaS0Y1UJ6Jo1bwpYw1TBIobZc
-eQ30+xhbSeRC9vEw1NXI6qM2Ai2gIHtAZvEiBkBBXTG5Ld7N/mBAmDIJEzVRxh6F
-jRkB3dzESF6eeTBm61OQepwV3aW6lslMaf26drPGv2W2q+K/WOpQOejfggtHUgVs
-9SWqtn7hHYSpIASe1Ihi14HAWv3kPhQien0zY1DLKJWf4ilbRaICn1QSJjNuKwtl
-A2ZwEw7FFddFcsF4okHPkxEoCre3shq0DEw9UA1gnwEaEF1Q+i9cvLtQg56zK3+R
-MfTzFUv2K1z3j1s5tC6Z6LzL8j682EFOll7MkihqiIWh+po1zcNs6Ln0SkjB3v9T
-OFRYVJis9GqXYO9PUW1mI69udR4nXbKlBl5tWNyAxn9hufJHLSAmbGMwActKLRM5
-kROapKrN1Ra/sHUmhoSSDUK9AXeYKkqPXVMbhly9xC1Kya4hFaFokjRQIMLPmXdQ
-lP46RL3HOq0v1BkXg05poSwDm+BtitZkcIhOzcmeucUqn1whsz39y3VoOhJqQu2j
-0dUcj19Fue1CDZfwzACb9mLZr643h0yCIHQaVT7is/yiN2vEt0S0zynvOA1D+Xgy
-4bFdjqed9DgBShLwF/lh4/hur5iZPpVr9A8rt3Vq0k5A1tdjsZpXP3qv5jLc7lJv
-cAQxdVLEuv8WPwwTV/EQsoH7lpoEdjktw/gu0v5PkUgR/WBxEqJq4liTekViQ+8X
-BAmdm/FGWeIxSSEm0a8I+muiBpIuKjuQoJit1f0k+lLUohoVDqpDDfeYHh1TxXHE
-xSKAKNmFSc2XOr5Zg2mOInxeH7WoxH6iylXKADBgEgAQ4C55DoAPRjFNtGGz2iJl
-WkzhQOfgsDss1VxpPZ4SWDQO+xxuuEnYcCYdJ6Tyi5hAwZ0+RZmXx0g9BCK+5qzc
-Ffei066kCItBcayekwCs0i86r8JvDtsMUUkzEKDQTSWHpP8ypIZoz3P+Skdqcs6p
-IcZHy2fODIsClctRAsHOjZ9BnWSY2rqf1lysqvRfOkNTViTOUVx2hf+LuL+8rT6g
-K4GvS39Q+c9FYSMjCNxv1m37NfHJv2W7AlqVV95gMBEFB97M3388T7PfvmSLsyPv
-qAKDE7genTOycQvEX9oeEACxPo08ai2Mgs/YXCig0g0btZoScoKPelQKtD0HLpZ+
-j7ruaKFy4/vySDMostB3AKSkCE/SkGu/W9oI37n1guSYC/9yJjtTcwZULXAClfwt
-LyHvLAw4+7BdGJqDe9Tf8z4zqVLax+BcBHkW7pbP+pvxC6fhIA4PO8k5HwwAVlRw
-68lG6e3z9+Vst4zrFLewHJvkDRSOTSecs9h9SPOjReTK0ovlDzMHVakfUvqpk9mv
-nCj8SWaMPF70z138AuRuKN7X4exNXPBFnOcseKp/NpT1DyvgoHm/oIO65mq9vvo+
-42uSbyyegYiTdVK4SaXBc2hixkhaTteqdEy6GxfWqKCvHtYuRD2LyUSjZn/0Y6CG
-3wZapylKL1sxfH+b1gogv2wAA8KtZAfiTlMISuymwQr5RbOFma7UVMVecCa7XrNG
-fZwO8R+6++ru0efDzeC/gtLOItjn+yVfsbk2gfu0FikHIV1sogOjnsv3dl6IpH/s
-w6WbuK/yZhyrrmhIIueHF30ES512Peogf/Gxp8U/ZAmqBa7p4qsv93XWDR52IPYz
-yU1MtboLD02J39daBNrYZuO4Yfo/xAvU7Ijg2KIR9HS0bSWNuSFAZaZXlJ2bSag3
-8l0dZMx2fZa0FALxWvY2+nd1tWcH+Wo99RSxX+4TH3guCpe1x/58yKOKL4d1xRpu
-02nGaqerV9bHU6WjCUYTrrZurTp6yqivpSFCALDMhAU5Ihd/Qjz69zg4uZ7iqbNd
-WqIYJ3SAOei2tSfoOJbdh8mohotnMFFbupck3Fv+lXAXYDp0V/sSuK32MSeJxan1
-q3t0eenAh6zoBP0Tj53N8B9YmrgZ1i1AljQqYsAdb8N5Z3vecuzQa946U8H4axEc
-BL5fgmqSfsbj1EjJVUrw3cE9hgqeqAYBBvZsyW5zSAsLq/RJKYtBxDGADqr0TOOu
-TjVqfPObb1u9EAQj15ALBhhPORa2gBAK5gnhJWW5deNgA0UOYoWARFYfATuQvr1T
-9xTVbqzZ0VJR4n7X5JyxJo2tZ44QYVzA0fqX0lt+uRkarrkbZMgplKp4MJTFCp2N
-tLciWS0YSHPbKTm7svw5mROazUvEoj1N3SYrJT+Ai9UgSL1cA4FmQ5Jsi+GOeQbH
-7E4pzjeST4b1aATY9ZZSy4TzK+UNYBcCVqY1dN5Xnk0e5yPMnrkkcYI41s/6oOaW
-lQkp/yrHkvpzQWZa7vF2yWg54j3eX8YWx/TsLvmuJmSQqiIHfu9TXcAIPDispCpF
-gp4ZbYPZ8RDQLw3ROc+bZ9E0J8e+FHwgXEELsMLW9n4d3PTj9pLFej1vmBKa03o3
-g+JViNxb1gUPNmC6ADk4o7TQzBrjV2pmmuCza16kOmq6oAbJPOeCLtVWA5HJTX8d
-AuOzBLO37tWP457dNqoNDaCMik3LCy8cslZjAz02D6VG/QGOAXP9x8bJ3zg9N7vW
-EOn1BMtIeMI4yIxpC6HgotNWDNbUBWremAFWYQRgYQqo9L1SdW4hz6X8FqdlBFvK
-ml7sdUwjEy2tNW+aiZI4cgAlI/VvMWYr5kPfhvaUu1wGYeS1TD1B+DPcjcXpOGWo
-vB1f/uvGc61zZWD0ph9f3S9OnvEko5qV3VhxOnxYUZTrqlM7LVgy/sHrSaPdR7Eo
-nb4QGdi5wEGMxVgQlDGwOmEmS5nCaA0RcfHbkQV4SebRleocLB9qcSwj5JzPICAB
-sn1qeSv45LnGdTzUnCQErw1EzgrK1FXOknujjZ3GX5dM7a6Gag0E6cAxoQeC8Mh0
-aUWolyBo9aSXltn7Vnywoe4X3v96eVH6tUQtN3wt51LBlfSDTWOQDeXLFyW57oYL
-/ErbmJLaSHpANBcC9InI+rxNYePTTba7K8rdPDppmMEmdOXjaL+5aPay2Bay9K8T
-FUyZdoyrbzxFZYT9/YyVJV/ukVcT9ru3HpzLTg9Vgc/CyRfIvCZY/Gzh+pPUbRsR
-pHYDT09BFS+mjszTkcdbceweYXJvknXpajMiISrPUUkb9rwCTmLS4QR4y7I9zAgJ
-9U72mCZB9yhhzS17kyKAANihXvOFrMXCO7QTWZbtSkobMBS2SybDxYP3rM5b6824
-HQaY4MZW5qCndydfz4fa908XbPTDka9Nu3CZfI3fhGiiGDFWViotGEYE4i9BuGZJ
-vmtzII7zeIoHwM4t5fb5mYDd9H+Rkct1yATGEIFEx7cu1fj4Ht2177EzhdkF3Q6I
-Fccn43yGDW06nFvEjnjb+Lz4EvtGp6dDefUhNBohdzd4Rm2o+etKobm0lZ1xOX74
-2gOGBLfXS6PF+msNkWP76mqKE6hG0+R1iPrN06Arti+ZRBhNGJDp1pnOERl7IyB0
-hiLUqae7xVSMVRDeq4O04EUpMXh5ixs3RJXjthYILt7vX+6qskJC3rMuyThrsvMi
-Kk0wErDpzR5U7KFnM2fk4jY5by/0b/jHZ/PWFGnaFrXNOiwK/mV1RIJtg5FCrvMv
-xJN5Qo7o2ZYzUL+IBf5mP5O49FCnz3e++9r4ySY/K57ybhQft1l+cQPWS7xuvVAg
-wZGM9DPl9AhBus0I3V3XzfkcWWHkMynMRcfTnkBHrmKjMopIOggsq05JPalM9b0V
-NfwZngVvTFbQejbGjgQQQ+G7spav/icCIA8Iu8JPHaKZt2IX77L1xMcQOouqMrx8
-JCXnJ7zsuU+8W3GQGm70H2kcen4bf4beA8TSkFmbVsaqDNtGaG+ZopWO8ctZX3CP
-jFgIYgEGi137IWvs1KD5QNFHZI6l0JMzglmvcfnViRPDHLi+EQXAoL/98j/YzA9t
-a9L4xMO0oucovKkqYOS2cdFaQKVIUM9L5ibcbW7Tol4ugMo5ibIsTgjZoyFohG6t
-acg+h2wTTyxtrIapvOOBeAo9V/iQowTAPQf38LKQZ5tApksiCG1qvJerKALTMp1J
-yUHjTCPCPsaiXVVO0mfa9OPtzVvi/icLmlz7umk82mew13djedgMS3/ghq5aEHbg
-e7rtI5snFlm/GQnV6IaCDytb+jYxqQ0DZ9Mb0CHcMpnLyiBO6nzHfadpZYlrxrpx
-dPx9MVqfLavj1UVjKuVj4Mgec9J38IBBRGMJZ4MGhde2hrw/s2jVzG1BzaIzcvFa
-bWiJOkKKRC4BY9DBDYfae5c/obwzkxLmvkbWAVzoFXc+46K1IK6bbC2a4EerOAxc
-C7B3X8BucD8OtiPORwXgjctd9AJ7cXq0EEVGoZZ8jkILnklsK6RXsxrT4gSOGFpx
-cBU7TF4kHpH+o4KGQmjlFA2VYP1tXirjEep57LOHfL+zy+HiSXdsbexf6odkqLYA
-1RR0TzSkmqJYvP0GfHPMvp2xredx1kP934fhTIUcWvErrG3NPd/Dod4BzQye1nNK
-8Y8aFYF6fACcD4SFZ11ecK9DJmB+WXGlsxtO3w1LeEysny2lVkkH6HuMRIzPyXAM
-/sEpwh3hwPJosAh6vGM6JxuL7CXP8hC1oUvK91VR0hxeDcO/LgdcHtDnlNMqt1wC
-jvYt9Hg+3aY5GehBnQPRppnIMaGhiBrRC6HjBg8Umt6UTUr5PXNY2aia5wRcx4M6
-Tj0O0dAt8WWZ9ySgzOoq4SRoaAp6m4E7CpRNMgXH031OWEeHqtt8rsYqAcvcQLuW
-vIwts5hiXZOfgXyR6SBY3ANE1SjDY46na2G4oiG8FI7eAqYgehjHrXqCnGrzjefE
-V1eVcIr7DBYuM8wq7C9x+qdMir6RNV4MrVD+7rO/drivnd3MaqDHlG0LfMZo6GIK
-QZGIy0z1W5lOXm9x3RAz7/Ea11ynkZyPDDxBE5NRcV6JfukdjDrvsaQA/Qk2Wo7h
-PdUZjv17H4syMdap6tUDTc8Cohut6n1UxnDnhaAYEDGR3TgPqI5vEaJ+yoaM9itv
-b2I/K+0uK6GfWwca7PeTtYn92/5etO4czG99xEBFzw7tiEmBTA8KfseZIUe/i3fr
-9LO+rKEGalFB4mVTYyCKPYYx4hOIvjdCox/jEBTFyYUEhgGnZvArgw9XabvII7eM
-c1FmwnN2CM/MHUzM0Kw7cS/oaoRFcG/PqioO/krL2Bd+xThwSH4Zn+Y1UVO7aXNy
-90MOehHSc2nhN984Y2re3ffVsjPhC3KdWxr8jbho/Az65rUkYg64roiO2ZqdqRvf
-aYtX9fCe8N8SzgLTlWZt+l8sjY8HP2k9NoajphV1nG4iC/pX0ZJiVQ+VBRNaGhSl
-6IhM9gM1ZsI86cULJpOTAhNu1fZBv+Mq8IXYD8SqlNVwVtjvshtlzBN4InSGEKiO
-HM7coo7aDuu+Go5AEiIVMbR09jAa0VINsCVScfSbTFhlGRTrZr2DSO/s8WxbV+Mb
-EQAfZmyrLF71Z3MfIukg+ps5iuqFhZ+gJSXXSFwumpg=
-EOF
-
-exec sh bin/do-setup-circleci-secrets

bin/wait_for.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# shellcheck disable=SC2155
+wait_for() {
+    local timeout=$1
+    local lock_file=$2
+    for i in $(seq 1 "$timeout"); do
+        if [ -f "$lock_file" ]; then
+            local status="$(cat "$lock_file")"
+            if [ "$status" == "OK" ]; then
+                echo "[$i seconds]: $lock_file found and status: $status." && return
+            else
+                echo "[$i seconds]: $lock_file found and status: $status." && return 1
+            fi
+        fi
+        if ! ((i % 10)); then echo "[$i seconds]: Waiting for $lock_file to be created..."; fi
+        sleep 1
+    done
+    echo "Timed out waiting for test VMs to be ready." >&2
+    return 1
+}

build/Dockerfile

@@ -1,24 +1,82 @@
-FROM ubuntu
+FROM golang:1.15.6-buster
 
-RUN apt-get -y update && apt-get -y install --no-install-recommends ca-certificates apt-transport-https
-RUN apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 36A1D7869245C8950F966E92D8576A8BA88D21E9
-RUN echo deb https://get.docker.io/ubuntu docker main > /etc/apt/sources.list.d/docker.list
-RUN apt-get -y update && apt-get -y install --no-install-recommends build-essential git lxc-docker-1.6.2 mercurial libpcap-dev curl make pkg-config gcc bison flex python-requests
+# Support Raspberry Pi 2 and newer
+ENV GOARM 7
 
-# When doing a build in a container, "apt-get update" happens twice,
-# which can be a very significant overhead for incremental builds.
-# And it's unnecessary, because if any of the prerequisites do change,
-# the right thing to do is to rebuild the container image.  Rather
-# than suppressing the "apt-get update" commands explicitly, we clear
-# out sources.list so that 'apt-get update' doesn't do anything.
-RUN echo >/etc/apt/sources.list
+# The names of the architectures that we're fetching cross-compilers for from the Debian packages
+ENV DEB_CROSSPLATFORMS \
+	armhf \
+	arm64 \
+	ppc64el \
+	s390x
 
-ENV GO_VERSION 1.4.2
-RUN curl -sSL https://golang.org/dl/go${GO_VERSION}.linux-amd64.tar.gz | tar -C /usr/local -xz
-ENV PATH /usr/local/go/bin:$PATH
+# The go platforms we are supporting to cross-compile
+ENV GO_CROSSPLATFORMS \
+	linux/arm \
+	linux/arm64 \
+	linux/ppc64le \
+	linux/s390x
 
-# So that sudo does not trample on PATH
-RUN sed -ie '/secure_path/d' /etc/sudoers
+# The names of the gcc cross-compilers we have installed
+ENV GCC_CROSSCOMPILERS \
+	arm-linux-gnueabihf \
+	aarch64-linux-gnu \
+	powerpc64le-linux-gnu \
+	s390x-linux-gnu
+
+# Install the build-essential and crossbuild-essential-ARCH packages
+RUN for platform in ${DEB_CROSSPLATFORMS}; do dpkg --add-architecture $platform; done \
+  && apt-get update \
+  && apt-get install -y build-essential \
+  && for platform in ${DEB_CROSSPLATFORMS}; do apt-get install -y crossbuild-essential-${platform}; done \
+  && apt-get clean && rm -rf /var/lib/apt/lists/*
+
+# Install some required packages
+# libpcap is required because we're linking against its C libraries from the prog/weaver binary
+# flex and bison are required packages for compiling libpcap manually later
+RUN apt-get update \
+	&& apt-get install -y \
+		libpcap-dev \
+		python-requests \
+		time \
+		file \
+		flex \
+		bison
+
+RUN curl -fsSLo shfmt https://github.com/mvdan/sh/releases/download/v1.3.0/shfmt_v1.3.0_linux_amd64 && \
+	echo "b1925c2c405458811f0c227266402cf1868b4de529f114722c2e3a5af4ac7bb2  shfmt" | sha256sum -c && \
+	chmod +x shfmt && \
+	mv shfmt /usr/bin
+
+# Install common Go tools
+RUN go get \
+    github.com/weaveworks/build-tools/cover \
+    github.com/mattn/goveralls \
+	golang.org/x/lint/golint \
+	github.com/fzipp/gocyclo \
+	github.com/fatih/hclfmt \
+	github.com/client9/misspell/cmd/misspell
+
+# Allow full write access to the Go folders for anyone
+RUN chmod -R a+w /usr/local/go
+
+# The libpcap version from Debian packages is 1.6.2, matching that version here although newer versions of libpcap have been released
+# We have to cross-compile the libpcap library for the new architectures, that's what we're doing here
+ENV LIBPCAP_CROSS_VERSION=1.6.2
+RUN curl -sSL https://www.tcpdump.org/release/libpcap-${LIBPCAP_CROSS_VERSION}.tar.gz | tar -xz \
+	&& cd libpcap-${LIBPCAP_CROSS_VERSION} \
+	&& for crosscompiler in ${GCC_CROSSCOMPILERS}; do \
+		CC=${crosscompiler}-gcc ac_cv_linux_vers=2 ./configure --host=${crosscompiler} --with-pcap=linux \
+		&& make \
+		&& export LIB_DIR="/usr/local/lib/${crosscompiler}-gcc" VER="$(cat ./VERSION)" MAJOR_VER="$(sed 's/\([0-9][0-9]*\)\..*/\1/' ./VERSION)" \
+		&& mkdir -p ${LIB_DIR} \
+		&& cp -f libpcap.a libpcap.so.${VER} ${LIB_DIR} \
+		&& ln -sf libpcap.so.${VER} /usr/local/lib/libpcap.so.${MAJOR_VER} \
+		&& ln -sf libpcap.so.${MAJOR_VER} /usr/local/lib/libpcap.so \
+		&& make clean; done
+
+# Install Docker
+RUN curl -fsSL https://get.docker.com | VERSION=18.06.0-ce /bin/sh
 
 COPY build.sh /
 ENTRYPOINT ["sh", "/build.sh"]

build/build.sh

@@ -1,45 +1,28 @@
 #!/bin/sh
-set -e
 
-GOPATH=/home/go
-export GOPATH
+set -eu
 
 WEAVE_SRC=$GOPATH/src/github.com/weaveworks/weave
 
-if [ $# -eq 0 -o "$1" = "tests" ] ; then
-    # No arguments.  Expect that the weave repo will be bind-mounted
-    # into $GOPATH
-    if ! [ -e $WEAVE_SRC ] ; then
-        cat 2>&1 <<EOF
-No container arguments supplied, and nothing at ${WEAVE_SRC}.  Please
-either bind-mount the golang workspace containing weave with the
+if ! [ -e $WEAVE_SRC ] ; then
+    cat 2>&1 <<EOF
+Nothing at ${WEAVE_SRC}.  Please bind-mount the weave repo with the
 docker run -v option, e.g.:
 
-    $ docker run -v <host gopath>:${GOPATH} \\
-          -v /var/run/docker.sock:/var/run/docker.sock weaveworks/weave-build
-
-Or supply git clone arguments to retrieve it, e.g.:
-
-    $ docker run -v /var/run/docker.sock:/var/run/docker.sock \\
-          weaveworks/weave-build https://github.com/weaveworks/weave.git
+    $ cd weave
+	$ docker run -v $(pwd):/go/src/github.com/weaveworks/weave \\
+		weaveworks/weave-build
 EOF
-        exit 1
-    fi
-
-    # If we run make directly, any files created on the bind mount
-    # will have awkward ownership.  So we switch to a user with the
-    # same user and group IDs as source directory.  We have to set a
-    # few things up so that sudo works without complaining later on.
-    uid=$(stat --format="%u" $WEAVE_SRC)
-    gid=$(stat --format="%g" $WEAVE_SRC)
-    echo "weave:x:$uid:$gid::$WEAVE_SRC:/bin/sh" >>/etc/passwd
-    echo "weave:*:::::::" >>/etc/shadow
-    echo "weave	ALL=(ALL)	NOPASSWD: ALL" >>/etc/sudoers
-
-    su weave -c "PATH=$PATH make -C $WEAVE_SRC build"
-else
-    # There are arguments to pass to git-clone
-    mkdir -p ${WEAVE_SRC%/*}
-    git clone "$@" $WEAVE_SRC
-    make -C $WEAVE_SRC build
 fi
+
+# If we run make directly, any files created on the bind mount
+# will have awkward ownership.  So we switch to a user with the
+# same user and group IDs as source directory.  We have to set a
+# few things up so that sudo works without complaining later on.
+uid=$(stat --format="%u" $WEAVE_SRC)
+gid=$(stat --format="%g" $WEAVE_SRC)
+echo "weave:x:$uid:$gid::$WEAVE_SRC:/bin/sh" >>/etc/passwd
+echo "weave:*:::::::" >>/etc/shadow
+echo "weave	ALL=(ALL)	NOPASSWD: ALL" >>/etc/sudoers
+
+su weave -c "PATH=$PATH make -C $WEAVE_SRC BUILD_IN_CONTAINER=false $*"

build/shasums/qemu-aarch64-static.sha256sum

@@ -0,0 +1 @@
+c02d861383d035ba020b361ef93bf14beb3964a42a6ae645b505b6148493e7ec qemu-aarch64-static

build/shasums/qemu-arm-static.sha256sum

@@ -0,0 +1 @@
+0ff63682b8868620d771aa812d3053dc3c579dc8633ce62d3d7ae7eee83beb06 qemu-arm-static

build/shasums/qemu-ppc64le-static.sha256sum

@@ -0,0 +1 @@
+926f7f265332076ea4abf6e9586288376dbed2322c155b8d0cafbee614aaa7f2  qemu-ppc64le-static

build/shasums/qemu-s390x-static.sha256sum

@@ -0,0 +1 @@
+bab3b4d04263479b3d9f85cf59bd0cad1f2b434f29856b2204f8288f2f3598e4  qemu-s390x-static

circle.yml

@@ -1,73 +0,0 @@
-general:
-  branches:
-    ignore:
-      - gh\-pages
-      - /pull\/.*/
-
-machine:
-  services:
-    - docker
-  environment:
-    GOPATH: /home/ubuntu:$GOPATH
-    SRCDIR: /home/ubuntu/src/github.com/weaveworks/weave
-    PATH: $PATH:$HOME/.local/bin:$HOME/google-cloud-sdk/bin/
-    CLOUDSDK_CORE_DISABLE_PROMPTS: 1
-    WEAVE_TEST: $HOME/docker/weave-test.tar
-
-dependencies:
-  cache_directories:
-    - "~/docker"
-  override:
-    - if [[ -e "$WEAVE_TEST" ]]; then
-        docker load -i $WEAVE_TEST;
-      else
-        docker build -t weaveworks/weave-build build;
-        docker build -t weaveworks/weave-test test/image;
-        mkdir -p $(dirname "$WEAVE_TEST");
-        docker save weaveworks/weave-test >$WEAVE_TEST;
-      fi
-  post:
-    - sudo apt-get update && sudo apt-get install bc jq && pip install requests
-    - curl https://sdk.cloud.google.com | bash
-    - bin/setup-circleci-secrets "$SECRET_PASSWORD"
-    - mkdir -p $(dirname $SRCDIR) && cp -r $(pwd)/ $SRCDIR
-    - cd $SRCDIR/test; ./gce.sh make_template:
-        parallel: false
-
-test:
-  override:
-    - cd $SRCDIR; make lint:
-        parallel: true
-    - docker run -v /home/ubuntu:/home/go -e COVERDIR=test/coverage -e SLOW=true -e CIRCLECI -e CIRCLE_BUILD_NUM -e CIRCLE_NODE_TOTAL -e CIRCLE_NODE_INDEX weaveworks/weave-test:
-        parallel: true
-    - docker run -v /var/run/docker.sock:/run/docker.sock -v /home/ubuntu:/home/go -e COVERAGE=true weaveworks/weave-build:
-        parallel: true
-    - cd $SRCDIR/test; ./gce.sh setup && eval $(./gce.sh hosts) && ./setup.sh:
-        parallel: true
-    - cd $SRCDIR/test; eval $(./gce.sh hosts); export COVERAGE=true; ./run_all.sh:
-        parallel: true
-        timeout: 300
-    - cd $SRCDIR; make clean-bin:
-        parallel: true
-    - docker run -v /var/run/docker.sock:/run/docker.sock -v /home/ubuntu:/home/go weaveworks/weave-build:
-        parallel: true
-  post:
-    - cd $SRCDIR/test; ./gce.sh destroy:
-        parallel: true
-
-teardown:
-  pre:
-    - test "$CIRCLE_NODE_INDEX" != "0" || (cd $SRCDIR/test; ./gen_coverage_reports.sh):
-        parallel: true
-    - test "$CIRCLE_NODE_INDEX" != "0" || (go get github.com/mattn/goveralls && goveralls -repotoken $COVERALLS_REPO_TOKEN -coverprofile=$SRCDIR/test/profile.cov -service=circleci || true):
-        parallel: true
-    - test "$CIRCLE_NODE_INDEX" != "0" || (cd $SRCDIR/test; cp coverage.* $CIRCLE_ARTIFACTS):
-        parallel: true
-
-deployment:
-  hub:
-    branch: master
-    owner: weaveworks
-    commands:
-      - docker login -e $DOCKER_EMAIL -u $DOCKER_USER -p $DOCKER_PASS
-      - cd $SRCDIR; make publish

code-of-conduct.md

@@ -0,0 +1,7 @@
+## Community Code of Conduct
+
+Weaveworks follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).
+
+Instances of abusive, harassing, or otherwise unacceptable behavior
+may be reported by contacting a Weaveworks project maintainer, or
+Alexis Richardson alexis@weave.works.

common/chains/npc.go

@@ -0,0 +1,12 @@
+package chains
+
+const (
+	MainChain    = "WEAVE-NPC"
+	DefaultChain = "WEAVE-NPC-DEFAULT"
+	IngressChain = "WEAVE-NPC-INGRESS"
+
+	EgressChain        = "WEAVE-NPC-EGRESS"
+	EgressDefaultChain = "WEAVE-NPC-EGRESS-DEFAULT"
+	EgressCustomChain  = "WEAVE-NPC-EGRESS-CUSTOM"
+	EgressMarkChain    = "WEAVE-NPC-EGRESS-ACCEPT"
+)

common/docker/client.go

@@ -1,82 +1,258 @@
 package docker
 
 import (
-	"github.com/fsouza/go-dockerclient"
-	. "github.com/weaveworks/weave/common"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	docker "github.com/fsouza/go-dockerclient"
+
+	"github.com/weaveworks/weave/common"
+)
+
+const (
+	InitialInterval = 1 * time.Second
+	MaxInterval     = 20 * time.Second
 )
 
 // An observer for container events
 type ContainerObserver interface {
 	ContainerStarted(ident string)
 	ContainerDied(ident string)
+	ContainerDestroyed(ident string)
 }
 
 type Client struct {
 	*docker.Client
 }
 
+type syncPair struct {
+	stop chan struct{}
+	done chan struct{}
+}
+
+type pendingStarts map[string]*syncPair
+
 // NewClient creates a new Docker client and checks we can talk to Docker
 func NewClient(apiPath string) (*Client, error) {
+	if apiPath != "" && !strings.Contains(apiPath, "://") {
+		apiPath = "tcp://" + apiPath
+	}
 	dc, err := docker.NewClient(apiPath)
 	if err != nil {
 		return nil, err
 	}
 	client := &Client{dc}
 
-	return client, client.checkWorking(apiPath)
+	return client, client.checkWorking()
 }
 
 func NewVersionedClient(apiPath string, apiVersionString string) (*Client, error) {
+	if !strings.Contains(apiPath, "://") {
+		apiPath = "tcp://" + apiPath
+	}
 	dc, err := docker.NewVersionedClient(apiPath, apiVersionString)
 	if err != nil {
 		return nil, err
 	}
 	client := &Client{dc}
 
-	return client, client.checkWorking(apiPath)
+	return client, client.checkWorking()
 }
 
-func (c *Client) checkWorking(apiPath string) error {
+func NewVersionedClientFromEnv(apiVersionString string) (*Client, error) {
+	dc, err := docker.NewVersionedClientFromEnv(apiVersionString)
+	if err != nil {
+		return nil, err
+	}
+	client := &Client{dc}
+
+	return client, client.checkWorking()
+}
+
+func (c *Client) checkWorking() error {
+	_, err := c.Version()
+	return err
+}
+
+func (c *Client) Info() string {
 	env, err := c.Version()
 	if err != nil {
-		return err
+		return fmt.Sprintf("Docker API error: %s", err)
 	}
-	Log.Infof("[docker] Using Docker API on %s: %v", apiPath, env)
-	return nil
+	return fmt.Sprintf("Docker API on %s: %v", c.Endpoint(), env)
+}
+
+func (c *Client) DockerVersion() string {
+	if env, err := c.Version(); err == nil {
+		if v, found := env.Map()["Version"]; found {
+			return v
+		}
+	}
+	return "unknown"
 }
 
 // AddObserver adds an observer for docker events
 func (c *Client) AddObserver(ob ContainerObserver) error {
-	events := make(chan *docker.APIEvents)
-	if err := c.AddEventListener(events); err != nil {
-		Log.Errorf("[docker] Unable to add listener to Docker API: %s", err)
-		return err
-	}
-
 	go func() {
-		for event := range events {
-			switch event.Status {
-			case "start":
-				id := event.ID
-				ob.ContainerStarted(id)
-			case "die":
-				id := event.ID
-				ob.ContainerDied(id)
+		pending := make(pendingStarts)
+		retryInterval := InitialInterval
+		for {
+			// Use a buffered chan so the client library can run ahead of the listener
+			// - Docker will drop an event if it is not collected quickly enough.
+			events := make(chan *docker.APIEvents, 1024)
+			if err := c.AddEventListener(events); err != nil {
+				c.errorf("Unable to add listener to Docker API: %s - retrying in %ds", err, retryInterval/time.Second)
+			} else {
+				start := time.Now()
+				for event := range events {
+					switch event.Status {
+					case "start":
+						pending.finish(event.ID)
+						pending.start(event.ID, c, ob)
+					case "die":
+						pending.finish(event.ID)
+						ob.ContainerDied(event.ID)
+					case "destroy":
+						pending.finish(event.ID)
+						ob.ContainerDestroyed(event.ID)
+					}
+				}
+				if time.Since(start) > retryInterval {
+					retryInterval = InitialInterval
+				}
+				c.errorf("Event listener channel closed - retrying subscription in %ds", retryInterval/time.Second)
+			}
+			time.Sleep(retryInterval)
+			retryInterval = retryInterval * 3 / 2
+			if retryInterval > MaxInterval {
+				retryInterval = MaxInterval
 			}
 		}
 	}()
 	return nil
 }
 
+// Docker sends a 'start' event before it has attempted to start the
+// container.  Delay notifying the observer until the container has a
+// pid, or we are told to stop when a 'die' event arrives.
+//
+// Note we always deliver the event, even if the container seems to
+// have gone away.
+func (pending pendingStarts) start(id string, c *Client, ob ContainerObserver) {
+	sync := syncPair{make(chan struct{}), make(chan struct{})}
+	pending[id] = &sync
+	go func() {
+		defer close(sync.done)
+		defer ob.ContainerStarted(id)
+		for {
+			if container, err := c.InspectContainer(id); err != nil || container.State.Pid != 0 {
+				return
+			}
+			select {
+			case <-sync.stop:
+				return
+			case <-time.After(200 * time.Millisecond):
+			}
+		}
+	}()
+}
+
+func (pending pendingStarts) finish(id string) {
+	if sync, found := pending[id]; found {
+		close(sync.stop)
+		<-sync.done
+		delete(pending, id)
+	}
+}
+
+// AllContainerIDs returns all the IDs of Docker containers,
+// whether they are running or not.
+func (c *Client) AllContainerIDs() ([]string, error) {
+	return c.containerIDs(true)
+}
+
+// RunningContainerIDs returns all the IDs of the running
+// Docker containers.
+func (c *Client) RunningContainerIDs() ([]string, error) {
+	return c.containerIDs(false)
+}
+
+func (c *Client) containerIDs(all bool) ([]string, error) {
+	containers, err := c.ListContainers(docker.ListContainersOptions{All: all})
+	if err != nil {
+		return nil, err
+	}
+	var ids []string
+	for _, c := range containers {
+		ids = append(ids, c.ID)
+	}
+	return ids, nil
+}
+
 // IsContainerNotRunning returns true if we have checked with Docker that the ID is not running
 func (c *Client) IsContainerNotRunning(idStr string) bool {
 	container, err := c.InspectContainer(idStr)
 	if err == nil {
-		return !container.State.Running
+		return !container.State.Running || container.State.Restarting
 	}
 	if _, notThere := err.(*docker.NoSuchContainer); notThere {
 		return true
 	}
-	Log.Errorf("[docker] Could not check container status: %s", err)
+	c.errorf("Could not check container status: %s", err)
 	return false
 }
+
+// This is intended to find an IP address that we can reach the container on;
+// if it is on the Docker bridge network then that address; if on the host network
+// then localhost
+func (c *Client) GetContainerIP(nameOrID string) (string, error) {
+	info, err := c.InspectContainer(nameOrID)
+	if err != nil {
+		return "", err
+	}
+	if info.NetworkSettings.Networks != nil {
+		if bridgeNetwork, ok := info.NetworkSettings.Networks["bridge"]; ok {
+			return bridgeNetwork.IPAddress, nil
+		} else if _, ok := info.NetworkSettings.Networks["host"]; ok {
+			return "127.0.0.1", nil
+		}
+	} else if info.HostConfig.NetworkMode == "host" {
+		return "127.0.0.1", nil
+	}
+	if info.NetworkSettings.IPAddress == "" {
+		return "", errors.New("No IP address found for container " + nameOrID)
+	}
+	return info.NetworkSettings.IPAddress, nil
+}
+
+func (c *Client) EnsureNetwork(networkName, driver, subnet string, options map[string]interface{}) error {
+	_, err := c.CreateNetwork(
+		docker.CreateNetworkOptions{
+			Name:           networkName,
+			CheckDuplicate: true,
+			Driver:         driver,
+			IPAM: &docker.IPAMOptions{
+				Driver: driver,
+				Config: []docker.IPAMConfig{{Subnet: subnet}},
+			},
+			Options: options,
+		})
+	if err != docker.ErrNetworkAlreadyExists && err != nil {
+		// Despite appearances to the contrary, CreateNetwork does
+		// sometimes(always?) *not* return ErrNetworkAlreadyExists
+		// when the network already exists. Hence we need to check for
+		// this explicitly.
+		if _, err2 := c.NetworkInfo(networkName); err2 != nil {
+			return fmt.Errorf("unable to create network: %s", err)
+		}
+	}
+	return nil
+}
+
+// logging
+
+func (c *Client) errorf(fmt string, args ...interface{}) {
+	common.Log.Errorf("[docker] "+fmt, args...)
+}

common/http.go

@@ -0,0 +1,18 @@
+package common
+
+import (
+	"net/http"
+)
+
+type loggingHandler struct {
+	next http.Handler
+}
+
+func (l *loggingHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	Log.Debugf("[http] %s %s", r.Method, r.URL.RequestURI())
+	l.next.ServeHTTP(w, r)
+}
+
+func LoggingHTTPHandler(h http.Handler) http.Handler {
+	return &loggingHandler{next: h}
+}

common/logging.go

@@ -3,9 +3,10 @@ package common
 import (
 	"bytes"
 	"fmt"
+	"log"
 	"strings"
 
-	"github.com/Sirupsen/logrus"
+	"github.com/sirupsen/logrus"
 )
 
 type textFormatter struct {
@@ -53,6 +54,12 @@ func SetLogLevel(levelname string) {
 	Log.Level = level
 }
 
+func CheckError(e error) {
+	if e != nil {
+		Log.Error(e)
+	}
+}
+
 func CheckFatal(e error) {
 	if e != nil {
 		Log.Fatal(e)
@@ -64,3 +71,23 @@ func CheckWarn(e error) {
 		Log.Warnln(e)
 	}
 }
+
+// Adaptor type to go from Logrus to something expecting a standard library log.Logger
+type logLogger struct {
+	logger *logrus.Logger
+}
+
+// io.Writer interface
+func (l logLogger) Write(p []byte) (n int, err error) {
+	ln := len(p)
+	// Strip a trailing newline, because logrus formatter adds one
+	if ln > 0 && p[ln-1] == '\n' {
+		p = p[:ln-1]
+	}
+	l.logger.Info(string(p))
+	return ln, nil
+}
+
+func LogLogger() *log.Logger {
+	return log.New(logLogger{Log}, "", 0)
+}

common/odp/odp.go

@@ -10,49 +10,50 @@ import (
 
 // ODP admin functionality
 
-func CreateDatapath(dpname string) (err error, supported bool) {
+func CreateDatapath(dpname string) (supported bool, err error) {
 	dpif, err := odp.NewDpif()
 	if err != nil {
 		if odp.IsKernelLacksODPError(err) {
-			return nil, false
+			return false, nil
 		}
-
-		return err, true
+		return true, err
 	}
-
 	defer dpif.Close()
 
 	dp, err := dpif.CreateDatapath(dpname)
-	if err != nil && !odp.IsDatapathNameAlreadyExistsError(err) {
-		return err, true
+	if err != nil {
+		if !odp.IsDatapathNameAlreadyExistsError(err) {
+			return true, err
+		}
+		if dp, err = dpif.LookupDatapath(dpname); err != nil {
+			return true, err
+		}
 	}
 
 	// Pick an ephemeral port number to use in probing for vxlan
 	// support.
 	udpconn, err := net.ListenUDP("udp4", nil)
 	if err != nil {
-		return err, true
+		return true, err
 	}
+	defer udpconn.Close()
 
 	// we leave the UDP socket open, so creating a vxlan vport on
 	// the same port number should fail.  But that's fine: It's
 	// still sufficient to probe for support.
 	portno := uint16(udpconn.LocalAddr().(*net.UDPAddr).Port)
-	vpid, err := dp.CreateVport(odp.NewVxlanVportSpec(
-		fmt.Sprintf("vxlan-%d", portno), portno))
+	vpid, err := dp.CreateVport(odp.NewVxlanVportSpec(fmt.Sprintf("vxlan-%d", portno), portno))
 	if nlerr, ok := err.(odp.NetlinkError); ok {
 		if syscall.Errno(nlerr) == syscall.EAFNOSUPPORT {
 			dp.Delete()
-			return fmt.Errorf("kernel does not have Open vSwitch VXLAN support"), false
+			return false, fmt.Errorf("kernel does not have Open vSwitch VXLAN support")
 		}
 	}
-
 	if err == nil {
 		dp.DeleteVport(vpid)
 	}
 
-	udpconn.Close()
-	return nil, true
+	return true, nil
 }
 
 func DeleteDatapath(dpname string) error {
@@ -60,7 +61,6 @@ func DeleteDatapath(dpname string) error {
 	if err != nil {
 		return err
 	}
-
 	defer dpif.Close()
 
 	dp, err := dpif.LookupDatapath(dpname)
@@ -68,7 +68,6 @@ func DeleteDatapath(dpname string) error {
 		if odp.IsNoSuchDatapathError(err) {
 			return nil
 		}
-
 		return err
 	}
 
@@ -76,11 +75,18 @@ func DeleteDatapath(dpname string) error {
 }
 
 func AddDatapathInterface(dpname string, ifname string) error {
+	return addDatapathInterface(dpname, ifname, false)
+}
+
+func AddDatapathInterfaceIfNotExist(dpname string, ifname string) error {
+	return addDatapathInterface(dpname, ifname, true)
+}
+
+func addDatapathInterface(dpname, ifname string, ignoreIfExist bool) error {
 	dpif, err := odp.NewDpif()
 	if err != nil {
 		return err
 	}
-
 	defer dpif.Close()
 
 	dp, err := dpif.LookupDatapath(dpname)
@@ -89,5 +95,9 @@ func AddDatapathInterface(dpname string, ifname string) error {
 	}
 
 	_, err = dp.CreateVport(odp.NewNetdevVportSpec(ifname))
+	if ignoreIfExist && err == odp.NetlinkError(syscall.EEXIST) {
+		return nil
+	}
+
 	return err
 }

common/process.go

@@ -0,0 +1,27 @@
+package common
+
+import (
+	"os"
+	"strconv"
+)
+
+func AllPids(procRoot string) ([]int, error) {
+	fh, err := os.Open(procRoot)
+	if err != nil {
+		return nil, err
+	}
+	defer fh.Close()
+	dirNames, err := fh.Readdirnames(-1)
+	if err != nil {
+		return nil, err
+	}
+	pids := make([]int, len(dirNames))
+	for _, dirName := range dirNames {
+		pid, err := strconv.Atoi(dirName)
+		if err != nil { // Only interested in numeric entries - skip /proc/stat, etc.
+			continue
+		}
+		pids = append(pids, pid)
+	}
+	return pids, err
+}

common/signals.go

@@ -1,32 +0,0 @@
-package common
-
-import (
-	"os"
-	"os/signal"
-	"runtime"
-	"syscall"
-)
-
-// A subsystem/server/... that can be stopped or queried about the status with a signal
-type SignalReceiver interface {
-	Stop() error
-}
-
-func SignalHandlerLoop(ss ...SignalReceiver) {
-	sigs := make(chan os.Signal, 1)
-	signal.Notify(sigs, syscall.SIGINT, syscall.SIGQUIT, syscall.SIGTERM)
-	buf := make([]byte, 1<<20)
-	for {
-		switch <-sigs {
-		case syscall.SIGINT, syscall.SIGTERM:
-			Log.Infof("=== received SIGINT/SIGTERM ===\n*** exiting")
-			for _, subsystem := range ss {
-				subsystem.Stop()
-			}
-			return
-		case syscall.SIGQUIT:
-			stacklen := runtime.Stack(buf, true)
-			Log.Infof("=== received SIGQUIT ===\n*** goroutine dump...\n%s\n*** end", buf[:stacklen])
-		}
-	}
-}

common/utils.go

@@ -1,8 +1,6 @@
 package common
 
-import (
-	"strings"
-)
+import "strings"
 
