Add release v1.6.0

clarify init-peer-count deprecation warning
Fixes #2355
2016-06-20 13:50:19 +01:00 · 2016-06-20 03:54:16 +01:00 · 2016-06-20 03:25:10 +01:00 · 2016-06-20 03:24:30 +01:00 · 2016-06-20 03:20:46 +01:00 · 2016-06-20 03:15:25 +01:00
284 changed files with 14955 additions and 15525 deletions
@@ -0,0 +1,2 @@
+--ignore-dir=vendor
+--ignore-dir=.pkg
@@ -25,6 +25,7 @@ _testmain.go
 *.prof
 profile.cov
 coverage.html
+.pkg

 # Emacs backup files
 *~
@@ -41,16 +42,12 @@ prog/sigproxy/sigproxy
 prog/weavewait/weavewait
 prog/weavewait/weavewait_noop
 prog/weavewait/weavewait_nomcast
-prog/netcheck/netcheck
-prog/docker_tls_args/docker_tls_args
+prog/weaveutil/weaveutil
 prog/plugin/plugin
 testing/cover/cover
 testing/runner/runner
 releases
-.weaver.uptodate
-.weavedns.uptodate
-.weaveexec.uptodate
-.dockerplugin.uptodate
+.*.uptodate
 weave.tar.gz
 prog/weaveexec/weave
 prog/weaveexec/weavehosts
@@ -59,8 +56,7 @@ prog/weaveexec/weavewait
 prog/weaveexec/weavewait_noop
 prog/weaveexec/weavewait_nomcast
 prog/weaveexec/sigproxy
-prog/weaveexec/netcheck
-prog/weaveexec/docker_tls_args
+prog/weaveexec/weaveutil
 prog/weaveexec/docker*.tgz
 Vagrantfile.local
 test/tls/tls
@@ -1,3 +1,78 @@
 [submodule "tools"]
 	path = tools
 	url = https://github.com/weaveworks/build-tools
+[submodule "vendor/github.com/vishvananda/netlink"]
+	path = vendor/github.com/vishvananda/netlink
+	url = https://github.com/vishvananda/netlink.git
+[submodule "vendor/github.com/gorilla/mux"]
+	path = vendor/github.com/gorilla/mux
+	url = https://github.com/gorilla/mux.git
+[submodule "vendor/github.com/gorilla/context"]
+	path = vendor/github.com/gorilla/context
+	url = https://github.com/gorilla/context.git
+[submodule "vendor/github.com/google/gopacket"]
+	path = vendor/github.com/google/gopacket
+	url = https://github.com/google/gopacket.git
+[submodule "vendor/github.com/weaveworks/go-odp"]
+	path = vendor/github.com/weaveworks/go-odp
+	url = https://github.com/weaveworks/go-odp.git
+[submodule "vendor/github.com/opencontainers/runc"]
+	path = vendor/github.com/opencontainers/runc
+	url = https://github.com/opencontainers/runc.git
+[submodule "vendor/github.com/fsouza/go-dockerclient"]
+	path = vendor/github.com/fsouza/go-dockerclient
+	url = https://github.com/fsouza/go-dockerclient.git
+[submodule "vendor/github.com/docker/libnetwork"]
+	path = vendor/github.com/docker/libnetwork
+	url = https://github.com/docker/libnetwork.git
+[submodule "vendor/github.com/docker/docker"]
+	path = vendor/github.com/docker/docker
+	url = https://github.com/docker/docker.git
+[submodule "vendor/github.com/Sirupsen/logrus"]
+	path = vendor/github.com/Sirupsen/logrus
+	url = https://github.com/Sirupsen/logrus.git
+[submodule "vendor/github.com/andybalholm/go-bit"]
+	path = vendor/github.com/andybalholm/go-bit
+	url = https://github.com/andybalholm/go-bit.git
+[submodule "vendor/github.com/miekg/dns"]
+	path = vendor/github.com/miekg/dns
+	url = https://github.com/miekg/dns.git
+[submodule "vendor/github.com/stretchr/testify"]
+	path = vendor/github.com/stretchr/testify
+	url = https://github.com/stretchr/testify.git
+[submodule "vendor/golang.org/x/crypto"]
+	path = vendor/golang.org/x/crypto
+	url = https://github.com/golang/crypto.git
+[submodule "vendor/github.com/docker/machine"]
+	path = vendor/github.com/docker/machine
+	url = https://github.com/docker/machine.git
+[submodule "vendor/github.com/weaveworks/mesh"]
+	path = vendor/github.com/weaveworks/mesh
+	url = https://github.com/weaveworks/mesh
+[submodule "vendor/github.com/vishvananda/netns"]
+	path = vendor/github.com/vishvananda/netns
+	url = https://github.com/vishvananda/netns.git
+[submodule "vendor/github.com/boltdb/bolt"]
+	path = vendor/github.com/boltdb/bolt
+	url = https://github.com/boltdb/bolt
+[submodule "vendor/github.com/weaveworks/go-checkpoint"]
+	path = vendor/github.com/weaveworks/go-checkpoint
+	url = https://github.com/weaveworks/go-checkpoint
+[submodule "vendor/github.com/hashicorp/go-cleanhttp"]
+	path = vendor/github.com/hashicorp/go-cleanhttp
+	url = http://github.com/hashicorp/go-cleanhttp
+[submodule "vendor/github.com/appc/cni"]
+	path = vendor/github.com/appc/cni
+	url = https://github.com/appc/cni
+[submodule "vendor/github.com/coreos/go-iptables"]
+	path = vendor/github.com/coreos/go-iptables
+	url = https://github.com/coreos/go-iptables
+[submodule "vendor/github.com/pkg/profile"]
+	path = vendor/github.com/pkg/profile
+	url = https://github.com/pkg/profile
+[submodule "vendor/github.com/j-keck/arping"]
+	path = vendor/github.com/j-keck/arping
+	url = https://github.com/j-keck/arping
+[submodule "vendor/github.com/aws/aws-sdk-go"]
+	path = vendor/github.com/aws/aws-sdk-go
+	url = https://github.com/aws/aws-sdk-go
@@ -1,28 +0,0 @@
-language: go
-sudo: false
-go:
-  - 1.4
-
-env:
-  - PATH="${PATH}:${HOME}/.local/bin"
-
-addons:
-  apt:
-    packages:
-    - libpcap-dev
-
-install:
-  - go clean -i net
-  - go install -tags netgo std
-  - go get github.com/golang/lint/golint
-  - pip install --user --upgrade gsutil
-  - bin/setup-ci-secrets $encrypted_5ba036e89377_key $encrypted_5ba036e89377_iv
-  - make travis
-  - go get ./...
-
-script:
-  - make tests
-
-after_success:
-  - go get github.com/mattn/goveralls
-  - test "${TRAVIS_PULL_REQUEST}" = "false" && site/build-and-publish.sh
@@ -1,3 +1,108 @@
+## Release 1.6.0
+
+## Highlights
+
+* A new [AWS VPC](https://weave.works/docs/net/latest/using-weave/awsvpc/) mode
+  that leverages Amazon Virtual Private Cloud for near-native network
+  performance, as an alternative to the Sleeve and Fast Datapath
+  overlays
+* Docker 1.12 introduced some internal changes that made it
+  incompatible with previous version of Weave Net - this version
+  restores compatability
+* An [operational guide](https://weave.works/docs/net/latest/operational-guide)
+  detailing best practices for deploying and operating Weave Net
+* Changes to the target peer list are remembered across restarts,
+  making it much easier to deploy resilient networks
+* The version checkpoint now transmits network mode (e.g. 'awsvpc')
+  and kernel/docker versions to us to inform and guide our development
+  efforts. See the [installation documentation](https://weave.works/docs/net/latest/installing-weave/)
+  for instructions on disabling the checkpoint feature.
+
+More details in the [change log](https://github.com/weaveworks/weave/issues?q=milestone%3A1.6.0).
+
+## Release 1.5.2
+
+Bug fixes and minor improvements
+
+* Weave Proxy did not flush the initial http header in the Docker event stream, which could cause Docker Swarm to show all nodes pending. #2306/#2311
+* When using the CNI plugin, if a container was removed and quickly replaced by another using the same IP address, other containers might be unable to contact it. Send an address resolution protocol message to update them. #2313
+* Avoid Docker hanging for 1 minute in `weave launch` if the plugin had not shut down cleanly #2286/#2292
+* Print an error message when Weave bridge mode is changed without `weave reset` #2304
+* Eliminate spurious warning message from IP allocator on plugin shutdown #2300/#2319
+* Display error message when address requested in a subnet that is too small (/31 or /32) #2282/#2321
+* Add short wait after `weave reset` to allow updates to reach peers #2280
+* Weave was occasionally unable to claim existing IP address immediately after launch #2275/#2281
+* Refactor some integration tests to run faster and more reliably #2291
+
+## Release 1.5.1
+
+Bug fixes and minor improvements
+
+* Persisted data that was rendered invalid by changing peer name or
+  allocation range is detected and removed automatically, preventing
+  crashes and hangs #2246/#2209/#2249
+* `weave rmpeer` persists the range takeover in case the peer on which
+  it was executed dies subsequently #2238
+* Launching a container with an explicit `WEAVE_CIDR` in the
+  allocation range now waits instead of erroring if the allocator
+  hasn't finished initialising #2232/#2265
+* Weave DNS now responds to AAAA queries with an empty answer section,
+  instead of NXDOMAIN which could be cached and block subsequent
+  resolution of A records #2244/#2252
+* Many improvements to the documentation.
+
+More details in the [change log](https://github.com/weaveworks/weave/issues?q=milestone%3A1.5.1).
+
+## Release 1.5.0
+
+## Highlights
+
+- A new [Container Network Interface](https://github.com/appc/cni#cni---the-container-network-interface) plugin.
+- This release is much more robust against unscheduled restarts,
+  because it persists key data to disk.
+- New configuration options that are useful when you create or
+  auto-scale larger networks.
+- Weave now periodically checks for updates (can be disabled)
+
+Plus many bug fixes and minor enhancements. More details below and in
+the [change log](https://github.com/weaveworks/weave/issues?q=milestone%3A1.5.0).
+
+## Release 1.4.6
+
+Fixes some issues encountered by our users.
+
+* Restarting a peer could leave stale entries in WeaveDNS
+  #1867/#2023/#2081
+* Weave proxy occasionally failing to attach any new containers
+  #2016/#2049
+
+Other fixes:
+
+* Resolved a crash when a restarting peer re-connected to a peer that
+  had not received the latest IPAM data #2083/#2092
+* Make IP address space available immediately after a dead peer is
+  removed #2068
+
+## Release 1.4.5
+
+Higher performance for multicast and broadcast traffic when using
+Weave's Fast Datapath
+
+* The flow rule to deliver broadcast and multicast packets in-kernel
+  was not created correctly, hence every such packet caused a
+  context-switch to the software router #2003/#2008
+
+Other fixes:
+
+* Remove DNS entries for containers that are being restarted by Docker
+  but are not live yet #1977/#1989
+* Don't let one failing allocation attempt prevent others from
+  succeeding; they could be in different subnets which are more
+  available #1996/#2001
+* Don't complain on second router launch on kernels that lack support
+  for Fast Datapath #1929/#1983
+* Fix build broken by change in libnetwork IPAM API #1984/#1985
+
 ## Release 1.4.4

 Fixing a rather serious issue that slipped through our preparations
@@ -0,0 +1,32 @@
+Thanks for your interest in contributing to this project and for
+taking the time to read this guide.
+
+# Code of conduct
+
+**Be respectful:** disagreements between people are to be expected and are usually the sign of healthy debate and engagement. Disagreements can lead to frustration and even anger for some members. Turning to personal insults, intimidation or threatening behaviour does not improve the situation. Participants should thus take care to ensure all communications / interactions stay professional at all times.
+
+**Be considerate:** remember that the community has members with a diverse background, many of whom have English as a second language. What might appear impolite, may simply be a result of a lack of knowledge of the English language. Bear in mind that actions will have an impact on other community members and the project as a whole, so take potential consequences into account before pursuing a course of action.
+
+**Be forgiving:** humans are fallible and as such prone to make mistakes and inexplicably change their positions at times. Don't assume that other members are acting with malicious intent. Be prepared to forgive people who make mistakes and assist each other in learning from them. Playing a blame game doesn't help anyone.
+
+# Issues
+* Before reporting an issue make sure you search first if anybody has already reported a similar issue and whether or not it has been fixed.
+* Make sure your issue report sufficiently details the problem:
+ * If you set up weave in some way other than that described by our [main instructions](https://github.com/zettio/weave#installation), please mention that.
+ * Include step-by-step instructions to reproduce the issue.
+ * State the OS platform you are using, i.e. `uname -a`
+ * `iptables` rules and firewalls can have a great impact on any Linux network; please note whether you have set up any rules and/or are running a firewall on your machine(s).
+* If you want to tackle any open issue, make sure you let people know you are working on it.
+
+## Pull Requests
+* Please be generous describing your changes.
+* Although it is highly suggested to include tests, they are not a hard requirement in order to get your contributions accepted.
+* Keep pull requests small so core developers can review them quickly.
+* Keep each pull request focused on a specific topic.  If you have two things to change, create two pull requests. This helps reviewers to understand the meat of your contribution.
+
+## Workflow
+See [WorkingOnWeave](https://github.com/weaveworks/weave/wiki/WorkingOnWeave)
+
+# Acknowledgements
+
+Much of this taken from https://github.com/cloudescape/gowsdl/blob/master/CONTRIBUTING.md
@@ -176,7 +176,7 @@

   END OF TERMS AND CONDITIONS

-   Copyright 2014-2015 Weaveworks Ltd.
+   Copyright 2014-2016 Weaveworks Ltd.

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
@@ -1,10 +1,14 @@
 PUBLISH=publish_weave publish_weaveexec publish_plugin

 .DEFAULT: all
-.PHONY: all update tests lint publish $(PUBLISH) clean clean-bin prerequisites build travis run-smoketests
+.PHONY: all exes testrunner update tests lint publish $(PUBLISH) clean clean-bin prerequisites build run-smoketests

 # If you can use docker without being root, you can do "make SUDO="
-SUDO=sudo
+SUDO=$(shell docker info >/dev/null 2>&1 || echo "sudo -E")
+BUILD_IN_CONTAINER=true
+RM=--rm
+RUN_FLAGS=-ti
+COVERAGE=

 DOCKERHUB_USER=weaveworks
 WEAVE_VERSION=git-$(shell git rev-parse --short=12 HEAD)
@@ -15,25 +19,28 @@ SIGPROXY_EXE=prog/sigproxy/sigproxy
 WEAVEWAIT_EXE=prog/weavewait/weavewait
 WEAVEWAIT_NOOP_EXE=prog/weavewait/weavewait_noop
 WEAVEWAIT_NOMCAST_EXE=prog/weavewait/weavewait_nomcast
-NETCHECK_EXE=prog/netcheck/netcheck
-DOCKERTLSARGS_EXE=prog/docker_tls_args/docker_tls_args
-DOCKERPLUGIN_EXE=prog/plugin/plugin
+WEAVEUTIL_EXE=prog/weaveutil/weaveutil
+PLUGIN_EXE=prog/plugin/plugin
 RUNNER_EXE=tools/runner/runner
 TEST_TLS_EXE=test/tls/tls

-EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(NETCHECK_EXE) $(DOCKERTLSARGS_EXE) $(DOCKERPLUGIN_EXE) $(TEST_TLS_EXE)
+EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVEUTIL_EXE) $(PLUGIN_EXE) $(TEST_TLS_EXE)

+BUILD_UPTODATE=.build.uptodate
 WEAVER_UPTODATE=.weaver.uptodate
 WEAVEEXEC_UPTODATE=.weaveexec.uptodate
-DOCKERPLUGIN_UPTODATE=.dockerplugin.uptodate
+PLUGIN_UPTODATE=.plugin.uptodate
+WEAVEDB_UPTODATE=.weavedb.uptodate

-IMAGES_UPTODATE=$(WEAVER_UPTODATE) $(WEAVEEXEC_UPTODATE) $(DOCKERPLUGIN_UPTODATE)
+IMAGES_UPTODATE=$(WEAVER_UPTODATE) $(WEAVEEXEC_UPTODATE) $(PLUGIN_UPTODATE) $(WEAVEDB_UPTODATE)

 WEAVER_IMAGE=$(DOCKERHUB_USER)/weave
 WEAVEEXEC_IMAGE=$(DOCKERHUB_USER)/weaveexec
-DOCKERPLUGIN_IMAGE=$(DOCKERHUB_USER)/plugin
+PLUGIN_IMAGE=$(DOCKERHUB_USER)/plugin
+BUILD_IMAGE=$(DOCKERHUB_USER)/weavebuild
+WEAVEDB_IMAGE=$(DOCKERHUB_USER)/weavedb

-IMAGES=$(WEAVER_IMAGE) $(WEAVEEXEC_IMAGE) $(DOCKERPLUGIN_IMAGE)
+IMAGES=$(WEAVER_IMAGE) $(WEAVEEXEC_IMAGE) $(PLUGIN_IMAGE) $(WEAVEDB_IMAGE)

 WEAVE_EXPORT=weave.tar.gz

@@ -48,79 +55,101 @@ NETGO_CHECK=@strings $@ | grep cgo_stub\\\.go >/dev/null || { \
 	echo "    sudo go install -tags netgo std"; \
 	false; \
 }
-BUILD_FLAGS=-ldflags "-extldflags \"-static\" -X main.version $(WEAVE_VERSION)" -tags netgo
+BUILD_FLAGS=-i -ldflags "-extldflags \"-static\" -X main.version=$(WEAVE_VERSION)" -tags netgo

 PACKAGE_BASE=$(shell go list -e ./)

-all: $(WEAVE_EXPORT) $(RUNNER_EXE) $(TEST_TLS_EXE)
+all: $(WEAVE_EXPORT)
+testrunner: $(RUNNER_EXE) $(TEST_TLS_EXE)

-travis: $(EXES)
+$(WEAVER_EXE) $(WEAVEPROXY_EXE) $(WEAVEUTIL_EXE): common/*.go common/*/*.go net/*.go net/*/*.go
+$(WEAVER_EXE): router/*.go ipam/*.go ipam/*/*.go db/*.go nameserver/*.go prog/weaver/*.go
+$(WEAVEPROXY_EXE): proxy/*.go prog/weaveproxy/*.go
+$(WEAVEUTIL_EXE): prog/weaveutil/*.go net/*.go
+$(SIGPROXY_EXE): prog/sigproxy/*.go
+$(PLUGIN_EXE): prog/plugin/*.go plugin/*/*.go api/*.go common/*.go common/docker/*.go net/*.go
+$(TEST_TLS_EXE): test/tls/*.go
+$(WEAVEWAIT_NOOP_EXE): prog/weavewait/*.go
+$(WEAVEWAIT_EXE): prog/weavewait/*.go net/*.go
+$(WEAVEWAIT_NOMCAST_EXE): prog/weavewait/*.go net/*.go
+tests: tools/.git
+lint: tools/.git

-update:
-	go get -u -f -v -tags netgo $(addprefix ./,$(dir $(EXES)))
+ifeq ($(BUILD_IN_CONTAINER),true)

-$(WEAVER_EXE) $(WEAVEPROXY_EXE): common/*.go common/*/*.go net/*.go
+exes $(EXES) tests lint: $(BUILD_UPTODATE)
+	git submodule update --init
+	@mkdir -p $(shell pwd)/.pkg
+	$(SUDO) docker run $(RM) $(RUN_FLAGS) \
+	    -v $(shell pwd):/go/src/github.com/weaveworks/weave \
+		-v $(shell pwd)/.pkg:/go/pkg \
+		-e GOARCH -e GOOS -e CIRCLECI -e CIRCLE_BUILD_NUM -e CIRCLE_NODE_TOTAL -e CIRCLE_NODE_INDEX -e COVERDIR -e SLOW \
+		$(BUILD_IMAGE) COVERAGE=$(COVERAGE) WEAVE_VERSION=$(WEAVE_VERSION) $@
+
+else
+
+exes: $(EXES)
+
+$(WEAVER_EXE) $(WEAVEPROXY_EXE) $(PLUGIN_EXE):
 ifeq ($(COVERAGE),true)
-	$(eval COVERAGE_MODULES := $(shell (go list ./$(@D); go list -f '{{join .Deps "\n"}}' ./$(@D) | grep "^$(PACKAGE_BASE)/") | paste -s -d,))
-	go get -t -tags netgo ./$(@D)
+	$(eval COVERAGE_MODULES := $(shell (go list ./$(@D); go list -f '{{join .Deps "\n"}}' ./$(@D) | grep "^$(PACKAGE_BASE)/") | grep -v "^$(PACKAGE_BASE)/vendor/" | paste -s -d,))
 	go test -c -o ./$@ $(BUILD_FLAGS) -v -covermode=atomic -coverpkg $(COVERAGE_MODULES) ./$(@D)/
 else
-	go get -tags netgo ./$(@D)
 	go build $(BUILD_FLAGS) -o $@ ./$(@D)
 endif
 	$(NETGO_CHECK)

-$(NETCHECK_EXE): common/*.go common/*/*.go net/*.go
-	go get -tags netgo ./$(@D)
+$(WEAVEUTIL_EXE):
 	go build $(BUILD_FLAGS) -o $@ ./$(@D)
 	$(NETGO_CHECK)

-$(WEAVER_EXE): router/*.go mesh/*.go ipam/*.go ipam/*/*.go nameserver/*.go prog/weaver/*.go
-$(WEAVEPROXY_EXE): proxy/*.go prog/weaveproxy/main.go
-$(NETCHECK_EXE): prog/netcheck/netcheck.go
-
-# These next programs need separate rules as they fail the netgo check in
-# the main build stanza due to not importing net package
-$(SIGPROXY_EXE): prog/sigproxy/main.go
-$(DOCKERTLSARGS_EXE): prog/docker_tls_args/*.go
-$(DOCKERPLUGIN_EXE): prog/plugin/*.go plugin/net/*.go plugin/ipam/*.go plugin/skel/*.go api/*.go common/docker/*.go
-$(TEST_TLS_EXE): test/tls/*.go
-
-$(SIGPROXY_EXE) $(DOCKERTLSARGS_EXE) $(DOCKERPLUGIN_EXE) $(TEST_TLS_EXE):
-	go get -tags netgo ./$(@D)
-	go build $(BUILD_FLAGS) -o $@ ./$(@D)
-
-$(WEAVEWAIT_EXE): prog/weavewait/*.go net/*.go
-	go get -tags netgo ./$(@D)
+$(WEAVEWAIT_EXE):
 	go build $(BUILD_FLAGS) -tags "netgo iface mcast" -o $@ ./$(@D)
+	$(NETGO_CHECK)

-$(WEAVEWAIT_NOMCAST_EXE): prog/weavewait/*.go net/*.go
-	go get -tags netgo ./$(@D)
+$(WEAVEWAIT_NOMCAST_EXE):
 	go build $(BUILD_FLAGS) -tags "netgo iface" -o $@ ./$(@D)
+	$(NETGO_CHECK)

-$(WEAVEWAIT_NOOP_EXE): prog/weavewait/*.go
-	go get -tags netgo ./$(@D)
+# These programs need a separate rule as they fail the netgo check in
+# the main build stanza due to not importing net package
+$(SIGPROXY_EXE) $(TEST_TLS_EXE) $(WEAVEWAIT_NOOP_EXE):
 	go build $(BUILD_FLAGS) -o $@ ./$(@D)

+tests:
+	./tools/test -no-go-get
+
+lint:
+	./tools/lint -nocomment -notestpackage .
+
+endif
+
+$(BUILD_UPTODATE): build/*
+	$(SUDO) docker build -t $(BUILD_IMAGE) build/
+	touch $@
+
 $(WEAVER_UPTODATE): prog/weaver/Dockerfile $(WEAVER_EXE)
 	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker build -t $(WEAVER_IMAGE) prog/weaver
 	touch $@

-$(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile prog/weaveexec/symlink $(DOCKER_DISTRIB) weave $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(NETCHECK_EXE) $(DOCKERTLSARGS_EXE)
+$(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile prog/weaveexec/symlink $(DOCKER_DISTRIB) weave $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVEUTIL_EXE)
 	cp weave prog/weaveexec/weave
 	cp $(SIGPROXY_EXE) prog/weaveexec/sigproxy
 	cp $(WEAVEPROXY_EXE) prog/weaveexec/weaveproxy
 	cp $(WEAVEWAIT_EXE) prog/weaveexec/weavewait
 	cp $(WEAVEWAIT_NOOP_EXE) prog/weaveexec/weavewait_noop
 	cp $(WEAVEWAIT_NOMCAST_EXE) prog/weaveexec/weavewait_nomcast
-	cp $(NETCHECK_EXE) prog/weaveexec/netcheck
-	cp $(DOCKERTLSARGS_EXE) prog/weaveexec/docker_tls_args
+	cp $(WEAVEUTIL_EXE) prog/weaveexec/weaveutil
 	cp $(DOCKER_DISTRIB) prog/weaveexec/docker.tgz
 	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker build -t $(WEAVEEXEC_IMAGE) prog/weaveexec
 	touch $@

-$(DOCKERPLUGIN_UPTODATE): prog/plugin/Dockerfile $(DOCKERPLUGIN_EXE) $(WEAVEEXEC_UPTODATE)
-	$(SUDO) docker build -t $(DOCKERPLUGIN_IMAGE) prog/plugin
+$(PLUGIN_UPTODATE): prog/plugin/Dockerfile $(PLUGIN_EXE) $(WEAVEEXEC_UPTODATE)
+	$(SUDO) docker build -t $(PLUGIN_IMAGE) prog/plugin
+	touch $@
+
+$(WEAVEDB_UPTODATE): prog/weavedb/Dockerfile
+	$(SUDO) docker build -t $(WEAVEDB_IMAGE) prog/weavedb
 	touch $@

 $(WEAVE_EXPORT): $(IMAGES_UPTODATE)
@@ -129,12 +158,6 @@ $(WEAVE_EXPORT): $(IMAGES_UPTODATE)
 $(DOCKER_DISTRIB):
 	curl -o $(DOCKER_DISTRIB) $(DOCKER_DISTRIB_URL)

-tests: tools/.git
-	tools/test
-
-lint: tools/.git
-	tools/lint -nocomment -notestpackage .
-
 tools/.git:
 	git submodule update --init

@@ -149,19 +172,22 @@ ifneq ($(UPDATE_LATEST),false)
 endif

 publish: $(PUBLISH)
+ifeq ($(PUBLISH_WEAVEDB),true)
+	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker push   $(DOCKERHUB_USER)/weavedb:latest
+endif

 clean-bin:
 	-$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker rmi $(IMAGES)
-	go clean -r $(addprefix ./,$(dir $(EXES)))
-	rm -f $(EXES) $(IMAGES_UPTODATE) $(WEAVE_EXPORT)
+	rm -rf $(EXES) $(IMAGES_UPTODATE) $(WEAVE_EXPORT) .pkg

 clean: clean-bin
-	rm -rf test/tls/*.pem test/coverage.* test/coverage
+	-$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker rmi $(BUILD_IMAGE)
+	rm -rf test/tls/*.pem test/coverage.* test/coverage $(BUILD_UPTODATE)

 build:
 	$(SUDO) go clean -i net
 	$(SUDO) go install -tags netgo std
 	$(MAKE)

-run-smoketests: all
+run-smoketests: all testrunner
 	cd test && ./setup.sh && ./run_all.sh
@@ -1,3 +1,3 @@
 Weave
-Copyright 2014-2015 Weaveworks Ltd.
+Copyright 2014-2016 Weaveworks Ltd.
 This product includes software developed at Weaveworks Ltd.
@@ -1,174 +1,25 @@
-# Weave - weaving containers into applications
+# Weave Net - Weaving Containers into Applications

-[![Build Status](https://travis-ci.org/weaveworks/weave.svg?branch=master)](https://travis-ci.org/weaveworks/weave) [![Integration Tests](https://circleci.com/gh/weaveworks/weave/tree/master.svg?style=shield&circle-token=4933c7dabb3d0383e62117565cb9d16df7b1a811)](https://circleci.com/gh/weaveworks/weave) [![Coverage Status](https://coveralls.io/repos/weaveworks/weave/badge.svg)](https://coveralls.io/r/weaveworks/weave)
+[![Integration Tests](https://circleci.com/gh/weaveworks/weave/tree/master.svg?style=shield)](https://circleci.com/gh/weaveworks/weave)
+[![Coverage Status](https://coveralls.io/repos/weaveworks/weave/badge.svg)](https://coveralls.io/r/weaveworks/weave)
+[![Go Report Card](https://goreportcard.com/badge/github.com/weaveworks/weave)](https://goreportcard.com/report/github.com/weaveworks/weave)
+[![Slack Status](https://slack.weave.works/badge.svg)](https://slack.weave.works)
+[![Docker Pulls](https://img.shields.io/docker/pulls/weaveworks/weave.svg?maxAge=604800)](https://hub.docker.com/r/weaveworks/weave/)

 # About Weaveworks

-[Weaveworks](http://weave.works) is the company that develops Weave -
-the most productive way for developers to connect, observe and control
-Docker containers. To learn about our products, including getting
-started tutorials, visit our [website](http://weave.works) and
-[documentation](http://docs.weave.works) or continue to read about
-some of the more technical aspects of Weave in this readme.
+[Weaveworks](https://www.weave.works) is the company that delivers the most productive way for developers to connect, observe and control
+Docker containers.

-# Weave
+This repository contains [Weave Net](https://www.weave.works/products/weave-net/), the first product developed by Weaveworks, and with nearly 5 million downloads to date, it enables you to get started with Docker clusters and portable apps in a fraction of the time compared with other solutions.

-Weave creates a virtual network that connects Docker containers
-deployed across multiple hosts and enables their automatic discovery.
+Other products from Weaveworks include [Weave Scope](https://www.weave.works/products/weave-scope/), a powerful container monitoring tool that automatically maps Docker containers and their interactions, and [Weave Flux](https://www.weave.works/products/weave-flux/), a microservice router that automates the access of containers as services.

-![Weave Virtual Network](/docs/virtual-network.png?raw=true "Weave Virtual Network")
+# Weave Net

-Applications use the network just as if the containers were all
-plugged into the same network switch, with no need to configure port
-mappings, links, etc. Services provided by application containers on
-the weave network can be made accessible to the outside world,
-regardless of where those containers are running. Similarly, existing
-internal systems can be exposed to application containers irrespective
-of their location.
+Weave Net creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. With Weave Net, portable microservices-based applications consisting of multiple containers can run anywhere: on one host, multiple hosts or even across cloud providers and data centers. Applications use the network just as if the containers were all plugged into the same network switch, without having to configure port mappings, ambassadors or links.

-![Weave Deployment](/docs/deployment.png?raw=true "Weave Deployment")
+Services provided by application containers on the Weave network can be exposed to the outside world, regardless of where they are running. Similarly, existing internal systems can be opened to accept connections from application containers irrespective of their location.

-Weave can traverse firewalls and operate in partially connected
-networks. Traffic can be encrypted, allowing hosts to be connected
-across an untrusted network.
-
-With weave you can easily construct applications consisting of
-multiple containers, running anywhere.
-
-Weave works alongside Docker's existing (single host) networking
-capabilities, so these can continue to be used by containers.
-
-## Installation
-
-Ensure you are running Linux (kernel 3.8 or later) and have Docker
-(version 1.6.0 or later) installed. Then install weave with
-
-    sudo curl -L git.io/weave -o /usr/local/bin/weave
-    sudo chmod a+x /usr/local/bin/weave
-
-For usage on OSX (with Docker Machine) you first need to make sure
-that a VM is running and configured, as shown in [the Docker Machine
-documentation](https://docs.docker.com/installation/mac/#from-your-shell).
-Then you can launch weave directly from the OSX host.
-
-CoreOS users see [here](https://github.com/fintanr/weave-gs/blob/master/coreos-simple/user-data) for an example of installing weave using cloud-config.
-
-Amazon ECS users see
-[here](https://github.com/weaveworks/guides/blob/master/aws-ecs/LATESTAMIs.md)
-for the latest Weave AMIs and
-[here](http://weave.works/guides/service-discovery-with-weave-aws-ecs.html) to get started with Weave on ECS.
-
-Weave respects the environment variable `DOCKER_HOST`, so you can run
-it locally to control a weave network on a remote host.
-
-## Quick Start Screencast
-
-<a href="https://youtu.be/kihQCCT1ykE" alt="Click to watch the screencast" target="_blank">
-  <img src="/docs/hello-screencast.png" />
-</a>
-
-## Example
-
-Say you have docker running on two hosts, accessible to each other as
-`$HOST1` and `$HOST2`, and want to deploy an application consisting of
-two containers, one on each host.
-
-On $HOST1 we run:
-
-    host1$ weave launch
-    host1$ eval $(weave env)
-    host1$ docker run --name a1 -ti ubuntu
-
-> NB: If the first command results in an error like
-> `http:///var/run/docker.sock/v1.19/containers/create: dial unix
-> /var/run/docker.sock: permission denied. Are you trying to connect
-> to a TLS-enabled daemon without TLS?` then you likely need to be
-> 'root' in order to connect to the Docker daemon. If so, run the
-> above and all subsequent commands in a *single* root shell (e.g. one
-> created with `sudo -s`). Do *not* prefix individual commands with
-> `sudo`, since some commands modify environment entries and hence
-> they all need to be executed from the same shell.
-
-The first line runs weave. The second line configures our environment
-so that containers launched via the docker command line are
-automatically attached to the weave network. Finally, we run our
-application container.
-
-That's it! If our application consists of more than one container on
-this host we simply launch them with `docker run` as appropriate.
-
-Next we repeat similar steps on `$HOST2`...
-
-    host2$ weave launch $HOST1
-    host2$ eval $(weave env)
-    host2$ docker run --name a2 -ti ubuntu
-
-The only difference, apart from the name of the application container,
-is that we tell our weave that it should peer with the weave on
-`$HOST1` (specified as the IP address or hostname, and optional
-`:port`, by which `$HOST2` can reach it). NB: if there is a firewall
-between `$HOST1` and `$HOST2`, you must permit traffic to the weave
-control port (TCP 6783) and data ports (UDP 6783/6784).
-
-Note that we could instead have told the weave on `$HOST1` to connect to
-`$HOST2`, or told both about each other. Order does not matter here;
-weave automatically (re)connects to peers when they become
-available. Also, we can tell weave to connect to multiple peers by
-supplying multiple addresses, separated by spaces. And we can
-[add peers dynamically](http://docs.weave.works/weave/latest_release/features.html#dynamic-topologies).
-
-Weave must be started once per host. The relevant container images are
-pulled down on demand, but if you wish you can preload them by running
-`weave setup` - this is particularly useful for automated deployments,
-and ensures that there are no delays during later operations.
-
-Now that we've got everything set up, let's see whether our containers
-can talk to each other...
-
-In the container started on `$HOST1`...
-
-    root@a1:/# ping -c 1 -q a2
-    PING a2.weave.local (10.40.0.2) 56(84) bytes of data.
-    --- a2.weave.local ping statistics ---
-    1 packets transmitted, 1 received, 0% packet loss, time 0ms
-    rtt min/avg/max/mdev = 0.341/0.341/0.341/0.000 ms
-
-Similarly, in the container started on `$HOST2`...
-
-    root@a2:/# ping -c 1 -q a1
-    PING a1.weave.local (10.32.0.2) 56(84) bytes of data.
-    --- a1.weave.local ping statistics ---
-    1 packets transmitted, 1 received, 0% packet loss, time 0ms
-    rtt min/avg/max/mdev = 0.366/0.366/0.366/0.000 ms
-
-So there we have it, two containers on separate hosts happily talking
-to each other.
-
-## Find out more
-
- * [Documentation homepage](http://docs.weave.works/weave/latest_release/)
- * [Getting Started Guides](http://weave.works/guides/)
- * [Features](http://docs.weave.works/weave/latest_release/features.html)
- * [Troubleshooting](http://docs.weave.works/weave/latest_release/troubleshooting.html)
- * [Building](http://docs.weave.works/weave/latest_release/building.html)
- * [How it works](http://docs.weave.works/weave/latest_release/how-it-works.html)
-
-## Contact Us
-
-Found a bug, want to suggest a feature, or have a question?  You can
-[File an issue](https://github.com/weaveworks/weave/issues).  And
-there is a [Weave Users Google
-Group](https://groups.google.com/a/weave.works/forum/#!forum/weave-users),
-which you can post to by email at weave-users@weave.works.  Or you can
-contact Weaveworks directly at help@weave.works. When reporting a
-bug, please include which version of weave you are running, as shown
-by `weave version`.
-
-Follow on Twitter:
-[@weaveworks](https://twitter.com/weaveworks).
-
-Read the Weave blog:
-[Weaveblog](http://weaveblog.com/).
-
-IRC:
-[#weavenetwork](https://botbot.me/freenode/weavenetwork/)
+* [Install Weave Net](https://www.weave.works/docs/net/latest/installing-weave/)
+* [Find out more about Weave Net](https://www.weave.works/products/weave-net/)
@@ -5,7 +5,7 @@ require './vagrant-common.rb'
 vm_ip = "172.16.0.3" # arbitrary private IP

 pkgs = %w(
-  docker-engine
+  docker-engine=1.10.2-0~wily
  aufs-tools
  build-essential
  ethtool
@@ -18,8 +18,7 @@ pkgs = %w(

 Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|

-  config.vm.box = "ubuntu/ubuntu-15.04-amd64"
-  config.vm.box_url = "https://cloud-images.ubuntu.com/vagrant/vivid/current/vivid-server-cloudimg-amd64-vagrant-disk1.box"
+  config.vm.box = "ubuntu/wily64"

  config.vm.network "private_network", ip: vm_ip
  config.vm.provider :virtualbox do |vb|
@@ -5,6 +5,10 @@ import (
 	"net/url"
 )

+func (client *Client) DNSDomain() (string, error) {
+	return client.httpVerb("GET", "/domain", nil)
+}
+
 func (client *Client) RegisterWithDNS(ID string, fqdn string, ip string) error {
 	data := url.Values{}
 	data.Add("fqdn", fqdn)
@@ -18,15 +18,29 @@ func (client *Client) AllocateIP(ID string) (*net.IPNet, error) {
 	return client.ipamOp(ID, "POST")
 }