 // Assert test is true, panic otherwise
 func Assert(test bool) {

common/wait.go

@@ -0,0 +1,25 @@
+package common
+
+import (
+	"sync"
+	"sync/atomic"
+)
+
+type WaitGroup struct {
+	wg    sync.WaitGroup
+	count int32
+}
+
+// Increase the count of things waiting and return a closure which calls Done
+func (w *WaitGroup) Add() func() {
+	atomic.AddInt32(&w.count, 1)
+	w.wg.Add(1)
+	return func() {
+		w.wg.Done()
+		atomic.AddInt32(&w.count, -1)
+	}
+}
+
+func (w *WaitGroup) IsDone() bool {
+	return atomic.LoadInt32(&w.count) == 0
+}

db/boltdb.go

@@ -0,0 +1,115 @@
+package db
+
+import (
+	"bytes"
+	"encoding/gob"
+	"fmt"
+	"time"
+
+	"github.com/boltdb/bolt"
+)
+
+type DB interface {
+	Load(string, interface{}) (bool, error)
+	Save(string, interface{}) error
+}
+
+type BoltDB struct {
+	db *bolt.DB
+}
+
+var (
+	versionIdent       = []byte("version")
+	persistenceVersion = []byte{1, 0} // major.minor
+	topBucket          = []byte("top")
+)
+
+const (
+	NameIdent = "peername"
+	fileName  = "data.db"
+)
+
+func Pathname(dbPrefix string) string {
+	return dbPrefix + fileName
+}
+
+func NewBoltDB(dbPrefix string) (*BoltDB, error) {
+	dbPathname := Pathname(dbPrefix)
+	db, err := bolt.Open(dbPathname, 0660, nil)
+	if err != nil {
+		return nil, fmt.Errorf("[boltDB] Unable to open %s: %s", dbPathname, err)
+	}
+	err = db.Update(checkVersion(false))
+	return &BoltDB{db: db}, err
+}
+
+func NewBoltDBReadOnly(dbPrefix string) (*BoltDB, error) {
+	options := bolt.Options{Timeout: time.Millisecond * 50, ReadOnly: true}
+	dbPathname := Pathname(dbPrefix)
+	db, err := bolt.Open(dbPathname, 0660, &options)
+	if err != nil {
+		return nil, fmt.Errorf("[boltDB] Unable to open %s: %s", dbPathname, err)
+	}
+	err = db.View(checkVersion(true))
+	if err != nil {
+		return nil, fmt.Errorf("[boltDB] Cannot use persistence file %s: %s", dbPathname, err)
+	}
+	return &BoltDB{db: db}, nil
+}
+
+func checkVersion(readOnly bool) func(tx *bolt.Tx) error {
+	return func(tx *bolt.Tx) error {
+		if top := tx.Bucket(topBucket); top == nil {
+			if readOnly {
+				return fmt.Errorf("no top bucket")
+			}
+			top, err := tx.CreateBucket(topBucket)
+			if err != nil {
+				return err
+			}
+			if err := top.Put(versionIdent, persistenceVersion); err != nil {
+				return err
+			}
+		} else {
+			if checkVersion := top.Get(versionIdent); checkVersion != nil {
+				if checkVersion[0] != persistenceVersion[0] {
+					return fmt.Errorf("mismatched version %x", checkVersion)
+				}
+			}
+		}
+		return nil
+	}
+}
+
+func (d *BoltDB) Load(ident string, data interface{}) (bool, error) {
+	found := true
+	err := d.db.View(func(tx *bolt.Tx) error {
+		b := tx.Bucket(topBucket)
+		v := b.Get([]byte(ident))
+		if v == nil {
+			found = false
+			return nil
+		}
+		reader := bytes.NewReader(v)
+		decoder := gob.NewDecoder(reader)
+		err := decoder.Decode(data)
+		return err
+	})
+	return found, err
+}
+
+func (d *BoltDB) Save(ident string, data interface{}) error {
+	return d.db.Update(func(tx *bolt.Tx) error {
+		b := tx.Bucket(topBucket)
+		buf := new(bytes.Buffer)
+		enc := gob.NewEncoder(buf)
+		if err := enc.Encode(data); err != nil {
+			return err
+		}
+		return b.Put([]byte(ident), buf.Bytes())
+	})
+}
+
+func (d *BoltDB) Close() error {
+	return d.db.Close()
+}

docs/benchmarks.md

@@ -0,0 +1,81 @@
+# Weave Net Benchmarks
+
+## 2017-02-16: Fast Datapath Encryption
+
+Results: https://www.weave.works/weave-net-performance-fast-datapath/
+
+* Two `c3.8xlarge` instances running Ubuntu 16.04 LTS (`ami-d8f4deab`) in
+`eu-west-1` region of AWS.
+* 10 Gigabit [Enhanced Networking](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/enhanced-networking.html).
+* `iperf 3.0.11`.
+
+### fastdp
+
+* Encrypted:
+
+```
+host1$ WEAVE_MTU=8916 weave launch --password=foobar
+host1$ docker $(weave config) run --rm -ti --name server networkstatic/iperf3 -s
+
+host2$ WEAVE_MTU=8916 weave launch --password=foobar host1
+host2$ docker $(weave config) run --rm -ti networkstatic/iperf3 -c server
+```
+
+* Non-encrypted:
+
+```
+host1$ WEAVE_MTU=8950 weave launch
+host1$ docker $(weave config) run --rm -ti --name server networkstatic/iperf3 -s
+
+host2$ WEAVE_MTU=8950 weave launch --password=foobar host1
+host2$ docker $(weave config) run --rm -ti networkstatic/iperf3 -c server
+```
+
+### sleeve
+
+* Encrypted:
+
+```
+host1$ WEAVE_NO_FASTDP=1 weave launch --password=foobar
+host1$ docker $(weave config) run --rm -ti --name server networkstatic/iperf3 -s
+
+host2$ WEAVE_NO_FASTDP=1 weave launch --password=foobar host1
+host2$ docker $(weave config) run --rm -ti networkstatic/iperf3 -c server
+```
+
+* Non-encrypted:
+
+```
+host1$ WEAVE_NO_FASTDP=1 weave launch
+host1$ docker $(weave config) run --rm -ti --name server networkstatic/iperf3 -s
+
+host2$ WEAVE_NO_FASTDP=1 weave launch --password=foobar host1
+host2$ docker $(weave config) run --rm -ti networkstatic/iperf3 -c server
+```
+
+### host
+
+* Non-encrypted:
+
+```
+host1$ iperf -s
+host2$ iperf -c host1
+```
+
+* Encrypted:
+
+```
+host1$ export KEY1="0x466454f2b1a770f8f872f9afbc35ebeac57e00fc11ac86ed1f82716f010b20f0cf532274"
+host1$ export KEY2="0x3531151241a770f8f872f9afbc35ebeac57e00fc11ac86ed1f82716f010b20f0cf532274"
+host1# ip xfrm state add src ${IP1} dst ${IP2} proto esp spi 0x4c856ffc replay-window 256 flag esn reqid 0 mode transport aead 'rfc4106(gcm(aes))' ${KEY1} 128
+host1# ip xfrm state add src ${IP2} dst ${IP1} proto esp spi 0x9b0830bc replay-window 256 flag esn reqid 0 mode transport aead 'rfc4106(gcm(aes))' ${KEY2} 128
+host1# ip xfrm policy add src ${IP1}/32 dst ${IP2}/32 dir out tmpl src ${IP1} dst ${IP2} proto esp spi 0x4c856ffc reqid 0 mode transport
+host1$ iperf -s
+
+host2$ export KEY1="0x466454f2b1a770f8f872f9afbc35ebeac57e00fc11ac86ed1f82716f010b20f0cf532274"
+host2$ export KEY2="0x3531151241a770f8f872f9afbc35ebeac57e00fc11ac86ed1f82716f010b20f0cf532274"
+host2# ip xfrm state add src ${IP2} dst ${IP1} proto esp spi 0x9b0830bc reqid 0 replay-window 256 flag esn mode transport aead 'rfc4106(gcm(aes))' ${KEY2} 128
+host2# ip xfrm state add src ${IP1} dst ${IP2} proto esp spi 0x4c856ffc reqid 0 replay-window 256 flag esn mode transport aead 'rfc4106(gcm(aes))' ${KEY1} 128
+host2# ip xfrm policy add src ${IP2}/32 dst ${IP1}/32 dir out tmpl src ${IP1} dst ${IP2} proto esp spi 0x9b0830bc reqid 0 mode transport
+host2$ iperf -c host1
+```

docs/entrypoints.md

@@ -0,0 +1,70 @@
+# Entrypoints
+
+This document describes the various ways that weave as a binary gets launched, and where and how it processes options.
+
+The goal is to enable maintainers to modify functionality without having to reverse engineer the code to find all of the places you can start a weave binary and what it depends upon.
+
+## Components
+### weaver
+
+`weaver` is the primary binary: it sets up the weave bridge to which containers are attached, manages IP address allocation, serves DNS requests and does many more things.
+
+Since version 2.0, `weaver` also bundles the Docker Plugin (legacy version) and Docker API Proxy which used to be shipped as separate containers.
+
+### weaveutil
+weaveutil is a binary which provides a number of functions for managing an existing weave network. It gets information about the network, attaches and detaches containers, etc.
+
+For the majority of interactions with an existing weave network, you will launch `weaveutil` in some manner or another.
+
+Almost all options can be passed as `--option` to `weaveutil`. These options are created in `prog/weaveutil/main.go` with a table mapping each command to a dedicated golang function.
+
+In addition to operating in normal mode, `weaveutil` has several additional operating modes. Before processing any commands, `weaveutil` checks the filename with which it was called.
+
+* If it was `weave-ipam` it delegates responsibility to the `cniIPAM()` function in `prog/weaveutil/cni.go`, which, in turn, calls the standard CNI plugin function `cni.PluginMain()`, passing it weave's IPAM implementation from `plugin/ipam`.
+* If it was `weave-net` it delegates responsibility to the `cniNet()` function in `prog/weaveutil/cni.go`, which, in turn, calls the standard CNI plugin function `cni.PluginMain()`, passing it weave's net plugin implementation from `plugin/net`.
+
+Finally, `weaveutil` is called by `weaver` when it needs to operate in a different network namespace.
+Go programs cannot safely switch namespaces; see this [issue](http://github.com/vishvananda/netns/issues/17).
+The call chain is `weaver`->`nsenter`->`weaveutil`.
+
+### weave
+Wrapping `weaver` and `weaveutil` is `weave`, a `sh` script that provides help information and calls `weaveutil` as relevant.
+
+### weave-kube
+weave-kube is an image with the weave binaries and a wrapper script installed. It is responsible for:
+
+1. Setting up the weave network
+2. Connecting to peers
+3. Copy the weave CNI-compatible binary plugin `weaveutil` to `/opt/cni/bin/weave-net` and weave config in `/etc/cni/net.d/10-weave.conflist`
+4. Running the weave network policy controller (weave-npc) to implement kubernetes' `NetworkPolicy`
+
+Once installation is complete, each network-relevant change in a container leads `kubelet` to:
+
+1. Set certain environment variables to configure the CNI plugin, mostly related to the container ID
+2. Launch `/opt/cni/bin/weave-net`
+3. Pass the CNI config - the contents of `/etc/cni/net.d/10-weave.conflist` to `weave-net`
+
+Thus, when each container is changed, and `kubelet` calls weave as a CNI plugin, it really just is launching `weaveutil` as `weave-net`.
+
+The installation and setup of all of the above - and therefore the entrypoint to the weave-kube image - is the script `prog/weave-kube/launch.sh`. `launch.sh` does the following:
+
+1. Read configuration variables from the environment. When the documentation for `weave-kube` describes configuring the weave network by changing the environment variables in the daemonset in the `.yml` file, `launch.sh` reads these environment variables.
+2. Set up the config file at `/etc/cni/net.d/10-weave.conflist`
+3. Run the `weave` initialization script
+4. Run `weaver` with the correct configuration passed as command-line options
+
+
+## Adding Options
+To add new options to how weave should run with each invocation, you would do the following:
+
+1. determine to which `weave` command you want to add the option(s). `weave` normally is launched as `weave <command> <options> ...`.
+2. Add the option to `weave` script help for each `weave` command you wish to make it available. As of this writing, all of the commands and their options are listed in the function `usage_no_exist()`.
+3. Add the option to `weave` script option processing for the `weave` command, under the `case $COMMAND in` in the main `weave` script.
+4. In the function for the `weave` command, determine if the command should be passed on to `weaveutil` or `weaver`. Pass the option on to `weaveutil` or `weaver`, as appropriate, in the format `--option`, in the function for the `weave` command.
+5. Add a command-line option `--option` to `weaveutil` or `weaver` as appropriate.
+6. If the option can be configured for CNI:
+    * have `prog/weave-kube/launch.sh` read it as an environment variable and set inside
+    * set a default for the environment variable in `prog/weave-kube/weave-daemonset-k8s-N.N.yaml`
+    * if it should be set via `weaver` globally on its one-time initialization invocation, pass it on in `launch.sh`
+    * if it needs to be set via `weaveutil` on each invocation of `weave-net`, have `launch.sh` save it as an option in the CNI config file `/etc/cni/net.d/10-weave.conflist` and then have the CNI code in `plugin/net/cni.go` in `weaveutil` read it and use where appropriate
+7. Document it!

docs/fastdp-crypto.md

@@ -0,0 +1,155 @@
+This document describes implementation details of the fast datapath encryption.
+
+# Overview
+
+At the high level, we use the ESP protocol ([RFC 2406][esp]) in the Transport
+mode. Each packet is encrypted with AES in GCM mode ([RFC 4106][aesgcm]), with
+32 byte key and 4 byte salt. This combo provides the following security
+properties:
+
+* Data confidentiality.
+* Data origin authentication.
+* Integrity.
+* Anti-replay.
+* Limited traffic flow confidentiality as fast datapath VXLAN packets are fully
+  encrypted.
+
+## Notation
+
+* `SAin`:  IPsec security association for inbound connections.
+* `SAout`: IPsec security association for outbound connections.
+* `SPout`: IPsec security policy for outbound connections. Used to match
+           outbound flows to SAout.
+
+## SA Key Derivation
+
+For each connection direction, a different AES-GCM key and salt is used.
+The pairs are derived with HKDF ([RFC 5869][hkdf]):
+
+```
+SAin[KeyAndSalt] = HKDF(sha256, ikm=sessionKey, salt=nonceIn, info=localPeerName)
+SAout[KeyAndSalt] = HKDF(sha256, ikm=sessionKey, salt=nonceOut, info=remotePeerName)
+```
+
+Where:
+
+* the mutual `sessionKey` is derived by the [Mesh][mesh] library during
+  the control plane connection establishment between the local peer and
+  the remote peer.
+* `nonceIn` and `nonceOut` are randomly generated 32byte nonces which
+  are exchanged over the encrypted control plane channel.
+
+## SPI
+
+A directional secure connection between two peers is identified with SPI.
+
+The kernel requires the pair of SPI and dst IP to be unique among security
+associations. Thus, to avoid collisions, we generate outbound SPI on a remote
+peer.
+
+## Connection Establishment
+
+```
+Peer A                                                        Peer B
+-----------------------------------------------------------------------------------------------------------------
+
+fastdp.fwd.Confirm():
+    install iptables blocking rules,                          fastdp.fwd.Confirm():
+    nonce_BA = rand(),                                            install iptables blocking rules,
+    {key,salt}_BA = hkdf(sessionKey, nonce_BA, A),                nonce_AB = rand(),
+    spi_BA = allocspi(),                                          {key,salt}_AB = hkdf(sessionKey, nonce_AB, B),
+    create SA_BA(B<-A, spi_BA, key_BA, salt_BA),                  spi_AB = allocspi(),
+    send InitSARemote(spi_BA, nonce_BA). -->                      create SA_AB(A<-B, spi_AB, key_AB, salt_AB),
+                                                              <-- send InitSARemote(spi_AB, nonce_AB).
+
+
+                                                          --> recv InitSARemote(spi_BA, nonce_BA):
+recv InitSARemote(spi_AB, nonce_AB): <--                          {key,salt}_BA = hkdf(sessionKey, nonce_BA, A),
+    {key,salt}_AB = hkdf(sessionKey, nonce_AB, B),                create SA_BA(B<-A, spi_BA, key_BA, salt_BA),
+    create SA_AB(A<-B, spi_AB, key_AB, salt_AB),                  create SP_BA(B<-A, spi_BA),
+    create SP_AB(A<-B, spi_AB),                                   install marking rule.
+    install marking rule.
+```
+
+# Implementation Details
+
+## XFRM
+
+The implementation is based on the kernel IP packet transformation framework
+called XFRM. Unfortunately, docs are barely existing and the complexity of
+the framework is high. The best resource I found is Chapter 10 in
+"Linux Kernel Networking: Implementation and Theory" by Rami Rosen.
+
+## iptables Rules
+
+The kernel VXLAN driver does not set a dst port of a tunnel in the ip flow
+descriptor, thus XFRM policy lookup cannot match a policy (SPout) which includes
+the port. This makes impossible to encrypt only tunneled traffic between
+peers. To work around, we mark such outgoing packets with iptables and set
+the same mark in the policy selector (funnily enough, `iptables_mangle` module
+eventually sets the missing dst port in the flow descriptor). The challenge
+here is to pick a mark that it would not interfere with other networking
+applications before OUTPUT'ing a packet. For example, Kubernetes by default
+uses 1<<14 and 1<<15 marks and we choose 1<<17 (0x20000). Additionally,
+such workaround brings the requirement for at least the 4.2 kernel.
+
+The marking rules are the following:
+
+```
+iptables -t mangle -A OUTPUT -j WEAVE-IPSEC-OUT
+iptables -t mangle -A WEAVE-IPSEC-OUT -s ${LOCAL_PEER_IP} -d ${REMOTE_PEER_IP} \
+         -p udp --dport ${TUNNEL_PORT} -j WEAVE-IPSEC-OUT-MARK
+iptables -t mangle -A WEAVE-IPSEC-OUT-MARK --set-xmark ${MARK} -j MARK
+```
+
+As Linux does not implement [IP Security Levels][ipseclevel], we install
+additional iptables rules to prevent from accidentally sending unencrypted
+traffic between peers which have previously established the secure connection.
+
+For inbound traffic, we mark each ESP packet with the mark and drop non-marked
+tunnel traffic:
+
+```
+iptables -t mangle -A INPUT -j WEAVE-IPSEC-IN
+iptables -t mangle -A WEAVE-IPSEC-IN -s ${REMOTE_PEER_IP} -d ${LOCAL_PEER_IP} \
+         -m esp --espspi ${SPIin} -j WEAVE-IPSEC-IN-MARK
+iptables -t mangle -A WEAVE-IPSEC-IN-MARK --set-xmark ${MARK} -j MARK
+
+iptables -t filter -A INPUT -j WEAVE-IPSEC-IN
+iptables -t filter -A WEAVE-IPSEC-IN -s ${REMOTE_PEER_IP} -d ${LOCAL_PEER_IP} \
+         -p udp --dport ${TUNNEL_PORT} -m mark ! --mark ${MARK} -j DROP
+```
+
+For outbound traffic, we drop marked traffic which does not match any SPout:
+
+```
+iptables -t filter -A OUTPUT ! -p esp -m policy --dir out --pol none \
+         -m mark --mark ${MARK} -j DROP
+```
+
+## ESN
+
+To prevent from cycling SeqNo which makes replay attacks possible, we use
+64-bit extended sequence numbers known as [ESN](esn).
+
+## MTU
+
+In addition to the VXLAN overhead, the MTU calculation should take into account
+the ESP overhead which is 34-37 bytes (encrypted Payload is 4 bytes aligned) and
+consists of:
+
+* 4 bytes (SPI).
+* 4 bytes (Sequence Number).
+* 8 bytes (ESP IV).
+* 1 byte (Pad Length).
+* 1 byte (NextHeader).
+* 16 bytes (ICV).
+* 0-3 bytes (Padding).
+
+
+[esp]:              https://tools.ietf.org/html/rfc2406
+[aesgcm]:           https://tools.ietf.org/html/rfc4106
+[hkdf]:             https://tools.ietf.org/html/rfc5869
+[esn]:              https://tools.ietf.org/html/rfc4304
+[ipseclevel]:       https://tools.ietf.org/html/draft-mcdonald-simple-ipsec-api-01)
+[mesh]:             https://github.com/weaveworks/mesh

docs/fastdp.md

@@ -0,0 +1,170 @@
+# Overlay Method Selection
+
+Weave automatically selects the best working overlay implementation
+when connecting to a new peer. It does this by initiating both
+forwarders in parallel, eventually settling on the most preferred
+established forwarder at which point the other forwarder is shut down,
+assuming it had not failed already. In the event that the remaining
+forwarder fails at a later time (e.g. because of a heartbeat timeout)
+the control plane TCP connection will recycle allowing the selection
+algorithm to run again. By default fast datapath is preferred over
+Sleeve.
+
+# Local Bridging
+
+Unlike the weave bridge netdev used by Sleeve, the OVS datapath has no
+inherent bridging capability. Consequently fastdp implements an
+ethernet bridge in addition to the vxlan overlay, maintaining its own
+forwarding database by learning MAC addresses and dispatching
+broadcast, unicast & multicast traffic accordingly.
+
+# Short Peer IDs
+
+The router relies on having access to the source and destination peer
+when deciding how to forward packets. When the Sleeve overlay is in
+use this information is conveyed directly within the encapsulation by
+including the names of the peers in question, a solution not
+accommodated directly by the vxlan wire format. Fortunately vxlan does
+have a twenty four bit segment ID field in the header we can use to
+encode this data - the challenge is to identify peers uniquely with a
+twelve bit identifier instead of the seventeen bytes used by Sleeve.
+In practice this is achieved by peers adopting a random 'short ID' and
+resolving ownership collisions of same via the existing gossip
+mechanism.
+
+# Heartbeats via vxlan
+
+Heartbeats are implemented by sending an encapsulated ethernet frame
+with source and destination MAC addresses of `00:00:00:00:00:00` and a
+payload consisting of the connection UID and total ethernet frame
+length. The vxlan vport miss handler on the receiving side detects the
+all-zero addresses and acknowledges the heartbeat via the TCP control
+channel after validating the connection UID and frame length against
+their expected values.
+
+# PMTU Discovery
+
+The length of the heartbeat ethernet frame is set to the MTU of the
+datapath interface. In the event the vxlan packet is dropped or
+truncated, the heartbeat will not be acknowledged; this lack of
+acknowledgement will cause the peers to fall back to the Sleeve
+overlay, which has a more sophisticated dynamic mechanism for coping
+with low path MTUs.
+
+To avoid triggering this fallback in typical deployments, the datapath
+interface is statically configured with an MTU of 1376 bytes allowing
+it to work with most underlay network provider MTUs, including GCE at
+1460 bytes (the eighty four byte difference accommodates the encrypted vxlan overhead).
+This value can be overridden by setting `WEAVE_MTU` at launch if
+necessary.
+
+# Virtual Ports
+
+There are three kinds of virtual port associated with the weave
+datapath:
+
+* `internal` - one of these is created automatically, named after the
+  datapath. It corresponds to the network interface of the same name
+  that appears on the host when the datapath is created; it is the
+  ingress/egress port for `weave expose`
+* `netdev` - one for each application container, corresponding to the
+  host end of the veth pair
+* `vxlan` - one for each UDP port on which we are listening for vxlan
+  encapsulated packets. Typically there is only one of these, but
+  there may be more in a network in which peers do not all use the same
+  port configuration
+
+# Misses and Flow Creation
+
+As mentioned above, the datapath has no inherent behaviour - any
+ingressing packet which does not match a flow is passed to a userspace
+miss handler. The miss handler is then responsible for a) instructing
+the datapath to take actions for the packet that caused the miss (for
+example by copying it to one or more ports) and optionally b)
+installing flow rules which will allow the datapath to act on similar
+packets in future without invoking the miss handler.
+
+At a high level the fast datapath implementation can be viewed as a
+set of miss handlers that determine what actions the OVS datapath
+should take based on router topology information, together with some
+additional machinery that manages the expiry of resulting flows when
+that state changes.
+
+When a miss handler is invoked, it has two pieces of context: a byte
+array containing the packet that triggered the miss, and a set of
+'flow keys' that have been extracted from the packet by the kernel
+module. The following flow keys are of interest to weave:
+
+* `InPort` - the identifier of the ingress virtual port
+* `Ethernet` - the source and destination MAC addresses of the
+  ethernet frame
+* `Tunnel` - tunnel identifier (see section on short peer IDs above),
+  and source/dest IPv4 addresses. Only present for ingress via a vxlan
+  vport
+
+Crucially, the router must use this information alone to determine
+which actions to take - this allows the specification of a flow which
+matches these keys and instructs the kernel to take action
+automatically in future without further userspace involvement.
+
+Two actions are of interest:
+
+* `Output` - output the packet to the specified vport
+* `SetTunnel` - update the effective vxlan tunnel parameters. Only
+  required prior to output from a vxlan vport
+
+It is possible to have multiple actions in a flow, so the router can
+for example create a single rule that copies broadcast traffic to all
+'local' vports (save the ingress vport obviously) as well as to vxlan
+vports for onward peers as dictated by the routing topology.
+
+Every flow specified by the router has the following characteristics:
+
+* An `InPort` key matching the ingress vport
+* A `Tunnel` key if the ingress vport is of type vxlan
+* An `Ethernet` key matching the source and destination MAC
+* A list of `Output` (for internal and netdev vports) and
+  `SetTunnel`+`Output` (for vxlan vports) actions
+
+Under certain circumstances the miss handler will instruct the
+datapath to execute a set of actions for a packet without creating a
+corresponding flow:
+
+* When broadcasting packets to discover the path to unknown
+  destination MACs. This condition is transient in the overwhelming
+  majority of cases and so the benefit of creating a flow is
+  outweighed by the need to invalidate it once the MAC is learned
+* When the packet also needs to be forwarded to one or more peers via
+  Sleeve. In this case the router needs to handle all subsequent
+  matching packets as there is no OVS flow action to do it without
+  userspace involvement
+
+# Flow Invalidation
+
+Once a flow has been created for a particular combination of keys, the
+miss handler will never again be invoked for matching packets. It is
+therefore extremely important that we detect events which invalidate
+existing flow actions:
+
+* Addition of netdev vports to the datapath
+* Route invalidation (topology change)
+* Short peer ID collision
+
+The response in each case is the same - delete all flows from the
+datapath, allowing them to be recreated taking into account the
+updated state.
+
+In addition to these event based invalidations there is an expiry
+process that executes every five minutes. This process enumerates all
+flows in the datapath, removing any which have not been used since the
+last check; this cleans up:
+
+* Flows referring to netdev vports which have been removed
+* Flows created by forwarders which have been stopped
+* Flows related to MAC addresses which have not communicated recently
+
+Flows keyed on tunnel IPv4 address do not need to be cleared when a
+peer appears to change IP address due to NAT; this will cause a miss
+resulting in a new flow, and the old flow will expire naturally via
+the timer mechanism.
+

docs/ipam.md

@@ -65,14 +65,30 @@ peer for space:
   - it will continue to ask for space until it receives some, or its
     copy of the ring tells it all peers are full in that subnet.
 
+### Data persistence
+
+Key IPAM data is saved to disk, in a [BoltDB](https://github.com/boltdb/bolt)
+file, stored within a [data volume container](https://docs.docker.com/engine/userguide/containers/dockervolumes/#creating-and-mounting-a-data-volume-container)
+named `weavedb`.
+
+This file is used to persist data for various Weave Net components; for IPAM it contains:
+
+* the division of the IP allocation range amongst peers, and
+* allocation of addresses to containers on the local peer,
+
+so that it is immediately available when the peer restarts.
+
 ### Claiming an address
 
-If a Weave process is restarted, in most cases it will hear from
-another peer which ranges it used to own, but it needs to know which
-individual IP addresses are assigned to containers in order to avoid
-giving the same address out in subsequent allocation requests. The
-weave script invokes the `claim` command in `populate_ipam` to do
-this.
+If a Weave process is restarted,
+
+- if `weavedb` is present, then it loads persisted IPAM data from there, as
+described, in the previous section;
+- else, it learns from other peers which ranges it used to own.
+
+Weave Net then consults the allocator to know which individual IP addresses
+are assigned to containers, and therefore avoid giving the same address out in
+subsequent allocation requests.
 
 When the Allocator is told to claim an address, there are four
 possibilities:
@@ -210,11 +226,3 @@ reached the peer that does the `rmpeer`, then we get an inconsistent
 ring.  We could make it safe, up to partitions, by inquiring of every
 live peer what its view of the dead peer is, and making sure we use
 the latest info.)
-
-## Limitations
-
-Nothing is persisted. If one peer restarts it should receive gossip
-from other peers showing what it used to own, and in that case it can
-recover quite well. If, however, there are no peers left alive, or
-this peer cannot establish network communication with those that are,
-then it cannot recover.

docs/k8s-src-ip.md

@@ -0,0 +1,33 @@
+# Source IP addr of packet sent to k8s Service
+
+## Setup
+
+* Weave Net: v2.2.1.
+* Kubernetes: v1.10.0.
+* kube-proxy: iptables/ipvs mode with `--masquerade-all=false` and `--cluster-cidr` unspecified(default kubeadm options).
+* Hosts: `h1` and `h2`.
+
+## Source IP
+
+\# | Src         | Target            | Dst    | Src IP           | `-j WEAVE-NPC`
+---|-------------|-------------------|--------|------------------|--------------
+1  | Pod_h1      | ip(Pod_h2)        | Pod_h2 | ip(Pod_h1)       | OK
+2  | h1          | ClusterIP         | Pod_h1 | ip(weave_h1)     | **NOK**
+3  | h1          | ClusterIP         | Pod_h2 | ip(weave_h1)     | OK
+4  | Pod_h1      | ClusterIP         | Pod_h1 | ip(Pod_h1)       | OK
+5  | Pod_h1      | ClusterIP         | Pod_h2 | ip(weave_h1)     | OK
+6  | h1          | ip(h1):NodePort   | Pod_h1 | ip(weave_h1)     | **NOK**
+7  | h1          | ip(h1):NodePort   | Pod_h2 | ip(weave_h1)     | OK
+8  | h1          | ip(h2):NodePort   | Pod_h1 | ip(weave_h2)     | OK
+9  | h1          | ip(h2):NodePort   | Pod_h2 | ip(weave_h2)     | ??? Can't reproduce
+10 | Pod_h1      | ip(h1):NodePort   | Pod_h1 | ip(weave_h1)     | **NOK**
+11 | Pod_h1      | ip(h1):NodePort   | Pod_h2 | ip(weave_h1)     | OK
+12 | Pod_h1      | ip(h2):NodePort   | Pod_h1 | ip(weave_h2)     | OK
+13 | Pod_h1      | ip(h2):NodePort   | Pod_h2 | ip(weave_h2)     | OK
+
+Remarks:
+
+* **Src IP** is of a packet which is captured on the weave bridge.
+* **-j WEAVE-NPC** - whether a packet enters the `filter/WEAVE-NPC` iptables chain (OK = NetworkPolicy is enforced as required).
+* **Pod_h1** - a Pod running on the `h1` host.
+* **ip(weave_h1)** - IP addr of the weave bridge on the `h1` host.

docs/release-process.md

@@ -3,10 +3,9 @@
 
 * Up-to-date versions of `git`, `go` etc
 * Install GitHub release tool `go get github.com/weaveworks/github-release`
+* Install manifest tool `go get github.com/estesp/manifest-tool`
 * Create a [github token for
-  github-release](https://help.github.com/articles/creating-an-access-token-for-command-line-use/);
-set and export `$GITHUB_TOKEN` with this value
-* Update all dependencies with `make update`
+  github-release](https://help.github.com/articles/creating-an-access-token-for-command-line-use/); select the `repo` OAuth scope; set and export `$GITHUB_TOKEN` with this value
 
 ## Release Types
 
@@ -63,9 +62,10 @@ This has the following effects:
 ## Draft Phase
 ### Push Version Tag Upstream
 
-First you must push your version tag upstream, so that an associated
-GitHub release may be created:
+First you must push your branch and version tag upstream, so that an
+associated GitHub release may be created:
 
+    git push git@github.com:weaveworks/weave
     git push git@github.com:weaveworks/weave $TAG
 
 N.B. if you're testing the release process, push to your fork
@@ -128,6 +128,59 @@ Finally, for **Mainline** releases only:
 
 * Images tagged `latest` are updated on DockerHub
 
+Now, you can validate whether images were published for all platforms:
+
+    # Required platforms for each image:
+    grep '^ML_PLATFORMS=' Makefile
+
+    # Published platforms per image:
+    for img in $(grep '^PUBLISH=' Makefile); do
+        img="weaveworks/$(echo $img | cut -d_ -f2):${TAG#v}"
+        platforms=$(manifest-tool \
+                inspect --raw "$img" | \
+                jq '.[].Platform | .os + "/" +.architecture' | \
+                tr '\n' ' ')
+        echo "$img: $platforms"
+    done
+
+
+### Docker Store
+
+Weave Net is [available in Docker Store](https://store.docker.com/plugins/weave-net-plugin) and should also be released there.
+
+* Go to https://store.docker.com/ and log in.
+* Go to "[_Publish_](https://store.docker.com/publisher/center)".
+* Under "_My Products_", select "_owners (weaveworks)_". Weave Net should be listed among our products.
+* Click "_Actions_" > "_Edit Product_".
+* Go to "_Plans & Pricing_" > "_Free Tier_".
+* Under "_Source Repositories & Tags_", click on "_Add Source_", select "_net-plugin_" under "_Repository_" and the version to release under "_Tag_".
+* Under "_Resources_" > "_Installation Instructions_", update the lines containing `export NET_VERSION=<version>`.
+* Click "_Save_"
+* Click "_Submit For Review_". You should see a message like: "_Your product has been submitted for approval. [...] We'll be in touch with next steps soon!_".
+* You should receive an email saying:
+
+> This email confirms that we received your submission on \<date\> of Weave Net to the Docker Store.
+>
+> We're reviewing your submission to ensure that it meets our [security guidelines](https://success.docker.com/Store#Security_and_Audit_Policies) and complies with our [best practices](https://success.docker.com/Store#Create_Great_Content). Don't worry! We'll let you know if there's anything you need to change before we publish your submission. You should hear back from us within the next 14 days.
+> 
+> Thanks for submitting your content to the Docker Store!
+
+* Hope Docker eventually performs the release or contacts us. If nothing happens within 14 days, contact their support team: publisher-support@docker.com.
+
+### Finish up
+
+* If not on master, merge branch into master and push to GitHub.
+* Close the [milestone](https://github.com/weaveworks/weave/milestones) in GitHub and create the next milestone
+* Update the `#weavenetwork` topic heading on freenode (requires 'chanops' permission)
+* For a mainline release vX.Y.0, create a release branch X.Y from the
+  tag, push to GitHub and set [WEAVE_NET_REV](https://github.com/weaveworks/website-next/blob/master/Makefile)
+  to X.Y via a PR - this will result in X.Y.0 site docs being published to https://www.weave.works
+* Add the new version of `weave-net` to the checkpoint system at
+  https://checkpoint-api.weave.works/admin
+* File a PR to update the version of the daemonset at
+  https://github.com/kubernetes/kops/tree/master/upup/models/cloudup/resources/addons/networking.weave
+  and kops/upup/pkg/fi/cloudup/bootstrapchannelbuilder.go
+  and kops/upup/pkg/fi/cloudup/tests/bootstrapchannelbuilder/weave/manifest.yaml
 
 ## Troubleshooting
 

docs/weavedns-design.md

@@ -9,7 +9,7 @@ The model is that each host has a service that is notified of
 hostnames and weave addresses for containers on the host.  Like IPAM,
 this service is embedded within the router.  It binds to
 the host bridge to answer DNS queries from local containers; for
-anything it can't answer, it uses the infomation in the host's
+anything it can't answer, it uses the information in the host's
 /etc/resolv.conf to query an 'fallback' server.
 
 The service is comprised of a DNS server, which answers all DNS queries
@@ -33,7 +33,7 @@ are re-broadcast around the cluster.
 The DNS server also listens to the Docker event stream, and removes
 entries for containers when they die.  Entries removed in this way are
 tombstoned, and the tombstone lazily broadcast around the cluster.
-After a short timeout the tombstones are independantly removed from
+After a short timeout the tombstones are independently removed from
 each host.
 
 

docs/weavenpc-design.md

@@ -0,0 +1,158 @@
+# Overview
+
+# ipsets
+
+The policy controller maintains a number of ipsets which are
+subsequently referred to by the iptables rules used to effect network
+policy specifications. These ipsets are created, modified and
+destroyed automatically in response to Pod, Namespace and
+NetworkPolicy object updates from the k8s API server:
+
+* A `hash:ip` set per namespace, containing the IP addresses of all
+  pods in that namespace for which default ingress is allowed
+* A `hash:ip` set per namespace, containing the IP addresses of all
+  pods in that namespace for which default egress is allowed  
+* A `list:set` per distinct (across all network policies in all
+  namespaces) namespace selector mentioned in a network policy,
+  containing the names of any of the above hash:ip sets whose
+  corresponding namespace labels match the selector
+* A `hash:ip` set for each distinct (within the scope of the
+  containing network policy's namespace) pod selector mentioned in a
+  network policy, containing the IP addresses of all pods in the
+  namespace whose labels match that selector
+* A `hash:net` set for each distinct (within the scope of the
+  containing network policy's namespace) `except` list of CIDR's mentioned in
+  the network policies
+
+IPsets are implemented by the kernel module `xt_set`, without which
+weave-npc will not work.
+
+ipset names are generated deterministically from a string
+representation of the corresponding label selector. Because ipset
+names are limited to 31 characters in length, this is done by taking a
+SHA hash of the selector string and then printing that out as a base
+85 string with a "weave-" prefix e.g.:
+
+    weave-k?Z;25^M}|1s7P3|H9i;*;MhG
+
+Because pod selectors are scoped to a namespace, we need to make sure
+that if the same selector definition is used in different namespaces
+that we maintain distinct ipsets. Consequently, for such selectors the
+namespace name is prepended to the label selector string before
+hashing to avoid clashes.
+
+# iptables chains
+
+The policy controller maintains several iptables chains in response to
+changes to pods, namespaces and network policies. 
+
+## Static `WEAVE-NPC` chain
+
+`WEAVE-NPC` chain contains static rules to ACCEPT traffic that is `RELATED,ESTABLISHED`
+and run `NEW` traffic through `WEAVE-NPC-DEFAULT` followed by `WEAVE-NPC-INGRESS` chains 
+
+Static configuration:
+
+```
+iptables -A WEAVE-NPC -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -A WEAVE-NPC -m state --state NEW -j WEAVE-NPC-DEFAULT
+iptables -A WEAVE-NPC -m state --state NEW -j WEAVE-NPC-INGRESS
+```
+
+## Dynamically maintained `WEAVE-NPC-DEFAULT` chain
+
+The policy controller maintains a rule in this chain for every
+namespace whose ingress isolation policy is `DefaultAllow`. The
+purpose of this rule is simply to ACCEPT any traffic destined for such
+namespaces before it reaches the ingress chain.
+
+```
+iptables -A WEAVE-NPC-DEFAULT -m set --match-set $NSIPSET dst -j ACCEPT
+```
+
+## Dynamically maintained `WEAVE-NPC-INGRESS` chain
+
+For each namespace network policy ingress rule peer/port combination:
+
+```
+iptables -A WEAVE-NPC-INGRESS -p $PROTO [-m set --match-set $SRCSET] -m set --match-set $DSTSET --dport $DPORT -j ACCEPT
+```
+
+## Static `WEAVE-NPC-EGRESS` chain
+
+`WEAVE-NPC-EGRESS` chain contains static rules to ACCEPT traffic that is `RELATED,ESTABLISHED`
+and run `NEW` traffic through `WEAVE-NPC-EGRESS-DEFAULT` followed by `WEAVE-NPC-EGRESS-CUSTOM` chains 
+
+Static configuration:
+
+```
+iptables -A WEAVE-NPC-EGRESS -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -A WEAVE-NPC-EGRESS -m state --state NEW -j WEAVE-NPC-EGRESS-DEFAULT
+iptables -A WEAVE-NPC-EGRESS -m state --state NEW -m mark ! --mark 0x40000/0x40000 -j WEAVE-NPC-EGRESS-CUSTOM
+iptables -A WEAVE-NPC-EGRESS -m mark ! --mark 0x40000/0x40000 -j DROP
+```
+
+## Dynamically maintained `WEAVE-NPC-EGRESS-DEFAULT` chain
+
+The policy controller maintains a rule in this chain for every
+namespace whose egress isolation policy is `DefaultAllow`. The
+purpose of this rule is simply to ACCEPT any traffic originating from such namespace before it reaches the egress chain.
+
+```
+iptables -A WEAVE-NPC-EGRESS-DEFAULT -m set --match-set $NSIPSET src -j WEAVE-NPC-EGRESS-ACCEPT
+iptables -A WEAVE-NPC-EGRESS-DEFAULT -m set --match-set $NSIPSET src -j RETURN
+```
+
+## Static `WEAVE-NPC-EGRESS-ACCEPT` chain
+
+`WEAVE-NPC-EGRESS-ACCEPTS` chain contains static rules to mark traffic
+
+Static configuration:
+
+```
+iptables -A WEAVE-NPC-EGRESS-ACCEPT -j MARK --set-xmark 0x40000/0x40000
+```
+
+## Dynamically maintained `WEAVE-NPC-EGRESS-CUSTOM` chain
+
+For each namespace network policy egress rule peer/port combination:
+
+```
+iptables -A WEAVE-NPC-EGRESS-CUSTOM -p $PROTO [-m set --match-set $SRCSET] -m set --match-set $DSTSET --dport $DPORT -j ACCEPT
+```
+
+
+# Steering traffic into the policy engine
+
+To direct traffic into the policy engine:
+
+```
+iptables -A INPUT -i weave -j WEAVE-NPC-EGRESS
+iptables -A FORWARD -i weave -j WEAVE-NPC-EGRESS
+iptables -A FORWARD -o weave -j WEAVE-NPC
+```
+
+Note this only affects traffic which egresses the bridge on a physical
+port which is not the Weave Net router - in other words, it is
+destined for an application container veth. The following traffic is
+affected:
+
+* Traffic bridged between local application containers
+* Traffic bridged from the router to a local application container
+* Traffic originating from the internet destined for nodeports - this
+  is routed via the FORWARD chain to a container pod IP after DNAT
+
+The following traffic is NOT affected:
+
+* Traffic bridged from a local application container to the router
+* Traffic originating from processes in the host network namespace
+  (e.g. kubelet health checks)
+* Traffic routed from an application container to the internet
+
+The above mechanism relies on the kernel module `br_netfilter` being
+loaded and enabled via `/proc/sys/net/bridge/bridge-nf-call-iptables`.
+
+See these resources for helpful context:
+
+* http://ebtables.netfilter.org/br_fw_ia/br_fw_ia.html
+* https://commons.wikimedia.org/wiki/File:Netfilter-packet-flow.svg

go.mod

@@ -0,0 +1,65 @@
+module github.com/weaveworks/weave
+
+go 1.14
+
+require (
+	github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 // indirect
+	github.com/Microsoft/go-winio v0.4.7 // indirect
+	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
+	github.com/andybalholm/go-bit v0.0.0-20150501193155-34813fe0e46a
+	github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
+	github.com/aws/aws-sdk-go v1.13.22
+	github.com/boltdb/bolt v1.3.1
+	github.com/containerd/continuity v0.0.0-20180322171221-3e8f2ea4b190 // indirect
+	github.com/containernetworking/cni v0.5.2
+	github.com/coreos/go-iptables v0.3.0
+	github.com/docker/distribution v2.6.0-rc.1.0.20180327202408-83389a148052+incompatible // indirect
+	github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible
+	github.com/docker/go-connections v0.3.0 // indirect
+	github.com/docker/go-units v0.3.2 // indirect
+	github.com/docker/libnetwork v0.8.0-dev.2.0.20180212220201-119badbd737b
+	github.com/docker/machine v0.14.0
+	github.com/fsouza/go-dockerclient v1.2.0
+	github.com/go-ini/ini v1.33.0 // indirect
+	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
+	github.com/google/go-cmp v0.5.1 // indirect
+	github.com/google/gopacket v1.1.16
+	github.com/gorilla/context v0.0.0-20160226214623-1ea25387ff6f // indirect
+	github.com/gorilla/mux v1.6.1
+	github.com/gotestyourself/gotestyourself v2.2.0+incompatible // indirect
+	github.com/hashicorp/go-cleanhttp v0.0.0-20171218145408-d5fe4b57a186 // indirect
+	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/j-keck/arping v0.0.0-20160618110441-2cf9dc699c56
+	github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8 // indirect
+	github.com/mattn/go-colorable v0.0.9 // indirect
+	github.com/mattn/go-isatty v0.0.3 // indirect
+	github.com/mdlayher/raw v0.0.0-20181016155347-fa5ef3332ca9 // indirect
+	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b
+	github.com/miekg/dns v1.0.4
+	github.com/onsi/ginkgo v1.14.0 // indirect
+	github.com/opencontainers/go-digest v1.0.0-rc1 // indirect
+	github.com/opencontainers/image-spec v1.0.1 // indirect
+	github.com/opencontainers/runc v0.1.1 // indirect
+	github.com/opencontainers/selinux v1.6.0 // indirect
+	github.com/pkg/errors v0.9.1
+	github.com/pkg/profile v1.2.1
+	github.com/prometheus/client_golang v1.7.1
+	github.com/sirupsen/logrus v1.4.2
+	github.com/smartystreets/goconvey v1.6.4 // indirect
+	github.com/spf13/cobra v0.0.1
+	github.com/stretchr/testify v1.4.0
+	github.com/vishvananda/netlink v1.0.0
+	github.com/vishvananda/netns v0.0.0-20171111001504-be1fbeda1936
+	github.com/weaveworks/common v0.0.0-20180321110636-ebab3a78900a
+	github.com/weaveworks/go-checkpoint v0.0.0-20170503165305-ebbb8b0518ab
+	github.com/weaveworks/go-odp v0.0.0-20181017121109-6b0aa22550d9
+	github.com/weaveworks/mesh v0.0.0-20191105120815-58dbcc3e8e63
+	golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975
+	golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1
+	golang.org/x/tools v0.0.0-20190328211700-ab21143f2384
+	gopkg.in/ini.v1 v1.57.0 // indirect
+	gotest.tools v2.2.0+incompatible // indirect
+	k8s.io/api v0.18.6
+	k8s.io/apimachinery v0.18.6
+	k8s.io/client-go v0.18.6
+)