+func (client *Client) AllocateIPInSubnet(ID string, subnet *net.IPNet) (*net.IPNet, error) {
+	ip, err := client.httpVerb("POST", fmt.Sprintf("/ip/%s/%s", ID, subnet), nil)
+	if err != nil {
+		return nil, err
+	}
+	return parseIP(ip)
+}
+
 // returns an IP for the ID given, or nil if one has not been
 // allocated
 func (client *Client) LookupIP(ID string) (*net.IPNet, error) {
 	return client.ipamOp(ID, "GET")
 }

-// release an IP which is no longer needed
-func (client *Client) ReleaseIP(ID string) error {
-	_, err := client.ipamOp(ID, "DELETE")
+// Claim a specific IP on behalf of the ID
+func (client *Client) ClaimIP(ID string, cidr *net.IPNet) error {
+	_, err := client.httpVerb("PUT", fmt.Sprintf("/ip/%s/%s", ID, cidr), nil)
+	return err
+}
+
+// release all IPs owned by an ID
+func (client *Client) ReleaseIPsFor(ID string) error {
+	_, err := client.httpVerb("DELETE", fmt.Sprintf("/ip/%s", ID), nil)
 	return err
 }

@@ -8,30 +8,21 @@ import (
 	"net/http"
 	"net/url"
 	"strings"
-
-	. "github.com/weaveworks/weave/common"
 )

 const (
-	WeaveHttpPort = 6784
+	WeaveHTTPHost = "127.0.0.1"
+	WeaveHTTPPort = 6784
 )

 type Client struct {
-	baseUrl string
-	resolve func() (string, error)
+	baseURL string
+	log     Logger
 }

 func (client *Client) httpVerb(verb string, url string, values url.Values) (string, error) {
-	baseUrl := client.baseUrl
-	if client.resolve != nil {
-		addr, err := client.resolve()
-		if err != nil {
-			return "", err
-		}
-		baseUrl = fmt.Sprintf("http://%s:%d", addr, WeaveHttpPort)
-	}
-	url = baseUrl + url
-	Log.Debugf("weave %s to %s with %v", verb, url, values)
+	url = client.baseURL + url
+	client.log.Debugf("weave %s to %s with %v", verb, url, values)
 	var body io.Reader
 	if values != nil {
 		body = strings.NewReader(values.Encode())
@@ -43,31 +34,49 @@ func (client *Client) httpVerb(verb string, url string, values url.Values) (stri
 	if values != nil {
 		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 	}
-	if resp, err := http.DefaultClient.Do(req); err != nil {
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
 		return "", err
-	} else {
-		defer resp.Body.Close()
-		body, err := ioutil.ReadAll(resp.Body)
-		if err != nil {
-			return "", err
-		}
-		if resp.StatusCode == http.StatusOK || resp.StatusCode == http.StatusNoContent {
-			return string(body), nil
-		} else {
-			return "", errors.New(resp.Status + ": " + string(body))
-		}
 	}
+	defer resp.Body.Close()
+	rbody, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return "", err
+	}
+	if resp.StatusCode == http.StatusOK || resp.StatusCode == http.StatusNoContent {
+		return string(rbody), nil
+	}
+	return "", errors.New(resp.Status + ": " + string(rbody))
 }

-func NewClient(addr string) *Client {
-	return &Client{baseUrl: fmt.Sprintf("http://%s:%d", addr, WeaveHttpPort)}
-}
-
-func NewClientWithResolver(resolver func() (string, error)) *Client {
-	return &Client{resolve: resolver}
+func NewClient(addr string, log Logger) *Client {
+	host := WeaveHTTPHost
+	port := fmt.Sprintf("%d", WeaveHTTPPort)
+	switch parts := strings.Split(addr, ":"); len(parts) {
+	case 0:
+	case 1:
+		if parts[0] != "" {
+			host = parts[0]
+		}
+	case 2:
+		if parts[0] != "" {
+			host = parts[0]
+		}
+		if parts[1] != "" {
+			port = parts[1]
+		}
+	default:
+		return &Client{baseURL: fmt.Sprintf("http://%s", addr), log: log}
+	}
+	return &Client{baseURL: fmt.Sprintf("http://%s:%s", host, port), log: log}
 }

 func (client *Client) Connect(remote string) error {
 	_, err := client.httpVerb("POST", "/connect", url.Values{"peer": {remote}})
 	return err
 }
+
+type Logger interface {
+	Infof(string, ...interface{})
+	Debugf(string, ...interface{})
+}
@@ -14,7 +14,8 @@ set -e
 START=${FIRST_WEAVE:-1}
 COUNT=${NUM_WEAVES:-28}
 FINISH=$((START+COUNT-1))
-PORT=6783
+
+SUBNET=192.168.7

 weavedir=$(dirname $0)/..

@@ -26,32 +27,42 @@ random_mac() {
    od -txC -An -N6 /dev/urandom | ( read a b c d e f && printf "%02x:$b:$c:$d:$e:$f" $((0x$a & ~1 | 2)) )
 }

+weave() {
+    i=$1
+    shift
+    WEAVE_CONTAINER_NAME=weave$i WEAVE_HTTP_ADDR=$SUBNET.$i:6784 $weavedir/weave "$@"
+}
+
 case "$1" in
    launch)
        shift 1
        echo $(date -R) launching
+        ip link show multiweave >/dev/null 2>&1 || sudo ip link add name multiweave type bridge
        for i in $(seq $START $FINISH); do
-            WEAVE_CONTAINER_NAME=weave$i WEAVE_PORT=$((5000+i)) $weavedir/weave launch-router --iface '' --name $(random_mac) --nickname weave$i --port $PORT --no-dns "$@"
+            IP=$SUBNET.$i
+            sudo ip addr add $IP/24 dev multiweave
+            weave $i launch-router --datapath '' --iface '' --no-dns --host $IP \
+                --name $(random_mac) --nickname weave$i "$@"
        done
-        if [ $START -ne 1 ] ; then
-            status=$(docker inspect --format='{{.State.Running}} {{.NetworkSettings.IPAddress}}' weave$((START-1)))
-            PREV="${status#true }"
-        fi
        echo $(date -R) connecting
+        [ $START -gt 1 ] || START=2
        for i in $(seq $START $FINISH); do
-            if [ -n "$PREV" ] ; then
-                echo connecting weave$i to $PREV
-                WEAVE_CONTAINER_NAME=weave$i $weavedir/weave connect $PREV
-            fi
-            status=$(docker inspect --format='{{.State.Running}} {{.NetworkSettings.IPAddress}}' weave$i)
-            PREV="${status#true }"
+            TO=$SUBNET.$((i-1))
+            echo connecting weave$i to $TO
+            weave $i connect $TO
        done
        echo $(date -R) done
        ;;
    stop)
-        for i in $(seq $START $FINISH); do
+        for i in $(seq $FINISH -1 $START); do
+            IP=$SUBNET.$i
            echo Stopping weave$i
-            WEAVE_CONTAINER_NAME=weave$i $weavedir/weave stop-router
+            weave $i stop-router
+            sudo ip addr del $IP/24 dev multiweave || true
        done
+        [ -z "$(ip -4 -o addr show multiweave)" ] && sudo ip link del multiweave
+        ;;
+    *)
+            weave "$@"
        ;;
 esac
@@ -0,0 +1,46 @@
+#!/bin/bash
+
+set -e
+set -o pipefail
+
+PRODUCT=net
+
+fatal() {
+    echo "$@" >&2
+    exit 1
+}
+
+if [ ! -d .git ] ; then
+    fatal "Current directory is not a git clone"
+fi
+
+if ! BRANCH=$(git symbolic-ref --short HEAD) || [ -z "$BRANCH" ] ; then
+    fatal "Could not determine branch"
+fi
+
+case "$BRANCH" in
+    issues/*)
+        VERSION="${BRANCH#issues/}"
+        TAGS="$VERSION"
+        ;;
+    *)
+        if echo "$BRANCH" | grep -qE '^[0-9]+\.[0-9]+' ; then
+            DESCRIBE=$(git describe --match 'v*')
+            if ! VERSION=$(echo "$DESCRIBE" | grep -oP '(?<=^v)[0-9]+\.[0-9]+\.[0-9]+') ; then
+                fatal "Could not infer latest $BRANCH version from $DESCRIBE"
+            fi
+            TAGS="$VERSION latest"
+        else
+            VERSION="$BRANCH"
+            TAGS="$VERSION"
+        fi
+        ;;
+esac
+
+for TAG in $TAGS ; do
+    echo ">>> Publishing $PRODUCT $VERSION to $1/docs/$PRODUCT/$TAG"
+    wordepress \
+        --url "$1" --user "$2" --password "$3" \
+        --product "$PRODUCT" --version "$VERSION" --tag "$TAG" \
+        publish site
+done
@@ -165,14 +165,14 @@ publish() {
    setup
    cd $PWD/$RELEASE_DIR

-    UPDATE_LATEST=false
+    IS_MAINLINE=false
    if [ "$RELEASE_TYPE" = 'MAINLINE' ] ; then
-        UPDATE_LATEST=true
+        IS_MAINLINE=true
    fi

    if [ "$RELEASE_TYPE" = 'PRERELEASE' ] ; then
        echo "== Tagging and pushing images on docker hub as user $DOCKERHUB_USER"
-        make UPDATE_LATEST=$UPDATE_LATEST SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER publish
+        make UPDATE_LATEST=$IS_MAINLINE SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER publish
        echo "** Docker images tagged and pushed"

        echo "== Publishing pre-release on GitHub"
@@ -204,7 +204,7 @@ publish() {
        echo '** Sanity checks OK for publishing tag' $LATEST_TAG as $DOCKERHUB_USER/weave:$VERSION

        echo "== Tagging and pushing images on docker hub as user $DOCKERHUB_USER"
-        make UPDATE_LATEST=$UPDATE_LATEST SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER publish
+        make PUBLISH_WEAVEDB=$IS_MAINLINE UPDATE_LATEST=$IS_MAINLINE SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER publish
        echo "** Docker images tagged and pushed"

        echo "== Publishing release on GitHub"
@@ -1,24 +1,8 @@
-FROM ubuntu
-
-RUN apt-get -y update && apt-get -y install --no-install-recommends ca-certificates apt-transport-https
-RUN apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 36A1D7869245C8950F966E92D8576A8BA88D21E9
-RUN echo deb https://get.docker.io/ubuntu docker main > /etc/apt/sources.list.d/docker.list
-RUN apt-get -y update && apt-get -y install --no-install-recommends build-essential git lxc-docker-1.6.2 mercurial libpcap-dev curl make pkg-config gcc bison flex python-requests
-
-# When doing a build in a container, "apt-get update" happens twice,
-# which can be a very significant overhead for incremental builds.
-# And it's unnecessary, because if any of the prerequisites do change,
-# the right thing to do is to rebuild the container image.  Rather
-# than suppressing the "apt-get update" commands explicitly, we clear
-# out sources.list so that 'apt-get update' doesn't do anything.
-RUN echo >/etc/apt/sources.list
-
-ENV GO_VERSION 1.4.2
-RUN curl -sSL https://golang.org/dl/go${GO_VERSION}.linux-amd64.tar.gz | tar -C /usr/local -xz
-ENV PATH /usr/local/go/bin:$PATH
-
-# So that sudo does not trample on PATH
-RUN sed -ie '/secure_path/d' /etc/sudoers
-
+FROM golang:1.5.2
+ENV GO15VENDOREXPERIMENT 1
+RUN apt-get update && apt-get install -y libpcap-dev python-requests time file
+RUN go get github.com/golang/lint/golint github.com/fzipp/gocyclo github.com/client9/misspell/cmd/misspell
+RUN go clean -i net && go install -tags netgo std
+RUN go install -race -tags netgo std
 COPY build.sh /
 ENTRYPOINT ["sh", "/build.sh"]
@@ -1,45 +1,28 @@
 #!/bin/sh
-set -e

-GOPATH=/home/go
-export GOPATH
+set -eu

 WEAVE_SRC=$GOPATH/src/github.com/weaveworks/weave

-if [ $# -eq 0 -o "$1" = "tests" ] ; then
-    # No arguments.  Expect that the weave repo will be bind-mounted
-    # into $GOPATH
-    if ! [ -e $WEAVE_SRC ] ; then
-        cat 2>&1 <<EOF
-No container arguments supplied, and nothing at ${WEAVE_SRC}.  Please
-either bind-mount the golang workspace containing weave with the
+if ! [ -e $WEAVE_SRC ] ; then
+    cat 2>&1 <<EOF
+Nothing at ${WEAVE_SRC}.  Please bind-mount the weave repo with the
 docker run -v option, e.g.:

-    $ docker run -v <host gopath>:${GOPATH} \\
-          -v /var/run/docker.sock:/var/run/docker.sock weaveworks/weave-build
-
-Or supply git clone arguments to retrieve it, e.g.:
-
-    $ docker run -v /var/run/docker.sock:/var/run/docker.sock \\
-          weaveworks/weave-build https://github.com/weaveworks/weave.git
+    $ cd weave
+	$ docker run -v $(pwd):/go/src/github.com/weaveworks/weave \\
+		weaveworks/weave-build
 EOF
-        exit 1
-    fi
-
-    # If we run make directly, any files created on the bind mount
-    # will have awkward ownership.  So we switch to a user with the
-    # same user and group IDs as source directory.  We have to set a
-    # few things up so that sudo works without complaining later on.
-    uid=$(stat --format="%u" $WEAVE_SRC)
-    gid=$(stat --format="%g" $WEAVE_SRC)
-    echo "weave:x:$uid:$gid::$WEAVE_SRC:/bin/sh" >>/etc/passwd
-    echo "weave:*:::::::" >>/etc/shadow
-    echo "weave	ALL=(ALL)	NOPASSWD: ALL" >>/etc/sudoers
-
-    su weave -c "PATH=$PATH make -C $WEAVE_SRC build"
-else
-    # There are arguments to pass to git-clone
-    mkdir -p ${WEAVE_SRC%/*}
-    git clone "$@" $WEAVE_SRC
-    make -C $WEAVE_SRC build
 fi
+
+# If we run make directly, any files created on the bind mount
+# will have awkward ownership.  So we switch to a user with the
+# same user and group IDs as source directory.  We have to set a
+# few things up so that sudo works without complaining later on.
+uid=$(stat --format="%u" $WEAVE_SRC)
+gid=$(stat --format="%g" $WEAVE_SRC)
+echo "weave:x:$uid:$gid::$WEAVE_SRC:/bin/sh" >>/etc/passwd
+echo "weave:*:::::::" >>/etc/shadow
+echo "weave	ALL=(ALL)	NOPASSWD: ALL" >>/etc/sudoers
+
+su weave -c "PATH=$PATH make -C $WEAVE_SRC BUILD_IN_CONTAINER=false $*"
@@ -12,62 +12,67 @@ machine:
    SRCDIR: /home/ubuntu/src/github.com/weaveworks/weave
    PATH: $PATH:$HOME/.local/bin:$HOME/google-cloud-sdk/bin/
    CLOUDSDK_CORE_DISABLE_PROMPTS: 1
-    WEAVE_TEST: $HOME/docker/weave-test.tar

 dependencies:
  cache_directories:
    - "~/docker"
-  override:
-    - if [[ -e "$WEAVE_TEST" ]]; then
-        docker load -i $WEAVE_TEST;
-      else
-        docker build -t weaveworks/weave-build build;
-        docker build -t weaveworks/weave-test test/image;
-        mkdir -p $(dirname "$WEAVE_TEST");
-        docker save weaveworks/weave-test >$WEAVE_TEST;
-      fi
  post:
-    - sudo apt-get update && sudo apt-get install bc jq && pip install requests
+    - "sudo apt-get update && sudo apt-get install bc jq"
    - curl https://sdk.cloud.google.com | bash
    - bin/setup-circleci-secrets "$SECRET_PASSWORD"
-    - mkdir -p $(dirname $SRCDIR) && cp -r $(pwd)/ $SRCDIR
+    - "mkdir -p $(dirname $SRCDIR) && cp -r $(pwd)/ $SRCDIR"
+    - "cd $SRCDIR; git submodule update --init"
    - cd $SRCDIR/test; ./gce.sh make_template:
        parallel: false
+    - "cd $SRCDIR/build; ../tools/rebuild-image weaveworks/weavebuild . Dockerfile build.sh && touch $SRCDIR/.build.uptodate"

 test:
  override:
    - cd $SRCDIR; make lint:
        parallel: true
-    - docker run -v /home/ubuntu:/home/go -e COVERDIR=test/coverage -e SLOW=true -e CIRCLECI -e CIRCLE_BUILD_NUM -e CIRCLE_NODE_TOTAL -e CIRCLE_NODE_INDEX weaveworks/weave-test:
+    - cd $SRCDIR; COVERDIR=test/coverage make RM= tests:
        parallel: true
-    - docker run -v /var/run/docker.sock:/run/docker.sock -v /home/ubuntu:/home/go -e COVERAGE=true weaveworks/weave-build:
+    - cd $SRCDIR; make COVERAGE=true RM= exes all:
+        parallel: true
+    - cd $SRCDIR; make testrunner:
        parallel: true
    - cd $SRCDIR/test; ./gce.sh setup && eval $(./gce.sh hosts) && ./setup.sh:
        parallel: true
    - cd $SRCDIR/test; eval $(./gce.sh hosts); export COVERAGE=true; ./run_all.sh:
        parallel: true
        timeout: 300
-    - cd $SRCDIR; make clean-bin:
-        parallel: true
-    - docker run -v /var/run/docker.sock:/run/docker.sock -v /home/ubuntu:/home/go weaveworks/weave-build:
-        parallel: true
  post:
    - cd $SRCDIR/test; ./gce.sh destroy:
        parallel: true
+    - test "$CIRCLE_NODE_INDEX" != "0" || (cd $SRCDIR/test; ./gen_coverage_reports.sh):
+        parallel: true

 teardown:
  pre:
-    - test "$CIRCLE_NODE_INDEX" != "0" || (cd $SRCDIR/test; ./gen_coverage_reports.sh):
-        parallel: true
    - test "$CIRCLE_NODE_INDEX" != "0" || (go get github.com/mattn/goveralls && goveralls -repotoken $COVERALLS_REPO_TOKEN -coverprofile=$SRCDIR/test/profile.cov -service=circleci || true):
        parallel: true
    - test "$CIRCLE_NODE_INDEX" != "0" || (cd $SRCDIR/test; cp coverage.* $CIRCLE_ARTIFACTS):
        parallel: true

 deployment:
+  release:
+    branch: /[0-9]+\.[0-9]+/
+    owner: weaveworks
+    commands:
+      - go get github.com/weaveworks/wordepress && cd /home/ubuntu/src/github.com/weaveworks/wordepress && git checkout v1.0.0 && cd cmd/wordepress && go get
+      - cd $SRCDIR; bin/publish-site "$WP_LIVE_URL" "$WP_LIVE_USER" "$WP_LIVE_PASSWORD"
  hub:
    branch: master
    owner: weaveworks
    commands:
      - docker login -e $DOCKER_EMAIL -u $DOCKER_USER -p $DOCKER_PASS
-      - cd $SRCDIR; make publish
+      - cd $SRCDIR; make clean-bin
+      - cd $SRCDIR; make exes publish
+#      - go get github.com/weaveworks/wordepress && cd /home/ubuntu/src/github.com/weaveworks/wordepress && git checkout v1.0.0 && cd cmd/wordepress && go get
+#      - cd $SRCDIR; bin/publish-site "$WP_DEV_URL" "$WP_DEV_USER" "$WP_DEV_PASSWORD"
+#  issues:
+#    branch: /.*/
+#    owner: weaveworks
+#    commands:
+#      - go get github.com/weaveworks/wordepress && cd /home/ubuntu/src/github.com/weaveworks/wordepress && git checkout v1.0.0 && cd cmd/wordepress && go get
+#      - cd $SRCDIR; bin/publish-site "$WP_DEV_URL" "$WP_DEV_USER" "$WP_DEV_PASSWORD"
@@ -4,22 +4,36 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+	"time"

 	docker "github.com/fsouza/go-dockerclient"

-	. "github.com/weaveworks/weave/common"
+	"github.com/weaveworks/weave/common"
+)
+
+const (
+	InitialInterval = 1 * time.Second
+	MaxInterval     = 20 * time.Second
 )

 // An observer for container events
 type ContainerObserver interface {
 	ContainerStarted(ident string)
 	ContainerDied(ident string)
+	ContainerDestroyed(ident string)
 }

 type Client struct {
 	*docker.Client
 }

+type syncPair struct {
+	stop chan struct{}
+	done chan struct{}
+}
+
+type pendingStarts map[string]*syncPair
+
 // NewClient creates a new Docker client and checks we can talk to Docker
 func NewClient(apiPath string) (*Client, error) {
 	if apiPath != "" && !strings.Contains(apiPath, "://") {
@@ -63,46 +77,116 @@ func (c *Client) checkWorking() error {
 }

 func (c *Client) Info() string {
-	if env, err := c.Version(); err != nil {
+	env, err := c.Version()
+	if err != nil {
 		return fmt.Sprintf("Docker API error: %s", err)
-	} else {
-		return fmt.Sprintf("Docker API on %s: %v", c.Endpoint(), env)
 	}
+	return fmt.Sprintf("Docker API on %s: %v", c.Endpoint(), env)
+}
+
+func (c *Client) DockerVersion() string {
+	if env, err := c.Version(); err == nil {
+		if v, found := env.Map()["Version"]; found {
+			return v
+		}
+	}
+	return "unknown"
 }

 // AddObserver adds an observer for docker events
 func (c *Client) AddObserver(ob ContainerObserver) error {
-	events := make(chan *docker.APIEvents)
-	if err := c.AddEventListener(events); err != nil {
-		Log.Errorf("[docker] Unable to add listener to Docker API: %s", err)
-		return err
-	}
-
 	go func() {
-		for event := range events {
-			switch event.Status {
-			case "start":
-				id := event.ID
-				ob.ContainerStarted(id)
-			case "die":
-				id := event.ID
-				ob.ContainerDied(id)
+		pending := make(pendingStarts)
+		retryInterval := InitialInterval
+		for {
+			events := make(chan *docker.APIEvents)
+			if err := c.AddEventListener(events); err != nil {
+				c.errorf("Unable to add listener to Docker API: %s - retrying in %ds", err, retryInterval/time.Second)
+			} else {
+				start := time.Now()
+				for event := range events {
+					switch event.Status {
+					case "start":
+						pending.finish(event.ID)
+						pending.start(event.ID, c, ob)
+					case "die":
+						pending.finish(event.ID)
+						ob.ContainerDied(event.ID)
+					case "destroy":
+						pending.finish(event.ID)
+						ob.ContainerDestroyed(event.ID)
+					}
+				}
+				if time.Since(start) > retryInterval {
+					retryInterval = InitialInterval
+				}
+				c.errorf("Event listener channel closed - retrying subscription in %ds", retryInterval/time.Second)
+			}
+			time.Sleep(retryInterval)
+			retryInterval = retryInterval * 3 / 2
+			if retryInterval > MaxInterval {
+				retryInterval = MaxInterval
 			}
 		}
 	}()
 	return nil
 }

+// Docker sends a 'start' event before it has attempted to start the
+// container.  Delay notifying the observer until the container has a
+// pid, or we are told to stop when a 'die' event arrives.
+//
+// Note we always deliver the event, even if the container seems to
+// have gone away.
+func (pending pendingStarts) start(id string, c *Client, ob ContainerObserver) {
+	sync := syncPair{make(chan struct{}), make(chan struct{})}
+	pending[id] = &sync
+	go func() {
+		defer close(sync.done)
+		defer ob.ContainerStarted(id)
+		for {
+			if container, err := c.InspectContainer(id); err != nil || container.State.Pid != 0 {
+				return
+			}
+			select {
+			case <-sync.stop:
+				return
+			case <-time.After(200 * time.Millisecond):
+			}
+		}
+	}()
+}
+
+func (pending pendingStarts) finish(id string) {
+	if sync, found := pending[id]; found {
+		close(sync.stop)
+		<-sync.done
+		delete(pending, id)
+	}
+}
+
+func (c *Client) AllContainerIDs() ([]string, error) {
+	all, err := c.ListContainers(docker.ListContainersOptions{All: true})
+	if err != nil {
+		return nil, err
+	}
+	var ids []string
+	for _, c := range all {
+		ids = append(ids, c.ID)
+	}
+	return ids, nil
+}
+
 // IsContainerNotRunning returns true if we have checked with Docker that the ID is not running
 func (c *Client) IsContainerNotRunning(idStr string) bool {
 	container, err := c.InspectContainer(idStr)
 	if err == nil {
-		return !container.State.Running
+		return !container.State.Running || container.State.Restarting
 	}
 	if _, notThere := err.(*docker.NoSuchContainer); notThere {
 		return true
 	}
-	Log.Errorf("[docker] Could not check container status: %s", err)
+	c.errorf("Could not check container status: %s", err)
 	return false
 }

@@ -110,13 +194,11 @@ func (c *Client) IsContainerNotRunning(idStr string) bool {
 // if it is on the Docker bridge network then that address; if on the host network
 // then localhost
 func (c *Client) GetContainerIP(nameOrID string) (string, error) {
-	Log.Debugf("Getting IP for container %s", nameOrID)
 	info, err := c.InspectContainer(nameOrID)
 	if err != nil {
 		return "", err
 	}
 	if info.NetworkSettings.Networks != nil {
-		Log.Debugln("Networks: ", info.NetworkSettings.Networks)
 		if bridgeNetwork, ok := info.NetworkSettings.Networks["bridge"]; ok {
 			return bridgeNetwork.IPAddress, nil
 		} else if _, ok := info.NetworkSettings.Networks["host"]; ok {
@@ -130,3 +212,9 @@ func (c *Client) GetContainerIP(nameOrID string) (string, error) {
 	}
 	return info.NetworkSettings.IPAddress, nil
 }
+
+// logging
+
+func (c *Client) errorf(fmt string, args ...interface{}) {
+	common.Log.Errorf("[docker] "+fmt, args...)
+}
@@ -0,0 +1,18 @@
+package common
+
+import (
+	"net/http"
+)
+
+type loggingHandler struct {
+	next http.Handler
+}
+
+func (l *loggingHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	Log.Debugf("[http] %s %s", r.Method, r.URL.RequestURI())
+	l.next.ServeHTTP(w, r)
+}
+
+func LoggingHTTPHandler(h http.Handler) http.Handler {
+	return &loggingHandler{next: h}
+}
@@ -3,6 +3,7 @@ package common
 import (
 	"bytes"
 	"fmt"
+	"log"
 	"strings"

 	"github.com/Sirupsen/logrus"
@@ -64,3 +65,23 @@ func CheckWarn(e error) {
 		Log.Warnln(e)
 	}
 }
+
+// Adaptor type to go from Logrus to something expecting a standard library log.Logger
+type logLogger struct {
+	logger *logrus.Logger
+}
+
+// io.Writer interface
+func (l logLogger) Write(p []byte) (n int, err error) {
+	ln := len(p)
+	// Strip a trailing newline, because logrus formatter adds one
+	if ln > 0 && p[ln-1] == '\n' {
+		p = p[:ln-1]
+	}
+	l.logger.Info(string(p))
+	return ln, nil
+}
+
+func LogLogger() *log.Logger {
+	return log.New(logLogger{Log}, "", 0)
+}
@@ -10,49 +10,45 @@ import (

 // ODP admin functionality

-func CreateDatapath(dpname string) (err error, supported bool) {
+func CreateDatapath(dpname string) (supported bool, err error) {
 	dpif, err := odp.NewDpif()
 	if err != nil {
 		if odp.IsKernelLacksODPError(err) {
-			return nil, false
+			return false, nil
 		}
-
-		return err, true
+		return true, err
 	}
-
 	defer dpif.Close()

 	dp, err := dpif.CreateDatapath(dpname)
 	if err != nil && !odp.IsDatapathNameAlreadyExistsError(err) {
-		return err, true
+		return true, err
 	}

 	// Pick an ephemeral port number to use in probing for vxlan
 	// support.
 	udpconn, err := net.ListenUDP("udp4", nil)
 	if err != nil {
-		return err, true
+		return true, err
 	}
+	defer udpconn.Close()

 	// we leave the UDP socket open, so creating a vxlan vport on
 	// the same port number should fail.  But that's fine: It's
 	// still sufficient to probe for support.
 	portno := uint16(udpconn.LocalAddr().(*net.UDPAddr).Port)
-	vpid, err := dp.CreateVport(odp.NewVxlanVportSpec(
-		fmt.Sprintf("vxlan-%d", portno), portno))
+	vpid, err := dp.CreateVport(odp.NewVxlanVportSpec(fmt.Sprintf("vxlan-%d", portno), portno))
 	if nlerr, ok := err.(odp.NetlinkError); ok {
 		if syscall.Errno(nlerr) == syscall.EAFNOSUPPORT {
 			dp.Delete()
-			return fmt.Errorf("kernel does not have Open vSwitch VXLAN support"), false
+			return false, fmt.Errorf("kernel does not have Open vSwitch VXLAN support")
 		}
 	}
-
 	if err == nil {
 		dp.DeleteVport(vpid)
 	}

-	udpconn.Close()
-	return nil, true
+	return true, nil
 }

 func DeleteDatapath(dpname string) error {
@@ -60,7 +56,6 @@ func DeleteDatapath(dpname string) error {
 	if err != nil {
 		return err
 	}
-
 	defer dpif.Close()

 	dp, err := dpif.LookupDatapath(dpname)
@@ -68,7 +63,6 @@ func DeleteDatapath(dpname string) error {
 		if odp.IsNoSuchDatapathError(err) {
 			return nil
 		}
-
 		return err
 	}

@@ -80,7 +74,6 @@ func AddDatapathInterface(dpname string, ifname string) error {
 	if err != nil {
 		return err
 	}
-
 	defer dpif.Close()

 	dp, err := dpif.LookupDatapath(dpname)
@@ -1,7 +1,16 @@
 package common

 import (
+	"fmt"
+	"net"
+	"os"
 	"strings"
+
+	"github.com/j-keck/arping"
+	"github.com/vishvananda/netlink"
+	"github.com/vishvananda/netns"
+
+	weavenet "github.com/weaveworks/weave/net"
 )

 // Assert test is true, panic otherwise
@@ -18,3 +27,132 @@ func ErrorMessages(errors []error) string {
 	}
 	return strings.Join(result, "\n")
 }
+
+type NetDev struct {
+	Name  string
+	MAC   net.HardwareAddr
+	CIDRs []*net.IPNet
+}
+
+// Search the network namespace of a process for interfaces matching a predicate
+// Note that the predicate is called while the goroutine is inside the process' netns
+func FindNetDevs(processID int, match func(link netlink.Link) bool) ([]NetDev, error) {
+	var netDevs []NetDev
+
+	ns, err := netns.GetFromPid(processID)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	defer ns.Close()
+
+	err = weavenet.WithNetNS(ns, func() error {
+		return forEachLink(func(link netlink.Link) error {
+			if match(link) {
+				netDev, err := linkToNetDev(link)
+				if err != nil {
+					return err
+				}
+				netDevs = append(netDevs, *netDev)
+			}
+			return nil
+		})
+	})
+
+	return netDevs, err
+}
+
+func forEachLink(f func(netlink.Link) error) error {
+	links, err := netlink.LinkList()
+	if err != nil {
+		return err
+	}
+	for _, link := range links {
+		if err := f(link); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func linkToNetDev(link netlink.Link) (*NetDev, error) {
+	addrs, err := netlink.AddrList(link, netlink.FAMILY_V4)
+	if err != nil {
+		return nil, err
+	}
+
+	netDev := &NetDev{Name: link.Attrs().Name, MAC: link.Attrs().HardwareAddr}
+	for _, addr := range addrs {
+		netDev.CIDRs = append(netDev.CIDRs, addr.IPNet)
+	}
+	return netDev, nil
+}
+
+// Lookup the weave interface of a container
+func GetWeaveNetDevs(processID int) ([]NetDev, error) {
+	// Bail out if this container is running in the root namespace
+	nsToplevel, err := netns.GetFromPid(1)
+	if err != nil {
+		return nil, fmt.Errorf("unable to open root namespace: %s", err)
+	}
+	nsContainr, err := netns.GetFromPid(processID)
+	if err != nil {
+		return nil, fmt.Errorf("unable to open process %d namespace: %s", processID, err)
+	}
+	if nsToplevel.Equal(nsContainr) {
+		return nil, nil
+	}
+
+	weaveBridge, err := netlink.LinkByName("weave")
+	if err != nil {
+		return nil, fmt.Errorf("Cannot find weave bridge: %s", err)
+	}
+	// Scan devices in root namespace to find those attached to weave bridge
+	indexes := make(map[int]struct{})
+	err = forEachLink(func(link netlink.Link) error {
+		if link.Attrs().MasterIndex == weaveBridge.Attrs().Index {
+			peerIndex := link.Attrs().ParentIndex
+			if peerIndex == 0 {
+				// perhaps running on an older kernel where ParentIndex doesn't work.
+				// as fall-back, assume the indexes are consecutive
+				peerIndex = link.Attrs().Index - 1
+			}
+			indexes[peerIndex] = struct{}{}
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return FindNetDevs(processID, func(link netlink.Link) bool {
+		_, isveth := link.(*netlink.Veth)
+		_, found := indexes[link.Attrs().Index]
+		return isveth && found
+	})
+}
+
+// Get the weave bridge interface
+func GetBridgeNetDev(bridgeName string) ([]NetDev, error) {
+	return FindNetDevs(1, func(link netlink.Link) bool {
+		return link.Attrs().Name == bridgeName
+	})
+}
+
+// Do post-attach configuration of all veths we have created
+func ConfigureARPforVeths(processID int, prefix string) error {
+	_, err := FindNetDevs(processID, func(link netlink.Link) bool {
+		ifName := link.Attrs().Name
+		if strings.HasPrefix(ifName, prefix) {
+			weavenet.ConfigureARPCache(ifName)
+			if addrs, err := netlink.AddrList(link, netlink.FAMILY_V4); err == nil {
+				for _, addr := range addrs {
+					arping.GratuitousArpOverIfaceByName(addr.IPNet.IP, ifName)
+				}
+			}
+		}
+		return false
+	})
+	return err
+}
@@ -0,0 +1,84 @@
+package db
+
+import (
+	"bytes"
+	"encoding/gob"
+	"fmt"
+
+	"github.com/boltdb/bolt"
+)
+
+type DB interface {
+	Load(string, interface{}) (bool, error)
+	Save(string, interface{}) error
+}
+
+type BoltDB struct {
+	db *bolt.DB
+}
+
+var (
+	versionIdent       = []byte("version")
+	persistenceVersion = []byte{1, 0} // major.minor
+	topBucket          = []byte("top")
+)
+
+func NewBoltDB(dbPathname string) (*BoltDB, error) {
+	db, err := bolt.Open(dbPathname, 0660, nil)
+	if err != nil {
+		return nil, fmt.Errorf("[boltDB] Unable to open %s: %s", dbPathname, err)
+	}
+	// check the persistence version
+	err = db.Update(func(tx *bolt.Tx) error {
+		if top := tx.Bucket(topBucket); top == nil {
+			top, err := tx.CreateBucket(topBucket)
+			if err != nil {
+				return err
+			}
+			if err := top.Put(versionIdent, persistenceVersion); err != nil {
+				return err
+			}
+		} else {
+			if checkVersion := top.Get(versionIdent); checkVersion != nil {
+				if checkVersion[0] != persistenceVersion[0] {
+					return fmt.Errorf("[boltDB] Cannot use persistence file %s - version %x", dbPathname, checkVersion)
+				}
+			}
+		}
+		return nil
+	})
+	return &BoltDB{db: db}, err
+}
+
+func (d *BoltDB) Load(ident string, data interface{}) (bool, error) {
+	found := true
+	err := d.db.View(func(tx *bolt.Tx) error {
+		b := tx.Bucket(topBucket)
+		v := b.Get([]byte(ident))
+		if v == nil {
+			found = false
+			return nil
+		}
+		reader := bytes.NewReader(v)
+		decoder := gob.NewDecoder(reader)
+		err := decoder.Decode(data)
+		return err
+	})
+	return found, err
+}
+
+func (d *BoltDB) Save(ident string, data interface{}) error {
+	return d.db.Update(func(tx *bolt.Tx) error {
+		b := tx.Bucket(topBucket)
+		buf := new(bytes.Buffer)
+		enc := gob.NewEncoder(buf)
+		if err := enc.Encode(data); err != nil {
+			return err
+		}
+		return b.Put([]byte(ident), buf.Bytes())
+	})
+}
+
+func (d *BoltDB) Close() error {
+	return d.db.Close()
+}
@@ -24,7 +24,7 @@ The router relies on having access to the source and destination peer
 when deciding how to forward packets. When the Sleeve overlay is in
 use this information is conveyed directly within the encapsulation by
 including the names of the peers in question, a solution not
-accomodated directly by the vxlan wire format. Fortunately vxlan does
+accommodated directly by the vxlan wire format. Fortunately vxlan does
 have a twenty four bit segment ID field in the header we can use to
 encode this data - the challenge is to identify peers uniquely with a
 twelve bit identifier instead of the seventeen bytes used by Sleeve.
@@ -54,8 +54,8 @@ with low path MTUs.
 To avoid triggering this fallback in typical deployments, the datapath
 interface is statically configured with an MTU of 1410 bytes allowing
 it to work with most underlay network provider MTUs, including GCE at
-1460 bytes (the fifty byte difference accomodates the vxlan overhead).
-This value can be overriden by setting `WEAVE_MTU` at launch if
+1460 bytes (the fifty byte difference accommodates the vxlan overhead).
+This value can be overridden by setting `WEAVE_MTU` at launch if
 necessary.