go.sum

@@ -0,0 +1,411 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
+github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 h1:w+iIsaOQNcT7OZ575w+acHgRric5iCyQh+xv+KJ4HB8=
+github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
+github.com/Azure/go-autorest/autorest v0.9.0/go.mod h1:xyHB1BMZT0cuDHU7I0+g046+BFDTQ8rEZB0s4Yfa6bI=
+github.com/Azure/go-autorest/autorest/adal v0.5.0/go.mod h1:8Z9fGy2MpX0PvDjB1pEgQTmVqjGhiHBW7RJJEciWzS0=
+github.com/Azure/go-autorest/autorest/date v0.1.0/go.mod h1:plvfp3oPSKwf2DNjlBjWF/7vwR+cUD/ELuzDCXwHUVA=
+github.com/Azure/go-autorest/autorest/mocks v0.1.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
+github.com/Azure/go-autorest/autorest/mocks v0.2.0/go.mod h1:OTyCOPRA2IgIlWxVYxBee2F5Gr4kF2zd2J5cFRaIDN0=
+github.com/Azure/go-autorest/logger v0.1.0/go.mod h1:oExouG+K6PryycPJfVSxi/koC6LSNgds39diKLz7Vrc=
+github.com/Azure/go-autorest/tracing v0.5.0/go.mod h1:r/s2XiOKccPW3HrqB+W0TQzfbtp2fGCgRFtBroKn4Dk=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/Microsoft/go-winio v0.4.7 h1:vOvDiY/F1avSWlCWiKJjdYKz2jVjTK3pWPHndeG4OAY=
+github.com/Microsoft/go-winio v0.4.7/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
+github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
+github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 h1:TngWCqHvy9oXAN6lEVMRuU21PR1EtLVZJmdB18Gu3Rw=
+github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5/go.mod h1:lmUJ/7eu/Q8D7ML55dXQrVaamCz2vxCfdQBasLZfHKk=
+github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/andybalholm/go-bit v0.0.0-20150501193155-34813fe0e46a h1:yE4/B7ng2G9tr5DdT/x2bj3u6p3Rze2Ha/61eChret8=
+github.com/andybalholm/go-bit v0.0.0-20150501193155-34813fe0e46a/go.mod h1:xPmFQkJW5/HS/ZMM6soMdODwdIOO9zs3yAhksnFQJE0=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/aws/aws-sdk-go v1.13.22 h1:S18o71mCjRUw9bZzw61k2xjZx3/XtzwJKdAXx5CUf6s=
+github.com/aws/aws-sdk-go v1.13.22/go.mod h1:ZRmQr0FajVIyZ4ZzBYKG5P3ZqPz9IHG41ZoMu1ADI3k=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973 h1:xJ4a3vCFaGF/jqvzLMYoU8P317H5OQ+Via4RmuPwCS0=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/boltdb/bolt v1.3.1 h1:JQmyP4ZBrce+ZQu0dY660FMfatumYDLun9hBCUVIkF4=
+github.com/boltdb/bolt v1.3.1/go.mod h1:clJnj/oiGkjum5o1McbSZDSLxVThjynRyGBgiAx27Ps=
+github.com/cespare/xxhash/v2 v2.1.1 h1:6MnRN8NT7+YBpUIWxHtefFZOKTAPgGjpQSxqLNn0+qY=
+github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/containerd/continuity v0.0.0-20180322171221-3e8f2ea4b190 h1:xySrq2Xw0gX07PHM/LS8kuGpRd3hKDz+0/QvIJRILYk=
+github.com/containerd/continuity v0.0.0-20180322171221-3e8f2ea4b190/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
+github.com/containernetworking/cni v0.5.2 h1:/nFPNGJQu4yiNvXxH31qL05FIyGG5Y/p0YxuUutl+PE=
+github.com/containernetworking/cni v0.5.2/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY=
+github.com/coreos/go-iptables v0.3.0 h1:UTQkjHl9rPwwtXZhXbY3T932cV9aUnKlSsZ7YGfJVXM=
+github.com/coreos/go-iptables v0.3.0/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
+github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
+github.com/docker/distribution v2.6.0-rc.1.0.20180327202408-83389a148052+incompatible h1:W1rhCpxfWMU0CaZSFWpmWfmB68zYZVksig+VC1ZbgI4=
+github.com/docker/distribution v2.6.0-rc.1.0.20180327202408-83389a148052+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible h1:C81UCfrC3AgecXLr1vYezUVtYqTPlizDRO67F/lRU2U=
+github.com/docker/docker v17.12.0-ce-rc1.0.20180328155642-38588656727d+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/go-connections v0.3.0 h1:3lOnM9cSzgGwx8VfK/NGOW5fLQ0GjIlCkaktF+n1M6o=
+github.com/docker/go-connections v0.3.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
+github.com/docker/go-units v0.3.2 h1:Kjm80apys7gTtfVmCvVY8gwu10uofaFSrmAKOVrtueE=
+github.com/docker/go-units v0.3.2/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/docker/libnetwork v0.8.0-dev.2.0.20180212220201-119badbd737b h1:u7WZJnaLG9o39ZmpCJEwuFM6nCBuUQL0y/AbyE5sbaM=
+github.com/docker/libnetwork v0.8.0-dev.2.0.20180212220201-119badbd737b/go.mod h1:93m0aTqz6z+g32wla4l4WxTrdtvBRmVzYRkYvasA5Z8=
+github.com/docker/machine v0.14.0 h1:7zMwMAz0XbL27Q4NPqtW7I0wuhOaGFpq5WfvrUfZROM=
+github.com/docker/machine v0.14.0/go.mod h1:I8mPNDeK1uH+JTcUU7X0ZW8KiYz0jyAgNaeSJ1rCfDI=
+github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
+github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
+github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/evanphx/json-patch v4.2.0+incompatible h1:fUDGZCv/7iAN7u0puUVhvKCcsR6vRfwrJatElLBEf0I=
+github.com/evanphx/json-patch v4.2.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
+github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/fsouza/go-dockerclient v1.2.0 h1:lmjnUbZFR+De5PfuXCk62hAIlkokNtD9CaGPR8Iu5UU=
+github.com/fsouza/go-dockerclient v1.2.0/go.mod h1:KpcjM623fQYE9MZiTGzKhjfxXAV9wbyX2C1cyRHfhl0=
+github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-ini/ini v1.33.0 h1:/0Y2X+/6jgfPYl2LOihvxikDfznXMufz0Zkr3mW+7Zg=
+github.com/go-ini/ini v1.33.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
+github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
+github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
+github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
+github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
+github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
+github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/gogo/protobuf v1.1.1 h1:72R+M5VuhED/KujmZVcIquuo8mBgX4oVda//DQb3PXo=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.3.1 h1:DqDEcV5aeaTmdFBePNpYsp3FlcVH/2ISVVM9Qf8PSls=
+github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e h1:1r7pUrabqp18hOBcwBwiTsbnFeTZHV9eER/QT5JVZxY=
+github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v0.0.0-20161109072736-4bd1920723d7/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0=
+github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.1 h1:JFrFEBb2xKufg6XkJsJr+WbKb4FQlURi5RUcBveYu9k=
+github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/gofuzz v1.0.0 h1:A8PeW59pxE9IoFRqBp37U+mSNaQoZ46F1f0f863XSXw=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.1.0 h1:Hsa8mG0dQ46ij8Sl2AYJDUv1oA9/d6Vk+3LG99Oe02g=
+github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gopacket v1.1.16 h1:u6Afvia5C5srlLcbTwpHaFW918asLYPxieziOaWwz8M=
+github.com/google/gopacket v1.1.16/go.mod h1:UCLx9mCmAwsVbn6qQl1WIEt2SO7Nd2fD0th1TBAsqBw=
+github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
+github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
+github.com/googleapis/gnostic v0.0.0-20170729233727-0c5108395e2d/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
+github.com/googleapis/gnostic v0.1.0 h1:rVsPeBmXbYv4If/cumu1AzZPwV58q433hvONV1UEZoI=
+github.com/googleapis/gnostic v0.1.0/go.mod h1:sJBsCZ4ayReDTBIg8b9dl28c5xFWyhBTVRp3pOg5EKY=
+github.com/gophercloud/gophercloud v0.1.0/go.mod h1:vxM41WHh5uqHVBMZHzuwNOHh8XEoIEcSTewFxm1c5g8=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
+github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gorilla/context v0.0.0-20160226214623-1ea25387ff6f h1:9oNbS1z4rVpbnkHBdPZU4jo9bSmrLpII768arSyMFgk=
+github.com/gorilla/context v0.0.0-20160226214623-1ea25387ff6f/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
+github.com/gorilla/mux v1.6.1 h1:KOwqsTYZdeuMacU7CxjMNYEKeBvLbxW+psodrbcEa3A=
+github.com/gorilla/mux v1.6.1/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
+github.com/gotestyourself/gotestyourself v2.2.0+incompatible h1:AQwinXlbQR2HvPjQZOmDhRqsv5mZf+Jb1RnSLxcqZcI=
+github.com/gotestyourself/gotestyourself v2.2.0+incompatible/go.mod h1:zZKM6oeNM8k+FRljX1mnzVYeS8wiGgQyvST1/GafPbY=
+github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 h1:pdN6V1QBWetyv/0+wjACpqVH+eVULgEjkurDLq3goeM=
+github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/hashicorp/go-cleanhttp v0.0.0-20171218145408-d5fe4b57a186 h1:URgjUo+bs1KwatoNbwG0uCO4dHN4r1jsp4a5AGgHRjo=
+github.com/hashicorp/go-cleanhttp v0.0.0-20171218145408-d5fe4b57a186/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1 h1:0hERBMJE1eitiLkihrMvRVBYAkpHzc/J3QdDN+dAcgU=
+github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
+github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/j-keck/arping v0.0.0-20160618110441-2cf9dc699c56 h1:742eGXur0715JMq73aD95/FU0XpVKXqNuTnEfXsLOYQ=
+github.com/j-keck/arping v0.0.0-20160618110441-2cf9dc699c56/go.mod h1:ymszkNOg6tORTn+6F6j+Jc8TOr5osrynvN6ivFWZ2GA=
+github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8 h1:12VvqtR6Aowv3l/EQUlocDHW2Cp4G9WJVH7uyH8QFJE=
+github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
+github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.10 h1:Kz6Cvnvv2wGdaG/V8yMvfkmNiXq9Ya2KUv4rouJJr68=
+github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
+github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
+github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
+github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mattn/go-colorable v0.0.9 h1:UVL0vNpWh04HeJXV0KLcaT7r06gOH2l4OW6ddYRUIY4=
+github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.3 h1:ns/ykhmWi7G9O+8a448SecJU3nSMBXJfqQkl0upE1jI=
+github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/mdlayher/raw v0.0.0-20181016155347-fa5ef3332ca9 h1:tOtO8DXiNGj9NshRKHWiZuGlSldPFzFCFYhNtsKTBCs=
+github.com/mdlayher/raw v0.0.0-20181016155347-fa5ef3332ca9/go.mod h1:rC/yE65s/DoHB6BzVOUBNYBGTg772JVytyAytffIZkY=
+github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b h1:j7+1HpAFS1zy5+Q4qx1fWh90gTKwiN4QCGoY9TWyyO4=
+github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
+github.com/miekg/dns v1.0.4 h1:Ec3LTJwwzqT1++63P12fhtdEbQhtPE7TBdD6rlhqrMM=
+github.com/miekg/dns v1.0.4/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.1 h1:9f412s+6RmYXLWZSEzVVgPGK7C2PphHj5RJrvfx9AWI=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
+github.com/nxadm/tail v1.4.4 h1:DQuhQpB1tVlglWS2hLQ5OV6B5r8aGxSrPc5Qo6uTN78=
+github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
+github.com/onsi/ginkgo v1.14.0 h1:2mOpI4JVVPBN+WQRa0WKH2eXR+Ey+uK4n7Zj0aYpIQA=
+github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
+github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
+github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
+github.com/onsi/gomega v1.10.1 h1:o0+MgICZLuZ7xjH7Vx6zS/zcu93/BEp1VwkIW1mEXCE=
+github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
+github.com/opencontainers/go-digest v1.0.0-rc1 h1:WzifXhOVOEOuFYOJAW6aQqW0TooG2iki3E3Ii+WN7gQ=
+github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
+github.com/opencontainers/image-spec v1.0.1 h1:JMemWkRwHx4Zj+fVxWoMCFm/8sYGGrUVojFA6h/TRcI=
+github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
+github.com/opencontainers/runc v0.1.1 h1:GlxAyO6x8rfZYN9Tt0Kti5a/cP41iuiO2yYT0IJGY8Y=
+github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
+github.com/opencontainers/selinux v1.6.0 h1:+bIAS/Za3q5FTwWym4fTB0vObnfCf3G/NC7K6Jx62mY=
+github.com/opencontainers/selinux v1.6.0/go.mod h1:VVGKuOLlE7v4PJyT6h7mNWvq1rzqiriPsEqVhc+svHE=
+github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
+github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
+github.com/pkg/errors v0.8.0 h1:WdK/asTD0HN+q6hsWO3/vpuAkAr+tw6aNJNDFFf0+qw=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/profile v1.2.1 h1:F++O52m40owAmADcojzM+9gyjmMOY/T4oYJkgFDH8RE=
+github.com/pkg/profile v1.2.1/go.mod h1:hJw3o1OdXxsrSjjVksARp5W95eeEaEfptyVZyv6JUPA=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
+github.com/prometheus/client_golang v1.7.1 h1:NTGy1Ja9pByO+xAeH/qiWnLrKtr3hJPNjaVUwnjpdpA=
+github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.2.0 h1:uq5h0d+GuxiXLJLNABMgp2qUWDPiLvgCzz2dUR+/W/M=
+github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/common v0.10.0 h1:RyRA7RzGXQZiW+tGMr7sxa85G1z0yOpM1qq5c8lNawc=
+github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/procfs v0.1.3 h1:F0+tqvhOksq22sc6iCHF5WGlWjdwj92p0udFh1VFBS8=
+github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
+github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=
+github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
+github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
+github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
+github.com/spf13/cobra v0.0.1 h1:zZh3X5aZbdnoj+4XkaBxKfhO4ot82icYdhhREIAXIj8=
+github.com/spf13/cobra v0.0.1/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
+github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/vishvananda/netlink v1.0.0 h1:bqNY2lgheFIu1meHUFSH3d7vG93AFyqg3oGbJCOJgSM=
+github.com/vishvananda/netlink v1.0.0/go.mod h1:+SR5DhBJrl6ZM7CoCKvpw5BKroDKQ+PJqOg65H/2ktk=
+github.com/vishvananda/netns v0.0.0-20171111001504-be1fbeda1936 h1:J9gO8RJCAFlln1jsvRba/CWVUnMHwObklfxxjErl1uk=
+github.com/vishvananda/netns v0.0.0-20171111001504-be1fbeda1936/go.mod h1:ZjcWmFBXmLKZu9Nxj3WKYEafiSqer2rnvPr0en9UNpI=
+github.com/weaveworks/common v0.0.0-20180321110636-ebab3a78900a h1:dIOYWkmKCq9tU3DY96p1D/8xXFWkqt9Jd1ipu6sTLSk=
+github.com/weaveworks/common v0.0.0-20180321110636-ebab3a78900a/go.mod h1:pSm+0KR57BG3pvGoJWFXJSAC7+sEPewcvdt5StevL3A=
+github.com/weaveworks/go-checkpoint v0.0.0-20170503165305-ebbb8b0518ab h1:mW+hgchD9qUUBqnuaDBj7BkcpFPk/FxeFcUFI5lvvUw=
+github.com/weaveworks/go-checkpoint v0.0.0-20170503165305-ebbb8b0518ab/go.mod h1:qkbvw5GPibQ/Nf7IZJL0UoLwmJ6858b4S/hUWRd+cH4=
+github.com/weaveworks/go-odp v0.0.0-20181017121109-6b0aa22550d9 h1:7OqrOqOJkneFGUT7CoR3uZnZP3ZyuUtzWNfv7GIc3RE=
+github.com/weaveworks/go-odp v0.0.0-20181017121109-6b0aa22550d9/go.mod h1:6/WClQKiVm/SQf6WJXv49l+9K9ONE2U8DYpeXEk3X7k=
+github.com/weaveworks/mesh v0.0.0-20191105120815-58dbcc3e8e63 h1:s0fUBZ8Vhtc3ruFmLIr3qVTQUb/j6ySkPLHoKKitHeM=
+github.com/weaveworks/mesh v0.0.0-20191105120815-58dbcc3e8e63/go.mod h1:RZebXKv56dax5zXcLIJZm1Awk28sx0XODXF94Z8WssY=
+github.com/willf/bitset v1.1.11-0.20200630133818-d5bec3311243 h1:R43TdZy32XXSXjJn7M/HhALJ9imq6ztLnChfYJpVDnM=
+github.com/willf/bitset v1.1.11-0.20200630133818-d5bec3311243/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
+go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
+golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190211182817-74369b46fc67/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191002192127-34f69633bfdc h1:c0o/qxkaO2LF5t6fQrT4b5hzyggAkLLlCUjqfRxd8Q4=
+golang.org/x/crypto v0.0.0-20191002192127-34f69633bfdc/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975 h1:/Tl7pH94bvbAAHBdZJT947M/+gp0+CqQXDtMRC0fseo=
+golang.org/x/crypto v0.0.0-20200220183623-bac4c82f6975/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3 h1:0GoQqolDA55aaLxZyTzK/Y2ePZzZTUrRacwib7cNsYQ=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7 h1:AeiKBIuRw3UomYXSbLy0Mc2dDLfdtbT/IVn4keq83P0=
+golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 h1:SVwTIAaPC2U/AvvLNZ2a7OVsmBpC8L5BlwK1whH3hm0=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190209173611-3b5209105503/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d h1:+R4KGOnez64A81RvjARKc4UT5/tI9ujCIVX+P5KiHuI=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200519105757-fe76b779f299 h1:DYfZAGf2WMFjMxbgTjaC+2HC7NkNAQs+6Q8b9WEB/F4=
+golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1 h1:ogLJMz+qpzav7lGMh10LMvAkM/fAoGlaiiHYiFYdm80=
+golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4 h1:SvFZT6jyqRaOeXpc5h/JSfZenJ2O330aBsf7JfSUXmQ=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190328211700-ab21143f2384 h1:TFlARGu6Czu1z7q93HTxcP1P+/ZFC/IKythI5RzrnRg=
+golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.5.0 h1:KxkO13IPW4Lslp2bz+KHP2E3gtFlrIGNThxkZQ3g+4c=
+google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.23.0 h1:4MY060fB1DLGMB/7MBTLnwQUY6+F09GEiz6SsrNqyzM=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/ini.v1 v1.57.0 h1:9unxIsFcTt4I55uWluz+UmL95q4kdJ0buvQ1ZIqVQww=
+gopkg.in/ini.v1 v1.57.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
+gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+k8s.io/api v0.18.6 h1:osqrAXbOQjkKIWDTjrqxWQ3w0GkKb1KA1XkUGHHYpeE=
+k8s.io/api v0.18.6/go.mod h1:eeyxr+cwCjMdLAmr2W3RyDI0VvTawSg/3RFFBEnmZGI=
+k8s.io/apimachinery v0.18.6 h1:RtFHnfGNfd1N0LeSrKCUznz5xtUP1elRGvHJbL3Ntag=
+k8s.io/apimachinery v0.18.6/go.mod h1:OaXp26zu/5J7p0f92ASynJa1pZo06YlV9fG7BoWbCko=
+k8s.io/client-go v0.18.6 h1:I+oWqJbibLSGsZj8Xs8F0aWVXJVIoUHWaaJV3kUN/Zw=
+k8s.io/client-go v0.18.6/go.mod h1:/fwtGLjYMS1MaM5oi+eXhKwG+1UHidUEXRh6cNsdO0Q=
+k8s.io/gengo v0.0.0-20190128074634-0689ccc1d7d6/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
+k8s.io/klog v0.0.0-20181102134211-b9b56d5dfc92/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
+k8s.io/klog v0.3.0/go.mod h1:Gq+BEi5rUBO/HRz0bTSXDUcqjScdoY3a9IHpCEIOOfk=
+k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
+k8s.io/klog v1.0.0/go.mod h1:4Bi6QPql/J/LkTDqv7R/cd3hPo4k2DG6Ptcz060Ez5I=
+k8s.io/kube-openapi v0.0.0-20200410145947-61e04a5be9a6 h1:Oh3Mzx5pJ+yIumsAD0MOECPVeXsVot0UkiaCGVyfGQY=
+k8s.io/kube-openapi v0.0.0-20200410145947-61e04a5be9a6/go.mod h1:GRQhZsXIAJ1xR0C9bd8UpWHZ5plfAS9fzPjJuQ6JL3E=
+k8s.io/utils v0.0.0-20200324210504-a9aa75ae1b89 h1:d4vVOjXm687F1iLSP2q3lyPPuyvTUt3aVoBpi2DqRsU=
+k8s.io/utils v0.0.0-20200324210504-a9aa75ae1b89/go.mod h1:sZAwmy6armz5eXlNoLmJcl4F1QuKu7sr+mFQ0byX7Ew=
+sigs.k8s.io/structured-merge-diff/v3 v3.0.0-20200116222232-67a7b8c61874/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
+sigs.k8s.io/structured-merge-diff/v3 v3.0.0 h1:dOmIZBMfhcHS09XZkMyUgkq5trg3/jRyJYFZUiaOp8E=
+sigs.k8s.io/structured-merge-diff/v3 v3.0.0/go.mod h1:PlARxl6Hbt/+BC80dRLi1qAmnMqwqDg62YvvVkZjemw=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
+sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=
+sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=

ipam/allocate.go

@@ -3,6 +3,7 @@ package ipam
 import (
 	"fmt"
 
+	"github.com/weaveworks/weave/api"
 	"github.com/weaveworks/weave/net/address"
 )
 
@@ -13,8 +14,9 @@ type allocateResult struct {
 
 type allocate struct {
 	resultChan       chan<- allocateResult
-	ident            string
-	r                address.Range // Range we are trying to allocate within
+	ident            string       // a container ID, something like "weave:expose", or api.NoContainerID
+	r                address.CIDR // Subnet we are trying to allocate within
+	isContainer      bool         // true if ident is a container ID
 	hasBeenCancelled func() bool
 }
 
@@ -25,29 +27,36 @@ func (g *allocate) Try(alloc *Allocator) bool {
 		return true
 	}
 
-	if addr, found := alloc.lookupOwned(g.ident, g.r); found {
-		g.resultChan <- allocateResult{addr, nil}
+	if addrs := alloc.ownedInRange(g.ident, g.r.Range()); len(addrs) > 0 {
+		// If we had heard that this container died, resurrect it
+		delete(alloc.dead, g.ident) // delete is no-op if key not in map
+		g.resultChan <- allocateResult{addrs[0].Addr, nil}
 		return true
 	}
 
-	if !alloc.universe.Overlaps(g.r) {
-		g.resultChan <- allocateResult{0, fmt.Errorf("range %s out of bounds: %s", g.r, alloc.universe)}
+	if !alloc.universe.Range().Overlaps(g.r.Range()) {
+		g.resultChan <- allocateResult{err: fmt.Errorf("range %s out of bounds: %s", g.r, alloc.universe)}
 		return true
 	}
 
 	alloc.establishRing()
 
-	if ok, addr := alloc.space.Allocate(g.r); ok {
+	if ok, addr := alloc.space.Allocate(g.r.HostRange()); ok {
+		// If caller hasn't supplied a unique ID, file it under the IP address
+		// which lets the caller then release the address using DELETE /ip/address
+		if g.ident == api.NoContainerID {
+			g.ident = addr.String()
+		}
 		alloc.debugln("Allocated", addr, "for", g.ident, "in", g.r)
-		alloc.addOwned(g.ident, addr)
+		alloc.addOwned(g.ident, address.MakeCIDR(g.r, addr), g.isContainer)
 		g.resultChan <- allocateResult{addr, nil}
 		return true
 	}
 
 	// out of space
-	donors := alloc.ring.ChoosePeersToAskForSpace(g.r.Start, g.r.End)
+	donors := alloc.ring.ChoosePeersToAskForSpace(g.r.Addr, g.r.Range().End)
 	for _, donor := range donors {
-		if err := alloc.sendSpaceRequest(donor, g.r); err != nil {
+		if err := alloc.sendSpaceRequest(donor, g.r.Range()); err != nil {
 			alloc.debugln("Problem asking peer", donor, "for space:", err)
 		} else {
 			alloc.debugln("Decided to ask peer", donor, "for space in range", g.r)
@@ -59,7 +68,7 @@ func (g *allocate) Try(alloc *Allocator) bool {
 }
 
 func (g *allocate) Cancel() {
-	g.resultChan <- allocateResult{0, &errorCancelled{"Allocate", g.ident}}
+	g.resultChan <- allocateResult{err: &errorCancelled{"Allocate", g.ident}}
 }
 
 func (g *allocate) ForContainer(ident string) bool {

ipam/allocator_test.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/weaveworks/weave/api"
 	"github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/net/address"
 	"github.com/weaveworks/weave/testing/gossip"
@@ -16,12 +17,22 @@ import (
 
 const (
 	testStart1 = "10.0.1.0"
-	testStart2 = "10.0.2.0"
-	testStart3 = "10.0.3.0"
 )
 
 func returnFalse() bool { return false }
 
+func (alloc *Allocator) SimplyAllocate(ident string, cidr address.CIDR) (address.Address, error) {
+	return alloc.Allocate(ident, cidr, true, returnFalse)
+}
+
+func (alloc *Allocator) SimplyClaim(ident string, cidr address.CIDR) error {
+	return alloc.Claim(ident, cidr, true, true, returnFalse)
+}
+
+func (alloc *Allocator) AnonymousClaim(cidr address.CIDR) error {
+	return alloc.Claim(api.NoContainerID, cidr, false, true, returnFalse)
+}
+
 func TestAllocFree(t *testing.T) {
 	const (
 		container1 = "abcdef"
@@ -37,40 +48,54 @@ func TestAllocFree(t *testing.T) {
 
 	alloc, subnet := makeAllocatorWithMockGossip(t, "01:00:00:01:00:00", universe, 1)
 	defer alloc.Stop()
-	_, cidr1, _ := address.ParseCIDR(subnet1)
-	_, cidr2, _ := address.ParseCIDR(subnet2)
+	cidr1, _ := address.ParseCIDR(subnet1)
+	cidr2, _ := address.ParseCIDR(subnet2)
 
 	alloc.claimRingForTesting()
-	addr1, err := alloc.Allocate(container1, cidr1.HostRange(), returnFalse)
+	addr1, err := alloc.SimplyAllocate(container1, cidr1)
 	require.NoError(t, err)
 	require.Equal(t, testAddr1, addr1.String(), "address")
 
-	addr2, err := alloc.Allocate(container1, cidr2.HostRange(), returnFalse)
+	addr2, err := alloc.SimplyAllocate(container1, cidr2)
 	require.NoError(t, err)
 	require.Equal(t, testAddr2, addr2.String(), "address")
 
+	addrs, err := alloc.Lookup(container1, subnet.Range())
+	require.NoError(t, err)
+	require.Equal(t, []address.CIDR{address.MakeCIDR(cidr1, addr1), address.MakeCIDR(cidr2, addr2)}, addrs)
+
 	// Ask for another address for a different container and check it's different
-	addr1b, _ := alloc.Allocate(container2, cidr1.HostRange(), returnFalse)
+	addr1b, _ := alloc.SimplyAllocate(container2, cidr1)
 	if addr1b.String() == testAddr1 {
 		t.Fatalf("Expected different address but got %s", addr1b.String())
 	}
 
 	// Ask for the first container again and we should get the same addresses again
-	addr1a, _ := alloc.Allocate(container1, cidr1.HostRange(), returnFalse)
+	addr1a, _ := alloc.SimplyAllocate(container1, cidr1)
 	require.Equal(t, testAddr1, addr1a.String(), "address")
-	addr2a, _ := alloc.Allocate(container1, cidr2.HostRange(), returnFalse)
+	addr2a, _ := alloc.SimplyAllocate(container1, cidr2)
 	require.Equal(t, testAddr2, addr2a.String(), "address")
 
 	// Now delete the first container, and we should get its addresses back
 	require.NoError(t, alloc.Delete(container1))
-	addr3, _ := alloc.Allocate(container3, cidr1.HostRange(), returnFalse)
+	addr3, _ := alloc.SimplyAllocate(container3, cidr1)
 	require.Equal(t, testAddr1, addr3.String(), "address")
-	addr4, _ := alloc.Allocate(container3, cidr2.HostRange(), returnFalse)
+	addr4, _ := alloc.SimplyAllocate(container3, cidr2)
 	require.Equal(t, testAddr2, addr4.String(), "address")
 
 	alloc.ContainerDied(container2)
+
+	// Resurrect
+	addr1c, err := alloc.SimplyAllocate(container2, cidr1)
+	require.NoError(t, err)
+	require.Equal(t, addr1b, addr1c, "address")
+
 	alloc.ContainerDied(container3)
-	require.Equal(t, address.Offset(spaceSize), alloc.NumFreeAddresses(subnet))
+	alloc.Encode() // sync up
+	// Move the clock forward and clear out the dead container
+	alloc.actionChan <- func() { alloc.now = func() time.Time { return time.Now().Add(containerDiedTimeout * 2) } }
+	alloc.actionChan <- func() { alloc.removeDeadContainers() }
+	require.Equal(t, address.Count(spaceSize+1), alloc.NumFreeAddresses(subnet.Range()))
 }
 
 func TestBootstrap(t *testing.T) {
@@ -95,7 +120,7 @@ func TestBootstrap(t *testing.T) {
 	ExpectBroadcastMessage(alloc1, nil) // alloc1 will try to form consensus
 	done := make(chan bool)
 	go func() {
-		alloc1.Allocate("somecontainer", subnet, returnFalse)
+		alloc1.Allocate("somecontainer", subnet, true, returnFalse)
 		done <- true
 	}()
 	time.Sleep(100 * time.Millisecond)
@@ -103,6 +128,7 @@ func TestBootstrap(t *testing.T) {
 
 	CheckAllExpectedMessagesSent(alloc1, alloc2)
 
+	// Check that tryPendingOps doesn't cause anything to happen here
 	alloc1.actionChan <- func() { alloc1.tryPendingOps() }
 	AssertNothingSent(t, done)
 
@@ -115,14 +141,24 @@ func TestBootstrap(t *testing.T) {
 	ExpectBroadcastMessage(alloc1, nil)
 	alloc1.OnGossipBroadcast(alloc2.ourName, alloc2.Encode())
 
-	// both nodes will get consensus now so initialize the ring
-	ExpectBroadcastMessage(alloc2, nil)
+	CheckAllExpectedMessagesSent(alloc1, alloc2)
+
+	// at this point, both nodes have seen each other, but don't have a valid proposal
+	// so there is another exchange of messages
 	ExpectBroadcastMessage(alloc2, nil)
 	alloc2.OnGossipBroadcast(alloc1.ourName, alloc1.Encode())
 
+	// we have consensus now so alloc1 will initialize the ring
+	ExpectBroadcastMessage(alloc1, nil)
+	alloc1.OnGossipBroadcast(alloc2.ourName, alloc2.Encode())
+
+	CheckAllExpectedMessagesSent(alloc1, alloc2)
+
+	// alloc2 receives the ring and does not reply
+	alloc2.OnGossipBroadcast(alloc1.ourName, alloc1.Encode())
+
 	CheckAllExpectedMessagesSent(alloc1, alloc2)
 
-	alloc1.OnGossipBroadcast(alloc2.ourName, alloc2.Encode())
 	// now alloc1 should have space
 
 	AssertSent(t, done)
@@ -135,43 +171,67 @@ func TestAllocatorClaim(t *testing.T) {
 		container1 = "abcdef"
 		container3 = "b01df00d"
 		universe   = "10.0.3.0/24"
-		testAddr1  = "10.0.3.2"
-		testAddr2  = "10.0.4.2"
+		testAddr1  = "10.0.3.5/24"
+		testAddr2  = "10.0.4.2/24"
+		testAddr4  = "10.0.2.3/23"
+		subnet4    = "10.0.2.0/23"
+		testPre    = "10.0.3.1/24"
 	)
 
-	allocs, _, subnet := makeNetworkOfAllocators(2, universe)
+	preAddr, _ := address.ParseCIDR(testPre)
+	allocs, router, subnet := makeNetworkOfAllocators(2, universe, []PreClaim{{container1, true, preAddr}})
+	defer stopNetworkOfAllocators(allocs, router)
 	alloc := allocs[1]
-	defer alloc.Stop()
-	addr1, _ := address.ParseIP(testAddr1)
+	addr1, _ := address.ParseCIDR(testAddr1)
 
 	// First claim should trigger "dunno, I'm going to wait"
-	err := alloc.Claim(container3, addr1, true)
+	err := alloc.SimplyClaim(container3, addr1)
 	require.NoError(t, err)
 
-	// Do one allocate to ensure paxos is all done
-	alloc.Allocate("unused", subnet, returnFalse)
+	alloc.Prime()
 	// Do an allocate on the other peer, which we will try to claim later
-	addrx, err := allocs[0].Allocate(container1, subnet, returnFalse)
+	addrx, err := allocs[0].Allocate(container1, subnet, true, returnFalse)
+	require.NoError(t, err)
+	// Should not get the address we pre-claimed
+	require.NotEqual(t, addrx, preAddr)
+	router.Flush()
 
 	// Now try the claim again
-	err = alloc.Claim(container3, addr1, true)
+	err = alloc.SimplyClaim(container3, addr1)
 	require.NoError(t, err)
 	// Check we get this address back if we try an allocate
-	addr3, _ := alloc.Allocate(container3, subnet, returnFalse)
-	require.Equal(t, testAddr1, addr3.String(), "address")
+	addr3, _ := alloc.SimplyAllocate(container3, subnet)
+	require.Equal(t, testAddr1, address.MakeCIDR(subnet, addr3).String(), "address")
 	// one more claim should still work
-	err = alloc.Claim(container3, addr1, true)
+	err = alloc.SimplyClaim(container3, addr1)
 	require.NoError(t, err)
 	// claim for a different container should fail
-	err = alloc.Claim(container1, addr1, true)
+	err = alloc.SimplyClaim(container1, addr1)
 	require.Error(t, err)
+	// claim for an anonymous container, will assume it's the same one
+	err = alloc.AnonymousClaim(addr1)
+	require.NoError(t, err)
 	// claiming the address allocated on the other peer should fail
-	err = alloc.Claim(container1, addrx, true)
+	err = alloc.SimplyClaim(container1, address.MakeCIDR(subnet, addrx))
+	require.Error(t, err, "claiming address allocated on other peer should fail")
+	// claiming the pre-claimed address should fail on both peers
+	err = alloc.SimplyClaim(container3, preAddr)
+	require.Error(t, err, "claiming address allocated on other peer should fail")
+	err = allocs[0].SimplyClaim(container3, preAddr)
 	require.Error(t, err, "claiming address allocated on other peer should fail")
 	// Check an address outside of our universe
-	addr2, _ := address.ParseIP(testAddr2)
-	err = alloc.Claim(container1, addr2, true)
+	addr2, _ := address.ParseCIDR(testAddr2)
+	err = alloc.SimplyClaim(container1, addr2)
 	require.NoError(t, err)
+	err = alloc.SimplyClaim(container3, addr2)
+	require.Error(t, err)
+	// Anonymous claim outside of our universe
+	addr4, _ := address.ParseCIDR(testAddr4)
+	subnet4cidr, _ := address.ParseCIDR(subnet4)
+	require.NoError(t, alloc.AnonymousClaim(addr4))
+	addr5, err := alloc.Allocate(api.NoContainerID, subnet4cidr, false, returnFalse)
+	require.NoError(t, err)
+	require.NotEqual(t, addr4.Start(), addr5)
 }
 
 func (alloc *Allocator) pause() func() {
@@ -187,16 +247,13 @@ func (alloc *Allocator) pause() func() {
 }
 
 func TestCancel(t *testing.T) {
-	const (
-		CIDR = "10.0.1.7/26"
-	)
-
+	const cidr = "10.0.4.0/26"
 	router := gossip.NewTestRouter(0.0)
 
-	alloc1, subnet := makeAllocator("01:00:00:02:00:00", CIDR, 2)
+	alloc1, subnet := makeAllocator("01:00:00:02:00:00", cidr, 2)
 	alloc1.SetInterfaces(router.Connect(alloc1.ourName, alloc1))
 
-	alloc2, _ := makeAllocator("02:00:00:02:00:00", CIDR, 2)
+	alloc2, _ := makeAllocator("02:00:00:02:00:00", cidr, 2)
 	alloc2.SetInterfaces(router.Connect(alloc2.ourName, alloc2))
 	alloc1.claimRingForTesting(alloc1, alloc2)
 	alloc2.claimRingForTesting(alloc1, alloc2)
@@ -208,9 +265,9 @@ func TestCancel(t *testing.T) {
 	alloc1.OnGossipBroadcast(alloc2.ourName, alloc2.Encode())
 
 	// Get some IPs, so each allocator has some space
-	res1, _ := alloc1.Allocate("foo", subnet, returnFalse)
+	res1, _ := alloc1.Allocate("foo", subnet, true, returnFalse)
 	common.Log.Debugf("res1 = %s", res1.String())
-	res2, _ := alloc2.Allocate("bar", subnet, returnFalse)
+	res2, _ := alloc2.Allocate("bar", subnet, true, returnFalse)
 	common.Log.Debugf("res2 = %s", res2.String())
 	if res1 == res2 {
 		require.FailNow(t, "Error: got same ips!")
@@ -221,13 +278,13 @@ func TestCancel(t *testing.T) {
 	unpause := alloc2.pause()
 
 	// Use up all the IPs that alloc1 owns, so the allocation after this will prompt a request to alloc2
-	for i := 0; alloc1.NumFreeAddresses(subnet) > 0; i++ {
-		alloc1.Allocate(fmt.Sprintf("tmp%d", i), subnet, returnFalse)
+	for i := 0; alloc1.NumFreeAddresses(subnet.HostRange()) > 0; i++ {
+		alloc1.Allocate(fmt.Sprintf("tmp%d", i), subnet, true, returnFalse)
 	}
 	cancelChan := make(chan bool, 1)
 	doneChan := make(chan bool)
 	go func() {
-		_, ok := alloc1.Allocate("baz", subnet,
+		_, ok := alloc1.Allocate("baz", subnet, true,
 			func() bool {
 				select {
 				case <-cancelChan:
@@ -251,18 +308,18 @@ func TestCancel(t *testing.T) {
 
 func TestCancelOnDied(t *testing.T) {
 	const (
-		CIDR       = "10.0.1.7/26"
+		cidr       = "10.0.4.0/26"
 		container1 = "abcdef"
 	)
 
 	router := gossip.NewTestRouter(0.0)
-	alloc1, subnet := makeAllocator("01:00:00:02:00:00", CIDR, 2)
+	alloc1, subnet := makeAllocator("01:00:00:02:00:00", cidr, 2)
 	alloc1.SetInterfaces(router.Connect(alloc1.ourName, alloc1))
 	alloc1.Start()
 
 	doneChan := make(chan bool)
 	f := func() {
-		_, ok := alloc1.Allocate(container1, subnet, returnFalse)
+		_, ok := alloc1.Allocate(container1, subnet, true, returnFalse)
 		doneChan <- ok == nil
 	}
 
@@ -293,62 +350,80 @@ func TestGossipShutdown(t *testing.T) {
 	defer alloc.Stop()
 
 	alloc.claimRingForTesting()
-	alloc.Allocate(container1, subnet, returnFalse)
+	alloc.SimplyAllocate(container1, subnet)
 
 	alloc.Shutdown()
 
-	_, err := alloc.Allocate(container2, subnet, returnFalse) // trying to allocate after shutdown should fail
+	_, err := alloc.SimplyAllocate(container2, subnet) // trying to allocate after shutdown should fail
 	require.False(t, err == nil, "no address")
 
 	CheckAllExpectedMessagesSent(alloc)
 }
 
+func TestNoFrag(t *testing.T) {
+	const cidr = "10.0.4.0/22"
+	resultChan := make(chan int)
+	for i := 0; i < 100; i++ {
+		allocs, router, subnet := makeNetworkOfAllocators(3, cidr)
+		allocs[1].Allocate("foo", subnet, true, returnFalse)
+		allocs[2].Allocate("bar", subnet, true, returnFalse)
+		allocs[2].actionChan <- func() {
+			resultChan <- len(allocs[2].ring.Entries)
+		}
+		require.True(t, <-resultChan < 6, "excessive ring fragmentation")
+		stopNetworkOfAllocators(allocs, router)
+	}
+}
+
 func TestTransfer(t *testing.T) {
-	const (
-		cidr = "10.0.1.7/22"
-	)
+	const cidr = "10.0.4.0/22"
 	allocs, router, subnet := makeNetworkOfAllocators(3, cidr)
-	alloc1 := allocs[0]
-	alloc2 := allocs[1]
-	alloc3 := allocs[2] // This will be 'master' and get the first range
+	defer stopNetworkOfAllocators(allocs, router)
+	alloc0 := allocs[0]
+	alloc1 := allocs[1]
+	alloc2 := allocs[2]
 
-	_, err := alloc2.Allocate("foo", subnet, returnFalse)
+	_, err := alloc1.Allocate("foo", subnet, true, returnFalse)
 	require.True(t, err == nil, "Failed to get address")
 
-	_, err = alloc3.Allocate("bar", subnet, returnFalse)
+	_, err = alloc2.Allocate("bar", subnet, true, returnFalse)
 	require.True(t, err == nil, "Failed to get address")
 
+	// simulation of periodic gossip
 	alloc2.gossip.GossipBroadcast(alloc2.Gossip())
 	router.Flush()
-	alloc2.gossip.GossipBroadcast(alloc3.Gossip())
+	alloc1.gossip.GossipBroadcast(alloc1.Gossip())
 	router.Flush()
+
+	free1 := alloc1.NumFreeAddresses(subnet.Range())
+	free2 := alloc2.NumFreeAddresses(subnet.Range())
+
+	router.RemovePeer(alloc1.ourName)
 	router.RemovePeer(alloc2.ourName)
-	router.RemovePeer(alloc3.ourName)
-	alloc2.Stop()
-	alloc3.Stop()
-	router.Flush()
-	require.NoError(t, alloc1.AdminTakeoverRanges(alloc2.ourName.String()))
-	require.NoError(t, alloc1.AdminTakeoverRanges(alloc3.ourName.String()))
-	router.Flush()
-
-	require.Equal(t, address.Offset(1022), alloc1.NumFreeAddresses(subnet))
-
-	_, err = alloc1.Allocate("foo", subnet, returnFalse)
-	require.True(t, err == nil, "Failed to get address")
 	alloc1.Stop()
+	alloc2.Stop()
+	router.Flush()
+
+	require.Equal(t, free1+1, alloc0.AdminTakeoverRanges(alloc1.ourName.String()))
+	require.Equal(t, free2+1, alloc0.AdminTakeoverRanges(alloc2.ourName.String()))
+	router.Flush()
+
+	require.Equal(t, address.Count(1024), alloc0.NumFreeAddresses(subnet.Range()))
+
+	_, err = alloc0.Allocate("foo", subnet, true, returnFalse)
+	require.True(t, err == nil, "Failed to get address")
+	alloc0.Stop()
 }
 
 func TestFakeRouterSimple(t *testing.T) {
-	const (
-		cidr = "10.0.1.7/22"
-	)
-	allocs, _, subnet := makeNetworkOfAllocators(2, cidr)
-	defer stopNetworkOfAllocators(allocs)
+	const cidr = "10.0.4.0/22"
+	allocs, router, subnet := makeNetworkOfAllocators(2, cidr)
+	defer stopNetworkOfAllocators(allocs, router)
 
 	alloc1 := allocs[0]
 	//alloc2 := allocs[1]
 
-	_, err := alloc1.Allocate("foo", subnet, returnFalse)
+	_, err := alloc1.Allocate("foo", subnet, true, returnFalse)
 	require.NoError(t, err, "Failed to get address")
 }
 
@@ -359,10 +434,10 @@ func TestAllocatorFuzz(t *testing.T) {
 		nodes        = 5
 		maxAddresses = 1000
 		concurrency  = 5
-		cidr         = "10.0.1.7/22"
+		cidr         = "10.0.4.0/22"
 	)
-	allocs, _, subnet := makeNetworkOfAllocators(nodes, cidr)
-	defer stopNetworkOfAllocators(allocs)
+	allocs, router, subnet := makeNetworkOfAllocators(nodes, cidr)
+	defer stopNetworkOfAllocators(allocs, router)
 
 	// Test state
 	// For each IP issued we store the allocator
@@ -429,7 +504,7 @@ func TestAllocatorFuzz(t *testing.T) {
 		allocIndex := rand.Int31n(nodes)
 		alloc := allocs[allocIndex]
 		//common.Log.Infof("Allocate: asking allocator %d", allocIndex)
-		addr, err := alloc.Allocate(name, subnet, returnFalse)
+		addr, err := alloc.SimplyAllocate(name, subnet)
 
 		if err != nil {
 			panic(fmt.Sprintf("Could not allocate addr"))
@@ -486,7 +561,7 @@ func TestAllocatorFuzz(t *testing.T) {
 
 		//common.Log.Infof("Asking for %s (%s) on allocator %d again", res.name, addr, res.alloc)
 
-		newAddr, _ := alloc.Allocate(res.name, subnet, returnFalse)
+		newAddr, _ := alloc.SimplyAllocate(res.name, subnet)
 		oldAddr, _ := address.ParseIP(addr)
 		if newAddr != oldAddr {
 			panic(fmt.Sprintf("Got different address for repeat request for %s: %s != %s", res.name, newAddr, oldAddr))
@@ -506,8 +581,8 @@ func TestAllocatorFuzz(t *testing.T) {
 		allocIndex := rand.Int31n(nodes)
 		addressIndex := rand.Int31n(int32(subnet.Size()))
 		alloc := allocs[allocIndex]
-		addr := address.Add(subnet.Start, address.Offset(addressIndex))
-		err := alloc.Claim(name, addr, true)
+		addr := address.Add(subnet.Addr, address.Offset(addressIndex))
+		err := alloc.SimplyClaim(name, address.MakeCIDR(subnet, addr))
 		if err == nil {
 			noteAllocation(allocIndex, name, addr)
 		}
@@ -563,14 +638,36 @@ func TestAllocatorFuzz(t *testing.T) {
 	})
 }
 
-func TestGossipSkew(t *testing.T) {
-	alloc1, _ := makeAllocatorWithMockGossip(t, "01:00:00:01:00:00", "10.0.1.0/22", 2)
-	defer alloc1.Stop()
-	alloc2, _ := makeAllocatorWithMockGossip(t, "02:00:00:02:00:00", "10.0.1.0/22", 2)
-	alloc2.now = func() time.Time { return time.Now().Add(time.Hour * 2) }
-	defer alloc2.Stop()
+func TestSpaceRequest(t *testing.T) {
+	const (
+		container1 = "cont-1"
+		container2 = "cont-2"
+		universe   = "10.32.0.0/12"
+	)
+	allocs, router, subnet := makeNetworkOfAllocators(1, universe)
+	defer stopNetworkOfAllocators(allocs, router)
+	alloc1 := allocs[0]
 
-	if _, err := alloc1.OnGossipBroadcast(alloc2.ourName, alloc2.Encode()); err == nil {
-		t.Fail()
-	}
+	addr, err := alloc1.Allocate(container1, subnet, true, returnFalse)
+	require.Nil(t, err, "")
+	// free it again so the donation splits the range neatly
+	err = alloc1.Free(container1, addr)
+	require.Nil(t, err, "")
+	require.Equal(t, cidrRanges(universe), alloc1.OwnedRanges(), "")
+
+	// Start a new peer
+	alloc2, _ := makeAllocator("02:00:00:02:00:00", universe, 2)
+	alloc2.SetInterfaces(router.Connect(alloc2.ourName, alloc2))
+	alloc2.Start()
+	defer alloc2.Stop()
+	alloc2.Allocate(container2, subnet, true, returnFalse)
+
+	// Test whether the universe has been split into two equal halves (GH #2009)
+	require.Equal(t, cidrRanges("10.32.0.0/13"), alloc1.OwnedRanges(), "")
+	require.Equal(t, cidrRanges("10.40.0.0/13"), alloc2.OwnedRanges(), "")
+}
+
+func cidrRanges(s string) []address.Range {
+	c, _ := address.ParseCIDR(s)
+	return []address.Range{c.Range()}
 }

ipam/claim.go

@@ -3,18 +3,25 @@ package ipam
 import (
 	"fmt"
 