 # Virtual Ports
@@ -210,11 +210,3 @@ reached the peer that does the `rmpeer`, then we get an inconsistent
 ring.  We could make it safe, up to partitions, by inquiring of every
 live peer what its view of the dead peer is, and making sure we use
 the latest info.)
-
-## Limitations
-
-Nothing is persisted. If one peer restarts it should receive gossip
-from other peers showing what it used to own, and in that case it can
-recover quite well. If, however, there are no peers left alive, or
-this peer cannot establish network communication with those that are,
-then it cannot recover.
@@ -6,7 +6,6 @@
 * Create a [github token for
  github-release](https://help.github.com/articles/creating-an-access-token-for-command-line-use/);
 set and export `$GITHUB_TOKEN` with this value
-* Update all dependencies with `make update`

 ## Release Types

@@ -63,9 +62,10 @@ This has the following effects:
 ## Draft Phase
 ### Push Version Tag Upstream

-First you must push your version tag upstream, so that an associated
-GitHub release may be created:
+First you must push your branch and version tag upstream, so that an
+associated GitHub release may be created:

+    git push git@github.com:weaveworks/weave
    git push git@github.com:weaveworks/weave $TAG

 N.B. if you're testing the release process, push to your fork
@@ -128,6 +128,16 @@ Finally, for **Mainline** releases only:

 * Images tagged `latest` are updated on DockerHub

+### Finish up
+
+* If not on master, merge branch into master and push to GitHub.
+* Close the [milestone](https://github.com/weaveworks/weave/milestones) in GitHub and create the next milestone
+* Update the `#weavenetwork` topic heading on freenode (requires 'chanops' permission)
+* For a mainline release vX.Y.0, create a release branch X.Y from the
+  tag and push to GitHub - this will result in X.Y.0 site docs being
+  published to https://www.weave.works
+* Add the new version of `weave-net` to the checkpoint system at
+  https://checkpoint-api.weave.works/admin

 ## Troubleshooting

@@ -9,7 +9,7 @@ The model is that each host has a service that is notified of
 hostnames and weave addresses for containers on the host.  Like IPAM,
 this service is embedded within the router.  It binds to
 the host bridge to answer DNS queries from local containers; for
-anything it can't answer, it uses the infomation in the host's
+anything it can't answer, it uses the information in the host's
 /etc/resolv.conf to query an 'fallback' server.

 The service is comprised of a DNS server, which answers all DNS queries
@@ -33,7 +33,7 @@ are re-broadcast around the cluster.
 The DNS server also listens to the Docker event stream, and removes
 entries for containers when they die.  Entries removed in this way are
 tombstoned, and the tombstone lazily broadcast around the cluster.
-After a short timeout the tombstones are independantly removed from
+After a short timeout the tombstones are independently removed from
 each host.


@@ -14,7 +14,8 @@ type allocateResult struct {
 type allocate struct {
 	resultChan       chan<- allocateResult
 	ident            string
-	r                address.Range // Range we are trying to allocate within
+	r                address.CIDR // Subnet we are trying to allocate within
+	isContainer      bool
 	hasBeenCancelled func() bool
 }

@@ -25,34 +26,36 @@ func (g *allocate) Try(alloc *Allocator) bool {
 		return true
 	}

-	if addr, found := alloc.lookupOwned(g.ident, g.r); found {
-		g.resultChan <- allocateResult{addr, nil}
+	if addrs := alloc.ownedInRange(g.ident, g.r.Range()); len(addrs) > 0 {
+		// If we had heard that this container died, resurrect it
+		delete(alloc.dead, g.ident) // delete is no-op if key not in map
+		g.resultChan <- allocateResult{addrs[0].Addr, nil}
 		return true
 	}

-	if !alloc.universe.Overlaps(g.r) {
-		g.resultChan <- allocateResult{0, fmt.Errorf("range %s out of bounds: %s", g.r, alloc.universe)}
+	if !alloc.universe.Range().Overlaps(g.r.Range()) {
+		g.resultChan <- allocateResult{err: fmt.Errorf("range %s out of bounds: %s", g.r, alloc.universe)}
 		return true
 	}

 	alloc.establishRing()

-	if ok, addr := alloc.space.Allocate(g.r); ok {
+	if ok, addr := alloc.space.Allocate(g.r.HostRange()); ok {
 		// If caller hasn't supplied a unique ID, file it under the IP address
 		// which lets the caller then release the address using DELETE /ip/address
 		if g.ident == "_" {
 			g.ident = addr.String()
 		}
 		alloc.debugln("Allocated", addr, "for", g.ident, "in", g.r)
-		alloc.addOwned(g.ident, addr)
+		alloc.addOwned(g.ident, address.MakeCIDR(g.r, addr), g.isContainer)
 		g.resultChan <- allocateResult{addr, nil}
 		return true
 	}

 	// out of space
-	donors := alloc.ring.ChoosePeersToAskForSpace(g.r.Start, g.r.End)
+	donors := alloc.ring.ChoosePeersToAskForSpace(g.r.Addr, g.r.Range().End)
 	for _, donor := range donors {
-		if err := alloc.sendSpaceRequest(donor, g.r); err != nil {
+		if err := alloc.sendSpaceRequest(donor, g.r.Range()); err != nil {
 			alloc.debugln("Problem asking peer", donor, "for space:", err)
 		} else {
 			alloc.debugln("Decided to ask peer", donor, "for space in range", g.r)
@@ -64,7 +67,7 @@ func (g *allocate) Try(alloc *Allocator) bool {
 }

 func (g *allocate) Cancel() {
-	g.resultChan <- allocateResult{0, &errorCancelled{"Allocate", g.ident}}
+	g.resultChan <- allocateResult{err: &errorCancelled{"Allocate", g.ident}}
 }

 func (g *allocate) ForContainer(ident string) bool {
@@ -7,11 +7,14 @@ import (
 	"sort"
 	"time"

+	"github.com/weaveworks/mesh"
+
 	"github.com/weaveworks/weave/common"
+	"github.com/weaveworks/weave/db"
 	"github.com/weaveworks/weave/ipam/paxos"
 	"github.com/weaveworks/weave/ipam/ring"
 	"github.com/weaveworks/weave/ipam/space"
-	"github.com/weaveworks/weave/mesh"
+	"github.com/weaveworks/weave/ipam/tracker"
 	"github.com/weaveworks/weave/net/address"
 )

@@ -21,8 +24,9 @@ const (
 	msgRingUpdate
 	msgSpaceRequestDenied

-	paxosInterval = time.Second * 5
-	MinSubnetSize = 4 // first and last addresses are excluded, so 2 would be too small
+	tickInterval         = time.Second * 5
+	MinSubnetSize        = 4 // first and last addresses are excluded, so 2 would be too small
+	containerDiedTimeout = time.Second * 30
 )

 // operation represents something which Allocator wants to do, but
@@ -38,52 +42,135 @@ type operation interface {
 	ForContainer(ident string) bool
 }

+// This type is persisted hence all fields exported
+type ownedData struct {
+	IsContainer bool
+	Cidrs       []address.CIDR
+}
+
 // Allocator brings together Ring and space.Set, and does the
 // necessary plumbing.  Runs as a single-threaded Actor, so no locks
 // are used around data structures.
 type Allocator struct {
-	actionChan       chan<- func()
-	ourName          mesh.PeerName
-	universe         address.Range                // superset of all ranges
-	ring             *ring.Ring                   // information on ranges owned by all peers
-	space            space.Space                  // more detail on ranges owned by us
-	owned            map[string][]address.Address // who owns what addresses, indexed by container-ID
-	nicknames        map[mesh.PeerName]string     // so we can map nicknames for rmpeer
-	pendingAllocates []operation                  // held until we get some free space
-	pendingClaims    []operation                  // held until we know who owns the space
-	gossip           mesh.Gossip                  // our link to the outside world for sending messages
-	paxos            *paxos.Node
-	paxosTicker      *time.Ticker
-	shuttingDown     bool // to avoid doing any requests while trying to shut down
-	isKnownPeer      func(mesh.PeerName) bool
-	now              func() time.Time
+	actionChan        chan<- func()
+	stopChan          chan<- struct{}
+	ourName           mesh.PeerName
+	seed              []mesh.PeerName          // optional user supplied ring seed
+	universe          address.CIDR             // superset of all ranges
+	ring              *ring.Ring               // information on ranges owned by all peers
+	space             space.Space              // more detail on ranges owned by us
+	owned             map[string]ownedData     // who owns what addresses, indexed by container-ID
+	nicknames         map[mesh.PeerName]string // so we can map nicknames for rmpeer
+	pendingAllocates  []operation              // held until we get some free space
+	pendingClaims     []operation              // held until we know who owns the space
+	pendingPrimes     []operation              // held while our ring is empty
+	dead              map[string]time.Time     // containers we heard were dead, and when
+	db                db.DB                    // persistence
+	gossip            mesh.Gossip              // our link to the outside world for sending messages
+	paxos             paxos.Participant
+	awaitingConsensus bool
+	ticker            *time.Ticker
+	shuttingDown      bool // to avoid doing any requests while trying to shut down
+	isKnownPeer       func(mesh.PeerName) bool
+	quorum            func() uint
+	now               func() time.Time
+}
+
+type Config struct {
+	OurName     mesh.PeerName
+	OurUID      mesh.PeerUID
+	OurNickname string
+	Seed        []mesh.PeerName
+	Universe    address.CIDR
+	IsObserver  bool
+	Quorum      func() uint
+	Db          db.DB
+	IsKnownPeer func(name mesh.PeerName) bool
+	Tracker     tracker.LocalRangeTracker
 }

 // NewAllocator creates and initialises a new Allocator
-func NewAllocator(ourName mesh.PeerName, ourUID mesh.PeerUID, ourNickname string, universe address.Range, quorum uint, isKnownPeer func(name mesh.PeerName) bool) *Allocator {
-	return &Allocator{
-		ourName:     ourName,
-		universe:    universe,
-		ring:        ring.New(universe.Start, universe.End, ourName),
-		owned:       make(map[string][]address.Address),
-		paxos:       paxos.NewNode(ourName, ourUID, quorum),
-		nicknames:   map[mesh.PeerName]string{ourName: ourNickname},
-		isKnownPeer: isKnownPeer,
+func NewAllocator(config Config) *Allocator {
+	var participant paxos.Participant
+	var alloc *Allocator
+	var onUpdate ring.OnUpdate
+
+	if config.IsObserver {
+		participant = paxos.NewObserver()
+	} else {
+		participant = paxos.NewNode(config.OurName, config.OurUID, 0)
+	}
+
+	if config.Tracker != nil {
+		onUpdate = func(prev []address.Range, curr []address.Range, local bool) {
+			if err := config.Tracker.HandleUpdate(prev, curr, local); err != nil {
+				alloc.errorf("HandleUpdate failed: %s", err)
+			}
+		}
+	}
+
+	alloc = &Allocator{
+		ourName:     config.OurName,
+		seed:        config.Seed,
+		universe:    config.Universe,
+		ring:        ring.New(config.Universe.Range().Start, config.Universe.Range().End, config.OurName, onUpdate),
+		owned:       make(map[string]ownedData),
+		db:          config.Db,
+		paxos:       participant,
+		nicknames:   map[mesh.PeerName]string{config.OurName: config.OurNickname},
+		isKnownPeer: config.IsKnownPeer,
+		quorum:      config.Quorum,
+		dead:        make(map[string]time.Time),
 		now:         time.Now,
 	}
+	return alloc
+}
+
+func ParseCIDRSubnet(cidrStr string) (cidr address.CIDR, err error) {
+	cidr, err = address.ParseCIDR(cidrStr)
+	if err != nil {
+		return
+	}
+	if !cidr.IsSubnet() {
+		err = fmt.Errorf("invalid subnet - bits after network prefix are not all zero: %s", cidrStr)
+	}
+	if cidr.Size() < MinSubnetSize {
+		err = fmt.Errorf("invalid subnet - smaller than minimum size %d: %s", MinSubnetSize, cidrStr)
+	}
+	return
 }

 // Start runs the allocator goroutine
 func (alloc *Allocator) Start() {
+	loadedPersistedData := alloc.loadPersistedData()
+	switch {
+	case loadedPersistedData && len(alloc.seed) != 0:
+		alloc.infof("Found persisted IPAM data, ignoring supplied IPAM seed")
+	case loadedPersistedData:
+		alloc.infof("Initialising with persisted data")
+	case len(alloc.seed) != 0:
+		alloc.infof("Initialising with supplied IPAM seed")
+		alloc.createRing(alloc.seed)
+	case alloc.paxos.IsElector():
+		alloc.infof("Initialising via deferred consensus")
+	default:
+		alloc.infof("Initialising as observer - awaiting IPAM data from another peer")
+	}
 	actionChan := make(chan func(), mesh.ChannelSize)
+	stopChan := make(chan struct{})
 	alloc.actionChan = actionChan
-	go alloc.actorLoop(actionChan)
+	alloc.stopChan = stopChan
+	alloc.ticker = time.NewTicker(tickInterval)
+	go alloc.actorLoop(actionChan, stopChan)
 }

 // Stop makes the actor routine exit, for test purposes ONLY because any
 // calls after this is processed will hang. Async.
 func (alloc *Allocator) Stop() {
-	alloc.actionChan <- nil
+	select {
+	case alloc.stopChan <- struct{}{}:
+	default:
+	}
 }

 // Operation life cycle
@@ -140,35 +227,31 @@ func (alloc *Allocator) cancelOpsFor(ops *[]operation, ident string) bool {
 	return found
 }

-// Try all pending operations
-func (alloc *Allocator) tryPendingOps() {
-	// The slightly different semantics requires us to operate on 'claims' and
-	// 'allocates' separately:
-	// Claims must be tried before Allocates
-	for i := 0; i < len(alloc.pendingClaims); {
-		op := alloc.pendingClaims[i]
+// Try all operations in a queue
+func (alloc *Allocator) tryOps(ops *[]operation) {
+	for i := 0; i < len(*ops); {
+		op := (*ops)[i]
 		if !op.Try(alloc) {
 			i++
 			continue
 		}
-		alloc.pendingClaims = append(alloc.pendingClaims[:i], alloc.pendingClaims[i+1:]...)
+		*ops = append((*ops)[:i], (*ops)[i+1:]...)
 	}
+}

-	// When the first Allocate fails, bail - no need to
-	// send too many begs for space.
-	for i := 0; i < len(alloc.pendingAllocates); {
-		op := alloc.pendingAllocates[i]
-		if !op.Try(alloc) {
-			break
-		}
-		alloc.pendingAllocates = append(alloc.pendingAllocates[:i], alloc.pendingAllocates[i+1:]...)
-	}
+// Try all pending operations
+func (alloc *Allocator) tryPendingOps() {
+	// Unblock pending primes first
+	alloc.tryOps(&alloc.pendingPrimes)
+	// Process existing claims before servicing new allocations
+	alloc.tryOps(&alloc.pendingClaims)
+	alloc.tryOps(&alloc.pendingAllocates)
 }

 func (alloc *Allocator) spaceRequestDenied(sender mesh.PeerName, r address.Range) {
 	for i := 0; i < len(alloc.pendingClaims); {
 		claim := alloc.pendingClaims[i].(*claim)
-		if r.Contains(claim.addr) {
+		if r.Contains(claim.cidr.Addr) {
 			claim.deniedBy(alloc, sender)
 			alloc.pendingClaims = append(alloc.pendingClaims[:i], alloc.pendingClaims[i+1:]...)
 			continue
@@ -188,87 +271,135 @@ func (e *errorCancelled) Error() string {

 // Actor client API

+// Prime (Sync) - wait for consensus
+func (alloc *Allocator) Prime() {
+	resultChan := make(chan struct{})
+	op := &prime{resultChan: resultChan}
+	alloc.doOperation(op, &alloc.pendingPrimes)
+	<-resultChan
+}
+
 // Allocate (Sync) - get new IP address for container with given name in range
 // if there isn't any space in that range we block indefinitely
-func (alloc *Allocator) Allocate(ident string, r address.Range, hasBeenCancelled func() bool) (address.Address, error) {
+func (alloc *Allocator) Allocate(ident string, r address.CIDR, isContainer bool, hasBeenCancelled func() bool) (address.Address, error) {
 	resultChan := make(chan allocateResult)
-	op := &allocate{resultChan: resultChan, ident: ident, r: r, hasBeenCancelled: hasBeenCancelled}
+	op := &allocate{
+		resultChan:       resultChan,
+		ident:            ident,
+		r:                r,
+		isContainer:      isContainer,
+		hasBeenCancelled: hasBeenCancelled,
+	}
 	alloc.doOperation(op, &alloc.pendingAllocates)
 	result := <-resultChan
 	return result.addr, result.err
 }

-// Lookup (Sync) - get existing IP address for container with given name in range
-func (alloc *Allocator) Lookup(ident string, r address.Range) (address.Address, error) {
-	resultChan := make(chan allocateResult)
+// Lookup (Sync) - get existing IP addresses for container with given name in range
+func (alloc *Allocator) Lookup(ident string, r address.Range) ([]address.CIDR, error) {
+	resultChan := make(chan []address.CIDR)
 	alloc.actionChan <- func() {
-		if addr, found := alloc.lookupOwned(ident, r); found {
-			resultChan <- allocateResult{addr: addr}
-			return
-		}
-		resultChan <- allocateResult{err: fmt.Errorf("lookup: no address found for %s in range %s", ident, r)}
+		resultChan <- alloc.ownedInRange(ident, r)
 	}
-	result := <-resultChan
-	return result.addr, result.err
+	return <-resultChan, nil
 }

 // Claim an address that we think we should own (Sync)
-func (alloc *Allocator) Claim(ident string, addr address.Address, noErrorOnUnknown bool) error {
+func (alloc *Allocator) Claim(ident string, cidr address.CIDR, isContainer, noErrorOnUnknown bool, hasBeenCancelled func() bool) error {
 	resultChan := make(chan error)
-	op := &claim{resultChan: resultChan, ident: ident, addr: addr, noErrorOnUnknown: noErrorOnUnknown}
+	op := &claim{
+		resultChan:       resultChan,
+		ident:            ident,
+		cidr:             cidr,
+		isContainer:      isContainer,
+		noErrorOnUnknown: noErrorOnUnknown,
+		hasBeenCancelled: hasBeenCancelled,
+	}
 	alloc.doOperation(op, &alloc.pendingClaims)
 	return <-resultChan
 }

-// ContainerDied is provided to satisfy the updater interface; does a 'Delete' underneath.  Sync.
+// ContainerDied called from the updater interface.  Async.
 func (alloc *Allocator) ContainerDied(ident string) {
-	if err := alloc.Delete(ident); err == nil {
-		alloc.debugln("Container", ident, "died; released addresses")
+	alloc.actionChan <- func() {
+		if alloc.hasOwned(ident) {
+			alloc.debugln("Container", ident, "died; noting to remove later")
+			alloc.dead[ident] = alloc.now()
+		}
+		// Also remove any pending ops
+		alloc.cancelOpsFor(&alloc.pendingAllocates, ident)
+		alloc.cancelOpsFor(&alloc.pendingClaims, ident)
 	}
 }