+	"github.com/weaveworks/mesh"
+
+	"github.com/weaveworks/weave/api"
 	"github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/mesh"
 	"github.com/weaveworks/weave/net/address"
 )
 
 type claim struct {
 	resultChan       chan<- error
-	ident            string
-	addr             address.Address
-	noErrorOnUnknown bool
+	tryCount         int
+	ident            string       // a container ID, something like "weave:expose", or api.NoContainerID
+	cidr             address.CIDR // single address being claimed
+	isContainer      bool         // true if ident is a container ID
+	noErrorOnUnknown bool         // if false, error or block if we don't know; if true return ok but keep trying
+	hasBeenCancelled func() bool
 }
 
+const maxTryCount = 5
+
 // Send an error (or nil for success) back to caller listening on resultChan
 func (c *claim) sendResult(result error) {
 	// Make sure we only send a result once, since listener stops listening after that
@@ -31,67 +38,113 @@ func (c *claim) sendResult(result error) {
 
 // Try returns true for success (or failure), false if we need to try again later
 func (c *claim) Try(alloc *Allocator) bool {
-	if !alloc.ring.Contains(c.addr) {
-		// Address not within our universe; assume user knows what they are doing
-		alloc.infof("Ignored address %s claimed by %s - not in our universe", c.addr, c.ident)
+	if c.hasBeenCancelled != nil && c.hasBeenCancelled() {
+		c.Cancel()
+		return true
+	}
+
+	c.tryCount++
+
+	addOwned := func() {
+		if c.ident == api.NoContainerID {
+			alloc.addOwned(c.cidr.Addr.String(), c.cidr, c.isContainer)
+		} else {
+			alloc.addOwned(c.ident, c.cidr, c.isContainer)
+		}
+	}
+
+	if !alloc.ring.Contains(c.cidr.Addr) {
+		alloc.infof("Address %s claimed by %s - not in our range", c.cidr, c.ident)
+		previousOwner := alloc.findOwner(c.cidr.Addr)
+		switch {
+		case previousOwner == "":
+			addOwned()
+		case previousOwner == c.ident: // already owned by this ID
+		case c.ident == api.NoContainerID: // already owned by anonymous container
+			// do nothing (no automatic fall-through in Go)
+		case !alloc.dead[previousOwner].IsZero(): // already owned by dead container
+			alloc.removeOwned(previousOwner, c.cidr.Addr)
+			addOwned()
+		default:
+			c.sendResult(fmt.Errorf("address %s already in use by %s", c.cidr, previousOwner))
+		}
 		c.sendResult(nil)
 		return true
 	}
 
 	alloc.establishRing()
 
-	switch owner := alloc.ring.Owner(c.addr); owner {
+	// If we had heard that this container died, resurrect it
+	delete(alloc.dead, c.ident) // (delete is no-op if key not in map)
+
+	switch owner := alloc.ring.Owner(c.cidr.Addr); owner {
 	case alloc.ourName:
 		// success
 	case mesh.UnknownPeerName:
 		// If our ring doesn't know, it must be empty.
+		alloc.infof("Claim %s for %s: is in the range %s, but the allocator is not initialized yet; will try later.",
+			c.cidr, c.ident, alloc.universe)
 		if c.noErrorOnUnknown {
-			alloc.infof("Claim %s for %s: address allocator still initializing; will try later.", c.addr, c.ident)
 			c.sendResult(nil)
-		} else {
-			c.sendResult(fmt.Errorf("%s is in the range %s, but the allocator is not initialized yet", c.addr, alloc.universe.AsCIDRString()))
 		}
 		return false
 	default:
-		alloc.debugf("requesting address %s from other peer %s", c.addr, owner)
-		err := alloc.sendSpaceRequest(owner, address.NewRange(c.addr, 1))
+		alloc.debugf("requesting address %s from other peer %s", c.cidr, owner)
+		err := alloc.sendSpaceRequest(owner, address.NewRange(c.cidr.Addr, 1))
 		if err != nil { // can't speak to owner right now
 			if c.noErrorOnUnknown {
-				alloc.infof("Claim %s for %s: %s; will try later.", c.addr, c.ident, err)
+				alloc.infof("Claim %s for %s: %s; will try later.", c.cidr, c.ident, err)
 				c.sendResult(nil)
-			} else { // just tell the user they can't do this.
-				c.deniedBy(alloc, owner)
+			} else if c.tryCount > maxTryCount {
+				// give up, tell the user they can't do this
+				c.deniedBy(alloc, owner, err)
+				return true
 			}
 		}
 		return false
 	}
 
 	// We are the owner, check we haven't given it to another container
-	switch existingIdent := alloc.findOwner(c.addr); existingIdent {
-	case "":
-		if err := alloc.space.Claim(c.addr); err == nil {
-			alloc.debugln("Claimed", c.addr, "for", c.ident)
-			alloc.addOwned(c.ident, c.addr)
+	existingIdent := alloc.findOwner(c.cidr.Addr)
+	switch {
+	case existingIdent == "":
+		// Unused address, we try to claim it:
+		if err := alloc.space.Claim(c.cidr.Addr); err == nil {
+			alloc.debugln("Claimed", c.cidr, "for", c.ident)
+			addOwned()
 			c.sendResult(nil)
 		} else {
 			c.sendResult(err)
 		}
-	case c.ident:
+	case (existingIdent == c.ident) || (c.ident == api.NoContainerID && existingIdent == c.cidr.Addr.String()):
 		// same identifier is claiming same address; that's OK
+		alloc.debugln("Re-Claimed", c.cidr, "for", c.ident)
+		c.sendResult(nil)
+	case existingIdent == c.cidr.Addr.String():
+		// Address already allocated via api.NoContainerID name and current ID is a real container ID:
+		c.sendResult(fmt.Errorf("address %s already in use", c.cidr))
+	case c.ident == api.NoContainerID:
+		// We do not know whether this is the same container or another one,
+		// but we also cannot prove otherwise, so we let it reclaim the address:
+		alloc.debugln("Re-Claimed", c.cidr, "for ID", c.ident, "having existing ID as", existingIdent)
 		c.sendResult(nil)
 	default:
 		// Addr already owned by container on this machine
-		c.sendResult(fmt.Errorf("address %s is already owned by %s", c.addr.String(), existingIdent))
+		c.sendResult(fmt.Errorf("address %s is already owned by %s", c.cidr.String(), existingIdent))
 	}
 	return true
 }
 
-func (c *claim) deniedBy(alloc *Allocator, owner mesh.PeerName) {
+func (c *claim) deniedBy(alloc *Allocator, owner mesh.PeerName, err error) {
 	name, found := alloc.nicknames[owner]
 	if found {
 		name = " (" + name + ")"
 	}
-	c.sendResult(fmt.Errorf("address %s is owned by other peer %s%s", c.addr.String(), owner, name))
+	reason := ""
+	if err != nil {
+		reason = fmt.Sprintf(" - %s", err)
+	}
+	c.sendResult(fmt.Errorf("address %s is owned by other peer %s%s%s", c.cidr.String(), owner, name, reason))
 }
 
 func (c *claim) Cancel() {

ipam/http.go

@@ -1,6 +1,8 @@
 package ipam
 
 import (
+	"context"
+	"encoding/json"
 	"fmt"
 	"net/http"
 
@@ -16,94 +18,160 @@ func badRequest(w http.ResponseWriter, err error) {
 	common.Log.Warningln("[allocator]:", err.Error())
 }
 
-func parseCIDR(w http.ResponseWriter, cidrStr string) (address.CIDR, bool) {
-	subnetAddr, cidr, err := address.ParseCIDR(cidrStr)
+func parseCIDR(w http.ResponseWriter, cidrStr string, net bool) (address.CIDR, bool) {
+	var cidr address.CIDR
+	var err error
+	if net {
+		cidr, err = ParseCIDRSubnet(cidrStr)
+	} else {
+		cidr, err = address.ParseCIDR(cidrStr)
+	}
 	if err != nil {
 		badRequest(w, err)
 		return address.CIDR{}, false
 	}
-	if cidr.Start != subnetAddr {
-		badRequest(w, fmt.Errorf("Invalid subnet %s - bits after network prefix are not all zero", cidrStr))
-		return address.CIDR{}, false
-	}
 	return cidr, true
 }
 
-func (alloc *Allocator) handleHTTPAllocate(dockerCli *docker.Client, w http.ResponseWriter, ident string, checkAlive bool, subnet address.CIDR) {
-	closedChan := w.(http.CloseNotifier).CloseNotify()
-	addr, err := alloc.Allocate(ident, subnet.HostRange(),
-		func() bool {
-			select {
-			case <-closedChan:
-				return true
-			default:
-				res := checkAlive && dockerCli != nil && dockerCli.IsContainerNotRunning(ident)
-				checkAlive = false // we check only once; if the container dies later we learn about that through events
-				return res
-			}
-		})
+func writeAddresses(w http.ResponseWriter, cidrs []address.CIDR) {
+	for i, cidr := range cidrs {
+		fmt.Fprint(w, cidr)
+		if i < len(cidrs)-1 {
+			w.Write([]byte{' '})
+		}
+	}
+}
+
+func hasBeenCancelled(dockerCli *docker.Client, closedChan <-chan struct{}, ident string, checkAlive bool) func() bool {
+	return func() bool {
+		select {
+		case <-closedChan:
+			return true
+		default:
+			res := checkAlive && dockerCli != nil && dockerCli.IsContainerNotRunning(ident)
+			checkAlive = false // we check only once; if the container dies later we learn about that through events
+			return res
+		}
+	}
+}
+
+func cancellationErr(w http.ResponseWriter, err error) bool {
+	if _, ok := err.(*errorCancelled); ok {
+		common.Log.Infoln("[allocator]:", err.Error())
+		fmt.Fprint(w, "cancelled")
+		return true
+	}
+	return false
+}
+
+func (alloc *Allocator) handleHTTPAllocate(ctx context.Context, dockerCli *docker.Client, w http.ResponseWriter, ident string, checkAlive bool, subnet address.CIDR) {
+	addr, err := alloc.Allocate(ident, subnet, checkAlive,
+		hasBeenCancelled(dockerCli, ctx.Done(), ident, checkAlive))
 	if err != nil {
-		if _, ok := err.(*errorCancelled); ok { // cancellation is not really an error
-			common.Log.Infoln("[allocator]:", err.Error())
-			fmt.Fprint(w, "cancelled")
-			return
+		if !cancellationErr(w, err) {
+			badRequest(w, err)
 		}
-		badRequest(w, err)
 		return
 	}
-
 	fmt.Fprintf(w, "%s/%d", addr, subnet.PrefixLen)
 }
 
+func (alloc *Allocator) handleHTTPClaim(ctx context.Context, dockerCli *docker.Client, w http.ResponseWriter, ident string, cidr address.CIDR, checkAlive, noErrorOnUnknown bool) {
+	err := alloc.Claim(ident, cidr, checkAlive, noErrorOnUnknown,
+		hasBeenCancelled(dockerCli, ctx.Done(), ident, checkAlive))
+	if err != nil {
+		if !cancellationErr(w, err) {
+			badRequest(w, fmt.Errorf("Unable to claim: %s", err))
+		}
+		return
+	}
+	w.WriteHeader(204)
+}
+
 // HandleHTTP wires up ipams HTTP endpoints to the provided mux.
 func (alloc *Allocator) HandleHTTP(router *mux.Router, defaultSubnet address.CIDR, dockerCli *docker.Client) {
-	router.Methods("PUT").Path("/ip/{id}/{ip}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		vars := mux.Vars(r)
-		ident := vars["id"]
-		ipStr := vars["ip"]
-		noErrorOnUnknown := r.FormValue("noErrorOnUnknown") == "true"
-		if ip, err := address.ParseIP(ipStr); err != nil {
-			badRequest(w, err)
-			return
-		} else if err := alloc.Claim(ident, ip, noErrorOnUnknown); err != nil {
-			badRequest(w, fmt.Errorf("Unable to claim: %s", err))
-			return
-		}
+	router.Methods("GET").Path("/ipinfo/defaultsubnet").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintf(w, "%s", defaultSubnet)
+	})
 
-		w.WriteHeader(204)
+	router.Methods("PUT").Path("/ip/{id}/{ip}/{prefixlen}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		vars := mux.Vars(r)
+		if cidr, ok := parseCIDR(w, vars["ip"]+"/"+vars["prefixlen"], false); ok {
+			ident := vars["id"]
+			checkAlive := r.FormValue("check-alive") == "true"
+			noErrorOnUnknown := r.FormValue("noErrorOnUnknown") == "true"
+			alloc.handleHTTPClaim(r.Context(), dockerCli, w, ident, cidr, checkAlive, noErrorOnUnknown)
+		}
+	})
+
+	router.Methods("GET").Path("/ring").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		alloc.Prime()
 	})
 
 	router.Methods("GET").Path("/ip/{id}/{ip}/{prefixlen}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		vars := mux.Vars(r)
-		if subnet, ok := parseCIDR(w, vars["ip"]+"/"+vars["prefixlen"]); ok {
-			addr, err := alloc.Lookup(vars["id"], subnet.HostRange())
+		if subnet, ok := parseCIDR(w, vars["ip"]+"/"+vars["prefixlen"], true); ok {
+			cidrs, err := alloc.Lookup(vars["id"], subnet.HostRange())
 			if err != nil {
 				http.NotFound(w, r)
 				return
 			}
-			fmt.Fprintf(w, "%s/%d", addr, subnet.PrefixLen)
+			writeAddresses(w, cidrs)
 		}
 	})
 
 	router.Methods("GET").Path("/ip/{id}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		addr, err := alloc.Lookup(mux.Vars(r)["id"], defaultSubnet.HostRange())
+		addrs, err := alloc.Lookup(mux.Vars(r)["id"], defaultSubnet.HostRange())
 		if err != nil {
 			http.NotFound(w, r)
 			return
 		}
-		fmt.Fprintf(w, "%s/%d", addr, defaultSubnet.PrefixLen)
+		writeAddresses(w, addrs)
+	})
+
+	router.Methods("GET").Path("/ip").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		type mapping struct {
+			ContainerID string   `json:"containerid"`
+			Addrs       []string `json:"addrs"`
+		}
+
+		type mappings struct {
+			Owned []mapping `json:"owned"`
+		}
+
+		resultChan := make(chan mappings)
+		alloc.actionChan <- func() {
+			ms := mappings{}
+			for containerid, d := range alloc.owned {
+				m := mapping{
+					ContainerID: containerid,
+					Addrs:       []string{},
+				}
+				for _, addr := range d.Cidrs {
+					m.Addrs = append(m.Addrs, addr.String())
+				}
+				ms.Owned = append(ms.Owned, m)
+			}
+			resultChan <- ms
+		}
+		ms := <-resultChan
+
+		w.Header().Set("Content-Type", "application/json")
+		if err := json.NewEncoder(w).Encode(ms); err != nil {
+			common.Log.Warningln("[allocator]:", err.Error())
+		}
 	})
 
 	router.Methods("POST").Path("/ip/{id}/{ip}/{prefixlen}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		vars := mux.Vars(r)
-		if subnet, ok := parseCIDR(w, vars["ip"]+"/"+vars["prefixlen"]); ok {
-			alloc.handleHTTPAllocate(dockerCli, w, vars["id"], r.FormValue("check-alive") == "true", subnet)
+		if subnet, ok := parseCIDR(w, vars["ip"]+"/"+vars["prefixlen"], true); ok {
+			alloc.handleHTTPAllocate(r.Context(), dockerCli, w, vars["id"], r.FormValue("check-alive") == "true", subnet)
 		}
 	})
 
 	router.Methods("POST").Path("/ip/{id}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		vars := mux.Vars(r)
-		alloc.handleHTTPAllocate(dockerCli, w, vars["id"], r.FormValue("check-alive") == "true", defaultSubnet)
+		alloc.handleHTTPAllocate(r.Context(), dockerCli, w, vars["id"], r.FormValue("check-alive") == "true", defaultSubnet)
 	})
 
 	router.Methods("DELETE").Path("/ip/{id}/{ip}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -131,18 +199,11 @@ func (alloc *Allocator) HandleHTTP(router *mux.Router, defaultSubnet address.CID
 		w.WriteHeader(204)
 	})
 
-	router.Methods("DELETE").Path("/peer").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		alloc.Shutdown()
-		w.WriteHeader(204)
-	})
-
-	router.Methods("DELETE").Path("/peer/{id}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		ident := mux.Vars(r)["id"]
-		if err := alloc.AdminTakeoverRanges(ident); err != nil {
-			badRequest(w, err)
-			return
+	router.Methods("GET").Path("/ipinfo/tracker").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		tracker := ""
+		if alloc.tracker != nil {
+			tracker = alloc.tracker.String()
 		}
-
-		w.WriteHeader(204)
+		fmt.Fprintln(w, tracker)
 	})
 }

ipam/http_test.go

@@ -1,6 +1,7 @@
 package ipam
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"io/ioutil"
@@ -14,7 +15,6 @@ import (
 	"github.com/stretchr/testify/require"
 	"github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/net/address"
-	wt "github.com/weaveworks/weave/testing"
 )
 
 func HTTPPost(t *testing.T, url string) string {
@@ -81,7 +81,7 @@ func TestHttp(t *testing.T) {
 	)
 
 	alloc, _ := makeAllocatorWithMockGossip(t, "08:00:27:01:c3:9a", universe, 1)
-	_, cidr, _ := address.ParseCIDR(universe)
+	cidr, _ := address.ParseCIDR(universe)
 	port := listenHTTP(alloc, cidr)
 	alloc.claimRingForTesting()
 
@@ -123,7 +123,7 @@ func TestBadHttp(t *testing.T) {
 
 	alloc, _ := makeAllocatorWithMockGossip(t, "08:00:27:01:c3:9a", testCIDR1, 1)
 	defer alloc.Stop()
-	_, cidr, _ := address.ParseCIDR(testCIDR1)
+	cidr, _ := address.ParseCIDR(testCIDR1)
 	port := listenHTTP(alloc, cidr)
 
 	alloc.claimRingForTesting()
@@ -133,7 +133,7 @@ func TestBadHttp(t *testing.T) {
 	// Verb that's not handled
 	resp, err := doHTTP("HEAD", fmt.Sprintf("http://localhost:%d/ip/%s/%s", port, containerID, testAddr1))
 	require.NoError(t, err)
-	require.Equal(t, http.StatusNotFound, resp.StatusCode, "http response")
+	require.Equal(t, http.StatusMethodNotAllowed, resp.StatusCode, "http response")
 	// Mis-spelled URL
 	resp, err = doHTTP("POST", fmt.Sprintf("http://localhost:%d/xip/%s/", port, containerID))
 	require.NoError(t, err)
@@ -145,40 +145,32 @@ func TestBadHttp(t *testing.T) {
 }
 
 func TestHTTPCancel(t *testing.T) {
-	wt.RunWithTimeout(t, 2*time.Second, func() {
-		impTestHTTPCancel(t)
-	})
-}
-
-func impTestHTTPCancel(t *testing.T) {
 	var (
 		containerID = "deadbeef"
 		testCIDR1   = "10.0.3.0/29"
 	)
 
-	alloc, _ := makeAllocatorWithMockGossip(t, "08:00:27:01:c3:9a", testCIDR1, 1)
+	// Say quorum=2, so the allocate won't go ahead
+	alloc, _ := makeAllocatorWithMockGossip(t, "08:00:27:01:c3:9a", testCIDR1, 2)
 	defer alloc.Stop()
-	alloc.claimRingForTesting()
-	_, cidr, _ := address.ParseCIDR(testCIDR1)
+	ExpectBroadcastMessage(alloc, nil) // trying to form consensus
+	cidr, _ := address.ParseCIDR(testCIDR1)
 	port := listenHTTP(alloc, cidr)
 
-	// Stop the alloc so nothing actually works
-	unpause := alloc.pause()
-
 	// Ask the http server for a new address
-	done := make(chan *http.Response)
 	req, _ := http.NewRequest("POST", allocURL(port, testCIDR1, containerID), nil)
+	ctx, cancel := context.WithCancel(context.Background())
+	req = req.WithContext(ctx)
+	// On another goroutine, wait for a bit then cancel the request
 	go func() {
-		res, _ := http.DefaultClient.Do(req)
-		done <- res
+		time.Sleep(100 * time.Millisecond)
+		common.Log.Debug("Cancelling allocate")
+		cancel()
 	}()
 
-	time.Sleep(100 * time.Millisecond)
-	fmt.Println("Cancelling allocate")
-	http.DefaultTransport.(*http.Transport).CancelRequest(req)
-	unpause()
-	res := <-done
+	res, _ := http.DefaultClient.Do(req)
 	if res != nil {
-		require.FailNow(t, "Error: Allocate returned non-nil")
+		body, _ := ioutil.ReadAll(res.Body)
+		require.FailNow(t, "Error: Allocate returned non-nil", string(body))
 	}
 }

ipam/paxos/participant.go

@@ -0,0 +1,44 @@
+package paxos
+
+type Participant interface {
+	GossipState() GossipState
+	Update(from GossipState) bool
+	SetQuorum(uint)
+	Propose()
+	Think() bool
+	Consensus() (bool, AcceptedValue)
+	IsElector() bool
+}
+
+type Observer struct {
+}
+
+func NewObserver() Participant {
+	return &Observer{}
+}
+
+func (observer *Observer) GossipState() GossipState {
+	return nil
+}
+
+func (observer *Observer) Update(from GossipState) bool {
+	return false
+}
+
+func (observer *Observer) Propose() {
+}
+
+func (observer *Observer) SetQuorum(uint) {
+}
+
+func (observer *Observer) Think() bool {
+	return false
+}
+
+func (observer *Observer) Consensus() (bool, AcceptedValue) {
+	return false, AcceptedValue{}
+}
+
+func (observer *Observer) IsElector() bool {
+	return false
+}

ipam/paxos/paxos.go

@@ -1,7 +1,7 @@
 package paxos
 
 import (
-	"github.com/weaveworks/weave/mesh"
+	"github.com/weaveworks/mesh"
 )
 
 // The node identifier.  The use of the UID here is important: Paxos
@@ -80,6 +80,10 @@ func NewNode(name mesh.PeerName, uid mesh.PeerUID, quorum uint) *Node {
 	}
 }
 
+func (node *Node) SetQuorum(quorum uint) {
+	node.quorum = quorum
+}
+
 func (node *Node) GossipState() GossipState {
 	return node.knows
 }
@@ -124,6 +128,9 @@ func max(a uint, b uint) uint {
 // simply a matter of gossipping a new proposal that supersedes all
 // others.
 func (node *Node) Propose() {
+	if node.quorum == 0 {
+		panic("Paxos node.Propose() called with no quorum set")
+	}
 	// Find the highest round number around
 	round := uint(0)
 
@@ -234,6 +241,9 @@ func (node *Node) pickValue() Value {
 
 // Has a consensus been reached, based on the known claims of other nodes?
 func (node *Node) Consensus() (bool, AcceptedValue) {
+	if node.quorum == 0 {
+		return false, AcceptedValue{}
+	}
 	counts := map[ProposalID]uint{}
 
 	for _, claims := range node.knows {
@@ -250,14 +260,16 @@ func (node *Node) Consensus() (bool, AcceptedValue) {
 	return false, AcceptedValue{}
 }
 
+func (node *Node) IsElector() bool {
+	return true
+}
+
 type Status struct {
+	Elector    bool
 	KnownNodes int
 	Quorum     uint
 }
 
 func NewStatus(node *Node) *Status {
-	if node == nil {
-		return nil
-	}
-	return &Status{len(node.knows), node.quorum}
+	return &Status{true, len(node.knows), node.quorum}
 }

ipam/paxos/paxos_test.go

@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/weaveworks/weave/mesh"
+	"github.com/weaveworks/mesh"
 )
 
 type TestNode struct {
@@ -56,16 +56,6 @@ func (m *Model) addLink(a, b *TestNode) {
 	m.readyLinks = append(m.readyLinks, &ab, &ba)
 }
 
-func (m *Model) linkExists(a, b *TestNode) bool {
-	for _, l := range a.links {
-		if l.to == b {
-			return true
-		}
-	}
-
-	return false
-}
-
 type TestParams struct {
 	// Number of nodes
 	nodeCount uint
@@ -300,14 +290,14 @@ func (m *Model) validate() {
 	for i := range m.nodes {
 		ok, val := m.nodes[i].Consensus()
 		if !ok {
-			//m.dump()
+			m.dump()
 			m.t.Fatal("Node doesn't know about consensus")
 		}
 
 		firstConsensus := m.nodes[i].firstConsensus
 		if firstConsensus.Origin.valid() &&
 			firstConsensus.Origin != val.Origin {
-			//m.dump()
+			m.dump()
 			m.t.Fatal("Consensus mismatch")
 		}
 

ipam/prime.go

@@ -0,0 +1,24 @@
+package ipam
+
+type prime struct {
+	resultChan chan<- struct{}
+}
+
+func (c *prime) Try(alloc *Allocator) bool {
+	if !alloc.ring.Empty() {
+		close(c.resultChan)
+		return true
+	}
+
+	alloc.establishRing()
+
+	return false
+}
+
+func (c *prime) Cancel() {
+	close(c.resultChan)
+}
+
+func (c *prime) ForContainer(ident string) bool {
+	return false
+}

ipam/ring/entry.go

@@ -1,10 +1,12 @@
 package ring
 
 import (
+	"fmt"
 	"sort"
 
+	"github.com/weaveworks/mesh"
+
 	"github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/mesh"
 	"github.com/weaveworks/weave/net/address"
 )
 
@@ -13,7 +15,7 @@ type entry struct {
 	Token   address.Address // The start of this range
 	Peer    mesh.PeerName   // Who owns this range
 	Version uint32          // Version of this range
-	Free    address.Offset  // Number of free IPs in this range
+	Free    address.Count   // Number of free IPs in this range
 }
 
 func (e *entry) Equal(e2 *entry) bool {
@@ -21,9 +23,10 @@ func (e *entry) Equal(e2 *entry) bool {
 		e.Version == e2.Version
 }
 
-func (e *entry) update(peername mesh.PeerName, free address.Offset) {
+func (e *entry) update(peername mesh.PeerName, free address.Count) {
 	e.Peer = peername
 	e.Version++
+	common.Log.Debugln(fmt.Sprintf("Updating ring token=%s current peer=%s updated peer=%s new version=%s", e.Token, e.Peer, peername, fmt.Sprint(e.Version)))
 	e.Free = free
 }
 

ipam/ring/expvar.go

@@ -1,31 +0,0 @@
-package ring
-
-/* Exported variables for monitoring and management */
-
-import (
-	"expvar"
-	"strconv"
-)
-
-var (
-	expRingSize    = expvar.NewMap("ipam.ringSize")
-	expRingEntries = expvar.NewMap("ipam.ringEntries")
-)
-
-type _int int
-
-func (i _int) String() string {
-	return strconv.Itoa(int(i))
-}
-
-type _uint32 uint32
-
-func (i _uint32) String() string {
-	return strconv.FormatUint(uint64(i), 10)
-}
-
-func (r *Ring) updateExportedVariables() {
-	ringName := r.Start.String()
-	expRingSize.Set(ringName, _uint32(r.End-r.Start))
-	expRingEntries.Set(ringName, _int(len(r.Entries)))
-}

ipam/ring/ring.go

@@ -12,17 +12,21 @@ import (
 	"sort"
 	"time"
 
+	"github.com/weaveworks/mesh"
+
 	"github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/mesh"
 	"github.com/weaveworks/weave/net/address"
 )
 
+type OnUpdate func(prev, curr []address.Range, local bool)
+
 // Ring represents the ring itself
 type Ring struct {
 	Start, End address.Address // [min, max) tokens in this ring.  Due to wrapping, min == max (effectively)
 	Peer       mesh.PeerName   // name of peer owning this ring instance
 	Entries    entries         // list of entries sorted by token
 	Seeds      []mesh.PeerName // peers with which the ring was seeded
+	onUpdate   OnUpdate
 }
 
 func (r *Ring) assertInvariants() {
@@ -37,42 +41,52 @@ var (
 	ErrNotSorted       = errors.New("Ring not sorted")
 	ErrTokenRepeated   = errors.New("Token appears twice in ring")
 	ErrTokenOutOfRange = errors.New("Token is out of range")
-	ErrDifferentSeeds  = errors.New("Received ring was seeded differently from ours!")
-	ErrDifferentRange  = errors.New("Received range differs from ours!")
-	ErrNewerVersion    = errors.New("Received new version for entry I own!")
-	ErrInvalidEntry    = errors.New("Received invalid state update!")
-	ErrEntryInMyRange  = errors.New("Received new entry in my range!")
-	ErrNotFound        = errors.New("No entries for peer found")
+	ErrDifferentSeeds  = errors.New("Received ring was seeded differently from ours")
+	ErrDifferentRange  = errors.New("Received range differs from ours")
 )
 
+func errInconsistentEntry(mine, theirs *entry) error {
+	return fmt.Errorf("Inconsistent entries for %s: owned by %s but incoming message says %s", mine.Token, mine.Peer, theirs.Peer)
+}
+func errEntryInMyRange(theirs *entry) error {
+	return fmt.Errorf("Peer %s says it owns the IP range from %s, which I think I own", theirs.Peer, theirs.Token)
+}
+func errNewerVersion(mine, theirs *entry) error {
+	return fmt.Errorf("Received update for IP range I own at %s v%d: incoming message says owner %s v%d", mine.Token, mine.Version, theirs.Peer, theirs.Version)
+}
+
 func (r *Ring) checkInvariants() error {
-	if !sort.IsSorted(r.Entries) {
+	return r.checkEntries(r.Entries)
+}
+
+func (r *Ring) checkEntries(entries entries) error {
+	if !sort.IsSorted(entries) {
 		return ErrNotSorted
 	}
 
 	// Check no token appears twice
 	// We know it's sorted...
-	for i := 1; i < len(r.Entries); i++ {
-		if r.Entries[i-1].Token == r.Entries[i].Token {
+	for i := 1; i < len(entries); i++ {
+		if entries[i-1].Token == entries[i].Token {
 			return ErrTokenRepeated
 		}
 	}
 
-	if len(r.Entries) == 0 {
+	if len(entries) == 0 {
 		return nil
 	}
 
 	// Check tokens are in range
-	if r.Entries.entry(0).Token < r.Start {
+	if entries.entry(0).Token < r.Start {
 		return ErrTokenOutOfRange
 	}
-	if r.Entries.entry(-1).Token >= r.End {
+	if entries.entry(-1).Token >= r.End {
 		return ErrTokenOutOfRange
 	}
 
 	// Check all the freespaces are in range
-	for i, entry := range r.Entries {
-		next := r.Entries.entry(i + 1)
+	for i, entry := range entries {
+		next := entries.entry(i + 1)
 		distance := r.distance(entry.Token, next.Token)
 
 		if entry.Free > distance {
@@ -83,27 +97,46 @@ func (r *Ring) checkInvariants() error {
 	return nil
 }
 
+func (r *Ring) trackUpdates() func() {
+	return r.trackUpdatesOfPeer(r.Peer)
+}
+
+func (r *Ring) trackUpdatesOfPeer(peer mesh.PeerName) func() {
+	if r.onUpdate == nil {
+		return func() {}
+	}
+	ranges := r.OwnedRangesOfPeer(peer)
+	return func() { r.onUpdate(ranges, r.OwnedRangesOfPeer(peer), peer == r.Peer) }
+}
+
 // New creates an empty ring belonging to peer.
-func New(start, end address.Address, peer mesh.PeerName) *Ring {
+func New(start, end address.Address, peer mesh.PeerName, f OnUpdate) *Ring {
 	common.Assert(start < end)
 
-	ring := &Ring{Start: start, End: end, Peer: peer, Entries: make([]*entry, 0)}
-	ring.updateExportedVariables()
+	ring := &Ring{Start: start, End: end, Peer: peer, Entries: make([]*entry, 0), onUpdate: f}
 	return ring
 }
 
+func (r *Ring) Restore(other *Ring) {
+	defer r.trackUpdates()()
+
+	onUpdate := r.onUpdate
+	*r = *other
+	r.onUpdate = onUpdate
+}
+
 func (r *Ring) Range() address.Range {
 	return address.Range{Start: r.Start, End: r.End}
 }
 
 // Returns the distance between two tokens on this ring, dealing
 // with ranges which cross the origin
-func (r *Ring) distance(start, end address.Address) address.Offset {
+func (r *Ring) distance(start, end address.Address) address.Count {
 	if end > start {
-		return address.Offset(end - start)
+		return address.Count(end - start)
 	}
 
-	return address.Offset((r.End - start) + (end - r.Start))
+	return address.Count((r.End - start) + (end - r.Start))
 }
 
 // GrantRangeToHost modifies the ring such that range [start, end)
@@ -115,8 +148,8 @@ func (r *Ring) GrantRangeToHost(start, end address.Address, peer mesh.PeerName)
 	//fmt.Printf("%s GrantRangeToHost [%v,%v) -> %s\n", r.Peer, start, end, peer)
 
 	r.assertInvariants()
+	defer r.trackUpdates()()
 	defer r.assertInvariants()
-	defer r.updateExportedVariables()
 
 	// ----------------- Start of Checks -----------------
 
@@ -178,43 +211,80 @@ func (r *Ring) GrantRangeToHost(start, end address.Address, peer mesh.PeerName)
 	r.Entries.insert(entry{Token: end, Peer: r.Peer, Free: endFree})
 }
 
-// Merge the given ring into this ring and return any new ranges added
-func (r *Ring) Merge(gossip Ring) error {
+// Merge the given ring into this ring and indicate whether this ring
+// got updated as a result.
+func (r *Ring) Merge(gossip Ring, hasAllocations func(r []address.Range) bool) (bool, error) {
 	r.assertInvariants()
-	defer r.assertInvariants()
-	defer r.updateExportedVariables()
+	defer r.trackUpdates()()
 
 	// Don't panic when checking the gossiped in ring.
 	// In this case just return any error found.
 	if err := gossip.checkInvariants(); err != nil {
-		return err
+		return false, err
 	}
 
 	if len(gossip.Seeds) > 0 && len(r.Seeds) > 0 {
 		if len(gossip.Seeds) != len(r.Seeds) {
-			return ErrDifferentSeeds
+			return false, ErrDifferentSeeds
 		}
 		for i, seed := range gossip.Seeds {
 			if seed != r.Seeds[i] {
-				return ErrDifferentSeeds
+				return false, ErrDifferentSeeds
 			}
 		}
 	}
 
 	if r.Start != gossip.Start || r.End != gossip.End {
-		return ErrDifferentRange
+		return false, ErrDifferentRange
 	}
 
-	// Now merge their ring with yours, in a temporary ring.
-	var result entries
-	addToResult := func(e entry) { result = append(result, &e) }
+	result, updated, err := r.Entries.merge(gossip.Entries, r.Peer, r, hasAllocations)
 
+	if err != nil {
+		return false, err
+	}
+
+	// reset the free space for entries if there is invalid free space
+	// due to accepting an unexpected update from the peers
+	for i := 0; i < len(result); i++ {
+		distance := r.distance(result.entry(i).Token, result.entry(i+1).Token)
+		if result.entry(i).Peer == r.Peer && result.entry(i).Free > distance {
+			// case that can arise when a range that we own that got split and had no allocations
+			result.entry(i).Free = distance
+		}
+	}
+
+	if err := r.checkEntries(result); err != nil {
+		return false, fmt.Errorf("Merge of incoming data causes: %s", err)
+	}
+
+	if len(r.Seeds) == 0 {
+		r.Seeds = gossip.Seeds
+	}
+	r.Entries = result
+
+	return updated, nil
+}
+
+// Merge other entries into ours, and complain when that stomps on
+// entries belonging to ourPeer. Returns the merged entries and an
+// indication whether the merge resulted in any changes, i.e. the
+// result differs from the original.
+func (es entries) merge(other entries, ourPeer mesh.PeerName, r *Ring, hasAllocations func(r []address.Range) bool) (result entries, updated bool, err error) {
 	var mine, theirs *entry
 	var previousOwner *mesh.PeerName
-	// i is index into r.Entries; j is index into gossip.Entries
+	addToResult := func(e entry) { result = append(result, &e) }
+	addTheirs := func(e entry) {
+		addToResult(e)
+		updated = true
+		previousOwner = nil
+	}
+
+	// i is index into es; j is index into other
 	var i, j int
-	for i < len(r.Entries) && j < len(gossip.Entries) {
-		mine, theirs = r.Entries[i], gossip.Entries[j]
+	for i < len(es) && j < len(other) {
+		mine, theirs = es[i], other[j]
+		common.Log.Debugf("[ring %s]: Merge mine.Token=%s theirs.Token=%s mine.Peer=%s theirs.Peer=%s mine.Version=%v theirs.Version=%v", ourPeer, mine.Token, theirs.Token, mine.Peer, theirs.Peer, mine.Version, theirs.Version)
 		switch {
 		case mine.Token < theirs.Token:
 			addToResult(*mine)
@@ -222,56 +292,82 @@ func (r *Ring) Merge(gossip Ring) error {
 			i++
 		case mine.Token > theirs.Token:
 			// insert, checking that a range owned by us hasn't been split
-			if previousOwner != nil && *previousOwner == r.Peer && theirs.Peer != r.Peer {
-				return ErrEntryInMyRange
+			if previousOwner != nil && *previousOwner == ourPeer && theirs.Peer != ourPeer {
+				// check we have no allocations in the range that got split
+				if hasAllocations(r.makeRanges(theirs.Token, mine.Token)) {
+					err = errEntryInMyRange(theirs)
+					return
+				}
 			}
-			addToResult(*theirs)
-			previousOwner = nil
+			addTheirs(*theirs)
 			j++
 		case mine.Token == theirs.Token:
 			// merge
 			switch {
 			case mine.Version >= theirs.Version:
 				if mine.Version == theirs.Version && !mine.Equal(theirs) {
-					common.Log.Debugf("Error merging entries at %s - %v != %v", mine.Token, mine, theirs)
-					return ErrInvalidEntry
+					if mine.Peer == ourPeer {
+						// if we own the entry and has allocations
+						if hasAllocations(r.makeRanges(theirs.Token, es.entry(i+1).Token)) {
+							err = errInconsistentEntry(mine, theirs)
+							return
+						}
+					}
+					// tie-break here, pick the entry with the highest free count
+					if mine.Free >= theirs.Free {
+						addToResult(*mine)
+						previousOwner = &mine.Peer
+					} else {
+						addTheirs(*theirs)
+					}
+				} else {
+					addToResult(*mine)
+					previousOwner = &mine.Peer
 				}
-				addToResult(*mine)
-				previousOwner = &mine.Peer
 			case mine.Version < theirs.Version:
-				if mine.Peer == r.Peer { // We shouldn't receive updates to our own tokens
-					return ErrNewerVersion
+				if mine.Peer == ourPeer {
+					// We received update to our own tokens accept the received entry
+					// if either it belongs to a different peer and we do not have allocations
+					// in the range effectively given away, or it belongs to our own peer, in
+					// which case we should set our version to the one received plus one,
+					// effectively imposing our existing entry.
+					if theirs.Peer != ourPeer && !hasAllocations(r.makeRanges(mine.Token, es.entry(i+1).Token)) {
+						common.Log.Infof("ring: repair inconsistent data by accepting token %v from %v - no allocations up to %v", theirs.Token, theirs.Peer, es.entry(i+1).Token)
+						addTheirs(*theirs)
+					} else if theirs.Peer == ourPeer {
+						mine.Version = theirs.Version + 1
+						addToResult(*mine)
+					} else {
+						err = errNewerVersion(mine, theirs)
+						return
+					}
+				} else {
+					addTheirs(*theirs)
 				}
-				addToResult(*theirs)
-				previousOwner = nil
 			}
 			i++
 			j++
 		}
 	}
 
-	// At this point, either i is at the end of r or j is at the end
-	// of gossip, so copy over the remaining entries.
+	// At this point, either i is at the end of es or j is at the end
+	// of other, so copy over the remaining entries.
 
-	for ; i < len(r.Entries); i++ {
-		mine = r.Entries[i]
+	for ; i < len(es); i++ {
+		mine = es[i]
 		addToResult(*mine)
 	}
 
-	for ; j < len(gossip.Entries); j++ {
-		theirs = gossip.Entries[j]
-		if previousOwner != nil && *previousOwner == r.Peer && theirs.Peer != r.Peer {
-			return ErrEntryInMyRange
+	for ; j < len(other); j++ {
+		theirs = other[j]
+		if previousOwner != nil && *previousOwner == ourPeer && theirs.Peer != ourPeer {
+			err = errEntryInMyRange(theirs)
+			return
 		}
-		addToResult(*theirs)
-		previousOwner = nil
+		addTheirs(*theirs)
 	}
 
-	if len(r.Seeds) == 0 {
-		r.Seeds = gossip.Seeds
-	}
-	r.Entries = result
-	return nil
+	return
 }
 
 // Empty returns true if the ring has no entries
@@ -279,6 +375,11 @@ func (r *Ring) Empty() bool {
 	return len(r.Entries) == 0
 }
 
+// convenience function to normalise a single range that may span zero
+func (r *Ring) makeRanges(start, end address.Address) []address.Range {
+	return r.splitRangesOverZero([]address.Range{{Start: start, End: end}})
+}
+
 // Given a slice of ranges which are all in the right order except
 // possibly the last one spans zero, fix that up and return the slice
 func (r *Ring) splitRangesOverZero(ranges []address.Range) []address.Range {
@@ -304,10 +405,14 @@ func (r *Ring) splitRangesOverZero(ranges []address.Range) []address.Range {
 // ranges are owned by this peer.  Will split ranges which
 // span 0 in the ring.
 func (r *Ring) OwnedRanges() (result []address.Range) {
+	return r.OwnedRangesOfPeer(r.Peer)
+}
+
+func (r *Ring) OwnedRangesOfPeer(peer mesh.PeerName) (result []address.Range) {
 	r.assertInvariants()
 
 	for i, entry := range r.Entries {
-		if entry.Peer == r.Peer {
+		if entry.Peer == peer {
 			nextEntry := r.Entries.entry(i + 1)
 			result = append(result, address.Range{Start: entry.Token, End: nextEntry.Token})
 		}
@@ -316,40 +421,54 @@ func (r *Ring) OwnedRanges() (result []address.Range) {
 	return r.splitRangesOverZero(result)
 }
 
+// For printing status
+type RangeInfo struct {
+	Peer mesh.PeerName
+	address.Range
+	Version uint32
+}
+
+func (r *Ring) AllRangeInfo() (result []RangeInfo) {
+	for i, entry := range r.Entries {
+		for _, r := range r.makeRanges(entry.Token, r.Entries.entry(i+1).Token) {
+			result = append(result, RangeInfo{entry.Peer, r, entry.Version})
+		}
+	}
+	return
+}
+
 // ClaimForPeers claims the entire ring for the array of peers passed
-// in.  Only works for empty rings.
+// in.  Only works for empty rings. Each claimed range is CIDR-aligned.
 func (r *Ring) ClaimForPeers(peers []mesh.PeerName) {
 	common.Assert(r.Empty())
+
+	defer r.trackUpdates()()
 	defer r.assertInvariants()
-	defer r.updateExportedVariables()
-
-	totalSize := r.distance(r.Start, r.End)
-	share := totalSize/address.Offset(len(peers)) + 1
-	remainder := totalSize % address.Offset(len(peers))
-	pos := r.Start
-
-	for i, peer := range peers {
-		if address.Offset(i) == remainder {
-			share--
-			if share == 0 {
-				break
-			}
-		}
-
-		if e, found := r.Entries.get(pos); found {
-			e.update(peer, share)
-		} else {
-			r.Entries.insert(entry{Token: pos, Peer: peer, Free: share})
-		}
-
-		pos += address.Address(share)
-	}
-
-	common.Assert(pos == r.End)
+	defer func() {
+		e := r.Entries[len(r.Entries)-1]
+		common.Assert(address.Add(e.Token, address.Offset(e.Free)) == r.End)
+	}()
 
+	r.subdivide(r.Start, r.End, peers)
 	r.Seeds = peers
 }
 
+// subdivide subdivides the [from,to) CIDR for the given peers into
+// CIDR-aligned subranges.
+func (r *Ring) subdivide(from, to address.Address, peers []mesh.PeerName) {
+	share := address.Length(to, from)
+	if share == 0 {
+		return
+	}
+	if share == 1 || len(peers) == 1 {
+		r.Entries.insert(entry{Token: from, Peer: peers[0], Free: share})
+		return
+	}
+	mid := address.Add(from, address.Offset(share/2))
+	r.subdivide(from, mid, peers[:len(peers)/2])
+	r.subdivide(address.Add(mid, address.Offset(share%2)), to, peers[len(peers)/2:])
+}
+
 func (r *Ring) FprintWithNicknames(w io.Writer, m map[mesh.PeerName]string) {
 	for _, entry := range r.Entries {
 		nickname, found := m[entry.Peer]
@@ -371,11 +490,10 @@ func (r *Ring) String() string {
 
 // ReportFree is used by the allocator to tell the ring how many free
 // ips are in a given range, so that ChoosePeersToAskForSpace can make
-// more intelligent decisions.
-func (r *Ring) ReportFree(freespace map[address.Address]address.Offset) {
+// more intelligent decisions.  Returns true if any changes made.
+func (r *Ring) ReportFree(freespace map[address.Address]address.Count) (updated bool) {
 	r.assertInvariants()
 	defer r.assertInvariants()
-	defer r.updateExportedVariables()
 
 	common.Assert(!r.Empty())
 	entries := r.Entries
@@ -402,15 +520,18 @@ func (r *Ring) ReportFree(freespace map[address.Address]address.Offset) {
 		// Check we're not reporting more space than the range
 		entry, next := entries.entry(i), entries.entry(i+1)
 		maxSize := r.distance(entry.Token, next.Token)
-		common.Assert(free <= maxSize)
+		common.Assert(free <= address.Count(maxSize))
 
 		if entries[i].Free == free {
-			return
+			continue
 		}
 
 		entries[i].Free = free
 		entries[i].Version++
+		common.Log.Debugf("[ring %s]: ReportFree token=%s peer=%s version=%v", r.Peer, entries[i].Token, entries[i].Peer, entries[i].Version)
+		updated = true
 	}
+	return
 }
 
 type weightedPeer struct {
@@ -427,10 +548,7 @@ func (ws weightedPeers) Swap(i, j int)      { ws[i], ws[j] = ws[j], ws[i] }
 // ChoosePeersToAskForSpace returns all peers we can ask for space in
 // the range [start, end), in weighted-random order.  Assumes start<end.
 func (r *Ring) ChoosePeersToAskForSpace(start, end address.Address) []mesh.PeerName {
-	var (
-		sum               address.Offset
-		totalSpacePerPeer = make(map[mesh.PeerName]address.Offset) // Compute total free space per peer
-	)
+	totalSpacePerPeer := make(map[mesh.PeerName]address.Count)
 
 	// iterate through tokens
 	for i, entry := range r.Entries {
@@ -442,7 +560,7 @@ func (r *Ring) ChoosePeersToAskForSpace(start, end address.Address) []mesh.PeerN
 			break
 		}
 		// Ignore ranges with no free space
-		if entry.Free <= 0 {
+		if entry.Free == 0 {
 			continue
 		}
 
@@ -452,7 +570,6 @@ func (r *Ring) ChoosePeersToAskForSpace(start, end address.Address) []mesh.PeerN
 		}
 
 		totalSpacePerPeer[entry.Peer] += entry.Free
-		sum += entry.Free
 	}
 
 	// Compute weighted random numbers, then sort.
@@ -481,28 +598,26 @@ func (r *Ring) PickPeerForTransfer(isValid func(mesh.PeerName) bool) mesh.PeerNa
 
 // Transfer will mark all entries associated with 'from' peer as owned by 'to' peer
 // and return ranges indicating the new space we picked up
-func (r *Ring) Transfer(from, to mesh.PeerName) ([]address.Range, error) {
+func (r *Ring) Transfer(from, to mesh.PeerName) []address.Range {
 	r.assertInvariants()
+	defer r.trackUpdates()()
+	defer r.trackUpdatesOfPeer(from)()
 	defer r.assertInvariants()
-	defer r.updateExportedVariables()
 
 	var newRanges []address.Range
-	found := false
 
 	for i, entry := range r.Entries {
 		if entry.Peer == from {
-			found = true
 			entry.Peer = to
-			entry.Version++
+			// bump version by large value so that transfer of range takes precedence (if there is any conflict in merging entry)
+			// over other opertaions on the entry that increments the version
+			entry.Version = entry.Version + 100
+			common.Log.Debugf("[ring %s]: Transfer token=%s from=%s to=%s version=%v", r.Peer, entry.Token, from, to, entry.Version)
 			newRanges = append(newRanges, address.Range{Start: entry.Token, End: r.Entries.entry(i + 1).Token})
 		}
 	}
 
-	if !found {
-		return nil, ErrNotFound
-	}
-
-	return r.splitRangesOverZero(newRanges), nil
+	return r.splitRangesOverZero(newRanges)
 }
 
 // Contains returns true if addr is in this ring

ipam/ring/ring_test.go

@@ -8,8 +8,9 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"github.com/weaveworks/mesh"
+
 	"github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/mesh"
 	"github.com/weaveworks/weave/net/address"
 )
 
@@ -18,7 +19,8 @@ var (
 	peer2name, _ = mesh.PeerNameFromString("02:00:00:00:02:00")
 	peer3name, _ = mesh.PeerNameFromString("03:00:00:00:02:00")
 
-	start, end    = ParseIP("10.0.0.0"), ParseIP("10.0.0.255")
+	start, end    = ParseIP("10.0.0.0"), ParseIP("10.0.1.0")
+	dot8          = ParseIP("10.0.0.8")
 	dot10, dot245 = ParseIP("10.0.0.10"), ParseIP("10.0.0.245")
 	dot250        = ParseIP("10.0.0.250")
 	middle        = ParseIP("10.0.0.128")
@@ -29,8 +31,37 @@ func ParseIP(s string) address.Address {
 	return addr
 }
 
+func merge(r1, r2 *Ring) error {
+	distance := func(start, end address.Address) address.Count {
+		if end > start {
+			return address.Count(end - start)
+		}
+		return address.Count((r1.End - start) + (end - r1.Start))
+	}
+	check := func(rs []address.Range) bool {
+		for _, r := range rs {
+			size := distance(r.Start, r.End)
+			entry, found := r1.Entries.get(r.Start)
+			if !found {
+				continue
+			}
+			if entry.Free < size {
+				return true
+			}
+		}
+		return false
+	}
+
+	_, err := r1.Merge(*r2, check)
+	return err
+}
+
+func NewRing(start, end address.Address, peer mesh.PeerName) *Ring {
+	return New(start, end, peer, nil)
+}
+
 func TestInvariants(t *testing.T) {
-	ring := New(start, end, peer1name)
+	ring := NewRing(start, end, peer1name)
 
 	// Check ring is sorted
 	ring.Entries = []*entry{{Token: dot245, Peer: peer1name}, {Token: dot10, Peer: peer2name}}
@@ -41,7 +72,7 @@ func TestInvariants(t *testing.T) {
 	require.True(t, ring.checkInvariants() == ErrTokenRepeated, "Expected error")
 
 	// Check tokens are in bounds
-	ring = New(dot10, dot245, peer1name)
+	ring = NewRing(dot10, dot245, peer1name)
 	ring.Entries = []*entry{{Token: start, Peer: peer1name}}
 	require.True(t, ring.checkInvariants() == ErrTokenOutOfRange, "Expected error")
 
@@ -50,7 +81,7 @@ func TestInvariants(t *testing.T) {
 }
 
 func TestInsert(t *testing.T) {
-	ring := New(start, end, peer1name)
+	ring := NewRing(start, end, peer1name)
 	ring.Entries = []*entry{{Token: start, Peer: peer1name, Free: 255}}
 
 	require.Panics(t, func() {
@@ -59,17 +90,23 @@ func TestInsert(t *testing.T) {
 
 	ring.Entries.entry(0).Free = 0
 	ring.Entries.insert(entry{Token: dot245, Peer: peer1name})
-	ring2 := New(start, end, peer1name)
-	ring2.Entries = []*entry{{Token: start, Peer: peer1name, Free: 0}, {Token: dot245, Peer: peer1name}}
-	require.Equal(t, ring2, ring)
+	check := []RangeInfo{
+		{Peer: peer1name, Range: address.Range{Start: start, End: dot245}},
+		{Peer: peer1name, Range: address.Range{Start: dot245, End: end}},
+	}
+	require.Equal(t, check, ring.AllRangeInfo())
 
 	ring.Entries.insert(entry{Token: dot10, Peer: peer1name})
-	ring2.Entries = []*entry{{Token: start, Peer: peer1name, Free: 0}, {Token: dot10, Peer: peer1name}, {Token: dot245, Peer: peer1name}}
-	require.Equal(t, ring2, ring)
+	check2 := []RangeInfo{
+		{Peer: peer1name, Range: address.Range{Start: start, End: dot10}},
+		{Peer: peer1name, Range: address.Range{Start: dot10, End: dot245}},
+		{Peer: peer1name, Range: address.Range{Start: dot245, End: end}},
+	}
+	require.Equal(t, check2, ring.AllRangeInfo())
 }
 
 func TestBetween(t *testing.T) {
-	ring1 := New(start, end, peer1name)
+	ring1 := NewRing(start, end, peer1name)
 	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 255}}
 
 	// First off, in a ring where everything is owned by the peer
@@ -111,29 +148,29 @@ func TestBetween(t *testing.T) {
 }
 
 func TestGrantSimple(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)
 
 	// Claim everything for peer1
 	ring1.ClaimItAll()
-	require.Equal(t, entries{{Token: start, Peer: peer1name, Free: 255}}, ring1.Entries)
+	require.Equal(t, entries{{Token: start, Peer: peer1name, Free: 256}}, ring1.Entries)
 
 	// Now grant everything to peer2
 	ring1.GrantRangeToHost(start, end, peer2name)
-	ring2.Entries = []*entry{{Token: start, Peer: peer2name, Free: 255, Version: 1}}
+	ring2.Entries = []*entry{{Token: start, Peer: peer2name, Free: 256, Version: 1}}
 	require.Equal(t, ring2.Entries, ring1.Entries)
 
 	// Now spint back to peer 1
 	ring2.GrantRangeToHost(dot10, end, peer1name)
 	ring1.Entries = []*entry{{Token: start, Peer: peer2name, Free: 10, Version: 2},
-		{Token: dot10, Peer: peer1name, Free: 245}}
+		{Token: dot10, Peer: peer1name, Free: 246}}
 	require.Equal(t, ring2.Entries, ring1.Entries)
 
 	// And spint back to peer 2 again
 	ring1.GrantRangeToHost(dot245, end, peer2name)
 	require.Equal(t, entries{{Token: start, Peer: peer2name, Free: 10, Version: 2},
 		{Token: dot10, Peer: peer1name, Free: 235, Version: 1},
-		{Token: dot245, Peer: peer2name, Free: 10}}, ring1.Entries)
+		{Token: dot245, Peer: peer2name, Free: 11}}, ring1.Entries)
 
 	// Grant range spanning a live token
 	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 10, Version: 2},
@@ -146,19 +183,19 @@ func TestGrantSimple(t *testing.T) {
 }
 
 func TestGrantSplit(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)
 
 	// Claim everything for peer1
-	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 255}}
-	ring2.Merge(*ring1)
+	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 256}}
+	merge(ring2, ring1)
 	require.Equal(t, ring2.Entries, ring1.Entries)
 
 	// Now grant a split range to peer2
 	ring1.GrantRangeToHost(dot10, dot245, peer2name)
 	require.Equal(t, entries{{Token: start, Peer: peer1name, Free: 10, Version: 1},
 		{Token: dot10, Peer: peer2name, Free: 235},
-		{Token: dot245, Peer: peer1name, Free: 10}}, ring1.Entries)
+		{Token: dot245, Peer: peer1name, Free: 11}}, ring1.Entries)
 
 	ring1.assertInvariants()
 
@@ -169,22 +206,22 @@ func TestGrantSplit(t *testing.T) {
 	require.Equal(t, entries{{Token: start, Peer: peer1name, Free: 10, Version: 2},
 		{Token: dot10, Peer: peer2name, Free: 118, Version: 1},
 		{Token: middle, Peer: peer2name, Free: 117, Version: 1},
-		{Token: dot245, Peer: peer1name, Free: 10, Version: 0}}, ring1.Entries)
+		{Token: dot245, Peer: peer1name, Free: 11, Version: 0}}, ring1.Entries)
 
 	ring1.assertInvariants()
 }
 
 func TestMergeSimple(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)
 
 	// Claim everything for peer1
 	ring1.ClaimItAll()
 	ring1.GrantRangeToHost(middle, end, peer2name)
-	require.NoError(t, ring2.Merge(*ring1))
+	require.NoError(t, merge(ring2, ring1))
 
 	require.Equal(t, entries{{Token: start, Peer: peer1name, Free: 128, Version: 1},
-		{Token: middle, Peer: peer2name, Free: 127}}, ring1.Entries)
+		{Token: middle, Peer: peer2name, Free: 128}}, ring1.Entries)
 
 	require.Equal(t, ring2.Entries, ring1.Entries)
 
@@ -193,47 +230,96 @@ func TestMergeSimple(t *testing.T) {
 	ring1.GrantRangeToHost(start, middle, peer2name)
 	ring2.GrantRangeToHost(middle, end, peer1name)
 
-	require.NoError(t, ring2.Merge(*ring1))
-	require.NoError(t, ring1.Merge(*ring2))
+	require.NoError(t, merge(ring2, ring1))
+	require.NoError(t, merge(ring1, ring2))
 
 	require.Equal(t, entries{{Token: start, Peer: peer2name, Free: 128, Version: 2},
-		{Token: middle, Peer: peer1name, Free: 127, Version: 1}}, ring1.Entries)
+		{Token: middle, Peer: peer1name, Free: 128, Version: 1}}, ring1.Entries)
 
 	require.Equal(t, ring2.Entries, ring1.Entries)
 }
 
-func TestMergeErrors(t *testing.T) {
-	// Cannot Merge in an invalid ring
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
-	ring2.Entries = []*entry{{Token: middle, Peer: peer2name}, {Token: start, Peer: peer2name}}
-	require.True(t, ring1.Merge(*ring2) == ErrNotSorted, "Expected ErrNotSorted")
+func TestMergeWithConflicts(t *testing.T) {
 
-	// Should Merge two rings for different ranges
-	ring2 = New(start, middle, peer2name)
-	ring2.Entries = []*entry{}
-	require.True(t, ring1.Merge(*ring2) == ErrDifferentRange, "Expected ErrDifferentRange")
+	// received update to entry with a token and version identical to an entry we have
+	// but but holding different content, if there are no allocations, resolve the
+	// conflict by picking entry one with high free count
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)
+	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 256, Version: 1}}
+	ring2.Entries = []*entry{{Token: start, Peer: peer2name, Free: 256, Version: 1}}
+	require.NoError(t, merge(ring1, ring2))
 
-	// Cannot Merge newer version of entry I own
-	ring2 = New(start, end, peer2name)
+	// received update to entry with a token and version identical to an entry we have
+	// but but holding different content, if there are allocations, then reject the received
+	// entry
+	ring1 = NewRing(start, end, peer1name)
+	ring2 = NewRing(start, end, peer2name)
+	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 128, Version: 1}}
+	ring2.Entries = []*entry{{Token: start, Peer: peer2name, Free: 256, Version: 1}}
+	require.Error(t, merge(ring1, ring2), "Expected error")
+
+	// received an entry with update to one of our own tokens and with new version,
+	// accept the received entry if its still going to belong to us
+	ring1 = NewRing(start, end, peer1name)
+	ring2 = NewRing(start, end, peer2name)
 	ring1.Entries = []*entry{{Token: start, Peer: peer1name}}
 	ring2.Entries = []*entry{{Token: start, Peer: peer1name, Version: 1}}
-	require.True(t, ring1.Merge(*ring2) == ErrNewerVersion, "Expected ErrNewerVersion")
+	require.NoError(t, merge(ring1, ring2))
+
+	// received an entry with update to one of our own tokens and with new version,
+	// but belongs to a different peer, accept the received entry if we do not
+	// have allocations in the range
+	ring1 = NewRing(start, end, peer1name)
+	ring2 = NewRing(start, end, peer2name)
+	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 256}}
+	ring2.Entries = []*entry{{Token: start, Peer: peer2name, Free: 256, Version: 1}}
+	require.NoError(t, merge(ring1, ring2))
+
+	// received an entry with update to one of our own tokens and with new version,
+	// reject received entry if we have allocations in the range
+	ring1 = NewRing(start, end, peer1name)
+	ring2 = NewRing(start, end, peer2name)
+	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 128}}
+	ring2.Entries = []*entry{{Token: start, Peer: peer2name, Version: 1}}
+	require.Error(t, merge(ring1, ring2), "Expected error")
+
+	// we receive an entry that splits one of our ranges, giving some of it
+	// away to another peer. accept the entry provided that we have no allocations
+	// in the range that got given away.
+	ring1 = NewRing(start, end, peer1name)
+	ring2 = NewRing(start, end, peer2name)
+	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 256, Version: 1}}
+	ring2.Entries = []*entry{{Token: start, Peer: peer1name, Free: 128, Version: 2}, {Token: middle, Peer: peer2name, Free: 128}}
+	require.NoError(t, merge(ring1, ring2))
+}
+
+func TestMergeErrors(t *testing.T) {
+	// Cannot Merge in an invalid ring
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)
+	ring2.Entries = []*entry{{Token: middle, Peer: peer2name}, {Token: start, Peer: peer2name}}
+	require.True(t, merge(ring1, ring2) == ErrNotSorted, "Expected ErrNotSorted")
+
+	// Should Merge two rings for different ranges
+	ring2 = NewRing(start, middle, peer2name)
+	ring2.Entries = []*entry{}
+	require.True(t, merge(ring1, ring2) == ErrDifferentRange, "Expected ErrDifferentRange")
 
 	// Cannot Merge two entries with same version but different hosts
 	ring1.Entries = []*entry{{Token: start, Peer: peer1name}}
 	ring2.Entries = []*entry{{Token: start, Peer: peer2name}}
-	require.True(t, ring1.Merge(*ring2) == ErrInvalidEntry, "Expected ErrInvalidEntry")
+	require.Error(t, merge(ring1, ring2), "Expected error")
 
 	// Cannot Merge an entry into a range I own
 	ring1.Entries = []*entry{{Token: start, Peer: peer1name}}
 	ring2.Entries = []*entry{{Token: middle, Peer: peer2name}}
-	require.True(t, ring1.Merge(*ring2) == ErrEntryInMyRange, "Expected ErrEntryInMyRange")
+	require.Error(t, merge(ring1, ring2), "Expected error")
 }
 
 func TestMergeMore(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)
 
 	assertRing := func(ring *Ring, entries entries) {
 		require.Equal(t, entries, ring.Entries)
@@ -244,74 +330,74 @@ func TestMergeMore(t *testing.T) {
 
 	// Claim everything for peer1
 	ring1.ClaimItAll()
-	assertRing(ring1, []*entry{{Token: start, Peer: peer1name, Free: 255}})
+	assertRing(ring1, []*entry{{Token: start, Peer: peer1name, Free: 256}})
 	assertRing(ring2, []*entry{})
 
 	// Check the Merge sends it to the other ring
-	require.NoError(t, ring2.Merge(*ring1))
-	assertRing(ring1, []*entry{{Token: start, Peer: peer1name, Free: 255}})
-	assertRing(ring2, []*entry{{Token: start, Peer: peer1name, Free: 255}})
+	require.NoError(t, merge(ring2, ring1))
+	assertRing(ring1, []*entry{{Token: start, Peer: peer1name, Free: 256}})
+	assertRing(ring2, []*entry{{Token: start, Peer: peer1name, Free: 256}})
 
 	// Give everything to peer2
 	ring1.GrantRangeToHost(start, end, peer2name)
-	assertRing(ring1, []*entry{{Token: start, Peer: peer2name, Free: 255, Version: 1}})
-	assertRing(ring2, []*entry{{Token: start, Peer: peer1name, Free: 255}})
+	assertRing(ring1, []*entry{{Token: start, Peer: peer2name, Free: 256, Version: 1}})
+	assertRing(ring2, []*entry{{Token: start, Peer: peer1name, Free: 256}})
 
-	require.NoError(t, ring2.Merge(*ring1))
-	assertRing(ring1, []*entry{{Token: start, Peer: peer2name, Free: 255, Version: 1}})
-	assertRing(ring2, []*entry{{Token: start, Peer: peer2name, Free: 255, Version: 1}})
+	require.NoError(t, merge(ring2, ring1))
+	assertRing(ring1, []*entry{{Token: start, Peer: peer2name, Free: 256, Version: 1}})
+	assertRing(ring2, []*entry{{Token: start, Peer: peer2name, Free: 256, Version: 1}})
 
 	// And carve off some space
 	ring2.GrantRangeToHost(middle, end, peer1name)
 	assertRing(ring2, []*entry{{Token: start, Peer: peer2name, Free: 128, Version: 2},
-		{Token: middle, Peer: peer1name, Free: 127}})
-	assertRing(ring1, []*entry{{Token: start, Peer: peer2name, Free: 255, Version: 1}})
+		{Token: middle, Peer: peer1name, Free: 128}})
+	assertRing(ring1, []*entry{{Token: start, Peer: peer2name, Free: 256, Version: 1}})
 
 	// And Merge back
-	require.NoError(t, ring1.Merge(*ring2))
+	require.NoError(t, merge(ring1, ring2))
 	assertRing(ring1, []*entry{{Token: start, Peer: peer2name, Free: 128, Version: 2},
-		{Token: middle, Peer: peer1name, Free: 127}})
+		{Token: middle, Peer: peer1name, Free: 128}})
 	assertRing(ring2, []*entry{{Token: start, Peer: peer2name, Free: 128, Version: 2},
-		{Token: middle, Peer: peer1name, Free: 127}})
+		{Token: middle, Peer: peer1name, Free: 128}})
 
 	// This should be a no-op
-	require.NoError(t, ring2.Merge(*ring1))
+	require.NoError(t, merge(ring2, ring1))
 	assertRing(ring1, []*entry{{Token: start, Peer: peer2name, Free: 128, Version: 2},
-		{Token: middle, Peer: peer1name, Free: 127}})
+		{Token: middle, Peer: peer1name, Free: 128}})
 	assertRing(ring2, []*entry{{Token: start, Peer: peer2name, Free: 128, Version: 2},
-		{Token: middle, Peer: peer1name, Free: 127}})
+		{Token: middle, Peer: peer1name, Free: 128}})
 }
 
 func TestMergeSplit(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)
 
 	// Claim everything for peer2
-	ring1.Entries = []*entry{{Token: start, Peer: peer2name, Free: 255}}
-	require.NoError(t, ring2.Merge(*ring1))
+	ring1.Entries = []*entry{{Token: start, Peer: peer2name, Free: 256}}
+	require.NoError(t, merge(ring2, ring1))
 	require.Equal(t, ring2.Entries, ring1.Entries)
 
 	// Now grant a split range to peer1
 	ring2.GrantRangeToHost(dot10, dot245, peer1name)
 	require.Equal(t, entries{{Token: start, Peer: peer2name, Free: 10, Version: 1},
 		{Token: dot10, Peer: peer1name, Free: 235},
-		{Token: dot245, Peer: peer2name, Free: 10}}, ring2.Entries)
+		{Token: dot245, Peer: peer2name, Free: 11}}, ring2.Entries)
 
-	require.NoError(t, ring1.Merge(*ring2))
+	require.NoError(t, merge(ring1, ring2))
 	require.Equal(t, entries{{Token: start, Peer: peer2name, Free: 10, Version: 1},
 		{Token: dot10, Peer: peer1name, Free: 235},
-		{Token: dot245, Peer: peer2name, Free: 10}}, ring1.Entries)
+		{Token: dot245, Peer: peer2name, Free: 11}}, ring1.Entries)
 
 	require.Equal(t, ring2.Entries, ring1.Entries)
 }
 
 func TestMergeSplit2(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)
 
 	// Claim everything for peer2
 	ring1.Entries = []*entry{{Token: start, Peer: peer2name, Free: 250}, {Token: dot250, Peer: peer2name, Free: 5}}
-	require.NoError(t, ring2.Merge(*ring1))
+	require.NoError(t, merge(ring2, ring1))
 	require.Equal(t, ring2.Entries, ring1.Entries)
 
 	// Now grant a split range to peer1
@@ -320,7 +406,7 @@ func TestMergeSplit2(t *testing.T) {
 		{Token: dot10, Peer: peer1name, Free: 235},
 		{Token: dot245, Peer: peer2name, Free: 5}, {Token: dot250, Peer: peer2name, Free: 5}}, ring2.Entries)
 
-	require.NoError(t, ring1.Merge(*ring2))
+	require.NoError(t, merge(ring1, ring2))
 	require.Equal(t, entries{{Token: start, Peer: peer2name, Free: 10, Version: 1},
 		{Token: dot10, Peer: peer1name, Free: 235},
 		{Token: dot245, Peer: peer2name, Free: 5}, {Token: dot250, Peer: peer2name, Free: 5}}, ring1.Entries)
@@ -330,8 +416,8 @@ func TestMergeSplit2(t *testing.T) {
 
 // A simple test, very similar to above, but using the marshalling to byte[]s
 func TestGossip(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)
 
 	assertRing := func(ring *Ring, entries entries) {
 		require.Equal(t, entries, ring.Entries)
@@ -342,13 +428,13 @@ func TestGossip(t *testing.T) {
 
 	// Claim everything for peer1
 	ring1.ClaimItAll()
-	assertRing(ring1, []*entry{{Token: start, Peer: peer1name, Free: 255}})
+	assertRing(ring1, []*entry{{Token: start, Peer: peer1name, Free: 256}})
 	assertRing(ring2, []*entry{})
 
 	// Check the Merge sends it to the other ring
-	require.NoError(t, ring2.Merge(*ring1))
-	assertRing(ring1, []*entry{{Token: start, Peer: peer1name, Free: 255}})
-	assertRing(ring2, []*entry{{Token: start, Peer: peer1name, Free: 255}})
+	require.NoError(t, merge(ring2, ring1))
+	assertRing(ring1, []*entry{{Token: start, Peer: peer1name, Free: 256}})
+	assertRing(ring2, []*entry{{Token: start, Peer: peer1name, Free: 256}})
 }
 
 func assertPeersWithSpace(t *testing.T, ring *Ring, start, end address.Address, expected int) []mesh.PeerName {
@@ -358,7 +444,7 @@ func assertPeersWithSpace(t *testing.T, ring *Ring, start, end address.Address,
 }
 
 func TestFindFree(t *testing.T) {
-	ring1 := New(start, end, peer1name)
+	ring1 := NewRing(start, end, peer1name)
 
 	assertPeersWithSpace(t, ring1, start, end, 0)
 
@@ -366,7 +452,7 @@ func TestFindFree(t *testing.T) {
 	assertPeersWithSpace(t, ring1, start, end, 0)
 
 	// We shouldn't return outselves
-	ring1.ReportFree(map[address.Address]address.Offset{start: 10})
+	ring1.ReportFree(map[address.Address]address.Count{start: 10})
 	assertPeersWithSpace(t, ring1, start, end, 0)
 
 	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 1},
@@ -394,14 +480,14 @@ func TestFindFree(t *testing.T) {
 }
 
 func TestReportFree(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)
 
 	ring1.ClaimItAll()
 	ring1.GrantRangeToHost(middle, end, peer2name)
-	require.NoError(t, ring2.Merge(*ring1))
+	require.NoError(t, merge(ring2, ring1))
 
-	freespace := make(map[address.Address]address.Offset)
+	freespace := make(map[address.Address]address.Count)
 	for _, r := range ring2.OwnedRanges() {
 		freespace[r.Start] = 0
 	}
@@ -409,7 +495,7 @@ func TestReportFree(t *testing.T) {
 }
 
 func TestMisc(t *testing.T) {
-	ring := New(start, end, peer1name)
+	ring := NewRing(start, end, peer1name)
 
 	require.True(t, ring.Empty(), "empty")
 
@@ -418,38 +504,38 @@ func TestMisc(t *testing.T) {
 }
 
 func TestEmptyGossip(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)
 
 	ring1.ClaimItAll()
 	// This used to panic, and it shouldn't
-	require.NoError(t, ring1.Merge(*ring2))
+	require.NoError(t, merge(ring1, ring2))
 }
 
 func TestMergeOldMessage(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)
 
 	ring1.ClaimItAll()
-	require.NoError(t, ring2.Merge(*ring1))
+	require.NoError(t, merge(ring2, ring1))
 
 	ring1.GrantRangeToHost(middle, end, peer1name)
-	require.NoError(t, ring1.Merge(*ring2))
+	require.NoError(t, merge(ring1, ring2))
 }
 
 func TestSplitRangeAtBeginning(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)
 
 	ring1.ClaimItAll()
-	require.NoError(t, ring2.Merge(*ring1))
+	require.NoError(t, merge(ring2, ring1))
 
 	ring1.GrantRangeToHost(start, middle, peer2name)
-	require.NoError(t, ring2.Merge(*ring1))
+	require.NoError(t, merge(ring2, ring1))
 }
 
 func TestOwnedRange(t *testing.T) {
-	ring1 := New(start, end, peer1name)
+	ring1 := NewRing(start, end, peer1name)
 	ring1.ClaimItAll()
 
 	require.Equal(t, []address.Range{{Start: start, End: end}}, ring1.OwnedRanges())
@@ -457,8 +543,8 @@ func TestOwnedRange(t *testing.T) {
 	ring1.GrantRangeToHost(middle, end, peer2name)
 	require.Equal(t, []address.Range{{Start: start, End: middle}}, ring1.OwnedRanges())
 
-	ring2 := New(start, end, peer2name)
-	ring2.Merge(*ring1)
+	ring2 := NewRing(start, end, peer2name)
+	merge(ring2, ring1)
 	require.Equal(t, []address.Range{{Start: middle, End: end}}, ring2.OwnedRanges())
 
 	ring2.Entries = []*entry{{Token: middle, Peer: peer2name}}
@@ -472,24 +558,24 @@ func TestOwnedRange(t *testing.T) {
 
 func TestTransfer(t *testing.T) {
 	// First test just checks if we can grant some range to a host, when we transfer it, we get it back
-	ring1 := New(start, end, peer1name)
+	ring1 := NewRing(start, end, peer1name)
 	ring1.ClaimItAll()
 	ring1.GrantRangeToHost(middle, end, peer2name)
 	ring1.Transfer(peer2name, peer1name)
-	require.Equal(t, []address.Range{{start, middle}, {middle, end}}, ring1.OwnedRanges())
+	require.Equal(t, []address.Range{{Start: start, End: middle}, {Start: middle, End: end}}, ring1.OwnedRanges())
 
 	// Second test is what happens when a token exists at the end of a range but is transferred
 	// - does it get resurrected correctly?
-	ring1 = New(start, end, peer1name)
+	ring1 = NewRing(start, end, peer1name)
 	ring1.ClaimItAll()
 	ring1.GrantRangeToHost(middle, end, peer2name)
 	ring1.Transfer(peer2name, peer1name)
 	ring1.GrantRangeToHost(dot10, middle, peer2name)
-	require.Equal(t, []address.Range{{start, dot10}, {middle, end}}, ring1.OwnedRanges())
+	require.Equal(t, []address.Range{{Start: start, End: dot10}, {Start: middle, End: end}}, ring1.OwnedRanges())
 }
 
 func TestOwner(t *testing.T) {
-	ring1 := New(start, end, peer1name)
+	ring1 := NewRing(start, end, peer1name)
 	require.True(t, ring1.Contains(start), "start should be in ring")
 	require.False(t, ring1.Contains(end), "end should not be in ring")
 
@@ -505,6 +591,36 @@ func TestOwner(t *testing.T) {
 
 }
 
+func makePeerName(i int) mesh.PeerName {
+	if i >= 10000 {
+		panic("makePeerName: invalid value")
+	}
+	peer, _ := mesh.PeerNameFromString(fmt.Sprintf("%02d:%02d:00:00:00:ff", i/100, i%100))
+	return peer
+}
+
+func makePeers(numPeers int) []mesh.PeerName {
+	peers := make([]mesh.PeerName, numPeers)
+	for i := 0; i < numPeers; i++ {
+		peers[i] = makePeerName(i)
+	}
+	return peers
+}
+
+func TestClaimForPeers(t *testing.T) {
+	const numPeers = 12
+	// Different end to usual so we get a number of addresses that a)
+	// is smaller than the max number of peers, and b) is divisible by
+	// some number of peers. This maximises coverage of edge cases.
+	end := dot8
+	peers := makePeers(numPeers)
+	// Test for a range of peer counts
+	for i := 0; i < numPeers; i++ {
+		ring := NewRing(start, end, peers[0])
+		ring.ClaimForPeers(peers[:i+1])
+	}
+}
+
 type addressSlice []address.Address
 
 func (s addressSlice) Len() int           { return len(s) }
@@ -519,8 +635,7 @@ func TestFuzzRing(t *testing.T) {
 
 	peers := make([]mesh.PeerName, numPeers)
 	for i := 0; i < numPeers; i++ {
-		peer, _ := mesh.PeerNameFromString(fmt.Sprintf("%02d:00:00:00:02:00", i))
-		peers[i] = peer
+		peers[i] = makePeerName(i)
 	}
 
 	// Make a valid, random ring
@@ -539,7 +654,7 @@ func TestFuzzRing(t *testing.T) {
 		sort.Sort(addressSlice(tokens))
 
 		peer := peers[rand.Intn(len(peers))]
-		ring := New(start, end, peer)
+		ring := NewRing(start, end, peer)
 		for _, token := range tokens {
 			peer = peers[rand.Intn(len(peers))]
 			ring.Entries = append(ring.Entries, &entry{Token: start + token, Peer: peer})
@@ -556,7 +671,7 @@ func TestFuzzRing(t *testing.T) {
 
 		// Merge them - this might fail, we don't care
 		// We just want to make sure it doesn't panic
-		ring1.Merge(*ring2)
+		merge(ring1, ring2)
 
 		// Check whats left still passes assertions
 		ring1.assertInvariants()
@@ -573,7 +688,7 @@ func TestFuzzRing(t *testing.T) {
 		}
 
 		peer := peers[rand.Intn(len(peers))]
-		ring := New(start, end, peer)
+		ring := NewRing(start, end, peer)
 		for _, token := range tokens {
 			peer = peers[rand.Intn(len(peers))]
 			ring.Entries = append(ring.Entries, &entry{Token: start + token, Peer: peer})
@@ -589,7 +704,7 @@ func TestFuzzRing(t *testing.T) {
 
 		// Merge them - this might fail, we don't care
 		// We just want to make sure it doesn't panic
-		ring1.Merge(*ring2)
+		merge(ring1, ring2)
 
 		// Check whats left still passes assertions
 		ring1.assertInvariants()
@@ -607,11 +722,11 @@ func TestFuzzRingHard(t *testing.T) {
 	)
 
 	addPeer := func() {
-		peer, _ := mesh.PeerNameFromString(fmt.Sprintf("%02d:%02d:00:00:00:00", nextPeerID/10, nextPeerID%10))
+		peer := makePeerName(nextPeerID)
 		common.Log.Debugf("%s: Adding peer", peer)
 		nextPeerID++
 		peers = append(peers, peer)
-		rings = append(rings, New(start, end, peer))
+		rings = append(rings, NewRing(start, end, peer))
 	}
 
 	for i := 0; i < numPeers; i++ {
@@ -650,7 +765,7 @@ func TestFuzzRingHard(t *testing.T) {
 
 		// We need to be in a ~converged ring to rmpeer
 		for _, ring := range rings {
-			require.NoError(t, otherRing.Merge(*ring))
+			require.NoError(t, merge(otherRing, ring))
 		}
 
 		common.Log.Debugf("%s: transferring from peer %s", otherPeername, peername)
@@ -664,7 +779,7 @@ func TestFuzzRingHard(t *testing.T) {
 		// And now tell everyone about the transfer - rmpeer is
 		// not partition safe
 		for i, ring := range rings {
-			require.NoError(t, ring.Merge(*otherRing))
+			require.NoError(t, merge(ring, otherRing))
 			theRanges[i] = ring.OwnedRanges()
 		}
 	}
@@ -693,7 +808,7 @@ func TestFuzzRingHard(t *testing.T) {
 			// Now 'gossip' this to a random host (note, note could be same host as above)
 			otherIndex, _, otherRing := randomPeer(-1)
 			common.Log.Debugf("%s: 'Gossiping' to %s", ring.Peer, otherRing.Peer)
-			require.NoError(t, otherRing.Merge(*ring))
+			require.NoError(t, merge(otherRing, ring))
 
 			theRanges[indexWithRanges] = ring.OwnedRanges()
 			theRanges[otherIndex] = otherRing.OwnedRanges()
@@ -712,7 +827,7 @@ func TestFuzzRingHard(t *testing.T) {
 		ring1 := ringsWithEntries[rand.Intn(len(ringsWithEntries))]
 		ring2index, _, ring2 := randomPeer(-1)
 		common.Log.Debugf("%s: 'Gossiping' to %s", ring1.Peer, ring2.Peer)
-		require.NoError(t, ring2.Merge(*ring1))
+		require.NoError(t, merge(ring2, ring1))
 		theRanges[ring2index] = ring2.OwnedRanges()
 	}
 

ipam/space/space.go

@@ -31,8 +31,8 @@ func (s *Space) Add(start address.Address, size address.Offset) {
 
 // Clear removes all spaces from this space set.  Used during node shutdown.
 func (s *Space) Clear() {
-	s.free = s.free[:0]
 	s.ours = s.ours[:0]
+	s.free = s.free[:0]
 }
 
 // Walk down the free list calling f() on the in-range portions, until
@@ -88,8 +88,24 @@ func (s *Space) Claim(addr address.Address) error {
 	return nil
 }
 
-func (s *Space) NumFreeAddressesInRange(r address.Range) address.Offset {
-	res := address.Offset(0)
+func (s *Space) NumOwnedAddresses() address.Count {
+	res := address.Count(0)
+	for i := 0; i < len(s.ours); i += 2 {
+		res += address.Length(s.ours[i+1], s.ours[i])
+	}
+	return res
+}
+
+func (s *Space) NumFreeAddresses() address.Count {
+	res := address.Count(0)
+	for i := 0; i < len(s.free); i += 2 {
+		res += address.Length(s.free[i+1], s.free[i])
+	}
+	return res
+}
+
+func (s *Space) NumFreeAddressesInRange(r address.Range) address.Count {
+	res := address.Count(0)
 	s.walkFree(r, func(chunk address.Range) bool {
 		res += chunk.Size()
 		return false
@@ -111,11 +127,14 @@ func (s *Space) Free(addr address.Address) error {
 }
 
 func (s *Space) biggestFreeRange(r address.Range) (biggest address.Range) {
-	biggestSize := address.Offset(0)
+	biggestSize := address.Count(0)
 	s.walkFree(r, func(chunk address.Range) bool {
 		if size := chunk.Size(); size >= biggestSize {
-			biggest = chunk
-			biggestSize = size
+			chunk = chunk.BiggestCIDRRange()
+			if size = chunk.Size(); size >= biggestSize {
+				biggest = chunk
+				biggestSize = size
+			}
 		}
 		return false
 	})
@@ -129,9 +148,12 @@ func (s *Space) Donate(r address.Range) (address.Range, bool) {
 		return address.Range{}, false
 	}
 
-	// Donate half of that biggest free range. Note size/2 rounds down, so
-	// the resulting donation size rounds up, and in particular can't be empty.
-	biggest.Start = address.Add(biggest.Start, biggest.Size()/2)
+	// Donate no more than half what we have available
+	if biggest.Size() > s.NumFreeAddressesInRange(r)/2 {
+		// Note size/2 rounds down, so the resulting donation size
+		// rounds up, and in particular can't be empty.
+		biggest.Start = address.Add(biggest.Start, address.Offset(biggest.Size()/2))
+	}
 
 	s.ours = subtract(s.ours, biggest.Start, biggest.End)
 	s.free = subtract(s.free, biggest.Start, biggest.End)

ipam/space/space_test.go

@@ -19,16 +19,6 @@ func ip(s string) address.Address {
 	return addr
 }
 
-// Helper function to avoid 'NumFreeAddressesInRange(start, end)'
-// dozens of times in tests
-func (s *Space) NumFreeAddresses() address.Offset {
-	res := address.Offset(0)
-	for i := 0; i < len(s.free); i += 2 {
-		res += address.Subtract(s.free[i+1], s.free[i])
-	}
-	return res
-}
-
 func TestLowlevel(t *testing.T) {
 	a := []address.Address{}
 	a = add(a, 100, 200)
@@ -61,35 +51,37 @@ func TestLowlevel(t *testing.T) {
 	require.Equal(t, []address.Address{}, a)
 
 	s := New()
-	require.Equal(t, address.Offset(0), s.NumFreeAddresses())
-	ok, got := s.Allocate(address.NewRange(0, 1000))
+	require.Equal(t, address.Count(0), s.NumFreeAddresses())
+	ok, _ := s.Allocate(address.NewRange(0, 1000))
 	require.False(t, ok, "allocate in empty space should fail")
 
 	s.Add(100, 100)
-	require.Equal(t, address.Offset(100), s.NumFreeAddresses())
-	ok, got = s.Allocate(address.NewRange(0, 1000))
+	require.Equal(t, address.Count(100), s.NumFreeAddresses())
+	ok, got := s.Allocate(address.NewRange(0, 1000))
 	require.True(t, ok && got == 100, "allocate")
-	require.Equal(t, address.Offset(99), s.NumFreeAddresses())
+	require.Equal(t, address.Count(99), s.NumFreeAddresses())
 	require.NoError(t, s.Claim(150))
-	require.Equal(t, address.Offset(98), s.NumFreeAddresses())
+	require.Equal(t, address.Count(98), s.NumFreeAddresses())
 	require.NoError(t, s.Free(100))
-	require.Equal(t, address.Offset(99), s.NumFreeAddresses())
+	require.Equal(t, address.Count(99), s.NumFreeAddresses())
 	wt.AssertErrorInterface(t, (*error)(nil), s.Free(0), "free not allocated")
 	wt.AssertErrorInterface(t, (*error)(nil), s.Free(100), "double free")
 
 	r, ok := s.Donate(address.NewRange(0, 1000))
-	require.True(t, ok && r.Start == 125 && r.Size() == 25, "donate")
+	require.True(t, ok, "donate")
+	require.Equal(t, address.NewRange(0xa0, 0x20), r, "donate")
 
 	// test Donate when addresses are scarce
 	s = New()
-	r, ok = s.Donate(address.NewRange(0, 1000))
+	_, ok = s.Donate(address.NewRange(0, 1000))
 	require.True(t, !ok, "donate on empty space should fail")
 	s.Add(0, 3)
 	require.NoError(t, s.Claim(0))
 	require.NoError(t, s.Claim(2))
 	r, ok = s.Donate(address.NewRange(0, 1000))
-	require.True(t, ok && r.Start == 1 && r.End == 2, "donate")
-	r, ok = s.Donate(address.NewRange(0, 1000))
+	require.True(t, ok, "donate")
+	require.Equal(t, address.NewRange(1, 1), r, "donate")
+	_, ok = s.Donate(address.NewRange(0, 1000))
 	require.True(t, !ok, "donate should fail")
 }
 
@@ -107,19 +99,22 @@ func TestSpaceAllocate(t *testing.T) {
 	)
 
 	space1 := makeSpace(start, size)
-	require.Equal(t, address.Offset(20), space1.NumFreeAddresses())
+	require.Equal(t, address.Count(20), space1.NumFreeAddresses())
+	require.Equal(t, address.Count(0), space1.NumOwnedAddresses())
 	space1.assertInvariants()
 
 	_, addr1 := space1.Allocate(address.NewRange(start, size))
 	require.Equal(t, testAddr1, addr1.String(), "address")
-	require.Equal(t, address.Offset(19), space1.NumFreeAddresses())
+	require.Equal(t, address.Count(19), space1.NumFreeAddresses())
+	require.Equal(t, address.Count(1), space1.NumOwnedAddresses())
 	space1.assertInvariants()
 
 	_, addr2 := space1.Allocate(address.NewRange(start, size))
 	require.False(t, addr2.String() == testAddr1, "address")
-	require.Equal(t, address.Offset(18), space1.NumFreeAddresses())
-	require.Equal(t, address.Offset(13), space1.NumFreeAddressesInRange(address.Range{Start: ip(testAddr1), End: ip(testAddrx)}))
-	require.Equal(t, address.Offset(18), space1.NumFreeAddressesInRange(address.Range{Start: ip(testAddr1), End: ip(testAddry)}))
+	require.Equal(t, address.Count(18), space1.NumFreeAddresses())
+	require.Equal(t, address.Count(2), space1.NumOwnedAddresses())
+	require.Equal(t, address.Count(13), space1.NumFreeAddressesInRange(address.Range{Start: ip(testAddr1), End: ip(testAddrx)}))
+	require.Equal(t, address.Count(18), space1.NumFreeAddressesInRange(address.Range{Start: ip(testAddr1), End: ip(testAddry)}))
 	space1.assertInvariants()
 
 	space1.Free(addr2)
@@ -134,20 +129,21 @@ func TestSpaceAllocate(t *testing.T) {
 
 func TestSpaceFree(t *testing.T) {
 	const (
-		testAddr1   = "10.0.3.4"
+		testAddr1   = "10.0.3.16"
 		testAddrx   = "10.0.3.19"
 		testAddry   = "10.0.9.19"
 		containerID = "deadbeef"
+		size        = 16
 	)
 
-	entireRange := address.NewRange(ip(testAddr1), 20)
-	space := makeSpace(ip(testAddr1), 20)
+	entireRange := address.NewRange(ip(testAddr1), size)
+	space := makeSpace(ip(testAddr1), size)
 
 	// Check we are prepared to give up the entire space
 	r := space.biggestFreeRange(entireRange)
-	require.True(t, r.Start == ip(testAddr1) && r.Size() == 20, "Wrong space")
+	require.Equal(t, address.NewRange(ip(testAddr1), size), r, "Wrong space")
 
-	for i := 0; i < 20; i++ {
+	for i := 0; i < size; i++ {
 		ok, _ := space.Allocate(entireRange)
 		require.True(t, ok, "Failed to get address")
 	}
@@ -155,48 +151,48 @@ func TestSpaceFree(t *testing.T) {
 	// Check we are full
 	ok, _ := space.Allocate(entireRange)
 	require.True(t, !ok, "Should have failed to get address")
-	r, ok = space.Donate(entireRange)
+	r, _ = space.Donate(entireRange)
 	require.True(t, r.Size() == 0, "Wrong space")
 
 	// Free in the middle
-	require.NoError(t, space.Free(ip("10.0.3.13")))
-	r = space.biggestFreeRange(entireRange)
-	require.True(t, r.Start == ip("10.0.3.13") && r.Size() == 1, "Wrong space")
-
-	// Free one at the end
 	require.NoError(t, space.Free(ip("10.0.3.23")))
 	r = space.biggestFreeRange(entireRange)
 	require.True(t, r.Start == ip("10.0.3.23") && r.Size() == 1, "Wrong space")
 
+	// Free one at the end
+	require.NoError(t, space.Free(ip("10.0.3.31")))
+	r = space.biggestFreeRange(entireRange)
+	require.True(t, r.Start == ip("10.0.3.31") && r.Size() == 1, "Wrong space")
+
 	// Now free a few at the end
+	require.NoError(t, space.Free(ip("10.0.3.30")))
+	require.NoError(t, space.Free(ip("10.0.3.29")))
+
+	require.Equal(t, address.Count(4), space.NumFreeAddresses())
+
+	// Now get the biggest free space; should be 3.30
+	r = space.biggestFreeRange(entireRange)
+	require.Equal(t, address.NewRange(ip("10.0.3.30"), 2), r, "Wrong space")
+
+	// Now free a few in the middle
+	require.NoError(t, space.Free(ip("10.0.3.24")))
 	require.NoError(t, space.Free(ip("10.0.3.22")))
 	require.NoError(t, space.Free(ip("10.0.3.21")))
 
-	require.Equal(t, address.Offset(4), space.NumFreeAddresses())
+	require.Equal(t, address.Count(7), space.NumFreeAddresses())
 