-func (alloc *Allocator) ContainerStarted(ident string) {}
+// ContainerDestroyed called from the updater interface.  Async.
+func (alloc *Allocator) ContainerDestroyed(ident string) {
+	alloc.actionChan <- func() {
+		if alloc.hasOwned(ident) {
+			alloc.debugln("Container", ident, "destroyed; removing addresses")
+			alloc.delete(ident)
+			delete(alloc.dead, ident)
+		}
+	}
+}
+
+func (alloc *Allocator) removeDeadContainers() {
+	cutoff := alloc.now().Add(-containerDiedTimeout)
+	for ident, timeOfDeath := range alloc.dead {
+		if timeOfDeath.Before(cutoff) {
+			if err := alloc.delete(ident); err == nil {
+				alloc.debugln("Removed addresses for container", ident)
+			}
+			delete(alloc.dead, ident)
+		}
+	}
+}
+
+func (alloc *Allocator) ContainerStarted(ident string) {
+	alloc.actionChan <- func() {
+		delete(alloc.dead, ident) // delete is no-op if key not in map
+	}
+}
+
+func (alloc *Allocator) PruneOwned(ids []string) {
+	idmap := make(map[string]struct{}, len(ids))
+	for _, id := range ids {
+		idmap[id] = struct{}{}
+	}
+	alloc.actionChan <- func() {
+		alloc.pruneOwned(idmap)
+	}
+}

 // Delete (Sync) - release all IP addresses for container with given name
 func (alloc *Allocator) Delete(ident string) error {
 	errChan := make(chan error)
 	alloc.actionChan <- func() {
-		addrs, found := alloc.owned[ident]
-		for _, addr := range addrs {
-			alloc.space.Free(addr)
-		}
-		delete(alloc.owned, ident)
-
-		// Also remove any pending ops
-		found = alloc.cancelOpsFor(&alloc.pendingAllocates, ident) || found
-		found = alloc.cancelOpsFor(&alloc.pendingClaims, ident) || found
-
-		if !found {
-			errChan <- fmt.Errorf("Delete: no addresses for %s", ident)
-			return
-		}
-		errChan <- nil
+		errChan <- alloc.delete(ident)
 	}
 	return <-errChan
 }

+func (alloc *Allocator) delete(ident string) error {
+	cidrs := alloc.removeAllOwned(ident)
+	if len(cidrs) == 0 {
+		return fmt.Errorf("Delete: no addresses for %s", ident)
+	}
+	for _, cidr := range cidrs {
+		alloc.space.Free(cidr.Addr)
+	}
+	return nil
+}
+
 // Free (Sync) - release single IP address for container
 func (alloc *Allocator) Free(ident string, addrToFree address.Address) error {
 	errChan := make(chan error)
 	alloc.actionChan <- func() {
-		addrs := alloc.owned[ident]
-		for i, ownedAddr := range addrs {
-			if ownedAddr == addrToFree {
-				alloc.debugln("Freed", addrToFree, "for", ident)
-				if len(addrs) == 1 {
-					delete(alloc.owned, ident)
-				} else {
-					alloc.owned[ident] = append(addrs[:i], addrs[i+1:]...)
-				}
-				alloc.space.Free(addrToFree)
-				errChan <- nil
-				return
-			}
+		if alloc.removeOwned(ident, addrToFree) {
+			alloc.debugln("Freed", addrToFree, "for", ident)
+			alloc.space.Free(addrToFree)
+			errChan <- nil
+			return
 		}

 		errChan <- fmt.Errorf("Free: address %s not found for %s", addrToFree, ident)
@@ -299,7 +430,7 @@ func (alloc *Allocator) pickPeerForTransfer() mesh.PeerName {
 	if heir := alloc.ring.PickPeerForTransfer(t); heir != mesh.UnknownPeerName {
 		return heir
 	}
-	// finally, disappeared peers that that passively participated in IPAM
+	// finally, disappeared peers that passively participated in IPAM
 	return alloc.pickPeerFromNicknames(t)
 }

@@ -311,37 +442,53 @@ func (alloc *Allocator) Shutdown() {
 		alloc.shuttingDown = true
 		alloc.cancelOps(&alloc.pendingClaims)
 		alloc.cancelOps(&alloc.pendingAllocates)
-		if heir := alloc.pickPeerForTransfer(); heir != mesh.UnknownPeerName {
-			alloc.ring.Transfer(alloc.ourName, heir)
-			alloc.space.Clear()
+		alloc.cancelOps(&alloc.pendingPrimes)
+		heir := alloc.pickPeerForTransfer()
+		alloc.ring.Transfer(alloc.ourName, heir)
+		alloc.space.Clear()
+		if heir != mesh.UnknownPeerName {
+			alloc.persistRing()
 			alloc.gossip.GossipBroadcast(alloc.Gossip())
-			time.Sleep(100 * time.Millisecond)
 		}
 		doneChan <- struct{}{}
 	}
 	<-doneChan
 }

-// AdminTakeoverRanges (Sync) - take over the ranges owned by a given peer.
-// Only done on adminstrator command.
-func (alloc *Allocator) AdminTakeoverRanges(peerNameOrNickname string) error {
-	resultChan := make(chan error)
+// AdminTakeoverRanges (Sync) - take over the ranges owned by a given
+// peer, and return how much space was transferred in the process.
+// Only done on administrator command.
+func (alloc *Allocator) AdminTakeoverRanges(peerNameOrNickname string) address.Count {
+	resultChan := make(chan address.Count)
 	alloc.actionChan <- func() {
 		peername, err := alloc.lookupPeername(peerNameOrNickname)
 		if err != nil {
-			resultChan <- fmt.Errorf("Cannot find peer '%s'", peerNameOrNickname)
+			alloc.warnf("attempt to take over range from unknown peer '%s'", peerNameOrNickname)
+			resultChan <- address.Count(0)
 			return
 		}

 		alloc.debugln("AdminTakeoverRanges:", peername)
 		if peername == alloc.ourName {
-			resultChan <- fmt.Errorf("Cannot take over ranges from yourself!")
+			alloc.warnf("attempt to take over range from ourself")
+			resultChan <- address.Count(0)
 			return
 		}

-		newRanges, err := alloc.ring.Transfer(peername, alloc.ourName)
-		alloc.space.AddRanges(newRanges)
-		resultChan <- err
+		newRanges := alloc.ring.Transfer(peername, alloc.ourName)
+
+		if len(newRanges) == 0 {
+			resultChan <- address.Count(0)
+			return
+		}
+
+		before := alloc.space.NumFreeAddresses()
+		alloc.ringUpdated()
+		after := alloc.space.NumFreeAddresses()
+
+		alloc.gossip.GossipBroadcast(alloc.Gossip())
+
+		resultChan <- after - before
 	}
 	return <-resultChan
 }
@@ -382,6 +529,22 @@ func (alloc *Allocator) annotatePeernames(names []mesh.PeerName) []string {
 	return res
 }

+// PeerGone removes nicknames of peers which are no longer mentioned
+// in the ring. Async.
+//
+// NB: the function is invoked by the gossip library routines and should be
+//     registered manually.
+func (alloc *Allocator) PeerGone(peerName mesh.PeerName) {
+	alloc.debugf("PeerGone: peer %s", peerName)
+
+	alloc.actionChan <- func() {
+		ringPeers := alloc.ring.PeerNames()
+		if _, ok := ringPeers[peerName]; !ok {
+			delete(alloc.nicknames, peerName)
+		}
+	}
+}
+
 func decodeRange(msg []byte) (r address.Range, err error) {
 	decoder := gob.NewDecoder(bytes.NewReader(msg))
 	return r, decoder.Decode(&r)
@@ -394,9 +557,11 @@ func (alloc *Allocator) OnGossipUnicast(sender mesh.PeerName, msg []byte) error
 	alloc.actionChan <- func() {
 		switch msg[0] {
 		case msgSpaceRequest:
-			// some other peer asked us for space
+			alloc.debugln("Peer", sender, "asked me for space")
 			r, err := decodeRange(msg[1:])
-			if err == nil {
+			// If we don't have a ring, just ignore a request for space.
+			// They'll probably ask again later.
+			if err == nil && !alloc.ring.Empty() {
 				alloc.donateSpace(r, sender)
 			}
 			resultChan <- err
@@ -425,7 +590,7 @@ func (alloc *Allocator) OnGossipBroadcast(sender mesh.PeerName, msg []byte) (mes

 type gossipState struct {
 	// We send a timstamp along with the information to be
-	// gossipped in order to detect skewed clocks
+	// gossipped for backwards-compatibility (previously to detect skewed clocks)
 	Now       int64
 	Nicknames map[mesh.PeerName]string

@@ -440,6 +605,9 @@ func (alloc *Allocator) encode() []byte {
 	}

 	// We're only interested in Paxos until we have a Ring.
+	// Non-electing participants (e.g. observers) return
+	// a nil gossip state in order to provoke a unicast ring
+	// update from electing peers who have reached consensus.
 	if alloc.ring.Empty() {
 		data.Paxos = alloc.paxos.GossipState()
 	} else {
@@ -499,21 +667,22 @@ func (alloc *Allocator) SetInterfaces(gossip mesh.Gossip) {

 // ACTOR server

-func (alloc *Allocator) actorLoop(actionChan <-chan func()) {
+func (alloc *Allocator) actorLoop(actionChan <-chan func(), stopChan <-chan struct{}) {
+	defer alloc.ticker.Stop()
 	for {
-		var tickChan <-chan time.Time
-		if alloc.paxosTicker != nil {
-			tickChan = alloc.paxosTicker.C
-		}
-
 		select {
 		case action := <-actionChan:
-			if action == nil {
-				return
-			}
 			action()
-		case <-tickChan:
-			alloc.propose()
+		case <-stopChan:
+			return
+		case <-alloc.ticker.C:
+			// Retry things in case messages got lost between here and recipients
+			if alloc.awaitingConsensus {
+				alloc.propose()
+			} else {
+				alloc.tryPendingOps()
+			}
+			alloc.removeDeadContainers()
 		}

 		alloc.assertInvariants()
@@ -525,39 +694,35 @@ func (alloc *Allocator) actorLoop(actionChan <-chan func()) {

 // Ensure we are making progress towards an established ring
 func (alloc *Allocator) establishRing() {
-	if !alloc.ring.Empty() || alloc.paxosTicker != nil {
+	if !alloc.ring.Empty() || alloc.awaitingConsensus {
 		return
 	}

+	alloc.awaitingConsensus = true
+	alloc.paxos.SetQuorum(alloc.quorum())
 	alloc.propose()
 	if ok, cons := alloc.paxos.Consensus(); ok {
 		// If the quorum was 1, then proposing immediately
 		// leads to consensus
 		alloc.createRing(cons.Value)
-	} else {
-		// re-try until we get consensus
-		alloc.paxosTicker = time.NewTicker(paxosInterval)
 	}
 }

 func (alloc *Allocator) createRing(peers []mesh.PeerName) {
 	alloc.debugln("Paxos consensus:", peers)
 	alloc.ring.ClaimForPeers(normalizeConsensus(peers))
-	alloc.gossip.GossipBroadcast(alloc.Gossip())
 	alloc.ringUpdated()
+	alloc.gossip.GossipBroadcast(alloc.Gossip())
 }

 func (alloc *Allocator) ringUpdated() {
 	// When we have a ring, we don't need paxos any more
-	if alloc.paxos != nil {
+	if alloc.awaitingConsensus {
+		alloc.awaitingConsensus = false
 		alloc.paxos = nil
-
-		if alloc.paxosTicker != nil {
-			alloc.paxosTicker.Stop()
-			alloc.paxosTicker = nil
-		}
 	}

+	alloc.persistRing()
 	alloc.space.UpdateRanges(alloc.ring.OwnedRanges())
 	alloc.tryPendingOps()
 }
@@ -626,27 +791,27 @@ func (alloc *Allocator) update(sender mesh.PeerName, msg []byte) error {
 	reader := bytes.NewReader(msg)
 	decoder := gob.NewDecoder(reader)
 	var data gossipState
-	var err error

 	if err := decoder.Decode(&data); err != nil {
 		return err
 	}

-	deltat := time.Unix(data.Now, 0).Sub(alloc.now())
-	if deltat > time.Hour || -deltat > time.Hour {
-		return fmt.Errorf("clock skew of %v detected, ignoring update", deltat)
-	}
-
 	// Merge nicknames
 	for peer, nickname := range data.Nicknames {
 		alloc.nicknames[peer] = nickname
 	}

-	// only one of Ring and Paxos should be present.  And we
-	// shouldn't get updates for a empty Ring. But tolerate
-	// them just in case.
-	if data.Ring != nil {
-		switch err = alloc.ring.Merge(*data.Ring); err {
+	switch {
+	// If someone sent us a ring, merge it into ours. Note this will move us
+	// out of the awaiting-consensus state if we didn't have a ring already.
+	case data.Ring != nil:
+		updated, err := alloc.ring.Merge(*data.Ring)
+		switch err {
+		case nil:
+			if updated {
+				alloc.pruneNicknames()
+				alloc.ringUpdated()
+			}
 		case ring.ErrDifferentSeeds:
 			return fmt.Errorf("IP allocation was seeded by different peers (received: %v, ours: %v)",
 				alloc.annotatePeernames(data.Ring.Seeds), alloc.annotatePeernames(alloc.ring.Seeds))
@@ -654,31 +819,44 @@ func (alloc *Allocator) update(sender mesh.PeerName, msg []byte) error {
 			return fmt.Errorf("Incompatible IP allocation ranges (received: %s, ours: %s)",
 				data.Ring.Range().AsCIDRString(), alloc.ring.Range().AsCIDRString())
 		default:
-			if err == nil && !alloc.ring.Empty() {
-				alloc.pruneNicknames()
-				alloc.ringUpdated()
-			}
 			return err
 		}
-	}

-	if data.Paxos != nil {
-		if alloc.ring.Empty() {
-			if alloc.paxos.Update(data.Paxos) {
-				if alloc.paxos.Think() {
-					// If something important changed, broadcast
-					alloc.gossip.GossipBroadcast(alloc.Gossip())
-				}
-
-				if ok, cons := alloc.paxos.Consensus(); ok {
-					alloc.createRing(cons.Value)
-				}
-			}
-		} else if sender != mesh.UnknownPeerName {
-			// Sender is trying to initialize a ring, but we have one
-			// already - send it straight back
+	// If we reach this point we know the sender is either an elector
+	// broadcasting a paxos proposal to form a ring or a non-elector
+	// broadcasting a ring request. If we have a ring already we can just send
+	// it back regardless.
+	case !alloc.ring.Empty():
+		if sender != mesh.UnknownPeerName {
 			alloc.sendRingUpdate(sender)
 		}
+
+	// Otherwise, we need to react according to whether or not we received a
+	// paxos proposal.
+	case data.Paxos != nil:
+		// Process the proposal (this is a no-op if we're an observer)
+		if alloc.paxos.Update(data.Paxos) {
+			if alloc.paxos.Think() {
+				// If something important changed, broadcast
+				alloc.gossip.GossipBroadcast(alloc.Gossip())
+			}
+
+			if ok, cons := alloc.paxos.Consensus(); ok {
+				alloc.createRing(cons.Value)
+			}
+		}
+
+	// No paxos proposal present, so sender is a non-elector. We don't have a
+	// ring to send, so attempt to establish one on their behalf. NB we only do
+	// this:
+	//
+	// * On an explicit broadcast request triggered by a remote allocation attempt
+	//   (if we did so on periodic gossip we would force consensus unnecessarily)
+	// * If we are an elector (to avoid a broadcast storm of ring request messages)
+	default:
+		if alloc.paxos.IsElector() && sender != mesh.UnknownPeerName {
+			alloc.establishRing()
+		}
 	}

 	return nil
@@ -686,13 +864,12 @@ func (alloc *Allocator) update(sender mesh.PeerName, msg []byte) error {

 func (alloc *Allocator) donateSpace(r address.Range, to mesh.PeerName) {
 	// No matter what we do, we'll send a unicast gossip
-	// of our ring back to tha chap who asked for space.
+	// of our ring back to the chap who asked for space.
 	// This serves to both tell him of any space we might
 	// have given him, or tell him where he might find some
 	// more.
 	defer alloc.sendRingUpdate(to)

-	alloc.debugln("Peer", to, "asked me for space")
 	chunk, ok := alloc.space.Donate(r)
 	if !ok {
 		free := alloc.space.NumFreeAddressesInRange(r)
@@ -705,7 +882,7 @@ func (alloc *Allocator) donateSpace(r address.Range, to mesh.PeerName) {
 	}
 	alloc.debugln("Giving range", chunk, "to", to)
 	alloc.ring.GrantRangeToHost(chunk.Start, chunk.End, to)
-	alloc.sendRingUpdate(to)
+	alloc.persistRing()
 }

 func (alloc *Allocator) assertInvariants() {
@@ -731,33 +908,146 @@ func (alloc *Allocator) reportFreeSpace() {
 		return
 	}

-	freespace := make(map[address.Address]address.Offset)
+	freespace := make(map[address.Address]address.Count)
 	for _, r := range ranges {
 		freespace[r.Start] = alloc.space.NumFreeAddressesInRange(r)
 	}
-	alloc.ring.ReportFree(freespace)
+	if alloc.ring.ReportFree(freespace) {
+		alloc.persistRing()
+	}
+}
+
+// Persistent data
+const (
+	ringIdent  = "ring"
+	nameIdent  = "peername"
+	ownedIdent = "ownedAddresses"
+)
+
+func (alloc *Allocator) persistRing() {
+	// It would be better if these two Save operations happened in the same transaction
+	if err := alloc.db.Save(nameIdent, alloc.ourName); err != nil {
+		alloc.fatalf("Error persisting ring data: %s", err)
+		return
+	}
+	if err := alloc.db.Save(ringIdent, alloc.ring); err != nil {
+		alloc.fatalf("Error persisting ring data: %s", err)
+	}
+}
+
+// Returns true if persisted data is to be used, otherwise false
+func (alloc *Allocator) loadPersistedData() bool {
+	var checkPeerName mesh.PeerName
+	nameFound, err := alloc.db.Load(nameIdent, &checkPeerName)
+	if err != nil {
+		alloc.fatalf("Error loading persisted peer name: %s", err)
+	}
+	var persistedRing *ring.Ring
+	ringFound, err := alloc.db.Load(ringIdent, &persistedRing)
+	if err != nil {
+		alloc.fatalf("Error loading persisted IPAM data: %s", err)
+	}
+	var persistedOwned map[string]ownedData
+	ownedFound, err := alloc.db.Load(ownedIdent, &persistedOwned)
+	if err != nil {
+		alloc.fatalf("Error loading persisted address data: %s", err)
+	}
+
+	overwritePersisted := func(fmt string, args ...interface{}) {
+		alloc.infof(fmt, args...)
+		alloc.persistRing()
+		alloc.persistOwned()
+	}
+
+	if !nameFound || !ringFound {
+		overwritePersisted("No valid persisted data")
+		return false
+	}
+
+	if checkPeerName != alloc.ourName {
+		overwritePersisted("Deleting persisted data for peername %s", checkPeerName)
+		return false
+	}
+
+	if persistedRing.Range() != alloc.universe.Range() {
+		overwritePersisted("Deleting persisted data for IPAM range %s; our range is %s", persistedRing.Range(), alloc.universe)
+		return false
+	}
+
+	alloc.ring.Restore(persistedRing)
+	alloc.space.UpdateRanges(alloc.ring.OwnedRanges())
+
+	if ownedFound {
+		alloc.owned = persistedOwned
+		for _, d := range alloc.owned {
+			for _, cidr := range d.Cidrs {
+				alloc.space.Claim(cidr.Addr)
+			}
+		}
+	}
+	return true
+}
+
+func (alloc *Allocator) persistOwned() {
+	if err := alloc.db.Save(ownedIdent, alloc.owned); err != nil {
+		alloc.fatalf("Error persisting address data: %s", err)
+	}
 }