-	// Now get the biggest free space; should be 3.21
+	// Now get the biggest free space; should be 3.30
 	r = space.biggestFreeRange(entireRange)
-	require.True(t, r.Start == ip("10.0.3.21") && r.Size() == 3, "Wrong space")
+	require.Equal(t, address.NewRange(ip("10.0.3.30"), 2), r, "Wrong space")
 
-	// Now free a few in the middle
-	require.NoError(t, space.Free(ip("10.0.3.12")))
-	require.NoError(t, space.Free(ip("10.0.3.11")))
-	require.NoError(t, space.Free(ip("10.0.3.10")))
-
-	require.Equal(t, address.Offset(7), space.NumFreeAddresses())
-
-	// Now get the biggest free space; should be 3.21
-	r = space.biggestFreeRange(entireRange)
-	require.True(t, r.Start == ip("10.0.3.10") && r.Size() == 4, "Wrong space")
-
-	require.Equal(t, []address.Range{{Start: ip("10.0.3.4"), End: ip("10.0.3.24")}}, space.OwnedRanges())
+	require.Equal(t, []address.Range{{Start: ip("10.0.3.16"), End: ip("10.0.3.32")}}, space.OwnedRanges())
 }
 
 func TestDonateSimple(t *testing.T) {
 	const (
 		testAddr1 = "10.0.1.0"
 		testAddr2 = "10.0.1.32"
-		size      = 48
+		size      = 64
 	)
 
 	var (
@@ -209,9 +205,9 @@ func TestDonateSimple(t *testing.T) {
 	r, ok := ps1.Donate(address.NewRange(ip(testAddr1), size))
 	numGivenUp := r.Size()
 	require.True(t, ok, "Donate result")
-	require.Equal(t, "10.0.1.24", r.Start.String(), "Invalid start")
-	require.Equal(t, address.Offset(size/2), numGivenUp)
-	require.Equal(t, address.Offset(size/2), ps1.NumFreeAddresses())
+	require.Equal(t, "10.0.1.32", r.Start.String(), "Invalid start")
+	require.Equal(t, address.Count(size/2), numGivenUp)
+	require.Equal(t, address.Count(size/2), ps1.NumFreeAddresses())
 
 	// Now check we can give the rest up.
 	count := 0 // count to avoid infinite loop
@@ -222,8 +218,8 @@ func TestDonateSimple(t *testing.T) {
 		}
 		numGivenUp += r.Size()
 	}
-	require.Equal(t, address.Offset(0), ps1.NumFreeAddresses())
-	require.Equal(t, address.Offset(size), numGivenUp)
+	require.Equal(t, address.Count(0), ps1.NumFreeAddresses())
+	require.Equal(t, address.Count(size), numGivenUp)
 }
 
 func TestDonateHard(t *testing.T) {
@@ -240,7 +236,7 @@ func TestDonateHard(t *testing.T) {
 		require.True(t, ok, "Failed to get IP!")
 	}
 
-	require.Equal(t, address.Offset(0), spaceset.NumFreeAddresses())
+	require.Equal(t, address.Count(0), spaceset.NumFreeAddresses())
 
 	// Now free all but the last address
 	// this will force us to split the free list
@@ -251,13 +247,13 @@ func TestDonateHard(t *testing.T) {
 	// Now split
 	newRange, ok := spaceset.Donate(address.NewRange(start, size))
 	require.True(t, ok, "GiveUpSpace result")
-	require.Equal(t, ip("10.0.1.23"), newRange.Start)
-	require.Equal(t, address.Offset(24), newRange.Size())
-	require.Equal(t, address.Offset(23), spaceset.NumFreeAddresses())
+	require.Equal(t, address.NewRange(ip("10.0.1.16"), 16), newRange, "Wrong space")
+	require.Equal(t, address.Count(31), spaceset.NumFreeAddresses())
 
-	//Space set should now have 2 spaces
-	expected := New()
-	expected.Add(start, 23)
-	expected.ours = add(nil, ip("10.0.1.47"), ip("10.0.1.48"))
+	//Space set should now have 3 spaces
+	expected := &Space{
+		ours: add(nil, ip("10.0.1.47"), ip("10.0.1.48")),
+		free: add(add(nil, ip("10.0.1.0"), ip("10.0.1.16")), ip("10.0.1.32"), ip("10.0.1.47")),
+	}
 	require.Equal(t, expected, spaceset)
 }

ipam/status.go

@@ -1,6 +1,7 @@
 package ipam
 
 import (
+	"fmt"
 	"github.com/weaveworks/weave/ipam/paxos"
 	"github.com/weaveworks/weave/net/address"
 )
@@ -8,6 +9,8 @@ import (
 type Status struct {
 	Paxos            *paxos.Status
 	Range            string
+	RangeNumIPs      int
+	ActiveIPs        int
 	DefaultSubnet    string
 	Entries          []EntryStatus
 	PendingClaims    []ClaimStatus
@@ -15,14 +18,17 @@ type Status struct {
 }
 
 type EntryStatus struct {
-	Token   string
-	Peer    string
-	Version uint32
+	Token       string
+	Size        uint32
+	Peer        string
+	Nickname    string
+	IsKnownPeer bool
+	Version     uint32
 }
 
 type ClaimStatus struct {
-	Ident   string
-	Address address.Address
+	Ident string
+	CIDR  address.CIDR
 }
 
 func NewStatus(allocator *Allocator, defaultSubnet address.CIDR) *Status {
@@ -31,8 +37,14 @@ func NewStatus(allocator *Allocator, defaultSubnet address.CIDR) *Status {
 	}
 
 	var paxosStatus *paxos.Status
-	if allocator.paxosTicker != nil {
-		paxosStatus = paxos.NewStatus(allocator.paxos)
+	if allocator.awaitingConsensus && allocator.paxos != nil {
+		if allocator.paxos.IsElector() {
+			if node, ok := allocator.paxos.(*paxos.Node); ok {
+				paxosStatus = paxos.NewStatus(node)
+			}
+		} else {
+			paxosStatus = &paxos.Status{Elector: false}
+		}
 	}
 
 	resultChan := make(chan *Status)
@@ -40,6 +52,8 @@ func NewStatus(allocator *Allocator, defaultSubnet address.CIDR) *Status {
 		resultChan <- &Status{
 			paxosStatus,
 			allocator.universe.String(),
+			int(allocator.universe.Size()),
+			int(allocator.space.NumOwnedAddresses()),
 			defaultSubnet.String(),
 			newEntryStatusSlice(allocator),
 			newClaimStatusSlice(allocator),
@@ -56,8 +70,15 @@ func newEntryStatusSlice(allocator *Allocator) []EntryStatus {
 		return slice
 	}
 
-	for _, entry := range allocator.ring.Entries {
-		slice = append(slice, EntryStatus{entry.Token.String(), entry.Peer.String(), entry.Version})
+	for _, r := range allocator.ring.AllRangeInfo() {
+		slice = append(slice, EntryStatus{
+			Token:       r.Start.String(),
+			Size:        uint32(r.Size()),
+			Peer:        r.Peer.String(),
+			Nickname:    allocator.nicknames[r.Peer],
+			IsKnownPeer: allocator.isKnownPeer(r.Peer),
+			Version:     r.Version,
+		})
 	}
 
 	return slice
@@ -67,7 +88,7 @@ func newClaimStatusSlice(allocator *Allocator) []ClaimStatus {
 	var slice []ClaimStatus
 	for _, op := range allocator.pendingClaims {
 		claim := op.(*claim)
-		slice = append(slice, ClaimStatus{claim.ident, claim.addr})
+		slice = append(slice, ClaimStatus{claim.ident, claim.cidr})
 	}
 	return slice
 }
@@ -76,7 +97,7 @@ func newAllocateIdentSlice(allocator *Allocator) []string {
 	var slice []string
 	for _, op := range allocator.pendingAllocates {
 		allocate := op.(*allocate)
-		slice = append(slice, allocate.ident)
+		slice = append(slice, fmt.Sprintf("%s %s", allocate.ident, allocate.r.String()))
 	}
 	return slice
 }

ipam/testutils_test.go

@@ -7,8 +7,9 @@ import (
 	"testing"
 	"time"
 
+	"github.com/weaveworks/mesh"
+
 	"github.com/stretchr/testify/require"
-	"github.com/weaveworks/weave/mesh"
 	"github.com/weaveworks/weave/net/address"
 	"github.com/weaveworks/weave/testing/gossip"
 )
@@ -23,14 +24,6 @@ func (m *mockMessage) String() string {
 	return fmt.Sprintf("-> %s [%x]", m.dst, m.buf)
 }
 
-func toStringArray(messages []mockMessage) []string {
-	out := make([]string, len(messages))
-	for i := range out {
-		out[i] = messages[i].String()
-	}
-	return out
-}
-
 type mockGossipComms struct {
 	sync.RWMutex
 	*testing.T
@@ -48,7 +41,7 @@ func (m *mockGossipComms) String() string {
 // that the contents of messages are never re-ordered.  Which, for instance,
 // requires they are not based off iterating through a map.
 
-func (m *mockGossipComms) GossipBroadcast(update mesh.GossipData) error {
+func (m *mockGossipComms) GossipBroadcast(update mesh.GossipData) {
 	m.Lock()
 	defer m.Unlock()
 	buf := []byte{}
@@ -62,9 +55,11 @@ func (m *mockGossipComms) GossipBroadcast(update mesh.GossipData) error {
 		// Swallow this message
 		m.messages = m.messages[1:]
 	}
-	return nil
 }
 
+func (m *mockGossipComms) GossipNeighbourSubset(update mesh.GossipData) {
+	m.GossipBroadcast(update)
+}
 func equalByteBuffer(a, b []byte) bool {
 	if len(a) != len(b) {
 		return false
@@ -97,14 +92,6 @@ func (m *mockGossipComms) GossipUnicast(dstPeerName mesh.PeerName, buf []byte) e
 	return nil
 }
 
-func ExpectMessage(alloc *Allocator, dst string, msgType byte, buf []byte) {
-	m := alloc.gossip.(*mockGossipComms)
-	dstPeerName, _ := mesh.PeerNameFromString(dst)
-	m.Lock()
-	m.messages = append(m.messages, mockMessage{dstPeerName, msgType, buf})
-	m.Unlock()
-}
-
 func ExpectBroadcastMessage(alloc *Allocator, buf []byte) {
 	m := alloc.gossip.(*mockGossipComms)
 	m.Lock()
@@ -117,30 +104,42 @@ func CheckAllExpectedMessagesSent(allocs ...*Allocator) {
 		m := alloc.gossip.(*mockGossipComms)
 		m.RLock()
 		if len(m.messages) > 0 {
-			require.FailNow(m, fmt.Sprintf("%s: Gossip message(s) not sent as expected: \n%x", m.name, m.messages))
+			require.FailNow(m, fmt.Sprintf("%s: Gossip message(s) not sent as expected: \n%v", m.name, m.messages))
 		}
 		m.RUnlock()
 	}
 }
 
-func makeAllocator(name string, cidrStr string, quorum uint) (*Allocator, address.Range) {
+type mockDB struct{}
+
+func (d *mockDB) Load(_ string, _ interface{}) (bool, error) { return false, nil }
+func (d *mockDB) Save(_ string, _ interface{}) error         { return nil }
+
+func makeAllocator(name string, cidrStr string, quorum uint, preClaims ...PreClaim) (*Allocator, address.CIDR) {
 	peername, err := mesh.PeerNameFromString(name)
 	if err != nil {
 		panic(err)
 	}
 
-	_, cidr, err := address.ParseCIDR(cidrStr)
+	cidr, err := address.ParseCIDR(cidrStr)
 	if err != nil {
 		panic(err)
 	}
 
-	alloc := NewAllocator(peername, mesh.PeerUID(rand.Int63()),
-		"nick-"+name, cidr.Range(), quorum, func(mesh.PeerName) bool { return true })
-
-	return alloc, cidr.HostRange()
+	return NewAllocator(Config{
+		OurName:     peername,
+		OurUID:      mesh.PeerUID(rand.Int63()),
+		OurNickname: "nick-" + name,
+		Universe:    cidr,
+		IsObserver:  quorum == 0,
+		PreClaims:   preClaims,
+		Quorum:      func() uint { return quorum },
+		Db:          new(mockDB),
+		IsKnownPeer: func(mesh.PeerName) bool { return true },
+	}), cidr
 }
 
-func makeAllocatorWithMockGossip(t *testing.T, name string, universeCIDR string, quorum uint) (*Allocator, address.Range) {
+func makeAllocatorWithMockGossip(t *testing.T, name string, universeCIDR string, quorum uint) (*Allocator, address.CIDR) {
 	alloc, subnet := makeAllocator(name, universeCIDR, quorum)
 	gossip := &mockGossipComms{T: t, name: name}
 	alloc.SetInterfaces(gossip)
@@ -157,14 +156,22 @@ func (alloc *Allocator) claimRingForTesting(allocs ...*Allocator) {
 	alloc.space.AddRanges(alloc.ring.OwnedRanges())
 }
 
-func (alloc *Allocator) NumFreeAddresses(r address.Range) address.Offset {
-	resultChan := make(chan address.Offset)
+func (alloc *Allocator) NumFreeAddresses(r address.Range) address.Count {
+	resultChan := make(chan address.Count)
 	alloc.actionChan <- func() {
 		resultChan <- alloc.space.NumFreeAddressesInRange(r)
 	}
 	return <-resultChan
 }
 
+func (alloc *Allocator) OwnedRanges() (result []address.Range) {
+	resultChan := make(chan []address.Range)
+	alloc.actionChan <- func() {
+		resultChan <- alloc.ring.OwnedRanges()
+	}
+	return <-resultChan
+}
+
 // Check whether or not something was sent on a channel
 func AssertSent(t *testing.T, ch <-chan bool) {
 	timeout := time.After(10 * time.Second)
@@ -185,24 +192,19 @@ func AssertNothingSent(t *testing.T, ch <-chan bool) {
 	}
 }
 
-func AssertNothingSentErr(t *testing.T, ch <-chan error) {
-	select {
-	case val := <-ch:
-		require.FailNow(t, fmt.Sprintf("Unexpected value on channel: %v", val))
-	default:
-		// no message received
-	}
-}
-
-func makeNetworkOfAllocators(size int, cidr string) ([]*Allocator, *gossip.TestRouter, address.Range) {
+func makeNetworkOfAllocators(size int, cidr string, preClaims ...[]PreClaim) ([]*Allocator, *gossip.TestRouter, address.CIDR) {
 	gossipRouter := gossip.NewTestRouter(0.0)
 	allocs := make([]*Allocator, size)
-	var subnet address.Range
+	var subnet address.CIDR
 
 	for i := 0; i < size; i++ {
 		var alloc *Allocator
+		preClaim := []PreClaim{}
+		if i < len(preClaims) {
+			preClaim = preClaims[i]
+		}
 		alloc, subnet = makeAllocator(fmt.Sprintf("%02d:00:00:02:00:00", i),
-			cidr, uint(size/2+1))
+			cidr, uint(size/2+1), preClaim...)
 		alloc.SetInterfaces(gossipRouter.Connect(alloc.ourName, alloc))
 		alloc.Start()
 		allocs[i] = alloc
@@ -213,7 +215,10 @@ func makeNetworkOfAllocators(size int, cidr string) ([]*Allocator, *gossip.TestR
 	return allocs, gossipRouter, subnet
 }
 
-func stopNetworkOfAllocators(allocs []*Allocator) {
+func stopNetworkOfAllocators(allocs []*Allocator, gossipRouter *gossip.TestRouter) {
+	// NB: We must stop the router first since ipam gossip makes
+	// synchronous calls into the allocator.
+	gossipRouter.Stop()
 	for _, alloc := range allocs {
 		alloc.Stop()
 	}

ipam/tracker/awsvpc.go

@@ -0,0 +1,247 @@
+package tracker
+
+// The AWSVPC tracker tracks the IPAM ring changes and accordingly updates
+// the AWS VPC route table and, if the announced change is local
+// (denoted by local=true) to the host, the host route table.
+//
+// During the initialization, the tracker detects AWS VPC route table id which
+// is associated with the host's subnet on the AWS network. If such a table does
+// not exist, the default VPC route table is used.
+//
+// When a host A donates a range to a host B, the necessary route table
+// updates (removal) happen on the host A first, and afterwards on
+// the host B (installation).
+//
+// NB: there is a hard limit for 50 routes within any VPC route table
+// (practically, it is 48, because one route is used by the AWS Internet GW and
+// one by the AWS host subnet), therefore it is suggested to avoid
+// an excessive fragmentation within the IPAM ring which might happen due to
+// the claim operations or uneven distribution of containers across the hosts.
+
+import (
+	"fmt"
+	"net"
+	"syscall"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/ec2metadata"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/vishvananda/netlink"
+
+	"github.com/weaveworks/weave/common"
+	"github.com/weaveworks/weave/net/address"
+)
+
+type AWSVPCTracker struct {
+	ec2          *ec2.EC2
+	instanceID   string // EC2 Instance ID
+	routeTableID string // VPC Route Table ID
+	linkIndex    int    // The weave bridge link index
+}
+
+// NewAWSVPCTracker creates and initialises AWS VPC based tracker.
+func NewAWSVPCTracker(bridgeName string) (*AWSVPCTracker, error) {
+	var (
+		err     error
+		session = session.New()
+		t       = &AWSVPCTracker{}
+	)
+
+	// Detect region and instance id
+	meta := ec2metadata.New(session)
+	t.instanceID, err = meta.GetMetadata("instance-id")
+	if err != nil {
+		return nil, fmt.Errorf("cannot detect instance-id: %s", err)
+	}
+	region, err := meta.Region()
+	if err != nil {
+		return nil, fmt.Errorf("cannot detect region: %s", err)
+	}
+
+	t.ec2 = ec2.New(session, aws.NewConfig().WithRegion(region))
+
+	routeTableID, err := t.detectRouteTableID()
+	if err != nil {
+		return nil, err
+	}
+	t.routeTableID = *routeTableID
+
+	// Detect Weave bridge link index
+	link, err := netlink.LinkByName(bridgeName)
+	if err != nil {
+		return nil, fmt.Errorf("cannot find \"%s\" interface: %s", bridgeName, err)
+	}
+	t.linkIndex = link.Attrs().Index
+
+	t.infof("AWSVPC has been initialized on %s instance for %s route table at %s region",
+		t.instanceID, t.routeTableID, region)
+
+	return t, nil
+}
+
+// HandleUpdate method updates the AWS VPC and the host route tables.
+func (t *AWSVPCTracker) HandleUpdate(prevRanges, currRanges []address.Range, local bool) error {
+	t.debugf("replacing %q by %q; local(%t)", prevRanges, currRanges, local)
+
+	prev, curr := address.RemoveCommon(address.NewCIDRs(address.Merge(prevRanges)), address.NewCIDRs(address.Merge(currRanges)))
+
+	// It might make sense to do the removal first and then add entries
+	// because of the 50 routes limit. However, in such case a container might
+	// not be reachable for a short period of time which is not a desired behavior.
+
+	// Add new entries
+	for _, cidr := range curr {
+		cidrStr := cidr.String()
+		t.debugf("adding route %s to %s", cidrStr, t.instanceID)
+		if _, err := t.createVPCRoute(cidrStr); err != nil {
+			return fmt.Errorf("createVPCRoutes failed: %s", err)
+		}
+		if local {
+			if err := t.createHostRoute(cidrStr); err != nil {
+				if errno, ok := err.(syscall.Errno); !(ok && errno == syscall.EEXIST) {
+					return fmt.Errorf("createHostRoute failed: %s", err)
+				}
+			}
+		}
+	}
+
+	// Remove obsolete entries
+	for _, cidr := range prev {
+		cidrStr := cidr.String()
+		t.debugf("removing %s route", cidrStr)
+		if _, err := t.deleteVPCRoute(cidrStr); err != nil {
+			return fmt.Errorf("deleteVPCRoute failed: %s", err)
+		}
+		if local {
+			if err := t.deleteHostRoute(cidrStr); err != nil {
+				return fmt.Errorf("deleteHostRoute failed: %s", err)
+			}
+		}
+	}
+
+	return nil
+}
+
+func (t *AWSVPCTracker) String() string {
+	return "awsvpc"
+}
+
+func (t *AWSVPCTracker) createVPCRoute(cidr string) (*ec2.CreateRouteOutput, error) {
+	route := &ec2.CreateRouteInput{
+		RouteTableId:         &t.routeTableID,
+		InstanceId:           &t.instanceID,
+		DestinationCidrBlock: &cidr,
+	}
+	return t.ec2.CreateRoute(route)
+}
+
+func (t *AWSVPCTracker) createHostRoute(cidr string) error {
+	dst, err := parseCIDR(cidr)
+	if err != nil {
+		return err
+	}
+	route := &netlink.Route{
+		LinkIndex: t.linkIndex,
+		Dst:       dst,
+		Scope:     netlink.SCOPE_LINK,
+	}
+	return netlink.RouteAdd(route)
+}
+
+func (t *AWSVPCTracker) deleteVPCRoute(cidr string) (*ec2.DeleteRouteOutput, error) {
+	route := &ec2.DeleteRouteInput{
+		RouteTableId:         &t.routeTableID,
+		DestinationCidrBlock: &cidr,
+	}
+	return t.ec2.DeleteRoute(route)
+}
+
+func (t *AWSVPCTracker) deleteHostRoute(cidr string) error {
+	dst, err := parseCIDR(cidr)
+	if err != nil {
+		return err
+	}
+	route := &netlink.Route{
+		LinkIndex: t.linkIndex,
+		Dst:       dst,
+		Scope:     netlink.SCOPE_LINK,
+	}
+	return netlink.RouteDel(route)
+}
+
+// detectRouteTableID detects AWS VPC Route Table ID of the given tracker instance.
+func (t *AWSVPCTracker) detectRouteTableID() (*string, error) {
+	instancesParams := &ec2.DescribeInstancesInput{
+		InstanceIds: []*string{aws.String(t.instanceID)},
+	}
+	instancesResp, err := t.ec2.DescribeInstances(instancesParams)
+	if err != nil {
+		return nil, fmt.Errorf("DescribeInstances failed: %s", err)
+	}
+	if len(instancesResp.Reservations) == 0 ||
+		len(instancesResp.Reservations[0].Instances) == 0 {
+		return nil, fmt.Errorf("cannot find %s instance within reservations", t.instanceID)
+	}
+	vpcID := instancesResp.Reservations[0].Instances[0].VpcId
+	subnetID := instancesResp.Reservations[0].Instances[0].SubnetId
+
+	// First try to find a routing table associated with the subnet of the instance
+	tablesParams := &ec2.DescribeRouteTablesInput{
+		Filters: []*ec2.Filter{
+			{
+				Name:   aws.String("association.subnet-id"),
+				Values: []*string{subnetID},
+			},
+		},
+	}
+	tablesResp, err := t.ec2.DescribeRouteTables(tablesParams)
+	if err != nil {
+		return nil, fmt.Errorf("DescribeRouteTables failed: %s", err)
+	}
+	if len(tablesResp.RouteTables) != 0 {
+		return tablesResp.RouteTables[0].RouteTableId, nil
+	}
+	// Fallback to the default routing table
+	tablesParams = &ec2.DescribeRouteTablesInput{
+		Filters: []*ec2.Filter{
+			{
+				Name:   aws.String("association.main"),
+				Values: []*string{aws.String("true")},
+			},
+			{
+				Name:   aws.String("vpc-id"),
+				Values: []*string{vpcID},
+			},
+		},
+	}
+	tablesResp, err = t.ec2.DescribeRouteTables(tablesParams)
+	if err != nil {
+		return nil, fmt.Errorf("DescribeRouteTables failed: %s", err)
+	}
+	if len(tablesResp.RouteTables) != 0 {
+		return tablesResp.RouteTables[0].RouteTableId, nil
+	}
+
+	return nil, fmt.Errorf("cannot find routetable for %s instance", t.instanceID)
+}
+
+func (t *AWSVPCTracker) debugf(fmt string, args ...interface{}) {
+	common.Log.Debugf("[tracker] "+fmt, args...)
+}
+
+func (t *AWSVPCTracker) infof(fmt string, args ...interface{}) {
+	common.Log.Infof("[tracker] "+fmt, args...)
+}
+
+// Helpers
+
+func parseCIDR(cidr string) (*net.IPNet, error) {
+	ip, ipnet, err := net.ParseCIDR(cidr)
+	if err != nil {
+		return nil, err
+	}
+	ipnet.IP = ip
+
+	return ipnet, nil
+}

ipam/tracker/tracker.go

@@ -0,0 +1,23 @@
+package tracker
+
+import (
+	"github.com/weaveworks/weave/net/address"
+)
+
+// LocalRangeTracker is an interface for tracking changes in the IPAM ring.
+type LocalRangeTracker interface {
+	// HandleUpdate is called whenever an address ring gets updated.
+	//
+	// prevRanges corresponds to ranges which were owned by a peer before
+	// a change in the ring, while currRanges to the ones which are currently
+	// owned by the peer.
+	// Both slices have to be sorted in increasing order.
+	// Adjacent ranges within each slice might appear as separate ranges.
+	//
+	// The local parameter indicates whether the ranges belong to the peer
+	// by which the method is called.
+	HandleUpdate(prevRanges, currRanges []address.Range, local bool) error
+
+	// String returns the tracker name
+	String() string
+}

mesh/connection.go

@@ -1,437 +0,0 @@
-package mesh
-
-import (
-	"fmt"
-	"net"
-	"strconv"
-	"sync"
-	"time"
-)
-
-type Connection interface {
-	Local() *Peer
-	Remote() *Peer
-	RemoteTCPAddr() string
-	Outbound() bool
-	Established() bool
-	BreakTie(Connection) ConnectionTieBreak
-	Shutdown(error)
-	Log(args ...interface{})
-}
-
-type ConnectionTieBreak int
-
-const (
-	TieBreakWon ConnectionTieBreak = iota
-	TieBreakLost
-	TieBreakTied
-)
-
-var ErrConnectToSelf = fmt.Errorf("Cannot connect to ourself")
-
-type RemoteConnection struct {
-	local         *Peer
-	remote        *Peer
-	remoteTCPAddr string
-	outbound      bool
-	established   bool
-}
-
-type LocalConnection struct {
-	sync.RWMutex
-	RemoteConnection
-	TCPConn      *net.TCPConn
-	version      byte
-	tcpSender    TCPSender
-	SessionKey   *[32]byte
-	heartbeatTCP *time.Ticker
-	Router       *Router
-	uid          uint64
-	actionChan   chan<- ConnectionAction
-	finished     <-chan struct{} // closed to signal that actorLoop has finished
-	OverlayConn  OverlayConnection
-}
-
-type ConnectionAction func() error
-
-func NewRemoteConnection(from, to *Peer, tcpAddr string, outbound bool, established bool) *RemoteConnection {
-	return &RemoteConnection{
-		local:         from,
-		remote:        to,
-		remoteTCPAddr: tcpAddr,
-		outbound:      outbound,
-		established:   established,
-	}
-}
-
-func (conn *RemoteConnection) Local() *Peer                           { return conn.local }
-func (conn *RemoteConnection) Remote() *Peer                          { return conn.remote }
-func (conn *RemoteConnection) RemoteTCPAddr() string                  { return conn.remoteTCPAddr }
-func (conn *RemoteConnection) Outbound() bool                         { return conn.outbound }
-func (conn *RemoteConnection) Established() bool                      { return conn.established }
-func (conn *RemoteConnection) BreakTie(Connection) ConnectionTieBreak { return TieBreakTied }
-func (conn *RemoteConnection) Shutdown(error)                         {}
-
-func (conn *RemoteConnection) Log(args ...interface{}) {
-	log.Println(append(append([]interface{}{}, fmt.Sprintf("->[%s|%s]:", conn.remoteTCPAddr, conn.remote)), args...)...)
-}
-
-func (conn *RemoteConnection) ErrorLog(args ...interface{}) {
-	log.Errorln(append(append([]interface{}{}, fmt.Sprintf("->[%s|%s]:", conn.remoteTCPAddr, conn.remote)), args...)...)
-}
-
-// Does not return anything. If the connection is successful, it will
-// end up in the local peer's connections map.
-func StartLocalConnection(connRemote *RemoteConnection, tcpConn *net.TCPConn, router *Router, acceptNewPeer bool) {
-	if connRemote.local != router.Ourself.Peer {
-		log.Fatal("Attempt to create local connection from a peer which is not ourself")
-	}
-	// NB, we're taking a copy of connRemote here.
-	actionChan := make(chan ConnectionAction, ChannelSize)
-	finished := make(chan struct{})
-	conn := &LocalConnection{
-		RemoteConnection: *connRemote,
-		Router:           router,
-		TCPConn:          tcpConn,
-		uid:              randUint64(),
-		actionChan:       actionChan,
-		finished:         finished}
-	go conn.run(actionChan, finished, acceptNewPeer)
-}
-
-func (conn *LocalConnection) BreakTie(dupConn Connection) ConnectionTieBreak {
-	dupConnLocal := dupConn.(*LocalConnection)
-	// conn.uid is used as the tie breaker here, in the knowledge that
-	// both sides will make the same decision.
-	if conn.uid < dupConnLocal.uid {
-		return TieBreakWon
-	} else if dupConnLocal.uid < conn.uid {
-		return TieBreakLost
-	} else {
-		return TieBreakTied
-	}
-}
-
-func (conn *LocalConnection) Established() bool {
-	return conn.established
-}
-
-// Send directly, not via the Actor.  If it goes via the Actor we can
-// get a deadlock where LocalConnection is blocked talking to
-// LocalPeer and LocalPeer is blocked trying send a ProtocolMsg via
-// LocalConnection, and the channels are full in both directions so
-// nothing can proceed.
-func (conn *LocalConnection) SendProtocolMsg(m ProtocolMsg) {
-	if err := conn.sendProtocolMsg(m); err != nil {
-		conn.Shutdown(err)
-	}
-}
-
-// ACTOR methods
-
-// NB: The conn.* fields are only written by the connection actor
-// process, which is the caller of the ConnectionAction funs. Hence we
-// do not need locks for reading, and only need write locks for fields
-// read by other processes.
-
-// Async
-func (conn *LocalConnection) Shutdown(err error) {
-	// err should always be a real error, even if only io.EOF
-	if err == nil {
-		panic("nil error")
-	}
-
-	// Run on its own goroutine in case the channel is backed up
-	go func() { conn.sendAction(func() error { return err }) }()
-}
-
-// Send an actor request to the actorLoop, but don't block if
-// actorLoop has exited - see http://blog.golang.org/pipelines for
-// pattern
-func (conn *LocalConnection) sendAction(action ConnectionAction) {
-	select {
-	case conn.actionChan <- action:
-	case <-conn.finished:
-	}
-}
-
-// ACTOR server
-
-func (conn *LocalConnection) run(actionChan <-chan ConnectionAction, finished chan<- struct{}, acceptNewPeer bool) {
-	var err error // important to use this var and not create another one with 'err :='
-	defer func() { conn.shutdown(err) }()
-	defer close(finished)
-
-	conn.TCPConn.SetLinger(0)
-	intro, err := ProtocolIntroParams{
-		MinVersion: conn.Router.ProtocolMinVersion,
-		MaxVersion: ProtocolMaxVersion,
-		Features:   conn.makeFeatures(),
-		Conn:       conn.TCPConn,
-		Password:   conn.Router.Password,
-		Outbound:   conn.outbound,
-	}.DoIntro()
-	if err != nil {
-		return
-	}
-
-	conn.SessionKey = intro.SessionKey
-	conn.tcpSender = intro.Sender
-	conn.version = intro.Version
-
-	remote, err := conn.parseFeatures(intro.Features)
-	if err != nil {
-		return
-	}
-
-	if err = conn.registerRemote(remote, acceptNewPeer); err != nil {
-		return
-	}
-
-	conn.Log("connection ready; using protocol version", conn.version)
-
-	params := OverlayConnectionParams{
-		RemotePeer:         conn.remote,
-		LocalAddr:          conn.TCPConn.LocalAddr().(*net.TCPAddr),
-		RemoteAddr:         conn.TCPConn.RemoteAddr().(*net.TCPAddr),
-		Outbound:           conn.outbound,
-		ConnUID:            conn.uid,
-		SessionKey:         conn.SessionKey,
-		SendControlMessage: conn.sendOverlayControlMessage,
-		Features:           intro.Features,
-	}
-	if conn.OverlayConn, err = conn.Router.Overlay.PrepareConnection(params); err != nil {
-		return
-	}
-
-	// As soon as we do AddConnection, the new connection becomes
-	// visible to the packet routing logic.  So AddConnection must
-	// come after PrepareConnection
-	if err = conn.Router.Ourself.AddConnection(conn); err != nil {
-		return
-	}
-	conn.Router.ConnectionMaker.ConnectionCreated(conn)
-
-	// OverlayConnection confirmation comes after AddConnection,
-	// because only after that completes do we know the connection is
-	// valid: in particular that it is not a duplicate connection to
-	// the same peer. Overlay communication on a duplicate connection
-	// can cause problems such as tripping up overlay crypto at the
-	// other end due to data being decoded by the other connection. It
-	// is also generally wasteful to engage in any interaction with
-	// the remote on a connection that turns out to be invalid.
-	conn.OverlayConn.Confirm()
-
-	// receiveTCP must follow also AddConnection. In the absence
-	// of any indirect connectivity to the remote peer, the first
-	// we hear about it (and any peers reachable from it) is
-	// through topology gossip it sends us on the connection. We
-	// must ensure that the connection has been added to Ourself
-	// prior to processing any such gossip, otherwise we risk
-	// immediately gc'ing part of that newly received portion of
-	// the topology (though not the remote peer itself, since that
-	// will have a positive ref count), leaving behind dangling
-	// references to peers. Hence we must invoke AddConnection,
-	// which is *synchronous*, first.
-	conn.heartbeatTCP = time.NewTicker(TCPHeartbeat)
-	go conn.receiveTCP(intro.Receiver)
-
-	// AddConnection must precede actorLoop. More precisely, it
-	// must precede shutdown, since that invokes DeleteConnection
-	// and is invoked on termination of this entire
-	// function. Essentially this boils down to a prohibition on
-	// running AddConnection in a separate goroutine, at least not
-	// without some synchronisation. Which in turn requires the
-	// launching of the receiveTCP goroutine to precede actorLoop.
-	err = conn.actorLoop(actionChan)
-}
-
-func (conn *LocalConnection) makeFeatures() map[string]string {
-	features := map[string]string{
-		"PeerNameFlavour": PeerNameFlavour,
-		"Name":            conn.local.Name.String(),
-		"NickName":        conn.local.NickName,
-		"ShortID":         fmt.Sprint(conn.local.ShortID),
-		"UID":             fmt.Sprint(conn.local.UID),
-		"ConnID":          fmt.Sprint(conn.uid),
-	}
-	conn.Router.Overlay.AddFeaturesTo(features)
-	return features
-}
-
-type features map[string]string
-
-func (features features) MustHave(keys []string) error {
-	for _, key := range keys {
-		if _, ok := features[key]; !ok {
-			return fmt.Errorf("Field %s is missing", key)
-		}
-	}
-	return nil
-}
-
-func (features features) Get(key string) string {
-	return features[key]
-}
-
-func (conn *LocalConnection) parseFeatures(features features) (*Peer, error) {
-	if err := features.MustHave([]string{"PeerNameFlavour", "Name", "NickName", "UID", "ConnID"}); err != nil {
-		return nil, err
-	}
-
-	remotePeerNameFlavour := features.Get("PeerNameFlavour")
-	if remotePeerNameFlavour != PeerNameFlavour {
-		return nil, fmt.Errorf("Peer name flavour mismatch (ours: '%s', theirs: '%s')", PeerNameFlavour, remotePeerNameFlavour)
-	}
-
-	name, err := PeerNameFromString(features.Get("Name"))
-	if err != nil {
-		return nil, err
-	}
-
-	nickName := features.Get("NickName")
-
-	var shortID uint64
-	var hasShortID bool
-	if shortIDStr, present := features["ShortID"]; present {
-		hasShortID = true
-		shortID, err = strconv.ParseUint(shortIDStr, 10,
-			PeerShortIDBits)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	uid, err := ParsePeerUID(features.Get("UID"))
-	if err != nil {
-		return nil, err
-	}
-
-	remoteConnID, err := strconv.ParseUint(features.Get("ConnID"), 10, 64)
-	if err != nil {
-		return nil, err
-	}
-
-	conn.uid ^= remoteConnID
-	peer := NewPeer(name, nickName, uid, 0, PeerShortID(shortID))
-	peer.HasShortID = hasShortID
-	return peer, nil
-}
-
-func (conn *LocalConnection) registerRemote(remote *Peer, acceptNewPeer bool) error {
-	if acceptNewPeer {
-		conn.remote = conn.Router.Peers.FetchWithDefault(remote)
-	} else {
-		conn.remote = conn.Router.Peers.FetchAndAddRef(remote.Name)
-		if conn.remote == nil {
-			return fmt.Errorf("Found unknown remote name: %s at %s", remote.Name, conn.remoteTCPAddr)
-		}
-	}
-
-	if conn.remote == conn.local {
-		return ErrConnectToSelf
-	}
-
-	return nil
-}
-
-func (conn *LocalConnection) actorLoop(actionChan <-chan ConnectionAction) (err error) {
-	fwdErrorChan := conn.OverlayConn.ErrorChannel()
-	fwdEstablishedChan := conn.OverlayConn.EstablishedChannel()
-
-	for err == nil {
-		select {
-		case action := <-actionChan:
-			err = action()
-
-		case <-conn.heartbeatTCP.C:
-			err = conn.sendSimpleProtocolMsg(ProtocolHeartbeat)
-
-		case <-fwdEstablishedChan:
-			conn.established = true
-			fwdEstablishedChan = nil
-			conn.Router.Ourself.ConnectionEstablished(conn)
-
-		case err = <-fwdErrorChan:
-		}
-	}
-	return
-}
-
-func (conn *LocalConnection) shutdown(err error) {
-	if conn.remote == nil {
-		log.Errorf("->[%s] connection shutting down due to error during handshake: %v", conn.remoteTCPAddr, err)
-	} else {
-		conn.ErrorLog("connection shutting down due to error:", err)
-	}
-
-	if conn.TCPConn != nil {
-		checkWarn(conn.TCPConn.Close())
-	}
-
-	if conn.remote != nil {
-		conn.Router.Peers.Dereference(conn.remote)
-		conn.Router.Ourself.DeleteConnection(conn)
-	}
-
-	if conn.heartbeatTCP != nil {
-		conn.heartbeatTCP.Stop()
-	}
-
-	if conn.OverlayConn != nil {
-		conn.OverlayConn.Stop()
-	}
-
-	conn.Router.ConnectionMaker.ConnectionTerminated(conn, err)
-}
-
-func (conn *LocalConnection) sendOverlayControlMessage(tag byte, msg []byte) error {
-	return conn.sendProtocolMsg(ProtocolMsg{ProtocolTag(tag), msg})
-}
-
-// Helpers
-
-func (conn *LocalConnection) sendSimpleProtocolMsg(tag ProtocolTag) error {
-	return conn.sendProtocolMsg(ProtocolMsg{tag: tag})
-}
-
-func (conn *LocalConnection) sendProtocolMsg(m ProtocolMsg) error {
-	return conn.tcpSender.Send(append([]byte{byte(m.tag)}, m.msg...))
-}
-
-func (conn *LocalConnection) receiveTCP(receiver TCPReceiver) {
-	var err error
-	for {
-		conn.extendReadDeadline()
-
-		var msg []byte
-		if msg, err = receiver.Receive(); err != nil {
-			break
-		}
-		if len(msg) < 1 {
-			conn.Log("ignoring blank msg")
-			continue
-		}
-		if err = conn.handleProtocolMsg(ProtocolTag(msg[0]), msg[1:]); err != nil {
-			break
-		}
-	}
-	conn.Shutdown(err)
-}
-
-func (conn *LocalConnection) handleProtocolMsg(tag ProtocolTag, payload []byte) error {
-	switch tag {
-	case ProtocolHeartbeat:
-	case ProtocolReserved1, ProtocolReserved2, ProtocolReserved3, ProtocolOverlayControlMsg:
-		conn.OverlayConn.ControlMessage(byte(tag), payload)
-	case ProtocolGossipUnicast, ProtocolGossipBroadcast, ProtocolGossip:
-		return conn.Router.handleGossip(tag, payload)
-	default:
-		conn.Log("ignoring unknown protocol tag:", tag)
-	}
-	return nil
-}
-
-func (conn *LocalConnection) extendReadDeadline() {
-	conn.TCPConn.SetReadDeadline(time.Now().Add(TCPHeartbeat * 2))
-}

mesh/connection_maker.go

@@ -1,312 +0,0 @@
-package mesh
-
-import (
-	"fmt"
-	"math/rand"
-	"net"
-	"time"
-)
-
-const (
-	InitialInterval = 2 * time.Second
-	MaxInterval     = 6 * time.Minute
-	ResetAfter      = 1 * time.Minute
-)
-
-type peerAddrs map[string]*net.TCPAddr
-
-type ConnectionMaker struct {
-	ourself     *LocalPeer
-	peers       *Peers
-	port        int
-	discovery   bool
-	targets     map[string]*Target
-	connections map[Connection]struct{}
-	directPeers peerAddrs
-	actionChan  chan<- ConnectionMakerAction
-}
-
-type TargetState int
-
-const (
-	TargetWaiting    TargetState = iota // we are waiting to connect there
-	TargetAttempting                    // we are attempting to connect there
-	TargetConnected                     // we are connected to there
-)
-
-// Information about an address where we may find a peer
-type Target struct {
-	state       TargetState
-	lastError   error         // reason for disconnection last time
-	tryAfter    time.Time     // next time to try this address
-	tryInterval time.Duration // retry delay on next failure
-}
-
-type ConnectionMakerAction func() bool
-
-func NewConnectionMaker(ourself *LocalPeer, peers *Peers, port int, discovery bool) *ConnectionMaker {
-	actionChan := make(chan ConnectionMakerAction, ChannelSize)
-	cm := &ConnectionMaker{
-		ourself:     ourself,
-		peers:       peers,
-		port:        port,
-		discovery:   discovery,
-		directPeers: peerAddrs{},
-		targets:     make(map[string]*Target),
-		connections: make(map[Connection]struct{}),
-		actionChan:  actionChan}
-	go cm.queryLoop(actionChan)
-	return cm
-}
-
-func (cm *ConnectionMaker) InitiateConnections(peers []string, replace bool) []error {
-	errors := []error{}
-	addrs := peerAddrs{}
-	for _, peer := range peers {
-		host, port, err := net.SplitHostPort(peer)
-		if err != nil {
-			host = peer
-			port = "0" // we use that as an indication that "no port was supplied"
-		}
-		if addr, err := net.ResolveTCPAddr("tcp4", fmt.Sprintf("%s:%s", host, port)); err != nil {
-			errors = append(errors, err)
-		} else {
-			addrs[peer] = addr
-		}
-	}
-	cm.actionChan <- func() bool {
-		if replace {
-			cm.directPeers = peerAddrs{}
-		}
-		for peer, addr := range addrs {
-			cm.directPeers[peer] = addr
-			// curtail any existing reconnect interval
-			if target, found := cm.targets[addr.String()]; found {
-				target.nextTryNow()
-			}
-		}
-		return true
-	}
-	return errors
-}
-
-func (cm *ConnectionMaker) ForgetConnections(peers []string) {
-	cm.actionChan <- func() bool {
-		for _, peer := range peers {
-			delete(cm.directPeers, peer)
-		}
-		return false
-	}
-}
-
-func (cm *ConnectionMaker) ConnectionAborted(address string, err error) {
-	cm.actionChan <- func() bool {
-		target := cm.targets[address]
-		target.state = TargetWaiting
-		target.lastError = err
-		target.nextTryLater()
-		return true
-	}
-}
-
-func (cm *ConnectionMaker) ConnectionCreated(conn Connection) {
-	cm.actionChan <- func() bool {
-		cm.connections[conn] = void
-		if conn.Outbound() {
-			target := cm.targets[conn.RemoteTCPAddr()]
-			target.state = TargetConnected
-		}
-		return false
-	}
-}
-
-func (cm *ConnectionMaker) ConnectionTerminated(conn Connection, err error) {
-	cm.actionChan <- func() bool {
-		delete(cm.connections, conn)
-		if conn.Outbound() {
-			target := cm.targets[conn.RemoteTCPAddr()]
-			target.state = TargetWaiting
-			target.lastError = err
-			switch {
-			case err == ErrConnectToSelf:
-				target.nextTryNever()
-			case time.Now().After(target.tryAfter.Add(ResetAfter)):
-				target.nextTryNow()
-			default:
-				target.nextTryLater()
-			}
-		}
-		return true
-	}
-}
-
-func (cm *ConnectionMaker) Refresh() {
-	cm.actionChan <- func() bool { return true }
-}
-
-func (cm *ConnectionMaker) queryLoop(actionChan <-chan ConnectionMakerAction) {
-	timer := time.NewTimer(MaxDuration)
-	run := func() { timer.Reset(cm.checkStateAndAttemptConnections()) }
-	for {
-		select {
-		case action := <-actionChan:
-			if action() {
-				run()
-			}
-		case <-timer.C:
-			run()
-		}
-	}
-}
-
-func (cm *ConnectionMaker) checkStateAndAttemptConnections() time.Duration {
-	var (
-		validTarget  = make(map[string]struct{})
-		directTarget = make(map[string]struct{})
-	)
-	ourConnectedPeers, ourConnectedTargets, ourInboundIPs := cm.ourConnections()
-
-	addTarget := func(address string) {
-		if _, connected := ourConnectedTargets[address]; connected {
-			return
-		}
-		validTarget[address] = void
-		if _, found := cm.targets[address]; found {
-			return
-		}
-		target := &Target{state: TargetWaiting}
-		target.nextTryNow()
-		cm.targets[address] = target
-	}
-
-	// Add direct targets that are not connected
-	for _, addr := range cm.directPeers {
-		completeAddr := *addr
-		attempt := true
-		if completeAddr.Port == 0 {
-			completeAddr.Port = cm.port
-			// If a peer was specified w/o a port, then we do not
-			// attempt to connect to it if we have any inbound
-			// connections from that IP.
-			if _, connected := ourInboundIPs[completeAddr.IP.String()]; connected {
-				attempt = false
-			}
-		}
-		address := completeAddr.String()
-		directTarget[address] = void
-		if attempt {
-			addTarget(address)
-		}
-	}
-
-	// Add targets for peers that someone else is connected to, but we
-	// aren't
-	if cm.discovery {
-		cm.addPeerTargets(ourConnectedPeers, addTarget)
-	}
-
-	return cm.connectToTargets(validTarget, directTarget)
-}
-
-func (cm *ConnectionMaker) ourConnections() (PeerNameSet, map[string]struct{}, map[string]struct{}) {
-	var (
-		ourConnectedPeers   = make(PeerNameSet)
-		ourConnectedTargets = make(map[string]struct{})
-		ourInboundIPs       = make(map[string]struct{})
-	)
-	for conn := range cm.connections {
-		address := conn.RemoteTCPAddr()
-		ourConnectedPeers[conn.Remote().Name] = void
-		ourConnectedTargets[address] = void
-		if conn.Outbound() {
-			continue
-		}
-		if ip, _, err := net.SplitHostPort(address); err == nil { // should always succeed
-			ourInboundIPs[ip] = void
-		}
-	}
-	return ourConnectedPeers, ourConnectedTargets, ourInboundIPs
-}
-
-func (cm *ConnectionMaker) addPeerTargets(ourConnectedPeers PeerNameSet, addTarget func(string)) {
-	cm.peers.ForEach(func(peer *Peer) {
-		if peer == cm.ourself.Peer {
-			return
-		}
-		// Modifying peer.connections requires a write lock on Peers,
-		// and since we are holding a read lock (due to the ForEach),
-		// access without locking the peer is safe.
-		for otherPeer, conn := range peer.connections {
-			if otherPeer == cm.ourself.Name {
-				continue
-			}
-			if _, connected := ourConnectedPeers[otherPeer]; connected {
-				continue
-			}
-			address := conn.RemoteTCPAddr()
-			if conn.Outbound() {
-				addTarget(address)
-			} else if ip, _, err := net.SplitHostPort(address); err == nil {
-				// There is no point connecting to the (likely
-				// ephemeral) remote port of an inbound connection
-				// that some peer has. Let's try to connect on the
-				// weave port instead.
-				addTarget(fmt.Sprintf("%s:%d", ip, cm.port))
-			}
-		}
-	})
-}
-
-func (cm *ConnectionMaker) connectToTargets(validTarget map[string]struct{}, directTarget map[string]struct{}) time.Duration {
-	now := time.Now() // make sure we catch items just added
-	after := MaxDuration
-	for address, target := range cm.targets {
-		if target.state != TargetWaiting {
-			continue
-		}
-		if _, valid := validTarget[address]; !valid {
-			delete(cm.targets, address)
-			continue
-		}
-		if target.tryAfter.IsZero() {
-			continue
-		}
-		switch duration := target.tryAfter.Sub(now); {
-		case duration <= 0:
-			target.state = TargetAttempting
-			_, isCmdLineTarget := directTarget[address]
-			go cm.attemptConnection(address, isCmdLineTarget)
-		case duration < after:
-			after = duration
-		}
-	}
-	return after
-}
-
-func (cm *ConnectionMaker) attemptConnection(address string, acceptNewPeer bool) {
-	log.Printf("->[%s] attempting connection", address)
-	if err := cm.ourself.CreateConnection(address, acceptNewPeer); err != nil {
-		log.Errorf("->[%s] error during connection attempt: %v", address, err)
-		cm.ConnectionAborted(address, err)
-	}
-}
-
-func (t *Target) nextTryNever() {
-	t.tryAfter = time.Time{}
-	t.tryInterval = MaxInterval
-}
-
-func (t *Target) nextTryNow() {
-	t.tryAfter = time.Now()
-	t.tryInterval = InitialInterval
-}
-
-// The delay at the nth retry is a random value in the range
-// [i-i/2,i+i/2], where i = InitialInterval * 1.5^(n-1).
-func (t *Target) nextTryLater() {
-	t.tryAfter = time.Now().Add(t.tryInterval/2 + time.Duration(rand.Int63n(int64(t.tryInterval))))
-	t.tryInterval = t.tryInterval * 3 / 2
-	if t.tryInterval > MaxInterval {
-		t.tryInterval = MaxInterval
-	}
-}