 // Owned addresses

-// NB: addr must not be owned by ident already
-func (alloc *Allocator) addOwned(ident string, addr address.Address) {
-	alloc.owned[ident] = append(alloc.owned[ident], addr)
+func (alloc *Allocator) hasOwned(ident string) bool {
+	_, b := alloc.owned[ident]
+	return b
 }

-func (alloc *Allocator) lookupOwned(ident string, r address.Range) (address.Address, bool) {
-	for _, addr := range alloc.owned[ident] {
-		if r.Contains(addr) {
-			return addr, true
+// NB: addr must not be owned by ident already
+func (alloc *Allocator) addOwned(ident string, cidr address.CIDR, isContainer bool) {
+	d := alloc.owned[ident]
+	d.IsContainer = isContainer
+	d.Cidrs = append(d.Cidrs, cidr)
+	alloc.owned[ident] = d
+	alloc.persistOwned()
+}
+
+func (alloc *Allocator) removeAllOwned(ident string) []address.CIDR {
+	a := alloc.owned[ident]
+	delete(alloc.owned, ident)
+	alloc.persistOwned()
+	return a.Cidrs
+}
+
+func (alloc *Allocator) removeOwned(ident string, addrToFree address.Address) bool {
+	d := alloc.owned[ident]
+	for i, ownedCidr := range d.Cidrs {
+		if ownedCidr.Addr == addrToFree {
+			if len(d.Cidrs) == 1 {
+				delete(alloc.owned, ident)
+			} else {
+				d.Cidrs = append(d.Cidrs[:i], d.Cidrs[i+1:]...)
+				alloc.owned[ident] = d
+			}
+			alloc.persistOwned()
+			return true
 		}
 	}
-	return 0, false
+	return false
+}
+
+func (alloc *Allocator) ownedInRange(ident string, r address.Range) []address.CIDR {
+	var c []address.CIDR
+	for _, cidr := range alloc.owned[ident].Cidrs {
+		if r.Contains(cidr.Addr) {
+			c = append(c, cidr)
+		}
+	}
+	return c
 }

 func (alloc *Allocator) findOwner(addr address.Address) string {
-	for ident, addrs := range alloc.owned {
-		for _, candidate := range addrs {
-			if candidate == addr {
+	for ident, d := range alloc.owned {
+		for _, candidate := range d.Cidrs {
+			if candidate.Addr == addr {
 				return ident
 			}
 		}
@@ -765,14 +1055,47 @@ func (alloc *Allocator) findOwner(addr address.Address) string {
 	return ""
 }

+// For each ID in the 'owned' map, remove the entry if it isn't in the map
+func (alloc *Allocator) pruneOwned(ids map[string]struct{}) {
+	changed := false
+	for ident, d := range alloc.owned {
+		if !d.IsContainer {
+			continue
+		}
+		if _, found := ids[ident]; !found {
+			for _, cidr := range d.Cidrs {
+				alloc.space.Free(cidr.Addr)
+			}
+			alloc.debugf("Deleting old entry %s: %v", ident, d.Cidrs)
+			delete(alloc.owned, ident)
+			changed = true
+		}
+	}
+	if changed {
+		alloc.persistOwned()
+	}
+}
+
 // Logging

+func (alloc *Allocator) fatalf(fmt string, args ...interface{}) {
+	alloc.logf(common.Log.Fatalf, fmt, args...)
+}
+func (alloc *Allocator) warnf(fmt string, args ...interface{}) {
+	alloc.logf(common.Log.Warnf, fmt, args...)
+}
+func (alloc *Allocator) errorf(fmt string, args ...interface{}) {
+	common.Log.Errorf("[allocator %s] "+fmt, append([]interface{}{alloc.ourName}, args...)...)
+}
 func (alloc *Allocator) infof(fmt string, args ...interface{}) {
-	common.Log.Infof("[allocator %s] "+fmt, append([]interface{}{alloc.ourName}, args...)...)
+	alloc.logf(common.Log.Infof, fmt, args...)
+}
+func (alloc *Allocator) debugf(fmt string, args ...interface{}) {
+	alloc.logf(common.Log.Debugf, fmt, args...)
+}
+func (alloc *Allocator) logf(f func(string, ...interface{}), fmt string, args ...interface{}) {
+	f("[allocator %s] "+fmt, append([]interface{}{alloc.ourName}, args...)...)
 }
 func (alloc *Allocator) debugln(args ...interface{}) {
 	common.Log.Debugln(append([]interface{}{fmt.Sprintf("[allocator %s]:", alloc.ourName)}, args...)...)
 }
-func (alloc *Allocator) debugf(fmt string, args ...interface{}) {
-	common.Log.Debugf("[allocator %s] "+fmt, append([]interface{}{alloc.ourName}, args...)...)
-}
@@ -22,6 +22,14 @@ const (

 func returnFalse() bool { return false }

+func (alloc *Allocator) SimplyAllocate(ident string, cidr address.CIDR) (address.Address, error) {
+	return alloc.Allocate(ident, cidr, true, returnFalse)
+}
+
+func (alloc *Allocator) SimplyClaim(ident string, cidr address.CIDR) error {
+	return alloc.Claim(ident, cidr, true, true, returnFalse)
+}
+
 func TestAllocFree(t *testing.T) {
 	const (
 		container1 = "abcdef"
@@ -37,40 +45,54 @@ func TestAllocFree(t *testing.T) {

 	alloc, subnet := makeAllocatorWithMockGossip(t, "01:00:00:01:00:00", universe, 1)
 	defer alloc.Stop()
-	_, cidr1, _ := address.ParseCIDR(subnet1)
-	_, cidr2, _ := address.ParseCIDR(subnet2)
+	cidr1, _ := address.ParseCIDR(subnet1)
+	cidr2, _ := address.ParseCIDR(subnet2)

 	alloc.claimRingForTesting()
-	addr1, err := alloc.Allocate(container1, cidr1.HostRange(), returnFalse)
+	addr1, err := alloc.SimplyAllocate(container1, cidr1)
 	require.NoError(t, err)
 	require.Equal(t, testAddr1, addr1.String(), "address")

-	addr2, err := alloc.Allocate(container1, cidr2.HostRange(), returnFalse)
+	addr2, err := alloc.SimplyAllocate(container1, cidr2)
 	require.NoError(t, err)
 	require.Equal(t, testAddr2, addr2.String(), "address")

+	addrs, err := alloc.Lookup(container1, subnet.Range())
+	require.NoError(t, err)
+	require.Equal(t, []address.CIDR{address.MakeCIDR(cidr1, addr1), address.MakeCIDR(cidr2, addr2)}, addrs)
+
 	// Ask for another address for a different container and check it's different
-	addr1b, _ := alloc.Allocate(container2, cidr1.HostRange(), returnFalse)
+	addr1b, _ := alloc.SimplyAllocate(container2, cidr1)
 	if addr1b.String() == testAddr1 {
 		t.Fatalf("Expected different address but got %s", addr1b.String())
 	}

 	// Ask for the first container again and we should get the same addresses again
-	addr1a, _ := alloc.Allocate(container1, cidr1.HostRange(), returnFalse)
+	addr1a, _ := alloc.SimplyAllocate(container1, cidr1)
 	require.Equal(t, testAddr1, addr1a.String(), "address")
-	addr2a, _ := alloc.Allocate(container1, cidr2.HostRange(), returnFalse)
+	addr2a, _ := alloc.SimplyAllocate(container1, cidr2)
 	require.Equal(t, testAddr2, addr2a.String(), "address")

 	// Now delete the first container, and we should get its addresses back
 	require.NoError(t, alloc.Delete(container1))
-	addr3, _ := alloc.Allocate(container3, cidr1.HostRange(), returnFalse)
+	addr3, _ := alloc.SimplyAllocate(container3, cidr1)
 	require.Equal(t, testAddr1, addr3.String(), "address")
-	addr4, _ := alloc.Allocate(container3, cidr2.HostRange(), returnFalse)
+	addr4, _ := alloc.SimplyAllocate(container3, cidr2)
 	require.Equal(t, testAddr2, addr4.String(), "address")

 	alloc.ContainerDied(container2)
+
+	// Resurrect
+	addr1c, err := alloc.SimplyAllocate(container2, cidr1)
+	require.NoError(t, err)
+	require.Equal(t, addr1b, addr1c, "address")
+
 	alloc.ContainerDied(container3)
-	require.Equal(t, address.Offset(spaceSize), alloc.NumFreeAddresses(subnet))
+	alloc.Encode() // sync up
+	// Move the clock forward and clear out the dead container
+	alloc.actionChan <- func() { alloc.now = func() time.Time { return time.Now().Add(containerDiedTimeout * 2) } }
+	alloc.actionChan <- func() { alloc.removeDeadContainers() }
+	require.Equal(t, address.Count(spaceSize+1), alloc.NumFreeAddresses(subnet.Range()))
 }

 func TestBootstrap(t *testing.T) {
@@ -95,7 +117,7 @@ func TestBootstrap(t *testing.T) {
 	ExpectBroadcastMessage(alloc1, nil) // alloc1 will try to form consensus
 	done := make(chan bool)
 	go func() {
-		alloc1.Allocate("somecontainer", subnet, returnFalse)
+		alloc1.Allocate("somecontainer", subnet, true, returnFalse)
 		done <- true
 	}()
 	time.Sleep(100 * time.Millisecond)
@@ -103,6 +125,7 @@ func TestBootstrap(t *testing.T) {

 	CheckAllExpectedMessagesSent(alloc1, alloc2)

+	// Check that tryPendingOps doesn't cause anything to happen here
 	alloc1.actionChan <- func() { alloc1.tryPendingOps() }
 	AssertNothingSent(t, done)

@@ -115,14 +138,24 @@ func TestBootstrap(t *testing.T) {
 	ExpectBroadcastMessage(alloc1, nil)
 	alloc1.OnGossipBroadcast(alloc2.ourName, alloc2.Encode())

-	// both nodes will get consensus now so initialize the ring
-	ExpectBroadcastMessage(alloc2, nil)
+	CheckAllExpectedMessagesSent(alloc1, alloc2)
+
+	// at this point, both nodes have seen each other, but don't have a valid proposal
+	// so there is another exchange of messages
 	ExpectBroadcastMessage(alloc2, nil)
 	alloc2.OnGossipBroadcast(alloc1.ourName, alloc1.Encode())

+	// we have consensus now so alloc1 will initialize the ring
+	ExpectBroadcastMessage(alloc1, nil)
+	alloc1.OnGossipBroadcast(alloc2.ourName, alloc2.Encode())
+
+	CheckAllExpectedMessagesSent(alloc1, alloc2)
+
+	// alloc2 receives the ring and does not reply
+	alloc2.OnGossipBroadcast(alloc1.ourName, alloc1.Encode())
+
 	CheckAllExpectedMessagesSent(alloc1, alloc2)

-	alloc1.OnGossipBroadcast(alloc2.ourName, alloc2.Encode())
 	// now alloc1 should have space

 	AssertSent(t, done)
@@ -135,42 +168,42 @@ func TestAllocatorClaim(t *testing.T) {
 		container1 = "abcdef"
 		container3 = "b01df00d"
 		universe   = "10.0.3.0/24"
-		testAddr1  = "10.0.3.2"
-		testAddr2  = "10.0.4.2"
+		testAddr1  = "10.0.3.2/24"
+		testAddr2  = "10.0.4.2/24"
 	)

-	allocs, _, subnet := makeNetworkOfAllocators(2, universe)
+	allocs, router, subnet := makeNetworkOfAllocators(2, universe)
+	defer stopNetworkOfAllocators(allocs, router)
 	alloc := allocs[1]
-	defer alloc.Stop()
-	addr1, _ := address.ParseIP(testAddr1)
+	addr1, _ := address.ParseCIDR(testAddr1)

 	// First claim should trigger "dunno, I'm going to wait"
-	err := alloc.Claim(container3, addr1, true)
+	err := alloc.SimplyClaim(container3, addr1)
 	require.NoError(t, err)

-	// Do one allocate to ensure paxos is all done
-	alloc.Allocate("unused", subnet, returnFalse)
+	alloc.Prime()
 	// Do an allocate on the other peer, which we will try to claim later
-	addrx, err := allocs[0].Allocate(container1, subnet, returnFalse)
+	addrx, err := allocs[0].Allocate(container1, subnet, true, returnFalse)
+	router.Flush()

 	// Now try the claim again
-	err = alloc.Claim(container3, addr1, true)
+	err = alloc.SimplyClaim(container3, addr1)
 	require.NoError(t, err)
 	// Check we get this address back if we try an allocate
-	addr3, _ := alloc.Allocate(container3, subnet, returnFalse)
-	require.Equal(t, testAddr1, addr3.String(), "address")
+	addr3, _ := alloc.SimplyAllocate(container3, subnet)
+	require.Equal(t, testAddr1, address.MakeCIDR(subnet, addr3).String(), "address")
 	// one more claim should still work
-	err = alloc.Claim(container3, addr1, true)
+	err = alloc.SimplyClaim(container3, addr1)
 	require.NoError(t, err)
 	// claim for a different container should fail
-	err = alloc.Claim(container1, addr1, true)
+	err = alloc.SimplyClaim(container1, addr1)
 	require.Error(t, err)
 	// claiming the address allocated on the other peer should fail
-	err = alloc.Claim(container1, addrx, true)
+	err = alloc.SimplyClaim(container1, address.MakeCIDR(subnet, addrx))
 	require.Error(t, err, "claiming address allocated on other peer should fail")
 	// Check an address outside of our universe
-	addr2, _ := address.ParseIP(testAddr2)
-	err = alloc.Claim(container1, addr2, true)
+	addr2, _ := address.ParseCIDR(testAddr2)
+	err = alloc.SimplyClaim(container1, addr2)
 	require.NoError(t, err)
 }

@@ -187,16 +220,13 @@ func (alloc *Allocator) pause() func() {
 }

 func TestCancel(t *testing.T) {
-	const (
-		CIDR = "10.0.1.7/26"
-	)
-
+	const cidr = "10.0.4.0/26"
 	router := gossip.NewTestRouter(0.0)

-	alloc1, subnet := makeAllocator("01:00:00:02:00:00", CIDR, 2)
+	alloc1, subnet := makeAllocator("01:00:00:02:00:00", cidr, 2)
 	alloc1.SetInterfaces(router.Connect(alloc1.ourName, alloc1))

-	alloc2, _ := makeAllocator("02:00:00:02:00:00", CIDR, 2)
+	alloc2, _ := makeAllocator("02:00:00:02:00:00", cidr, 2)
 	alloc2.SetInterfaces(router.Connect(alloc2.ourName, alloc2))
 	alloc1.claimRingForTesting(alloc1, alloc2)
 	alloc2.claimRingForTesting(alloc1, alloc2)
@@ -208,9 +238,9 @@ func TestCancel(t *testing.T) {
 	alloc1.OnGossipBroadcast(alloc2.ourName, alloc2.Encode())

 	// Get some IPs, so each allocator has some space
-	res1, _ := alloc1.Allocate("foo", subnet, returnFalse)
+	res1, _ := alloc1.Allocate("foo", subnet, true, returnFalse)
 	common.Log.Debugf("res1 = %s", res1.String())
-	res2, _ := alloc2.Allocate("bar", subnet, returnFalse)
+	res2, _ := alloc2.Allocate("bar", subnet, true, returnFalse)
 	common.Log.Debugf("res2 = %s", res2.String())
 	if res1 == res2 {
 		require.FailNow(t, "Error: got same ips!")
@@ -221,13 +251,13 @@ func TestCancel(t *testing.T) {
 	unpause := alloc2.pause()

 	// Use up all the IPs that alloc1 owns, so the allocation after this will prompt a request to alloc2
-	for i := 0; alloc1.NumFreeAddresses(subnet) > 0; i++ {
-		alloc1.Allocate(fmt.Sprintf("tmp%d", i), subnet, returnFalse)
+	for i := 0; alloc1.NumFreeAddresses(subnet.HostRange()) > 0; i++ {
+		alloc1.Allocate(fmt.Sprintf("tmp%d", i), subnet, true, returnFalse)
 	}
 	cancelChan := make(chan bool, 1)
 	doneChan := make(chan bool)
 	go func() {
-		_, ok := alloc1.Allocate("baz", subnet,
+		_, ok := alloc1.Allocate("baz", subnet, true,
 			func() bool {
 				select {
 				case <-cancelChan:
@@ -251,18 +281,18 @@ func TestCancel(t *testing.T) {

 func TestCancelOnDied(t *testing.T) {
 	const (
-		CIDR       = "10.0.1.7/26"
+		cidr       = "10.0.4.0/26"
 		container1 = "abcdef"
 	)

 	router := gossip.NewTestRouter(0.0)
-	alloc1, subnet := makeAllocator("01:00:00:02:00:00", CIDR, 2)
+	alloc1, subnet := makeAllocator("01:00:00:02:00:00", cidr, 2)
 	alloc1.SetInterfaces(router.Connect(alloc1.ourName, alloc1))
 	alloc1.Start()

 	doneChan := make(chan bool)
 	f := func() {
-		_, ok := alloc1.Allocate(container1, subnet, returnFalse)
+		_, ok := alloc1.Allocate(container1, subnet, true, returnFalse)
 		doneChan <- ok == nil
 	}

@@ -293,62 +323,80 @@ func TestGossipShutdown(t *testing.T) {
 	defer alloc.Stop()

 	alloc.claimRingForTesting()
-	alloc.Allocate(container1, subnet, returnFalse)
+	alloc.SimplyAllocate(container1, subnet)

 	alloc.Shutdown()

-	_, err := alloc.Allocate(container2, subnet, returnFalse) // trying to allocate after shutdown should fail
+	_, err := alloc.SimplyAllocate(container2, subnet) // trying to allocate after shutdown should fail
 	require.False(t, err == nil, "no address")

 	CheckAllExpectedMessagesSent(alloc)
 }

+func TestNoFrag(t *testing.T) {
+	const cidr = "10.0.4.0/22"
+	resultChan := make(chan int)
+	for i := 0; i < 100; i++ {
+		allocs, router, subnet := makeNetworkOfAllocators(3, cidr)
+		allocs[1].Allocate("foo", subnet, true, returnFalse)
+		allocs[2].Allocate("bar", subnet, true, returnFalse)
+		allocs[2].actionChan <- func() {
+			resultChan <- len(allocs[2].ring.Entries)
+		}
+		require.True(t, <-resultChan < 6, "excessive ring fragmentation")
+		stopNetworkOfAllocators(allocs, router)
+	}
+}
+
 func TestTransfer(t *testing.T) {
-	const (
-		cidr = "10.0.1.7/22"
-	)
+	const cidr = "10.0.4.0/22"
 	allocs, router, subnet := makeNetworkOfAllocators(3, cidr)
-	alloc1 := allocs[0]
-	alloc2 := allocs[1]
-	alloc3 := allocs[2] // This will be 'master' and get the first range
+	defer stopNetworkOfAllocators(allocs, router)
+	alloc0 := allocs[0]
+	alloc1 := allocs[1]
+	alloc2 := allocs[2]