mesh/gossip.go

@@ -1,170 +0,0 @@
-package mesh
-
-import (
-	"fmt"
-)
-
-type GossipData interface {
-	Encode() [][]byte
-	Merge(GossipData) GossipData
-}
-
-type Gossip interface {
-	// specific message from one peer to another
-	// intermediate peers relay it using unicast topology.
-	GossipUnicast(dstPeerName PeerName, msg []byte) error
-	// send gossip to every peer, relayed using broadcast topology.
-	GossipBroadcast(update GossipData) error
-}
-
-type Gossiper interface {
-	OnGossipUnicast(sender PeerName, msg []byte) error
-	// merge received data into state and return a representation of
-	// the received data, for further propagation
-	OnGossipBroadcast(sender PeerName, update []byte) (GossipData, error)
-	// return state of everything we know; gets called periodically
-	Gossip() GossipData
-	// merge received data into state and return "everything new I've
-	// just learnt", or nil if nothing in the received data was new
-	OnGossip(update []byte) (GossipData, error)
-}
-
-// Accumulates GossipData that needs to be sent to one destination,
-// and sends it when possible.
-type GossipSender struct {
-	send func(GossipData)
-	cell chan GossipData
-	// for testing
-	sent    bool
-	flushch chan chan bool
-}
-
-func NewGossipSender(send func(GossipData)) *GossipSender {
-	cell := make(chan GossipData, 1)
-	flushch := make(chan chan bool)
-	sender := &GossipSender{
-		send:    send,
-		cell:    cell,
-		flushch: flushch,
-	}
-	go sender.run()
-	return sender
-}
-
-func (sender *GossipSender) run() {
-	for {
-		select {
-		case pending := <-sender.cell:
-			if pending == nil { // receive zero value when chan is closed
-				return
-			}
-			sender.send(pending)
-			sender.sent = true
-		case ch := <-sender.flushch:
-			// send anything pending, then reply back whether we sent
-			// anything since previous flush
-			select {
-			case pending := <-sender.cell:
-				sender.send(pending)
-				sender.sent = true
-			default:
-			}
-			ch <- sender.sent
-			sender.sent = false
-		}
-	}
-}
-
-func (sender *GossipSender) Send(data GossipData) {
-	// NB: this must not be invoked concurrently
-	select {
-	case pending := <-sender.cell:
-		sender.cell <- pending.Merge(data)
-	default:
-		sender.cell <- data
-	}
-}
-
-func (sender *GossipSender) Stop() {
-	close(sender.cell)
-}
-
-type GossipChannels map[string]*GossipChannel
-
-func (router *Router) NewGossip(channelName string, g Gossiper) Gossip {
-	channel := NewGossipChannel(channelName, router.Ourself, router.Routes, g)
-	router.gossipLock.Lock()
-	defer router.gossipLock.Unlock()
-	if _, found := router.gossipChannels[channelName]; found {
-		checkFatal(fmt.Errorf("[gossip] duplicate channel %s", channelName))
-	}
-	router.gossipChannels[channelName] = channel
-	return channel
-}
-
-func (router *Router) gossipChannel(channelName string) *GossipChannel {
-	router.gossipLock.RLock()
-	channel, found := router.gossipChannels[channelName]
-	router.gossipLock.RUnlock()
-	if found {
-		return channel
-	}
-	router.gossipLock.Lock()
-	defer router.gossipLock.Unlock()
-	if channel, found = router.gossipChannels[channelName]; found {
-		return channel
-	}
-	channel = NewGossipChannel(channelName, router.Ourself, router.Routes, &surrogateGossiper)
-	channel.log("created surrogate channel")
-	router.gossipChannels[channelName] = channel
-	return channel
-}
-
-func (router *Router) gossipChannelSet() map[*GossipChannel]struct{} {
-	channels := make(map[*GossipChannel]struct{})
-	router.gossipLock.RLock()
-	defer router.gossipLock.RUnlock()
-	for _, channel := range router.gossipChannels {
-		channels[channel] = void
-	}
-	return channels
-}
-
-func (router *Router) SendAllGossip() {
-	for channel := range router.gossipChannelSet() {
-		if gossip := channel.gossiper.Gossip(); gossip != nil {
-			channel.Send(router.Ourself.Name, gossip)
-		}
-	}
-}
-
-func (router *Router) SendAllGossipDown(conn Connection) {
-	for channel := range router.gossipChannelSet() {
-		if gossip := channel.gossiper.Gossip(); gossip != nil {
-			channel.SendDown(conn, gossip)
-		}
-	}
-}
-
-// for testing
-
-func (router *Router) sendPendingGossip() bool {
-	sentSomething := false
-	for channel := range router.gossipChannelSet() {
-		channel.Lock()
-		for _, sender := range channel.senders {
-			sentSomething = sender.flush() || sentSomething
-		}
-		for _, sender := range channel.broadcasters {
-			sentSomething = sender.flush() || sentSomething
-		}
-		channel.Unlock()
-	}
-	return sentSomething
-}
-
-func (sender *GossipSender) flush() bool {
-	ch := make(chan bool)
-	sender.flushch <- ch
-	return <-ch
-}

mesh/gossip_channel.go

@@ -1,250 +0,0 @@
-package mesh
-
-import (
-	"bytes"
-	"encoding/gob"
-	"fmt"
-	"sync"
-)
-
-type GossipChannel struct {
-	sync.Mutex
-	name         string
-	ourself      *LocalPeer
-	routes       *Routes
-	gossiper     Gossiper
-	senders      connectionSenders
-	broadcasters peerSenders
-}
-
-type connectionSenders map[Connection]*GossipSender
-type peerSenders map[PeerName]*GossipSender
-
-func NewGossipChannel(channelName string, ourself *LocalPeer, routes *Routes, g Gossiper) *GossipChannel {
-	return &GossipChannel{
-		name:         channelName,
-		ourself:      ourself,
-		routes:       routes,
-		gossiper:     g,
-		senders:      make(connectionSenders),
-		broadcasters: make(peerSenders)}
-}
-
-func (router *Router) handleGossip(tag ProtocolTag, payload []byte) error {
-	decoder := gob.NewDecoder(bytes.NewReader(payload))
-	var channelName string
-	if err := decoder.Decode(&channelName); err != nil {
-		return err
-	}
-	channel := router.gossipChannel(channelName)
-	var srcName PeerName
-	if err := decoder.Decode(&srcName); err != nil {
-		return err
-	}
-	switch tag {
-	case ProtocolGossipUnicast:
-		return channel.deliverUnicast(srcName, payload, decoder)
-	case ProtocolGossipBroadcast:
-		return channel.deliverBroadcast(srcName, payload, decoder)
-	case ProtocolGossip:
-		return channel.deliver(srcName, payload, decoder)
-	}
-	return nil
-}
-
-func (c *GossipChannel) deliverUnicast(srcName PeerName, origPayload []byte, dec *gob.Decoder) error {
-	var destName PeerName
-	if err := dec.Decode(&destName); err != nil {
-		return err
-	}
-	if c.ourself.Name != destName {
-		if err := c.relayUnicast(destName, origPayload); err != nil {
-			// just log errors from relayUnicast; a problem between us and destination
-			// is not enough reason to break the connection from the source
-			c.log(err)
-		}
-		return nil
-	}
-	var payload []byte
-	if err := dec.Decode(&payload); err != nil {
-		return err
-	}
-	return c.gossiper.OnGossipUnicast(srcName, payload)
-}
-
-func (c *GossipChannel) deliverBroadcast(srcName PeerName, _ []byte, dec *gob.Decoder) error {
-	var payload []byte
-	if err := dec.Decode(&payload); err != nil {
-		return err
-	}
-	data, err := c.gossiper.OnGossipBroadcast(srcName, payload)
-	if err != nil || data == nil {
-		return err
-	}
-	return c.relayBroadcast(srcName, data)
-}
-
-func (c *GossipChannel) deliver(srcName PeerName, _ []byte, dec *gob.Decoder) error {
-	var payload []byte
-	if err := dec.Decode(&payload); err != nil {
-		return err
-	}
-	if data, err := c.gossiper.OnGossip(payload); err != nil {
-		return err
-	} else if data != nil {
-		c.Send(srcName, data)
-	}
-	return nil
-}
-
-func (c *GossipChannel) Send(srcName PeerName, data GossipData) {
-	// do this outside the lock below so we avoid lock nesting
-	c.routes.EnsureRecalculated()
-	selectedConnections := make(ConnectionSet)
-	for name := range c.routes.RandomNeighbours(srcName) {
-		if conn, found := c.ourself.ConnectionTo(name); found {
-			selectedConnections[conn] = void
-		}
-	}
-	if len(selectedConnections) == 0 {
-		return
-	}
-	connections := c.ourself.Connections()
-	c.Lock()
-	defer c.Unlock()
-	c.gcSenders(connections)
-	for conn := range selectedConnections {
-		c.sendDown(conn, data)
-	}
-}
-
-func (c *GossipChannel) SendDown(conn Connection, data GossipData) {
-	connections := c.ourself.Connections()
-	c.Lock()
-	defer c.Unlock()
-	c.gcSenders(connections)
-	c.sendDown(conn, data)
-}
-
-// GC - randomly (courtesy of go's map iterator) pick some existing
-// senders and stop&remove them if the associated connection is no
-// longer active.  We stop as soon as we encounter a valid entry; the
-// idea being that when there is little or no garbage then this
-// executes close to O(1)[1], whereas when there is lots of garbage we
-// remove it quickly.
-//
-// [1] TODO Unfortunately, due to the desire to avoid nested locks,
-// instead of simply invoking LocalPeer.ConnectionTo(name), we pass in
-// the result of LocalPeer.Connections(). That is O(n_our_connections)
-// at best.
-func (c *GossipChannel) gcSenders(connections ConnectionSet) {
-	for conn, sender := range c.senders {
-		if _, found := connections[conn]; !found {
-			delete(c.senders, conn)
-			sender.Stop()
-		} else {
-			break
-		}
-	}
-}
-
-// We have seen a couple of failures which suggest a >128GB slice was encountered.
-// 100MB should be enough for anyone.
-const maxFeasibleMessageLen = 100 * 1024 * 1024
-
-func (c *GossipChannel) sendDown(conn Connection, data GossipData) {
-	sender, found := c.senders[conn]
-	if !found {
-		sender = NewGossipSender(func(pending GossipData) {
-			for _, msg := range pending.Encode() {
-				if len(msg) > maxFeasibleMessageLen {
-					panic(fmt.Sprintf("Gossip message too large: len=%d bytes; on channel '%s' from %+v", len(msg), c.name, pending))
-				}
-				protocolMsg := ProtocolMsg{ProtocolGossip, GobEncode(c.name, c.ourself.Name, msg)}
-				conn.(ProtocolSender).SendProtocolMsg(protocolMsg)
-			}
-		})
-		c.senders[conn] = sender
-	}
-	sender.Send(data)
-}
-
-func (c *GossipChannel) GossipUnicast(dstPeerName PeerName, msg []byte) error {
-	return c.relayUnicast(dstPeerName, GobEncode(c.name, c.ourself.Name, dstPeerName, msg))
-}
-
-func (c *GossipChannel) GossipBroadcast(update GossipData) error {
-	return c.relayBroadcast(c.ourself.Name, update)
-}
-
-func (c *GossipChannel) relayUnicast(dstPeerName PeerName, buf []byte) (err error) {
-	if relayPeerName, found := c.routes.UnicastAll(dstPeerName); !found {
-		err = fmt.Errorf("unknown relay destination: %s", dstPeerName)
-	} else if conn, found := c.ourself.ConnectionTo(relayPeerName); !found {
-		err = fmt.Errorf("unable to find connection to relay peer %s", relayPeerName)
-	} else {
-		conn.(ProtocolSender).SendProtocolMsg(ProtocolMsg{ProtocolGossipUnicast, buf})
-	}
-	return err
-}
-
-func (c *GossipChannel) relayBroadcast(srcName PeerName, update GossipData) error {
-	names := c.routes.PeerNames() // do this outside the lock so they don't nest
-	c.Lock()
-	defer c.Unlock()
-	// GC - randomly (courtesy of go's map iterator) pick some
-	// existing broadcasters and stop&remove them if their source peer
-	// is unknown. We stop as soon as we encounter a valid entry; the
-	// idea being that when there is little or no garbage then this
-	// executes close to O(1)[1], whereas when there is lots of
-	// garbage we remove it quickly.
-	//
-	// [1] TODO Unfortunately, due to the desire to avoid nested
-	// locks, instead of simply invoking Peers.Fetch(name) below, we
-	// have that Peers.Names() invocation above. That is O(n_peers) at
-	// best.
-	for name, broadcaster := range c.broadcasters {
-		if _, found := names[name]; !found {
-			delete(c.broadcasters, name)
-			broadcaster.Stop()
-		} else {
-			break
-		}
-	}
-	broadcaster, found := c.broadcasters[srcName]
-	if !found {
-		broadcaster = NewGossipSender(func(pending GossipData) { c.sendBroadcast(srcName, pending) })
-		c.broadcasters[srcName] = broadcaster
-	}
-	broadcaster.Send(update)
-	return nil
-}
-
-func (c *GossipChannel) sendBroadcast(srcName PeerName, update GossipData) {
-	c.routes.EnsureRecalculated()
-	nextHops := c.routes.BroadcastAll(srcName)
-	if len(nextHops) == 0 {
-		return
-	}
-	connections := c.ourself.ConnectionsTo(nextHops)
-	for _, msg := range update.Encode() {
-		protocolMsg := ProtocolMsg{ProtocolGossipBroadcast, GobEncode(c.name, srcName, msg)}
-		// FIXME a single blocked connection can stall us
-		for _, conn := range connections {
-			conn.(ProtocolSender).SendProtocolMsg(protocolMsg)
-		}
-	}
-}
-
-func (c *GossipChannel) log(args ...interface{}) {
-	log.Println(append(append([]interface{}{}, "[gossip "+c.name+"]:"), args...)...)
-}
-
-func GobEncode(items ...interface{}) []byte {
-	buf := new(bytes.Buffer)
-	enc := gob.NewEncoder(buf)
-	for _, i := range items {
-		checkFatal(enc.Encode(i))
-	}
-	return buf.Bytes()
-}

mesh/gossip_test.go

@@ -1,259 +0,0 @@
-package mesh
-
-import (
-	"fmt"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	wt "github.com/weaveworks/weave/testing"
-)
-
-// TODO test gossip unicast; atm we only test topology gossip and
-// surrogates, neither of which employ unicast.
-
-type mockChannelConnection struct {
-	RemoteConnection
-	dest *Router
-}
-
-func NewTestRouter(name string) *Router {
-	peerName, _ := PeerNameFromString(name)
-	router := NewRouter(Config{}, peerName, "nick", nil)
-	router.Start()
-	return router
-}
-
-func (conn *mockChannelConnection) SendProtocolMsg(protocolMsg ProtocolMsg) {
-	if err := conn.dest.handleGossip(protocolMsg.tag, protocolMsg.msg); err != nil {
-		panic(err)
-	}
-}
-
-func sendPendingGossip(routers ...*Router) {
-	// Loop until all routers report they didn't send anything
-	for sentSomething := true; sentSomething; {
-		sentSomething = false
-		for _, router := range routers {
-			sentSomething = router.sendPendingGossip() || sentSomething
-		}
-	}
-}
-
-func (router *Router) AddTestChannelConnection(r *Router) {
-	fromPeer := NewPeerFrom(router.Ourself.Peer)
-	toPeer := NewPeerFrom(r.Ourself.Peer)
-
-	r.Peers.FetchWithDefault(fromPeer)    // Has side-effect of incrementing refcount
-	router.Peers.FetchWithDefault(toPeer) //
-
-	conn := &mockChannelConnection{RemoteConnection{router.Ourself.Peer, toPeer, "", false, true}, r}
-	router.Ourself.handleAddConnection(conn)
-	router.Ourself.handleConnectionEstablished(conn)
-}
-
-func (router *Router) DeleteTestChannelConnection(r *Router) {
-	fromName := router.Ourself.Peer.Name
-	toName := r.Ourself.Peer.Name
-
-	fromPeer := r.Peers.Fetch(fromName)
-	toPeer := router.Peers.Fetch(toName)
-
-	r.Peers.Dereference(fromPeer)
-	router.Peers.Dereference(toPeer)
-
-	conn, _ := router.Ourself.ConnectionTo(toName)
-	router.Ourself.handleDeleteConnection(conn)
-}
-
-func TestGossipTopology(t *testing.T) {
-	wt.RunWithTimeout(t, 5*time.Second, func() {
-		implTestGossipTopology(t)
-	})
-}
-
-// Create a Peer representing the receiver router, with connections to
-// the routers supplied as arguments, carrying across all UID and
-// version information.
-func (router *Router) tp(routers ...*Router) *Peer {
-	peer := NewPeerFrom(router.Ourself.Peer)
-	connections := make(map[PeerName]Connection)
-	for _, r := range routers {
-		p := NewPeerFrom(r.Ourself.Peer)
-		connections[r.Ourself.Peer.Name] = newMockConnection(peer, p)
-	}
-	peer.Version = router.Ourself.Peer.Version
-	peer.connections = connections
-	return peer
-}
-
-// Check that the topology of router matches the peers and all of their connections
-func checkTopology(t *testing.T, router *Router, wantedPeers ...*Peer) {
-	router.Peers.RLock()
-	checkTopologyPeers(t, true, router.Peers.allPeers(), wantedPeers...)
-	router.Peers.RUnlock()
-}
-
-func implTestGossipTopology(t *testing.T) {
-	// Create some peers that will talk to each other
-	r1 := NewTestRouter("01:00:00:01:00:00")
-	r2 := NewTestRouter("02:00:00:02:00:00")
-	r3 := NewTestRouter("03:00:00:03:00:00")
-
-	// Check state when they have no connections
-	checkTopology(t, r1, r1.tp())
-	checkTopology(t, r2, r2.tp())
-
-	// Now try adding some connections
-	r1.AddTestChannelConnection(r2)
-	sendPendingGossip(r1, r2)
-	checkTopology(t, r1, r1.tp(r2), r2.tp())
-	checkTopology(t, r2, r1.tp(r2), r2.tp())
-	r2.AddTestChannelConnection(r1)
-	sendPendingGossip(r1, r2)
-	checkTopology(t, r1, r1.tp(r2), r2.tp(r1))
-	checkTopology(t, r2, r1.tp(r2), r2.tp(r1))
-
-	// Currently, the connection from 2 to 3 is one-way only
-	r2.AddTestChannelConnection(r3)
-	sendPendingGossip(r1, r2, r3)
-	checkTopology(t, r1, r1.tp(r2), r2.tp(r1, r3), r3.tp())
-	checkTopology(t, r2, r1.tp(r2), r2.tp(r1, r3), r3.tp())
-	// When r2 gossiped to r3, 1 was unreachable from r3 so it got removed from the
-	// list of peers, but remains referenced in the connection from 1 to 3.
-	checkTopology(t, r3, r2.tp(r1, r3), r3.tp())
-
-	// Add a connection from 3 to 1 and now r1 is reachable.
-	r3.AddTestChannelConnection(r1)
-	sendPendingGossip(r1, r2, r3)
-	checkTopology(t, r1, r1.tp(r2), r2.tp(r1, r3), r3.tp(r1))
-	checkTopology(t, r2, r1.tp(r2), r2.tp(r1, r3), r3.tp(r1))
-	checkTopology(t, r3, r1.tp(), r2.tp(r1, r3), r3.tp(r1))
-
-	r1.AddTestChannelConnection(r3)
-	sendPendingGossip(r1, r2, r3)
-	checkTopology(t, r1, r1.tp(r2, r3), r2.tp(r1, r3), r3.tp(r1))
-	checkTopology(t, r2, r1.tp(r2, r3), r2.tp(r1, r3), r3.tp(r1))
-	checkTopology(t, r3, r1.tp(r2, r3), r2.tp(r1, r3), r3.tp(r1))
-
-	// Drop the connection from 2 to 3
-	r2.DeleteTestChannelConnection(r3)
-	sendPendingGossip(r1, r2, r3)
-	checkTopology(t, r1, r1.tp(r2, r3), r2.tp(r1), r3.tp(r1))
-	checkTopology(t, r2, r1.tp(r2, r3), r2.tp(r1))
-	checkTopology(t, r3, r1.tp(r2, r3), r2.tp(r1), r3.tp(r1))
-
-	// Drop the connection from 1 to 3
-	r1.DeleteTestChannelConnection(r3)
-	sendPendingGossip(r1, r2, r3)
-	checkTopology(t, r1, r1.tp(r2), r2.tp(r1), r3.tp(r1))
-
-	checkTopology(t, r1, r1.tp(r2), r2.tp(r1), r3.tp(r1))
-	checkTopology(t, r2, r1.tp(r2), r2.tp(r1))
-	// r3 still thinks r1 has a connection to it
-	checkTopology(t, r3, r1.tp(r2, r3), r2.tp(r1), r3.tp(r1))
-
-	// On a timer, r3 will gossip to r1
-	r3.SendAllGossip()
-	sendPendingGossip(r1, r2, r3)
-	checkTopology(t, r1, r1.tp(r2), r2.tp(r1), r3.tp(r1))
-}
-
-func TestGossipSurrogate(t *testing.T) {
-	// create the topology r1 <-> r2 <-> r3
-	r1 := NewTestRouter("01:00:00:01:00:00")
-	r2 := NewTestRouter("02:00:00:02:00:00")
-	r3 := NewTestRouter("03:00:00:03:00:00")
-	r1.AddTestChannelConnection(r2)
-	r2.AddTestChannelConnection(r1)
-	r3.AddTestChannelConnection(r2)
-	r2.AddTestChannelConnection(r3)
-	sendPendingGossip(r1, r2, r3)
-	checkTopology(t, r1, r1.tp(r2), r2.tp(r1, r3), r3.tp(r2))
-	checkTopology(t, r2, r1.tp(r2), r2.tp(r1, r3), r3.tp(r2))
-	checkTopology(t, r3, r1.tp(r2), r2.tp(r1, r3), r3.tp(r2))
-
-	// create a gossiper at either end, but not the middle
-	g1 := newTestGossiper()
-	g3 := newTestGossiper()
-	s1 := r1.NewGossip("Test", g1)
-	s3 := r3.NewGossip("Test", g3)
-
-	// broadcast a message from each end, check it reaches the other
-	broadcast(s1, 1)
-	broadcast(s3, 2)
-	sendPendingGossip(r1, r2, r3)
-	g1.checkHas(t, 2)
-	g3.checkHas(t, 1)
-
-	// check that each end gets their message back through periodic
-	// gossip
-	r1.SendAllGossip()
-	r3.SendAllGossip()
-	sendPendingGossip(r1, r2, r3)
-	g1.checkHas(t, 1, 2)
-	g3.checkHas(t, 1, 2)
-}
-
-type testGossiper struct {
-	sync.RWMutex
-	state map[byte]struct{}
-}
-
-func newTestGossiper() *testGossiper {
-	return &testGossiper{state: make(map[byte]struct{})}
-}
-
-func (g *testGossiper) OnGossipUnicast(sender PeerName, msg []byte) error {
-	return nil
-}
-
-func (g *testGossiper) OnGossipBroadcast(_ PeerName, update []byte) (GossipData, error) {
-	g.Lock()
-	defer g.Unlock()
-	for _, v := range update {
-		g.state[v] = void
-	}
-	return NewSurrogateGossipData(update), nil
-}
-
-func (g *testGossiper) Gossip() GossipData {
-	g.RLock()
-	defer g.RUnlock()
-	state := make([]byte, len(g.state))
-	for v := range g.state {
-		state = append(state, v)
-	}
-	return NewSurrogateGossipData(state)
-}
-
-func (g *testGossiper) OnGossip(update []byte) (GossipData, error) {
-	g.Lock()
-	defer g.Unlock()
-	var delta []byte
-	for _, v := range update {
-		if _, found := g.state[v]; !found {
-			delta = append(delta, v)
-			g.state[v] = void
-		}
-	}
-	if len(delta) > 0 {
-		return NewSurrogateGossipData(delta), nil
-	}
-	return nil, nil
-}
-
-func (g *testGossiper) checkHas(t *testing.T, vs ...byte) {
-	g.RLock()
-	defer g.RUnlock()
-	for _, v := range vs {
-		if _, found := g.state[v]; !found {
-			require.FailNow(t, fmt.Sprintf("%d is missing", v))
-		}
-	}
-}
-
-func broadcast(s Gossip, v byte) {
-	s.GossipBroadcast(NewSurrogateGossipData([]byte{v}))
-}

mesh/local_peer.go

@@ -1,261 +0,0 @@
-package mesh
-
-import (
-	"fmt"
-	"net"
-	"sync"
-	"time"
-)
-
-type LocalPeer struct {
-	sync.RWMutex
-	*Peer
-	router     *Router
-	actionChan chan<- LocalPeerAction
-}
-
-type LocalPeerAction func()
-
-func NewLocalPeer(name PeerName, nickName string, router *Router) *LocalPeer {
-	actionChan := make(chan LocalPeerAction, ChannelSize)
-	peer := &LocalPeer{
-		Peer:       NewPeer(name, nickName, randomPeerUID(), 0, randomPeerShortID()),
-		router:     router,
-		actionChan: actionChan,
-	}
-	go peer.actorLoop(actionChan)
-	return peer
-}
-
-func (peer *LocalPeer) Connections() ConnectionSet {
-	connections := make(ConnectionSet)
-	peer.RLock()
-	defer peer.RUnlock()
-	for _, conn := range peer.connections {
-		connections[conn] = void
-	}
-	return connections
-}
-
-func (peer *LocalPeer) ConnectionTo(name PeerName) (Connection, bool) {
-	peer.RLock()
-	defer peer.RUnlock()
-	conn, found := peer.connections[name]
-	return conn, found // yes, you really can't inline that. FFS.
-}
-
-func (peer *LocalPeer) ConnectionsTo(names []PeerName) []Connection {
-	conns := make([]Connection, 0, len(names))
-	peer.RLock()
-	defer peer.RUnlock()
-	for _, name := range names {
-		conn, found := peer.connections[name]
-		// Again, !found could just be due to a race.
-		if found {
-			conns = append(conns, conn)
-		}
-	}
-	return conns
-}
-
-func (peer *LocalPeer) CreateConnection(peerAddr string, acceptNewPeer bool) error {
-	if err := peer.checkConnectionLimit(); err != nil {
-		return err
-	}
-	tcpAddr, err := net.ResolveTCPAddr("tcp4", peerAddr)
-	if err != nil {
-		return err
-	}
-	tcpConn, err := net.DialTCP("tcp4", nil, tcpAddr)
-	if err != nil {
-		return err
-	}
-	connRemote := NewRemoteConnection(peer.Peer, nil, tcpConn.RemoteAddr().String(), true, false)
-	StartLocalConnection(connRemote, tcpConn, peer.router, acceptNewPeer)
-	return nil
-}
-
-// ACTOR client API
-
-// Sync.
-func (peer *LocalPeer) AddConnection(conn *LocalConnection) error {
-	resultChan := make(chan error)
-	peer.actionChan <- func() {
-		resultChan <- peer.handleAddConnection(conn)
-	}
-	return <-resultChan
-}
-
-// Async.
-func (peer *LocalPeer) ConnectionEstablished(conn *LocalConnection) {
-	peer.actionChan <- func() {
-		peer.handleConnectionEstablished(conn)
-	}
-}
-
-// Sync.
-func (peer *LocalPeer) DeleteConnection(conn *LocalConnection) {
-	resultChan := make(chan interface{})
-	peer.actionChan <- func() {
-		peer.handleDeleteConnection(conn)
-		resultChan <- nil
-	}
-	<-resultChan
-}
-
-// ACTOR server
-
-func (peer *LocalPeer) actorLoop(actionChan <-chan LocalPeerAction) {
-	gossipTimer := time.Tick(GossipInterval)
-	for {
-		select {
-		case action := <-actionChan:
-			action()
-		case <-gossipTimer:
-			peer.router.SendAllGossip()
-		}
-	}
-}
-
-func (peer *LocalPeer) handleAddConnection(conn Connection) error {
-	if peer.Peer != conn.Local() {
-		log.Fatal("Attempt made to add connection to peer where peer is not the source of connection")
-	}
-	if conn.Remote() == nil {
-		log.Fatal("Attempt made to add connection to peer with unknown remote peer")
-	}
-	toName := conn.Remote().Name
-	dupErr := fmt.Errorf("Multiple connections to %s added to %s", conn.Remote(), peer.String())
-	// deliberately non symmetrical
-	if dupConn, found := peer.connections[toName]; found {
-		if dupConn == conn {
-			return nil
-		}
-		switch conn.BreakTie(dupConn) {
-		case TieBreakWon:
-			dupConn.Shutdown(dupErr)
-			peer.handleDeleteConnection(dupConn)
-		case TieBreakLost:
-			return dupErr
-		case TieBreakTied:
-			// oh good grief. Sod it, just kill both of them.
-			dupConn.Shutdown(dupErr)
-			peer.handleDeleteConnection(dupConn)
-			return dupErr
-		}
-	}
-	if err := peer.checkConnectionLimit(); err != nil {
-		return err
-	}
-	_, isConnectedPeer := peer.router.Routes.Unicast(toName)
-	peer.addConnection(conn)
-	if isConnectedPeer {
-		conn.Log("connection added")
-	} else {
-		conn.Log("connection added (new peer)")
-		peer.router.SendAllGossipDown(conn)
-	}
-
-	peer.router.Routes.Recalculate()
-	peer.broadcastPeerUpdate(conn.Remote())
-
-	return nil
-}
-
-func (peer *LocalPeer) handleConnectionEstablished(conn Connection) {
-	if peer.Peer != conn.Local() {
-		log.Fatal("Peer informed of active connection where peer is not the source of connection")
-	}
-	if dupConn, found := peer.connections[conn.Remote().Name]; !found || conn != dupConn {
-		conn.Shutdown(fmt.Errorf("Cannot set unknown connection active"))
-		return
-	}
-	peer.connectionEstablished(conn)
-	conn.Log("connection fully established")
-
-	peer.router.Routes.Recalculate()
-	peer.broadcastPeerUpdate()
-}
-
-func (peer *LocalPeer) handleDeleteConnection(conn Connection) {
-	if peer.Peer != conn.Local() {
-		log.Fatal("Attempt made to delete connection from peer where peer is not the source of connection")
-	}
-	if conn.Remote() == nil {
-		log.Fatal("Attempt made to delete connection to peer with unknown remote peer")
-	}
-	toName := conn.Remote().Name
-	if connFound, found := peer.connections[toName]; !found || connFound != conn {
-		return
-	}
-	peer.deleteConnection(conn)
-	conn.Log("connection deleted")
-	// Must do garbage collection first to ensure we don't send out an
-	// update with unreachable peers (can cause looping)
-	peer.router.Peers.GarbageCollect()
-	peer.router.Routes.Recalculate()
-	peer.broadcastPeerUpdate()
-}
-
-// helpers
-
-func (peer *LocalPeer) broadcastPeerUpdate(peers ...*Peer) {
-	// Some tests run without a router.  This should be fixed so
-	// that the relevant part of Router can be easily run in the
-	// context of a test, but that will involve significant
-	// reworking of tests.
-	if peer.router != nil {
-		peer.router.BroadcastTopologyUpdate(append(peers, peer.Peer))
-	}
-}
-
-func (peer *LocalPeer) checkConnectionLimit() error {
-	limit := peer.router.ConnLimit
-	if 0 != limit && peer.connectionCount() >= limit {
-		return fmt.Errorf("Connection limit reached (%v)", limit)
-	}
-	return nil
-}
-
-func (peer *LocalPeer) addConnection(conn Connection) {
-	peer.Lock()
-	defer peer.Unlock()
-	peer.connections[conn.Remote().Name] = conn
-	peer.Version++
-}
-
-func (peer *LocalPeer) deleteConnection(conn Connection) {
-	peer.Lock()
-	defer peer.Unlock()
-	delete(peer.connections, conn.Remote().Name)
-	peer.Version++
-}
-
-func (peer *LocalPeer) connectionEstablished(conn Connection) {
-	peer.Lock()
-	defer peer.Unlock()
-	peer.Version++
-}
-
-func (peer *LocalPeer) connectionCount() int {
-	peer.RLock()
-	defer peer.RUnlock()
-	return len(peer.connections)
-}
-
-func (peer *LocalPeer) setShortID(shortID PeerShortID) {
-	peer.Lock()
-	defer peer.Unlock()
-	peer.ShortID = shortID
-	peer.Version++
-}
-
-func (peer *LocalPeer) setVersionBeyond(version uint64) bool {
-	peer.Lock()
-	defer peer.Unlock()
-	if version >= peer.Version {
-		peer.Version = version + 1
-		return true
-	}
-	return false
-}

mesh/mocks_test.go

@@ -1,115 +0,0 @@
-// No mocks are tested by this file.
-//
-// It supplies some mock implementations to other unit tests, and is
-// named "...test.go" so it is only compiled under `go test`.
-
-package mesh
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// Add to peers a connection from peers.ourself to p
-func (peers *Peers) AddTestConnection(p *Peer) {
-	summary := p.PeerSummary
-	summary.Version = 0
-	toPeer := NewPeerFromSummary(summary)
-	peers.FetchWithDefault(toPeer) // Has side-effect of incrementing refcount
-	conn := newMockConnection(peers.ourself.Peer, toPeer)
-	peers.ourself.addConnection(conn)
-	peers.ourself.connectionEstablished(conn)
-}
-
-// Add to peers a connection from p1 to p2
-func (peers *Peers) AddTestRemoteConnection(p1, p2 *Peer) {
-	fromPeer := NewPeerFrom(p1)
-	fromPeer = peers.FetchWithDefault(fromPeer)
-	toPeer := NewPeerFrom(p2)
-	toPeer = peers.FetchWithDefault(toPeer)
-	peers.ourself.addConnection(&RemoteConnection{fromPeer, toPeer, "", false, false})
-}
-
-func (peers *Peers) DeleteTestConnection(p *Peer) {
-	toName := p.Name
-	toPeer := peers.Fetch(toName)
-	peers.Dereference(toPeer)
-	conn, _ := peers.ourself.ConnectionTo(toName)
-	peers.ourself.deleteConnection(conn)
-}
-
-// mockConnection used in testing is very similar to a
-// RemoteConnection, without the RemoteTCPAddr(). We are making it a
-// separate type in order to distinguish what is created by the test
-// from what is created by the real code.
-func newMockConnection(from, to *Peer) Connection {
-	type mockConnection struct{ RemoteConnection }
-	return &mockConnection{RemoteConnection{from, to, "", false, false}}
-}
-
-func checkEqualConns(t *testing.T, ourName PeerName, got, wanted map[PeerName]Connection) {
-	checkConns := make(PeerNameSet)
-	for _, conn := range wanted {
-		checkConns[conn.Remote().Name] = void
-	}
-	for _, conn := range got {
-		remoteName := conn.Remote().Name
-		if _, found := checkConns[remoteName]; found {
-			delete(checkConns, remoteName)
-		} else {
-			require.FailNow(t, fmt.Sprintf("Unexpected connection from %s to %s", ourName, remoteName))
-		}
-	}
-	if len(checkConns) > 0 {
-		require.FailNow(t, fmt.Sprintf("Expected connections not found: from %s to %v", ourName, checkConns))
-	}
-}
-
-// Get all the peers from a Peers in a slice
-func (peers *Peers) allPeers() []*Peer {
-	var res []*Peer
-	for _, peer := range peers.byName {
-		res = append(res, peer)
-	}
-	return res
-}
-
-func (peers *Peers) allPeersExcept(excludeName PeerName) []*Peer {
-	res := peers.allPeers()
-	for i, peer := range res {
-		if peer.Name == excludeName {
-			return append(res[:i], res[i+1:]...)
-		}
-	}
-	return res
-}
-
-// Check that the peers slice matches the wanted peers
-func checkPeerArray(t *testing.T, peers []*Peer, wantedPeers ...*Peer) {
-	checkTopologyPeers(t, false, peers, wantedPeers...)
-}
-
-// Check that the peers slice matches the wanted peers and optionally
-// all of their connections
-func checkTopologyPeers(t *testing.T, checkConns bool, peers []*Peer, wantedPeers ...*Peer) {
-	check := make(map[PeerName]*Peer)
-	for _, peer := range wantedPeers {
-		check[peer.Name] = peer
-	}
-	for _, peer := range peers {
-		name := peer.Name
-		if wantedPeer, found := check[name]; found {
-			if checkConns {
-				checkEqualConns(t, name, peer.connections, wantedPeer.connections)
-			}
-			delete(check, name)
-		} else {
-			require.FailNow(t, fmt.Sprintf("Unexpected peer: %s", name))
-		}
-	}
-	if len(check) > 0 {
-		require.FailNow(t, fmt.Sprintf("Expected peers not found: %v", check))
-	}
-}

mesh/peer.go

@@ -1,173 +0,0 @@
-package mesh
-
-import (
-	"crypto/rand"
-	"encoding/binary"
-	"fmt"
-	"sort"
-	"strconv"
-)
-
-func randBytes(n int) []byte {
-	buf := make([]byte, n)
-	_, err := rand.Read(buf)
-	checkFatal(err)
-	return buf
-}
-
-func randUint64() (r uint64) {
-	return binary.LittleEndian.Uint64(randBytes(8))
-}
-
-func randUint16() (r uint16) {
-	return binary.LittleEndian.Uint16(randBytes(2))
-}
-
-type PeerUID uint64
-
-func randomPeerUID() PeerUID {
-	return PeerUID(randUint64())
-}
-
-func ParsePeerUID(s string) (PeerUID, error) {
-	uid, err := strconv.ParseUint(s, 10, 64)
-	return PeerUID(uid), err
-}
-
-// Short IDs exist for the sake of fast datapath.  They are 12 bits,
-// randomly assigned, but we detect and recover from collisions.  This
-// does limit us to 4096 peers, but that should be sufficient for a
-// while.
-type PeerShortID uint16
-
-const PeerShortIDBits = 12
-
-func randomPeerShortID() PeerShortID {
-	return PeerShortID(randUint16() & (1<<PeerShortIDBits - 1))
-}
-
-type PeerSummary struct {
-	NameByte   []byte
-	NickName   string
-	UID        PeerUID
-	Version    uint64
-	ShortID    PeerShortID
-	HasShortID bool
-}
-
-type Peer struct {
-	Name PeerName
-	PeerSummary
-	localRefCount uint64 // maintained by Peers
-	connections   map[PeerName]Connection
-}
-
-type ListOfPeers []*Peer
-
-func (lop ListOfPeers) Len() int {
-	return len(lop)
-}
-func (lop ListOfPeers) Swap(i, j int) {
-	lop[i], lop[j] = lop[j], lop[i]
-}
-func (lop ListOfPeers) Less(i, j int) bool {
-	return lop[i].Name < lop[j].Name
-}
-
-type ConnectionSet map[Connection]struct{}
-
-func NewPeerFromSummary(summary PeerSummary) *Peer {
-	return &Peer{
-		Name:        PeerNameFromBin(summary.NameByte),
-		PeerSummary: summary,
-		connections: make(map[PeerName]Connection),
-	}
-}
-
-func NewPeer(name PeerName, nickName string, uid PeerUID, version uint64, shortID PeerShortID) *Peer {
-	return NewPeerFromSummary(PeerSummary{
-		NameByte:   name.Bin(),
-		NickName:   nickName,
-		UID:        uid,
-		Version:    version,
-		ShortID:    shortID,
-		HasShortID: true,
-	})
-}
-
-func NewPeerFrom(peer *Peer) *Peer {
-	return NewPeerFromSummary(peer.PeerSummary)
-}
-
-func (peer *Peer) String() string {
-	return fmt.Sprint(peer.Name, "(", peer.NickName, ")")
-}
-
-// Calculate the routing table from this peer to all peers reachable
-// from it, returning a "next hop" map of PeerNameX -> PeerNameY,
-// which says "in order to send a message to X, the peer should send
-// the message to its neighbour Y".
-//
-// Because currently we do not have weightings on the connections
-// between peers, there is no need to use a minimum spanning tree
-// algorithm. Instead we employ the simpler and cheaper breadth-first
-// widening. The computation is deterministic, which ensures that when
-// it is performed on the same data by different peers, they get the
-// same result. This is important since otherwise we risk message loss
-// or routing cycles.
-//
-// When the 'establishedAndSymmetric' flag is set, only connections
-// that are marked as 'established' and are symmetric (i.e. where both
-// sides indicate they have a connection to the other) are considered.
-//
-// When a non-nil stopAt peer is supplied, the widening stops when it
-// reaches that peer. The boolean return indicates whether that has
-// happened.
-//
-// NB: This function should generally be invoked while holding a read
-// lock on Peers and LocalPeer.
-func (peer *Peer) Routes(stopAt *Peer, establishedAndSymmetric bool) (bool, map[PeerName]PeerName) {
-	routes := make(unicastRoutes)
-	routes[peer.Name] = UnknownPeerName
-	nextWorklist := []*Peer{peer}
-	for len(nextWorklist) > 0 {
-		worklist := nextWorklist
-		sort.Sort(ListOfPeers(worklist))
-		nextWorklist = []*Peer{}
-		for _, curPeer := range worklist {
-			if curPeer == stopAt {
-				return true, routes
-			}
-			curPeer.ForEachConnectedPeer(establishedAndSymmetric, routes,
-				func(remotePeer *Peer) {
-					nextWorklist = append(nextWorklist, remotePeer)
-					remoteName := remotePeer.Name
-					// We now know how to get to remoteName: the same
-					// way we get to curPeer. Except, if curPeer is
-					// the starting peer in which case we know we can
-					// reach remoteName directly.
-					if curPeer == peer {
-						routes[remoteName] = remoteName
-					} else {
-						routes[remoteName] = routes[curPeer.Name]
-					}
-				})
-		}
-	}
-	return false, routes
-}
-
-func (peer *Peer) ForEachConnectedPeer(establishedAndSymmetric bool, exclude map[PeerName]PeerName, f func(*Peer)) {
-	for remoteName, conn := range peer.connections {
-		if establishedAndSymmetric && !conn.Established() {
-			continue
-		}
-		if _, found := exclude[remoteName]; found {
-			continue
-		}
-		remotePeer := conn.Remote()
-		if remoteConn, found := remotePeer.connections[peer.Name]; !establishedAndSymmetric || (found && remoteConn.Established()) {
-			f(remotePeer)
-		}
-	}
-}

mesh/peer_name_mac.go

@@ -1,75 +0,0 @@
-// The !peer_name_alternative effectively makes this the default,
-// i.e. to choose an alternative, run "go build -tags
-// 'peer_name_alternative peer_name_hash'"
-
-// +build peer_name_mac !peer_name_alternative
-
-// Let peer names be MACs...
-//
-// MACs need to be unique across our network, or bad things will
-// happen anyway. So they make pretty good candidates for peer
-// names. And doing so is pretty efficient both computationally and
-// network overhead wise.
-//
-// Note that we do not mandate *what* MAC should be used as the peer
-// name. In particular it doesn't actually have to be the MAC of, say,
-// the network interface the peer is sniffing on.
-
-package mesh
-
-import (
-	"net"
-)
-
-// PeerName is used as a map key. Since net.HardwareAddr isn't
-// suitable for that - it's a slice, and slices can't be map keys - we
-// convert that to/from uint64.
-type PeerName uint64
-
-const (
-	PeerNameFlavour = "mac"
-	NameSize        = 6
-	UnknownPeerName = PeerName(0)
-)
-
-func PeerNameFromUserInput(userInput string) (PeerName, error) {
-	res, err := PeerNameFromString(userInput)
-	return res, err
-}
-
-func PeerNameFromString(nameStr string) (PeerName, error) {
-	mac, err := net.ParseMAC(nameStr)
-	if err != nil {
-		return UnknownPeerName, err
-	}
-	return PeerName(macint(mac)), nil
-}
-
-func PeerNameFromBin(nameByte []byte) PeerName {
-	return PeerName(macint(net.HardwareAddr(nameByte)))
-}
-
-func (name PeerName) Bin() []byte {
-	return intmac(uint64(name))
-}
-
-func (name PeerName) String() string {
-	return intmac(uint64(name)).String()
-}
-
-func macint(mac net.HardwareAddr) (r uint64) {
-	for _, b := range mac {
-		r <<= 8
-		r |= uint64(b)
-	}
-	return
-}
-
-func intmac(key uint64) (r net.HardwareAddr) {
-	r = make([]byte, 6)
-	for i := 5; i >= 0; i-- {
-		r[i] = byte(key)
-		key >>= 8
-	}
-	return
-}

mesh/peers_test.go

@@ -1,376 +0,0 @@
-package mesh
-
-import (
-	"fmt"
-	"math/rand"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-// TODO we should also test:
-//
-// - applying an incremental update, including the case where that
-//   leads to an UnknownPeerError
-//
-// - the "improved update" calculation
-//
-// - non-gc of peers that are only referenced locally
-
-func newNode(name PeerName) (*Peer, *Peers) {
-	peer := NewLocalPeer(name, "", nil)
-	peers := NewPeers(peer)
-	return peer.Peer, peers
-}
-
-// Check that ApplyUpdate copies the whole topology from peers
-func checkApplyUpdate(t *testing.T, peers *Peers) {
-	dummyName, _ := PeerNameFromString("99:00:00:01:00:00")
-	// We need a new node outside of the network, with a connection
-	// into it.
-	_, testBedPeers := newNode(dummyName)
-	testBedPeers.AddTestConnection(peers.ourself.Peer)
-	testBedPeers.ApplyUpdate(peers.EncodePeers(peers.Names()))
-
-	checkTopologyPeers(t, true, testBedPeers.allPeersExcept(dummyName), peers.allPeers()...)
-}
-
-func TestPeersEncoding(t *testing.T) {
-	const numNodes = 20
-	const numIters = 1000
-	var peer [numNodes]*Peer
-	var ps [numNodes]*Peers
-	for i := 0; i < numNodes; i++ {
-		name, _ := PeerNameFromString(fmt.Sprintf("%02d:00:00:01:00:00", i))
-		peer[i], ps[i] = newNode(name)
-	}
-
-	var conns []struct{ from, to int }
-	for i := 0; i < numIters; i++ {
-		oper := rand.Intn(2)
-		switch oper {
-		case 0:
-			from, to := rand.Intn(numNodes), rand.Intn(numNodes)
-			if from != to {
-				if _, found := peer[from].connections[peer[to].Name]; !found {
-					ps[from].AddTestConnection(peer[to])
-					conns = append(conns, struct{ from, to int }{from, to})
-					checkApplyUpdate(t, ps[from])
-				}
-			}
-		case 1:
-			if len(conns) > 0 {
-				n := rand.Intn(len(conns))
-				c := conns[n]
-				ps[c.from].DeleteTestConnection(peer[c.to])
-				ps[c.from].GarbageCollect()
-				checkApplyUpdate(t, ps[c.from])
-				conns = append(conns[:n], conns[n+1:]...)
-			}
-		}
-	}
-}
-
-func garbageCollect(peers *Peers) []*Peer {
-	var removed []*Peer
-	peers.OnGC(func(peer *Peer) { removed = append(removed, peer) })
-	peers.GarbageCollect()
-	return removed
-}
-
-func TestPeersGarbageCollection(t *testing.T) {
-	const (
-		peer1NameString = "01:00:00:01:00:00"
-		peer2NameString = "02:00:00:02:00:00"
-		peer3NameString = "03:00:00:03:00:00"
-	)
-	var (
-		peer1Name, _ = PeerNameFromString(peer1NameString)
-		peer2Name, _ = PeerNameFromString(peer2NameString)
-		peer3Name, _ = PeerNameFromString(peer3NameString)
-	)
-
-	// Create some peers with some connections to each other
-	p1, ps1 := newNode(peer1Name)
-	p2, ps2 := newNode(peer2Name)
-	p3, ps3 := newNode(peer3Name)
-	ps1.AddTestConnection(p2)
-	ps2.AddTestRemoteConnection(p1, p2)
-	ps2.AddTestConnection(p1)
-	ps2.AddTestConnection(p3)
-	ps3.AddTestConnection(p1)
-	ps1.AddTestConnection(p3)
-	ps2.AddTestRemoteConnection(p1, p3)
-	ps2.AddTestRemoteConnection(p3, p1)
-
-	// Every peer is referenced, so nothing should be dropped
-	require.Empty(t, garbageCollect(ps1), "peers removed")
-	require.Empty(t, garbageCollect(ps2), "peers removed")
-	require.Empty(t, garbageCollect(ps3), "peers removed")
-
-	// Drop the connection from 2 to 3, and 3 isn't garbage-collected
-	// because 1 has a connection to 3
-	ps2.DeleteTestConnection(p3)
-	require.Empty(t, garbageCollect(ps2), "peers removed")
-
-	// Drop the connection from 1 to 3, and 3 will get removed by
-	// garbage-collection
-	ps1.DeleteTestConnection(p3)
-	checkPeerArray(t, garbageCollect(ps1), p3)
-}
-
-func TestShortIDCollisions(t *testing.T) {
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
-	_, peers := newNode(PeerName(1 << PeerShortIDBits))
-
-	// Make enough peers that short id collisions are
-	// overwhelmingly likely
-	ps := make([]*Peer, 1<<PeerShortIDBits)
-	for i := 0; i < 1<<PeerShortIDBits; i++ {
-		ps[i] = NewPeer(PeerName(i), "", PeerUID(i), 0,
-			PeerShortID(rng.Intn(1<<PeerShortIDBits)))
-	}
-
-	shuffle := func() {
-		for i := range ps {
-			j := rng.Intn(i + 1)
-			ps[i], ps[j] = ps[j], ps[i]
-		}
-	}
-
-	// Fill peers
-	shuffle()
-	var pending PeersPendingNotifications
-	for _, p := range ps {
-		peers.addByShortID(p, &pending)
-	}
-
-	// Check invariants
-	counts := make([]int, 1<<PeerShortIDBits)
-	saw := func(p *Peer) {
-		if p != peers.ourself.Peer {
-			counts[p.UID]++
-		}
-	}
-
-	for shortID, entry := range peers.byShortID {
-		if entry.peer == nil {
-			// no principal peer for this short id, so
-			// others must be empty
-			require.Empty(t, entry.others)
-			continue
-		}
-
-		require.Equal(t, shortID, entry.peer.ShortID)
-		saw(entry.peer)
-
-		for _, p := range entry.others {
-			saw(p)
-			require.Equal(t, shortID, p.ShortID)
-
-			// the principal peer should have the lowest name
-			require.True(t, p.Name > entry.peer.Name)
-		}
-	}
-
-	// Check that every peer was seen
-	for _, n := range counts {
-		require.Equal(t, 1, n)
-	}
-
-	// Delete all the peers
-	shuffle()
-	for _, p := range ps {
-		peers.deleteByShortID(p, &pending)
-	}
-
-	for _, entry := range peers.byShortID {
-		if entry.peer != peers.ourself.Peer {
-			require.Nil(t, entry.peer)
-		}
-
-		require.Empty(t, entry.others)
-	}
-}
-
-// Test the easy case of short id reassignment, when few short ids are taken
-func TestShortIDReassignmentEasy(t *testing.T) {
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
-	_, peers := newNode(PeerName(0))
-
-	for i := 1; i <= 10; i++ {
-		peers.FetchWithDefault(NewPeer(PeerName(i), "", PeerUID(i), 0,
-			PeerShortID(rng.Intn(1<<PeerShortIDBits))))
-	}
-
-	checkShortIDReassignment(t, peers)
-}
-
-// Test the hard case of short id reassignment, when most short ids are taken
-func TestShortIDReassignmentHard(t *testing.T) {
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
-	_, peers := newNode(PeerName(1 << PeerShortIDBits))
-
-	// Take all short ids
-	ps := make([]*Peer, 1<<PeerShortIDBits)
-	var pending PeersPendingNotifications
-	for i := 0; i < 1<<PeerShortIDBits; i++ {
-		ps[i] = NewPeer(PeerName(i), "", PeerUID(i), 0,
-			PeerShortID(i))
-		peers.addByShortID(ps[i], &pending)
-	}
-
-	// As all short ids are taken, an attempted reassigment won't
-	// do anything
-	oldShortID := peers.ourself.ShortID
-	require.False(t, peers.reassignLocalShortID(&pending))
-	require.Equal(t, oldShortID, peers.ourself.ShortID)
-
-	// Free up a few ids
-	for i := 0; i < 10; i++ {
-		x := rng.Intn(len(ps))
-		if ps[x] != nil {
-			peers.deleteByShortID(ps[x], &pending)
-			ps[x] = nil
-		}
-	}
-
-	checkShortIDReassignment(t, peers)
-}
-
-func checkShortIDReassignment(t *testing.T, peers *Peers) {
-	oldShortID := peers.ourself.ShortID
-	peers.reassignLocalShortID(&PeersPendingNotifications{})
-	require.NotEqual(t, oldShortID, peers.ourself.ShortID)
-	require.Equal(t, peers.ourself.Peer, peers.byShortID[peers.ourself.ShortID].peer)
-}
-
-func TestShortIDInvalidation(t *testing.T) {
-	_, peers := newNode(PeerName(1 << PeerShortIDBits))
-
-	// need to use a short id that is not the local peer's
-	shortID := peers.ourself.ShortID + 1
-
-	var pending PeersPendingNotifications
-
-	requireInvalidateShortIDs := func(expect bool) {
-		require.Equal(t, expect, pending.invalidateShortIDs)
-		pending.invalidateShortIDs = false
-	}
-
-	// The use of a fresh short id does not cause invalidation
-	a := NewPeer(PeerName(1), "", PeerUID(1), 0, shortID)
-	peers.addByShortID(a, &pending)
-	requireInvalidateShortIDs(false)
-
-	// An addition which does not change the mapping
-	b := NewPeer(PeerName(2), "", PeerUID(2), 0, shortID)
-	peers.addByShortID(b, &pending)
-	requireInvalidateShortIDs(false)
-
-	// An addition which does change the mapping
-	c := NewPeer(PeerName(0), "", PeerUID(0), 0, shortID)
-	peers.addByShortID(c, &pending)
-	requireInvalidateShortIDs(true)
-
-	// A deletion which does not change the mapping
-	peers.deleteByShortID(b, &pending)
-	requireInvalidateShortIDs(false)
-
-	// A deletion which does change the mapping
-	peers.deleteByShortID(c, &pending)
-	requireInvalidateShortIDs(true)
-
-	// Deleting the last peer with a short id does not cause invalidation
-	peers.deleteByShortID(a, &pending)
-	requireInvalidateShortIDs(false)
-
-	// .. but subsequent reuse of that short id does cause invalidation
-	peers.addByShortID(a, &pending)
-	requireInvalidateShortIDs(true)
-}
-
-func TestShortIDPropagation(t *testing.T) {
-	_, peers1 := newNode(PeerName(1))
-	_, peers2 := newNode(PeerName(2))
-
-	peers1.AddTestConnection(peers2.ourself.Peer)
-	peers1.ApplyUpdate(peers2.EncodePeers(peers2.Names()))
-	peers12 := peers1.Fetch(PeerName(2))
-	old := peers12.PeerSummary
-
-	require.True(t,
-		peers2.reassignLocalShortID(&PeersPendingNotifications{}))
-	peers1.ApplyUpdate(peers2.EncodePeers(peers2.Names()))
-	require.NotEqual(t, old.Version, peers12.Version)
-	require.NotEqual(t, old.ShortID, peers12.ShortID)
-}
-
-func TestShortIDCollision(t *testing.T) {
-	// Create 3 peers
-	_, peers1 := newNode(PeerName(1))
-	_, peers2 := newNode(PeerName(2))
-	_, peers3 := newNode(PeerName(3))
-
-	var pending PeersPendingNotifications
-	peers1.setLocalShortID(1, &pending)
-	peers2.setLocalShortID(2, &pending)
-	peers3.setLocalShortID(3, &pending)
-
-	peers2.AddTestConnection(peers1.ourself.Peer)
-	peers3.AddTestConnection(peers2.ourself.Peer)
-
-	// Propogate from 1 to 2 to 3
-	peers2.ApplyUpdate(peers1.EncodePeers(peers1.Names()))
-	peers3.ApplyUpdate(peers2.EncodePeers(peers2.Names()))
-
-	// Force the short id of peer 1 to collide with peer 2.  Peer
-	// 1 has the lowest name, so it gets to keep the short id
-	peers1.setLocalShortID(2, &pending)
-
-	oldShortID := peers2.ourself.ShortID
-	_, updated, _ := peers2.ApplyUpdate(peers1.EncodePeers(peers1.Names()))
-
-	// peer 2 should have noticed the collision and resolved it
-	require.NotEqual(t, oldShortID, peers2.ourself.ShortID)
-
-	// The Peers do not have a Router, so broadcastPeerUpdate does
-	// nothing in the context of this test.  So we fake what it
-	// would do.
-	updated[PeerName(2)] = void
-
-	// the update from peer 2 should include its short id change
-	peers3.ApplyUpdate(peers2.EncodePeers(updated))
-	require.Equal(t, peers2.ourself.ShortID,
-		peers3.Fetch(PeerName(2)).ShortID)
-}
-
-// Test the case where all short ids are taken, but then some peers go
-// away, so the local peer reassigns
-func TestDeferredShortIDReassignment(t *testing.T) {
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
-	_, us := newNode(PeerName(1 << PeerShortIDBits))
-
-	// Connect us to other peers occupying all short ids
-	others := make([]*Peers, 1<<PeerShortIDBits)
-	var pending PeersPendingNotifications
-	for i := range others {
-		_, others[i] = newNode(PeerName(i))
-		others[i].setLocalShortID(PeerShortID(i), &pending)
-		us.AddTestConnection(others[i].ourself.Peer)
-	}
-
-	// Check that, as expected, the local peer does not own its
-	// short id
-	require.NotEqual(t, us.ourself.Peer,
-		us.byShortID[us.ourself.ShortID].peer)
-
-	// Disconnect one peer, and we should now be able to claim its
-	// short id
-	other := others[rng.Intn(1<<PeerShortIDBits)]
-	us.DeleteTestConnection(other.ourself.Peer)
-	us.GarbageCollect()
-
-	require.Equal(t, us.ourself.Peer, us.byShortID[us.ourself.ShortID].peer)
-}

mesh/protocol_crypto.go

@@ -1,180 +0,0 @@
-package mesh
-
-import (
-	"crypto/rand"
-	"crypto/sha256"
-	"encoding/binary"
-	"encoding/gob"
-	"fmt"
-	"io"
-	"sync"
-
-	"golang.org/x/crypto/nacl/box"
-	"golang.org/x/crypto/nacl/secretbox"
-)
-
-const MaxTCPMsgSize = 10 * 1024 * 1024
-
-func GenerateKeyPair() (publicKey, privateKey *[32]byte, err error) {
-	return box.GenerateKey(rand.Reader)
-}
-
-func FormSessionKey(remotePublicKey, localPrivateKey *[32]byte, secretKey []byte) *[32]byte {
-	var sharedKey [32]byte
-	box.Precompute(&sharedKey, remotePublicKey, localPrivateKey)
-	sharedKeySlice := sharedKey[:]
-	sharedKeySlice = append(sharedKeySlice, secretKey...)
-	sessionKey := sha256.Sum256(sharedKeySlice)
-	return &sessionKey
-}
-
-// TCP Senders/Receivers
-
-// The lowest 64 bits of the nonce contain the message sequence
-// number. The top most bit indicates the connection polarity at the
-// sender - '1' for outbound; the next indicates protocol type - '1'
-// for TCP. The remaining 126 bits are zero. The polarity is needed so
-// that the two ends of a connection do not use the same nonces; the
-// protocol type so that the TCP connection nonces are distinct from
-// nonces used by overlay connections, if they share the session key.
-// This is a requirement of the NaCl Security Model; see
-// http://nacl.cr.yp.to/box.html.
-type TCPCryptoState struct {
-	sessionKey *[32]byte
-	nonce      [24]byte
-	seqNo      uint64
-}
-
-func NewTCPCryptoState(sessionKey *[32]byte, outbound bool) *TCPCryptoState {
-	s := &TCPCryptoState{sessionKey: sessionKey}
-	if outbound {
-		s.nonce[0] |= (1 << 7)
-	}
-	s.nonce[0] |= (1 << 6)
-	return s
-}
-
-func (s *TCPCryptoState) advance() {
-	s.seqNo++
-	binary.BigEndian.PutUint64(s.nonce[16:24], s.seqNo)
-}
-
-type TCPSender interface {
-	Send([]byte) error
-}
-
-type GobTCPSender struct {
-	encoder *gob.Encoder
-}
-
-type LengthPrefixTCPSender struct {
-	writer io.Writer
-}
-
-type EncryptedTCPSender struct {
-	sync.RWMutex
-	sender TCPSender
-	state  *TCPCryptoState
-}
-
-func NewGobTCPSender(encoder *gob.Encoder) *GobTCPSender {
-	return &GobTCPSender{encoder: encoder}
-}
-
-func (sender *GobTCPSender) Send(msg []byte) error {
-	return sender.encoder.Encode(msg)
-}
-
-func NewLengthPrefixTCPSender(writer io.Writer) *LengthPrefixTCPSender {
-	return &LengthPrefixTCPSender{writer: writer}
-}
-
-func (sender *LengthPrefixTCPSender) Send(msg []byte) error {
-	l := len(msg)
-	if l > MaxTCPMsgSize {
-		return fmt.Errorf("outgoing message exceeds maximum size: %d > %d", l, MaxTCPMsgSize)
-	}
-	// We copy the message so we can send it in a single Write
-	// operation, thus making this thread-safe without locking.
-	prefixedMsg := make([]byte, 4+l)
-	binary.BigEndian.PutUint32(prefixedMsg, uint32(l))
-	copy(prefixedMsg[4:], msg)
-	_, err := sender.writer.Write(prefixedMsg)
-	return err
-}
-
-func NewEncryptedTCPSender(sender TCPSender, sessionKey *[32]byte, outbound bool) *EncryptedTCPSender {
-	return &EncryptedTCPSender{sender: sender, state: NewTCPCryptoState(sessionKey, outbound)}
-}
-
-func (sender *EncryptedTCPSender) Send(msg []byte) error {
-	sender.Lock()
-	defer sender.Unlock()
-	encodedMsg := secretbox.Seal(nil, msg, &sender.state.nonce, sender.state.sessionKey)
-	sender.state.advance()
-	return sender.sender.Send(encodedMsg)
-}
-
-type TCPReceiver interface {
-	Receive() ([]byte, error)
-}
-
-type GobTCPReceiver struct {
-	decoder *gob.Decoder
-}
-
-type LengthPrefixTCPReceiver struct {
-	reader io.Reader
-}
-
-type EncryptedTCPReceiver struct {
-	receiver TCPReceiver
-	state    *TCPCryptoState
-}
-
-func NewGobTCPReceiver(decoder *gob.Decoder) *GobTCPReceiver {
-	return &GobTCPReceiver{decoder: decoder}
-}
-
-func (receiver *GobTCPReceiver) Receive() ([]byte, error) {
-	var msg []byte
-	err := receiver.decoder.Decode(&msg)
-	return msg, err
-}
-
-func NewLengthPrefixTCPReceiver(reader io.Reader) *LengthPrefixTCPReceiver {
-	return &LengthPrefixTCPReceiver{reader: reader}
-}
-
-func (receiver *LengthPrefixTCPReceiver) Receive() ([]byte, error) {
-	lenPrefix := make([]byte, 4)
-	if _, err := io.ReadFull(receiver.reader, lenPrefix); err != nil {
-		return nil, err
-	}
-	l := binary.BigEndian.Uint32(lenPrefix)
-	if l > MaxTCPMsgSize {
-		return nil, fmt.Errorf("incoming message exceeds maximum size: %d > %d", l, MaxTCPMsgSize)
-	}
-	msg := make([]byte, l)
-	_, err := io.ReadFull(receiver.reader, msg)
-	return msg, err
-}
-
-func NewEncryptedTCPReceiver(receiver TCPReceiver, sessionKey *[32]byte, outbound bool) *EncryptedTCPReceiver {
-	return &EncryptedTCPReceiver{receiver: receiver, state: NewTCPCryptoState(sessionKey, !outbound)}
-}
-
-func (receiver *EncryptedTCPReceiver) Receive() ([]byte, error) {
-	msg, err := receiver.receiver.Receive()
-	if err != nil {
-		return nil, err
-	}
-
-	decodedMsg, success := secretbox.Open(nil, msg, &receiver.state.nonce, receiver.state.sessionKey)
-	if !success {
-		return nil, fmt.Errorf("Unable to decrypt TCP msg")
-	}
-
-	receiver.state.advance()
-	return decodedMsg, nil
-}

mesh/protocol_test.go

@@ -1,96 +0,0 @@
-package mesh
-
-import (
-	"io"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-type testConn struct {
-	io.Writer
-	io.Reader
-}
-
-func (testConn) SetDeadline(t time.Time) error {
-	return nil
-}
-
-func (testConn) SetReadDeadline(t time.Time) error {
-	return nil
-}
-
-func (testConn) SetWriteDeadline(t time.Time) error {
-	return nil
-}
-
-func connPair() (ProtocolIntroConn, ProtocolIntroConn) {
-	a := testConn{}
-	b := testConn{}
-	a.Reader, b.Writer = io.Pipe()
-	b.Reader, a.Writer = io.Pipe()
-	return &a, &b
-}
-
-func doIntro(t *testing.T, params ProtocolIntroParams) <-chan ProtocolIntroResults {
-	ch := make(chan ProtocolIntroResults, 1)
-	go func() {
-		res, err := params.DoIntro()
-		require.Nil(t, err)
-		ch <- res
-	}()
-	return ch
-}
-
-func doProtocolIntro(t *testing.T, aver, bver byte, password []byte) byte {
-	aconn, bconn := connPair()
-	aresch := doIntro(t, ProtocolIntroParams{
-		MinVersion: ProtocolMinVersion,
-		MaxVersion: aver,
-		Features:   map[string]string{"Name": "A"},
-		Conn:       aconn,
-		Outbound:   true,
-		Password:   password,
-	})
-	bresch := doIntro(t, ProtocolIntroParams{
-		MinVersion: ProtocolMinVersion,
-		MaxVersion: bver,
-		Features:   map[string]string{"Name": "B"},
-		Conn:       bconn,
-		Outbound:   false,
-		Password:   password,
-	})
-	ares := <-aresch
-	bres := <-bresch
-
-	// Check that features were conveyed
-	require.Equal(t, "B", ares.Features["Name"])
-	require.Equal(t, "A", bres.Features["Name"])
-
-	// Check that Senders and Receivers work
-	go func() {
-		require.Nil(t, ares.Sender.Send([]byte("Hello from A")))
-		require.Nil(t, bres.Sender.Send([]byte("Hello from B")))
-	}()
-
-	data, err := bres.Receiver.Receive()
-	require.Nil(t, err)
-	require.Equal(t, "Hello from A", string(data))
-
-	data, err = ares.Receiver.Receive()
-	require.Nil(t, err)
-	require.Equal(t, "Hello from B", string(data))
-
-	require.Equal(t, ares.Version, bres.Version)
-	return ares.Version
-}
-
-func TestProtocolIntro(t *testing.T) {
-	require.Equal(t, 2, int(doProtocolIntro(t, 2, 2, nil)))
-	require.Equal(t, 2, int(doProtocolIntro(t, 2, 2, []byte("sekr1t"))))
-	require.Equal(t, 1, int(doProtocolIntro(t, 1, 2, nil)))
-	require.Equal(t, 1, int(doProtocolIntro(t, 1, 2, []byte("pa55"))))
-	require.Equal(t, 1, int(doProtocolIntro(t, 2, 1, nil)))
-	require.Equal(t, 1, int(doProtocolIntro(t, 2, 1, []byte("w0rd"))))
-}

mesh/router.go

@@ -1,191 +0,0 @@
-package mesh
-
-import (
-	"fmt"
-	"math"
-	"net"
-	"sync"
-	"time"
-
-	"github.com/weaveworks/weave/common"
-)
-
-const (
-	Port           = 6783
-	ChannelSize    = 16
-	TCPHeartbeat   = 30 * time.Second
-	GossipInterval = 30 * time.Second
-	MaxDuration    = time.Duration(math.MaxInt64)
-
-	acceptMaxTokens  = 100                    // [1]
-	acceptTokenDelay = 100 * time.Millisecond // [2]
-)
-
-// [1] capacity of token bucket for rate limiting accepts
-
-// [2] control rate at which new tokens are added to the bucket
-
-var (
-	log        = common.Log
-	checkFatal = common.CheckFatal
-	checkWarn  = common.CheckWarn
-)
-
-type Config struct {
-	Port               int
-	ProtocolMinVersion byte
-	Password           []byte
-	ConnLimit          int
-	PeerDiscovery      bool
-}
-
-type Router struct {
-	Config
-	Overlay         Overlay
-	Ourself         *LocalPeer
-	Peers           *Peers
-	Routes          *Routes
-	ConnectionMaker *ConnectionMaker
-	gossipLock      sync.RWMutex
-	gossipChannels  GossipChannels
-	TopologyGossip  Gossip
-	acceptLimiter   *TokenBucket
-}
-
-func NewRouter(config Config, name PeerName, nickName string, overlay Overlay) *Router {
-	router := &Router{Config: config, gossipChannels: make(GossipChannels)}
-
-	if overlay == nil {
-		overlay = NullOverlay{}
-	}
-
-	router.Overlay = overlay
-	router.Ourself = NewLocalPeer(name, nickName, router)
-	router.Peers = NewPeers(router.Ourself)
-	router.Peers.OnGC(func(peer *Peer) {
-		log.Println("Removed unreachable peer", peer)
-	})
-	router.Routes = NewRoutes(router.Ourself, router.Peers)
-	router.ConnectionMaker = NewConnectionMaker(router.Ourself, router.Peers, router.Port, router.PeerDiscovery)
-	router.TopologyGossip = router.NewGossip("topology", router)
-	router.acceptLimiter = NewTokenBucket(acceptMaxTokens, acceptTokenDelay)
-
-	return router
-}
-
-// Start listening for TCP connections. This is separate from
-// NewRouter so that gossipers can register before we start forming
-// connections.
-func (router *Router) Start() {
-	router.listenTCP(router.Port)
-}
-
-func (router *Router) Stop() error {
-	// TODO: perform graceful shutdown...
-	return nil
-}
-
-func (router *Router) UsingPassword() bool {
-	return router.Password != nil
-}
-
-func (router *Router) listenTCP(localPort int) {
-	localAddr, err := net.ResolveTCPAddr("tcp4", fmt.Sprint(":", localPort))
-	checkFatal(err)
-	ln, err := net.ListenTCP("tcp4", localAddr)
-	checkFatal(err)
-	go func() {
-		defer ln.Close()
-		for {
-			tcpConn, err := ln.AcceptTCP()
-			if err != nil {
-				log.Errorln(err)
-				continue
-			}
-			router.acceptTCP(tcpConn)
-			router.acceptLimiter.Wait()
-		}
-	}()
-}
-
-func (router *Router) acceptTCP(tcpConn *net.TCPConn) {
-	remoteAddrStr := tcpConn.RemoteAddr().String()
-	log.Printf("->[%s] connection accepted", remoteAddrStr)
-	connRemote := NewRemoteConnection(router.Ourself.Peer, nil, remoteAddrStr, false, false)
-	StartLocalConnection(connRemote, tcpConn, router, true)
-}
-
-// Gossiper methods - the Router is the topology Gossiper
-
-type TopologyGossipData struct {
-	peers  *Peers
-	update PeerNameSet
-}
-
-func (router *Router) BroadcastTopologyUpdate(update []*Peer) {
-	names := make(PeerNameSet)
-	for _, p := range update {
-		names[p.Name] = void
-	}
-	router.TopologyGossip.GossipBroadcast(
-		&TopologyGossipData{peers: router.Peers, update: names})
-}
-
-func (d *TopologyGossipData) Merge(other GossipData) GossipData {
-	names := make(PeerNameSet)
-	for name := range d.update {
-		names[name] = void
-	}
-	for name := range other.(*TopologyGossipData).update {
-		names[name] = void
-	}
-	return &TopologyGossipData{peers: d.peers, update: names}
-}
-
-func (d *TopologyGossipData) Encode() [][]byte {
-	return [][]byte{d.peers.EncodePeers(d.update)}
-}
-
-func (router *Router) OnGossipUnicast(sender PeerName, msg []byte) error {
-	return fmt.Errorf("unexpected topology gossip unicast: %v", msg)
-}
-
-func (router *Router) OnGossipBroadcast(_ PeerName, update []byte) (GossipData, error) {
-	origUpdate, _, err := router.applyTopologyUpdate(update)
-	if err != nil || len(origUpdate) == 0 {
-		return nil, err
-	}
-	return &TopologyGossipData{peers: router.Peers, update: origUpdate}, nil
-}
-
-func (router *Router) Gossip() GossipData {
-	return &TopologyGossipData{peers: router.Peers, update: router.Peers.Names()}
-}
-
-func (router *Router) OnGossip(update []byte) (GossipData, error) {
-	_, newUpdate, err := router.applyTopologyUpdate(update)
-	if err != nil || len(newUpdate) == 0 {
-		return nil, err
-	}
-	return &TopologyGossipData{peers: router.Peers, update: newUpdate}, nil
-}
-
-func (router *Router) applyTopologyUpdate(update []byte) (PeerNameSet, PeerNameSet, error) {
-	origUpdate, newUpdate, err := router.Peers.ApplyUpdate(update)
-	if _, ok := err.(UnknownPeerError); err != nil && ok {
-		// That update contained a reference to a peer which wasn't
-		// itself included in the update, and we didn't know about
-		// already. We ignore this; eventually we should receive an
-		// update containing a complete topology.
-		log.Println("Topology gossip:", err)
-		return nil, nil, nil
-	}
-	if err != nil {
-		return nil, nil, err
-	}
-	if len(newUpdate) > 0 {
-		router.ConnectionMaker.Refresh()
-		router.Routes.Recalculate()
-	}
-	return origUpdate, newUpdate, nil
-}

mesh/routes.go

@@ -1,272 +0,0 @@
-package mesh
-
-import (
-	"math"
-	"sync"
-)
-
-type unicastRoutes map[PeerName]PeerName
-type broadcastRoutes map[PeerName][]PeerName
-
-type Routes struct {
-	sync.RWMutex
-	ourself      *LocalPeer
-	peers        *Peers
-	onChange     []func()
-	unicast      unicastRoutes
-	unicastAll   unicastRoutes // [1]
-	broadcast    broadcastRoutes
-	broadcastAll broadcastRoutes // [1]
-	recalculate  chan<- *struct{}
-	wait         chan<- chan struct{}
-	// [1] based on *all* connections, not just established &
-	// symmetric ones
-}
-
-func NewRoutes(ourself *LocalPeer, peers *Peers) *Routes {
-	recalculate := make(chan *struct{}, 1)
-	wait := make(chan chan struct{})
-	routes := &Routes{
-		ourself:      ourself,
-		peers:        peers,
-		unicast:      make(unicastRoutes),
-		unicastAll:   make(unicastRoutes),
-		broadcast:    make(broadcastRoutes),
-		broadcastAll: make(broadcastRoutes),
-		recalculate:  recalculate,
-		wait:         wait}
-	routes.unicast[ourself.Name] = UnknownPeerName
-	routes.unicastAll[ourself.Name] = UnknownPeerName
-	routes.broadcast[ourself.Name] = []PeerName{}
-	routes.broadcastAll[ourself.Name] = []PeerName{}
-	go routes.run(recalculate, wait)
-	return routes
-}
-
-func (routes *Routes) OnChange(callback func()) {
-	routes.Lock()
-	defer routes.Unlock()
-	routes.onChange = append(routes.onChange, callback)
-}
-
-func (routes *Routes) PeerNames() PeerNameSet {
-	return routes.peers.Names()
-}
-
-func (routes *Routes) Unicast(name PeerName) (PeerName, bool) {
-	routes.RLock()
-	defer routes.RUnlock()
-	hop, found := routes.unicast[name]
-	return hop, found
-}
-
-func (routes *Routes) UnicastAll(name PeerName) (PeerName, bool) {
-	routes.RLock()
-	defer routes.RUnlock()
-	hop, found := routes.unicastAll[name]
-	return hop, found
-}
-
-func (routes *Routes) Broadcast(name PeerName) []PeerName {
-	routes.RLock()
-	defer routes.RUnlock()
-	return routes.broadcast[name]
-}
-
-func (routes *Routes) BroadcastAll(name PeerName) []PeerName {
-	routes.RLock()
-	defer routes.RUnlock()
-	return routes.broadcastAll[name]
-}
-
-// Choose min(log2(n_peers), n_neighbouring_peers) neighbours, with a
-// random distribution that is topology-sensitive, favouring
-// neighbours at the end of "bottleneck links". We determine the
-// latter based on the unicast routing table. If a neighbour appears
-// as the value more frequently than others - meaning that we reach a
-// higher proportion of peers via that neighbour than other neighbours
-// - then it is chosen with a higher probability.
-//
-// Note that we choose log2(n_peers) *neighbours*, not
-// peers. Consequently, on sparsely connected peers this function
-// returns a higher proportion of neighbours than elsewhere. In
-// extremis, on peers with fewer than log2(n_peers) neighbours, all
-// neighbours are returned.
-func (routes *Routes) RandomNeighbours(except PeerName) PeerNameSet {
-	res := make(PeerNameSet)
-	routes.RLock()
-	defer routes.RUnlock()
-	count := int(math.Log2(float64(len(routes.unicastAll))))
-	// depends on go's random map iteration
-	for _, dst := range routes.unicastAll {
-		if dst != UnknownPeerName && dst != except {
-			res[dst] = void
-			if len(res) >= count {
-				break
-			}
-		}
-	}
-	return res
-}
-
-// Request recalculation of the routing table. This is async but can
-// effectively be made synchronous with a subsequent call to
-// EnsureRecalculated.
-func (routes *Routes) Recalculate() {
-	// The use of a 1-capacity channel in combination with the
-	// non-blocking send is an optimisation that results in multiple
-	// requests being coalesced.
-	select {
-	case routes.recalculate <- nil:
-	default:
-	}
-}
-
-// Wait for any preceding Recalculate requests to be processed.
-func (routes *Routes) EnsureRecalculated() {
-	done := make(chan struct{})
-	routes.wait <- done
-	<-done
-}
-
-func (routes *Routes) run(recalculate <-chan *struct{}, wait <-chan chan struct{}) {
-	for {
-		select {
-		case <-recalculate:
-			routes.calculate()
-		case done := <-wait:
-			select {
-			case <-recalculate:
-				routes.calculate()
-			default:
-			}
-			close(done)
-		}
-	}
-}
-
-func (routes *Routes) calculate() {
-	routes.peers.RLock()
-	routes.ourself.RLock()
-	var (
-		oldUnicast   = routes.unicast
-		oldBroadcast = routes.broadcast
-		unicast      = routes.calculateUnicast(true)
-		unicastAll   = routes.calculateUnicast(false)
-		broadcast    = routes.calculateBroadcast(true)
-		broadcastAll = routes.calculateBroadcast(false)
-	)
-	routes.ourself.RUnlock()
-	routes.peers.RUnlock()
-
-	routes.Lock()
-	routes.unicast = unicast
-	routes.unicastAll = unicastAll
-	routes.broadcast = broadcast
-	routes.broadcastAll = broadcastAll
-	onChange := routes.onChange
-	routes.Unlock()
-
-	if !unicast.equals(oldUnicast) || !broadcast.equals(oldBroadcast) {
-		for _, callback := range onChange {
-			callback()
-		}
-	}
-}
-
-// Calculate all the routes for the question: if *we* want to send a
-// packet to Peer X, what is the next hop?
-//
-// When we sniff a packet, we determine the destination peer
-// ourself. Consequently, we can relay the packet via any
-// arbitrary peers - the intermediate peers do not have to have
-// any knowledge of the MAC address at all. Thus there's no need
-// to exchange knowledge of MAC addresses, nor any constraints on
-// the routes that we construct.
-func (routes *Routes) calculateUnicast(establishedAndSymmetric bool) unicastRoutes {
-	_, unicast := routes.ourself.Routes(nil, establishedAndSymmetric)
-	return unicast
-}
-
-// Calculate all the routes for the question: if we receive a
-// broadcast originally from Peer X, which peers should we pass the
-// frames on to?
-//
-// When the topology is stable, and thus all peers perform route
-// calculations based on the same data, the algorithm ensures that
-// broadcasts reach every peer exactly once.
-//
-// This is largely due to properties of the Peer.Routes algorithm. In
-// particular:
-//
-// ForAll X,Y,Z in Peers.
-//     X.Routes(Y) <= X.Routes(Z) \/
-//     X.Routes(Z) <= X.Routes(Y)
-// ForAll X,Y,Z in Peers.
-//     Y =/= Z /\ X.Routes(Y) <= X.Routes(Z) =>
-//     X.Routes(Y) u [P | Y.HasSymmetricConnectionTo(P)] <= X.Routes(Z)
-// where <= is the subset relationship on keys of the returned map.
-func (routes *Routes) calculateBroadcast(establishedAndSymmetric bool) broadcastRoutes {
-	broadcast := make(broadcastRoutes)
-	for _, peer := range routes.peers.byName {
-		hops := []PeerName{}
-		if found, reached := peer.Routes(routes.ourself.Peer, establishedAndSymmetric); found {
-			routes.ourself.ForEachConnectedPeer(establishedAndSymmetric, reached,
-				func(remotePeer *Peer) { hops = append(hops, remotePeer.Name) })
-		}
-		broadcast[peer.Name] = hops
-	}
-	return broadcast
-}
-
-func (a unicastRoutes) equals(b unicastRoutes) bool {
-	for key, aval := range a {
-		if bval, ok := b[key]; !ok || bval != aval {
-			return false
-		}
-	}
-
-	for key := range b {
-		if _, ok := a[key]; !ok {
-			return false
-		}
-	}
-
-	return true
-}
-
-func (a broadcastRoutes) equals(b broadcastRoutes) bool {
-	set := make(map[PeerName]struct{})
-
-	for key, aval := range a {
-		bval, ok := b[key]
-		if !ok {
-			return false
-		}
-
-		for _, peer := range aval {
-			set[peer] = struct{}{}
-		}
-
-		for _, peer := range bval {
-			if _, ok := set[peer]; !ok {
-				return false
-			}
-
-			delete(set, peer)
-		}
-
-		if len(set) != 0 {
-			return false
-		}
-
-	}
-
-	for key := range b {
-		if _, ok := a[key]; !ok {
-			return false
-		}
-	}
-
-	return true
-}

mesh/status.go

@@ -1,193 +0,0 @@
-package mesh
-
-import (
-	"fmt"
-)
-
-type Status struct {
-	Protocol           string
-	ProtocolMinVersion int
-	ProtocolMaxVersion int
-	Encryption         bool
-	PeerDiscovery      bool
-	Name               string
-	NickName           string
-	Port               int
-	Peers              []PeerStatus
-	UnicastRoutes      []UnicastRouteStatus
-	BroadcastRoutes    []BroadcastRouteStatus
-	Connections        []LocalConnectionStatus
-	Targets            []string
-	OverlayDiagnostics interface{}
-}
-
-type PeerStatus struct {
-	Name        string
-	NickName    string
-	UID         PeerUID
-	ShortID     PeerShortID
-	Version     uint64
-	Connections []ConnectionStatus
-}
-
-type ConnectionStatus struct {
-	Name        string
-	NickName    string
-	Address     string
-	Outbound    bool
-	Established bool
-}
-
-type UnicastRouteStatus struct {
-	Dest, Via string
-}
-
-type BroadcastRouteStatus struct {
-	Source string
-	Via    []string
-}
-
-type LocalConnectionStatus struct {
-	Address  string
-	Outbound bool
-	State    string
-	Info     string
-}
-
-func NewStatus(router *Router) *Status {
-	return &Status{
-		Protocol,
-		ProtocolMinVersion,
-		ProtocolMaxVersion,
-		router.UsingPassword(),
-		router.PeerDiscovery,
-		router.Ourself.Name.String(),
-		router.Ourself.NickName,
-		router.Port,
-		NewPeerStatusSlice(router.Peers),
-		NewUnicastRouteStatusSlice(router.Routes),
-		NewBroadcastRouteStatusSlice(router.Routes),
-		NewLocalConnectionStatusSlice(router.ConnectionMaker),
-		NewTargetSlice(router.ConnectionMaker),
-		router.Overlay.Diagnostics()}
-}
-
-func NewPeerStatusSlice(peers *Peers) []PeerStatus {
-	var slice []PeerStatus
-
-	peers.ForEach(func(peer *Peer) {
-		var connections []ConnectionStatus
-		if peer == peers.ourself.Peer {
-			for conn := range peers.ourself.Connections() {
-				connections = append(connections, newConnectionStatus(conn))
-			}
-		} else {
-			// Modifying peer.connections requires a write lock on
-			// Peers, and since we are holding a read lock (due to the
-			// ForEach), access without locking the peer is safe.
-			for _, conn := range peer.connections {
-				connections = append(connections, newConnectionStatus(conn))
-			}
-		}
-		slice = append(slice, PeerStatus{
-			peer.Name.String(),
-			peer.NickName,
-			peer.UID,
-			peer.ShortID,
-			peer.Version,
-			connections})
-	})
-
-	return slice
-}
-
-func newConnectionStatus(c Connection) ConnectionStatus {
-	return ConnectionStatus{
-		c.Remote().Name.String(),
-		c.Remote().NickName,
-		c.RemoteTCPAddr(),
-		c.Outbound(),
-		c.Established()}
-}
-
-func NewUnicastRouteStatusSlice(routes *Routes) []UnicastRouteStatus {
-	routes.RLock()
-	defer routes.RUnlock()
-
-	var slice []UnicastRouteStatus
-	for dest, via := range routes.unicast {
-		slice = append(slice, UnicastRouteStatus{dest.String(), via.String()})
-	}
-	return slice
-}
-
-func NewBroadcastRouteStatusSlice(routes *Routes) []BroadcastRouteStatus {
-	routes.RLock()
-	defer routes.RUnlock()
-
-	var slice []BroadcastRouteStatus
-	for source, via := range routes.broadcast {
-		var hops []string
-		for _, hop := range via {
-			hops = append(hops, hop.String())
-		}
-		slice = append(slice, BroadcastRouteStatus{source.String(), hops})
-	}
-	return slice
-}
-
-func NewLocalConnectionStatusSlice(cm *ConnectionMaker) []LocalConnectionStatus {
-	resultChan := make(chan []LocalConnectionStatus, 0)
-	cm.actionChan <- func() bool {
-		var slice []LocalConnectionStatus
-		for conn := range cm.connections {
-			state := "pending"
-			if conn.Established() {
-				state = "established"
-			}
-			lc, _ := conn.(*LocalConnection)
-			info := fmt.Sprintf("%-6v %v", lc.OverlayConn.DisplayName(), conn.Remote())
-			slice = append(slice, LocalConnectionStatus{conn.RemoteTCPAddr(), conn.Outbound(), state, info})
-		}
-		for address, target := range cm.targets {
-			add := func(state, info string) {
-				slice = append(slice, LocalConnectionStatus{address, true, state, info})
-			}
-			switch target.state {
-			case TargetWaiting:
-				until := "never"
-				if !target.tryAfter.IsZero() {
-					until = target.tryAfter.String()
-				}
-				if target.lastError == nil { // shouldn't happen
-					add("waiting", "until: "+until)
-				} else {
-					add("failed", target.lastError.Error()+", retry: "+until)
-				}
-			case TargetAttempting:
-				if target.lastError == nil {
-					add("connecting", "")
-				} else {
-					add("retrying", target.lastError.Error())
-				}
-			case TargetConnected:
-			}
-		}
-		resultChan <- slice
-		return false
-	}
-	return <-resultChan
-}
-
-func NewTargetSlice(cm *ConnectionMaker) []string {
-	resultChan := make(chan []string, 0)
-	cm.actionChan <- func() bool {
-		var slice []string
-		for peer := range cm.directPeers {
-			slice = append(slice, peer)
-		}
-		resultChan <- slice
-		return false
-	}
-	return <-resultChan
-}