-	_, err := alloc2.Allocate("foo", subnet, returnFalse)
+	_, err := alloc1.Allocate("foo", subnet, true, returnFalse)
 	require.True(t, err == nil, "Failed to get address")

-	_, err = alloc3.Allocate("bar", subnet, returnFalse)
+	_, err = alloc2.Allocate("bar", subnet, true, returnFalse)
 	require.True(t, err == nil, "Failed to get address")

+	// simulation of periodic gossip
 	alloc2.gossip.GossipBroadcast(alloc2.Gossip())
 	router.Flush()
-	alloc2.gossip.GossipBroadcast(alloc3.Gossip())
+	alloc1.gossip.GossipBroadcast(alloc1.Gossip())
 	router.Flush()
+
+	free1 := alloc1.NumFreeAddresses(subnet.Range())
+	free2 := alloc2.NumFreeAddresses(subnet.Range())
+
+	router.RemovePeer(alloc1.ourName)
 	router.RemovePeer(alloc2.ourName)
-	router.RemovePeer(alloc3.ourName)
-	alloc2.Stop()
-	alloc3.Stop()
-	router.Flush()
-	require.NoError(t, alloc1.AdminTakeoverRanges(alloc2.ourName.String()))
-	require.NoError(t, alloc1.AdminTakeoverRanges(alloc3.ourName.String()))
-	router.Flush()
-
-	require.Equal(t, address.Offset(1022), alloc1.NumFreeAddresses(subnet))
-
-	_, err = alloc1.Allocate("foo", subnet, returnFalse)
-	require.True(t, err == nil, "Failed to get address")
 	alloc1.Stop()
+	alloc2.Stop()
+	router.Flush()
+
+	require.Equal(t, free1+1, alloc0.AdminTakeoverRanges(alloc1.ourName.String()))
+	require.Equal(t, free2+1, alloc0.AdminTakeoverRanges(alloc2.ourName.String()))
+	router.Flush()
+
+	require.Equal(t, address.Count(1024), alloc0.NumFreeAddresses(subnet.Range()))
+
+	_, err = alloc0.Allocate("foo", subnet, true, returnFalse)
+	require.True(t, err == nil, "Failed to get address")
+	alloc0.Stop()
 }

 func TestFakeRouterSimple(t *testing.T) {
-	const (
-		cidr = "10.0.1.7/22"
-	)
-	allocs, _, subnet := makeNetworkOfAllocators(2, cidr)
-	defer stopNetworkOfAllocators(allocs)
+	const cidr = "10.0.4.0/22"
+	allocs, router, subnet := makeNetworkOfAllocators(2, cidr)
+	defer stopNetworkOfAllocators(allocs, router)

 	alloc1 := allocs[0]
 	//alloc2 := allocs[1]

-	_, err := alloc1.Allocate("foo", subnet, returnFalse)
+	_, err := alloc1.Allocate("foo", subnet, true, returnFalse)
 	require.NoError(t, err, "Failed to get address")
 }

@@ -359,10 +407,10 @@ func TestAllocatorFuzz(t *testing.T) {
 		nodes        = 5
 		maxAddresses = 1000
 		concurrency  = 5
-		cidr         = "10.0.1.7/22"
+		cidr         = "10.0.4.0/22"
 	)
-	allocs, _, subnet := makeNetworkOfAllocators(nodes, cidr)
-	defer stopNetworkOfAllocators(allocs)
+	allocs, router, subnet := makeNetworkOfAllocators(nodes, cidr)
+	defer stopNetworkOfAllocators(allocs, router)

 	// Test state
 	// For each IP issued we store the allocator
@@ -429,7 +477,7 @@ func TestAllocatorFuzz(t *testing.T) {
 		allocIndex := rand.Int31n(nodes)
 		alloc := allocs[allocIndex]
 		//common.Log.Infof("Allocate: asking allocator %d", allocIndex)
-		addr, err := alloc.Allocate(name, subnet, returnFalse)
+		addr, err := alloc.SimplyAllocate(name, subnet)

 		if err != nil {
 			panic(fmt.Sprintf("Could not allocate addr"))
@@ -486,7 +534,7 @@ func TestAllocatorFuzz(t *testing.T) {

 		//common.Log.Infof("Asking for %s (%s) on allocator %d again", res.name, addr, res.alloc)

-		newAddr, _ := alloc.Allocate(res.name, subnet, returnFalse)
+		newAddr, _ := alloc.SimplyAllocate(res.name, subnet)
 		oldAddr, _ := address.ParseIP(addr)
 		if newAddr != oldAddr {
 			panic(fmt.Sprintf("Got different address for repeat request for %s: %s != %s", res.name, newAddr, oldAddr))
@@ -506,8 +554,8 @@ func TestAllocatorFuzz(t *testing.T) {
 		allocIndex := rand.Int31n(nodes)
 		addressIndex := rand.Int31n(int32(subnet.Size()))
 		alloc := allocs[allocIndex]
-		addr := address.Add(subnet.Start, address.Offset(addressIndex))
-		err := alloc.Claim(name, addr, true)
+		addr := address.Add(subnet.Addr, address.Offset(addressIndex))
+		err := alloc.SimplyClaim(name, address.MakeCIDR(subnet, addr))
 		if err == nil {
 			noteAllocation(allocIndex, name, addr)
 		}
@@ -563,14 +611,36 @@ func TestAllocatorFuzz(t *testing.T) {
 	})
 }

-func TestGossipSkew(t *testing.T) {
-	alloc1, _ := makeAllocatorWithMockGossip(t, "01:00:00:01:00:00", "10.0.1.0/22", 2)
-	defer alloc1.Stop()
-	alloc2, _ := makeAllocatorWithMockGossip(t, "02:00:00:02:00:00", "10.0.1.0/22", 2)
-	alloc2.now = func() time.Time { return time.Now().Add(time.Hour * 2) }
-	defer alloc2.Stop()
+func TestSpaceRequest(t *testing.T) {
+	const (
+		container1 = "cont-1"
+		container2 = "cont-2"
+		universe   = "10.32.0.0/12"
+	)
+	allocs, router, subnet := makeNetworkOfAllocators(1, universe)
+	defer stopNetworkOfAllocators(allocs, router)
+	alloc1 := allocs[0]

-	if _, err := alloc1.OnGossipBroadcast(alloc2.ourName, alloc2.Encode()); err == nil {
-		t.Fail()
-	}
+	addr, err := alloc1.Allocate(container1, subnet, true, returnFalse)
+	require.Nil(t, err, "")
+	// free it again so the donation splits the range neatly
+	err = alloc1.Free(container1, addr)
+	require.Nil(t, err, "")
+	require.Equal(t, cidrRanges(universe), alloc1.OwnedRanges(), "")
+
+	// Start a new peer
+	alloc2, _ := makeAllocator("02:00:00:02:00:00", universe, 2)
+	alloc2.SetInterfaces(router.Connect(alloc2.ourName, alloc2))
+	alloc2.Start()
+	defer alloc2.Stop()
+	alloc2.Allocate(container2, subnet, true, returnFalse)
+
+	// Test whether the universe has been split into two equal halves (GH #2009)
+	require.Equal(t, cidrRanges("10.32.0.0/13"), alloc1.OwnedRanges(), "")
+	require.Equal(t, cidrRanges("10.40.0.0/13"), alloc2.OwnedRanges(), "")
+}
+
+func cidrRanges(s string) []address.Range {
+	c, _ := address.ParseCIDR(s)
+	return []address.Range{c.Range()}
 }
@@ -3,16 +3,19 @@ package ipam
 import (
 	"fmt"

+	"github.com/weaveworks/mesh"
+
 	"github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/mesh"
 	"github.com/weaveworks/weave/net/address"
 )

 type claim struct {
 	resultChan       chan<- error
 	ident            string
-	addr             address.Address
+	cidr             address.CIDR
+	isContainer      bool
 	noErrorOnUnknown bool
+	hasBeenCancelled func() bool
 }

 // Send an error (or nil for success) back to caller listening on resultChan
@@ -31,33 +34,41 @@ func (c *claim) sendResult(result error) {

 // Try returns true for success (or failure), false if we need to try again later
 func (c *claim) Try(alloc *Allocator) bool {
-	if !alloc.ring.Contains(c.addr) {
+	if c.hasBeenCancelled() {
+		c.Cancel()
+		return true
+	}
+
+	if !alloc.ring.Contains(c.cidr.Addr) {
 		// Address not within our universe; assume user knows what they are doing
-		alloc.infof("Ignored address %s claimed by %s - not in our universe", c.addr, c.ident)
+		alloc.infof("Address %s claimed by %s - not in our range", c.cidr, c.ident)
+		alloc.addOwned(c.ident, c.cidr, c.isContainer)
 		c.sendResult(nil)
 		return true
 	}

 	alloc.establishRing()

-	switch owner := alloc.ring.Owner(c.addr); owner {
+	// If we had heard that this container died, resurrect it
+	delete(alloc.dead, c.ident) // (delete is no-op if key not in map)
+
+	switch owner := alloc.ring.Owner(c.cidr.Addr); owner {
 	case alloc.ourName:
 		// success
 	case mesh.UnknownPeerName:
 		// If our ring doesn't know, it must be empty.
+		alloc.infof("Claim %s for %s: is in the range %s, but the allocator is not initialized yet; will try later.",
+			c.cidr, c.ident, alloc.universe)
 		if c.noErrorOnUnknown {
-			alloc.infof("Claim %s for %s: address allocator still initializing; will try later.", c.addr, c.ident)
 			c.sendResult(nil)
-		} else {
-			c.sendResult(fmt.Errorf("%s is in the range %s, but the allocator is not initialized yet", c.addr, alloc.universe.AsCIDRString()))
 		}
 		return false
 	default:
-		alloc.debugf("requesting address %s from other peer %s", c.addr, owner)
-		err := alloc.sendSpaceRequest(owner, address.NewRange(c.addr, 1))
+		alloc.debugf("requesting address %s from other peer %s", c.cidr, owner)
+		err := alloc.sendSpaceRequest(owner, address.NewRange(c.cidr.Addr, 1))
 		if err != nil { // can't speak to owner right now
 			if c.noErrorOnUnknown {
-				alloc.infof("Claim %s for %s: %s; will try later.", c.addr, c.ident, err)
+				alloc.infof("Claim %s for %s: %s; will try later.", c.cidr, c.ident, err)
 				c.sendResult(nil)
 			} else { // just tell the user they can't do this.
 				c.deniedBy(alloc, owner)
@@ -66,22 +77,29 @@ func (c *claim) Try(alloc *Allocator) bool {
 		return false
 	}

+	if c.ident == "_" { // Special "I don't have a unique ID" identifier
+		c.ident = c.cidr.Addr.String()
+	}
 	// We are the owner, check we haven't given it to another container
-	switch existingIdent := alloc.findOwner(c.addr); existingIdent {
+	switch existingIdent := alloc.findOwner(c.cidr.Addr); existingIdent {
 	case "":
-		if err := alloc.space.Claim(c.addr); err == nil {
-			alloc.debugln("Claimed", c.addr, "for", c.ident)
-			alloc.addOwned(c.ident, c.addr)
+		if err := alloc.space.Claim(c.cidr.Addr); err == nil {
+			alloc.debugln("Claimed", c.cidr, "for", c.ident)
+			alloc.addOwned(c.ident, c.cidr, c.isContainer)
 			c.sendResult(nil)
 		} else {
 			c.sendResult(err)
 		}
 	case c.ident:
 		// same identifier is claiming same address; that's OK
+		alloc.debugln("Re-Claimed", c.cidr, "for", c.ident)
 		c.sendResult(nil)
+	case c.cidr.Addr.String():
+		// Address already allocated via "_" name
+		c.sendResult(fmt.Errorf("address %s already in use", c.cidr))
 	default:
 		// Addr already owned by container on this machine
-		c.sendResult(fmt.Errorf("address %s is already owned by %s", c.addr.String(), existingIdent))
+		c.sendResult(fmt.Errorf("address %s is already owned by %s", c.cidr.String(), existingIdent))
 	}
 	return true
 }
@@ -91,7 +109,7 @@ func (c *claim) deniedBy(alloc *Allocator, owner mesh.PeerName) {
 	if found {
 		name = " (" + name + ")"
 	}
-	c.sendResult(fmt.Errorf("address %s is owned by other peer %s%s", c.addr.String(), owner, name))
+	c.sendResult(fmt.Errorf("address %s is owned by other peer %s%s", c.cidr.String(), owner, name))
 }

 func (c *claim) Cancel() {
@@ -16,91 +16,120 @@ func badRequest(w http.ResponseWriter, err error) {
 	common.Log.Warningln("[allocator]:", err.Error())
 }

-func parseCIDR(w http.ResponseWriter, cidrStr string) (address.CIDR, bool) {
-	subnetAddr, cidr, err := address.ParseCIDR(cidrStr)
+func parseCIDR(w http.ResponseWriter, cidrStr string, net bool) (address.CIDR, bool) {
+	var cidr address.CIDR
+	var err error
+	if net {
+		cidr, err = ParseCIDRSubnet(cidrStr)
+	} else {
+		cidr, err = address.ParseCIDR(cidrStr)
+	}
 	if err != nil {
 		badRequest(w, err)
 		return address.CIDR{}, false
 	}
-	if cidr.Start != subnetAddr {
-		badRequest(w, fmt.Errorf("Invalid subnet %s - bits after network prefix are not all zero", cidrStr))
-		return address.CIDR{}, false
-	}
 	return cidr, true
 }

+func writeAddresses(w http.ResponseWriter, cidrs []address.CIDR) {
+	for i, cidr := range cidrs {
+		fmt.Fprint(w, cidr)
+		if i < len(cidrs)-1 {
+			w.Write([]byte{' '})
+		}
+	}
+}
+
+func hasBeenCancelled(dockerCli *docker.Client, closedChan <-chan bool, ident string, checkAlive bool) func() bool {
+	return func() bool {
+		select {
+		case <-closedChan:
+			return true
+		default:
+			res := checkAlive && dockerCli != nil && dockerCli.IsContainerNotRunning(ident)
+			checkAlive = false // we check only once; if the container dies later we learn about that through events
+			return res
+		}
+	}
+}
+
+func cancellationErr(w http.ResponseWriter, err error) bool {
+	if _, ok := err.(*errorCancelled); ok {
+		common.Log.Infoln("[allocator]:", err.Error())
+		fmt.Fprint(w, "cancelled")
+		return true
+	}
+	return false
+}
+
 func (alloc *Allocator) handleHTTPAllocate(dockerCli *docker.Client, w http.ResponseWriter, ident string, checkAlive bool, subnet address.CIDR) {
-	closedChan := w.(http.CloseNotifier).CloseNotify()
-	addr, err := alloc.Allocate(ident, subnet.HostRange(),
-		func() bool {
-			select {
-			case <-closedChan:
-				return true
-			default:
-				res := checkAlive && dockerCli != nil && dockerCli.IsContainerNotRunning(ident)
-				checkAlive = false // we check only once; if the container dies later we learn about that through events
-				return res
-			}
-		})
+	addr, err := alloc.Allocate(ident, subnet, checkAlive,
+		hasBeenCancelled(dockerCli, w.(http.CloseNotifier).CloseNotify(), ident, checkAlive))
 	if err != nil {
-		if _, ok := err.(*errorCancelled); ok { // cancellation is not really an error
-			common.Log.Infoln("[allocator]:", err.Error())
-			fmt.Fprint(w, "cancelled")
-			return
+		if !cancellationErr(w, err) {
+			badRequest(w, err)
 		}
-		badRequest(w, err)
 		return
 	}
-
 	fmt.Fprintf(w, "%s/%d", addr, subnet.PrefixLen)
 }

+func (alloc *Allocator) handleHTTPClaim(dockerCli *docker.Client, w http.ResponseWriter, ident string, cidr address.CIDR, checkAlive, noErrorOnUnknown bool) {
+	err := alloc.Claim(ident, cidr, checkAlive, noErrorOnUnknown,
+		hasBeenCancelled(dockerCli, w.(http.CloseNotifier).CloseNotify(), ident, checkAlive))
+	if err != nil {
+		if !cancellationErr(w, err) {
+			badRequest(w, fmt.Errorf("Unable to claim: %s", err))
+		}
+		return
+	}
+	w.WriteHeader(204)
+}
+
 // HandleHTTP wires up ipams HTTP endpoints to the provided mux.
-func (alloc *Allocator) HandleHTTP(router *mux.Router, defaultSubnet address.CIDR, dockerCli *docker.Client) {
+func (alloc *Allocator) HandleHTTP(router *mux.Router, defaultSubnet address.CIDR, tracker string, dockerCli *docker.Client) {
 	router.Methods("GET").Path("/ipinfo/defaultsubnet").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		fmt.Fprintf(w, "%s", defaultSubnet)
 	})

-	router.Methods("PUT").Path("/ip/{id}/{ip}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	router.Methods("PUT").Path("/ip/{id}/{ip}/{prefixlen}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		vars := mux.Vars(r)
-		ident := vars["id"]
-		ipStr := vars["ip"]
-		noErrorOnUnknown := r.FormValue("noErrorOnUnknown") == "true"
-		if ip, err := address.ParseIP(ipStr); err != nil {
-			badRequest(w, err)
-			return
-		} else if err := alloc.Claim(ident, ip, noErrorOnUnknown); err != nil {
-			badRequest(w, fmt.Errorf("Unable to claim: %s", err))
-			return
+		if cidr, ok := parseCIDR(w, vars["ip"]+"/"+vars["prefixlen"], false); ok {
+			ident := vars["id"]
+			checkAlive := r.FormValue("check-alive") == "true"
+			noErrorOnUnknown := r.FormValue("noErrorOnUnknown") == "true"
+			alloc.handleHTTPClaim(dockerCli, w, ident, cidr, checkAlive, noErrorOnUnknown)
 		}
+	})

-		w.WriteHeader(204)
+	router.Methods("GET").Path("/ring").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		alloc.Prime()
 	})

 	router.Methods("GET").Path("/ip/{id}/{ip}/{prefixlen}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		vars := mux.Vars(r)
-		if subnet, ok := parseCIDR(w, vars["ip"]+"/"+vars["prefixlen"]); ok {
-			addr, err := alloc.Lookup(vars["id"], subnet.HostRange())
+		if subnet, ok := parseCIDR(w, vars["ip"]+"/"+vars["prefixlen"], true); ok {
+			cidrs, err := alloc.Lookup(vars["id"], subnet.HostRange())
 			if err != nil {
 				http.NotFound(w, r)
 				return
 			}
-			fmt.Fprintf(w, "%s/%d", addr, subnet.PrefixLen)
+			writeAddresses(w, cidrs)
 		}
 	})

 	router.Methods("GET").Path("/ip/{id}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		addr, err := alloc.Lookup(mux.Vars(r)["id"], defaultSubnet.HostRange())
+		addrs, err := alloc.Lookup(mux.Vars(r)["id"], defaultSubnet.HostRange())
 		if err != nil {
 			http.NotFound(w, r)
 			return
 		}
-		fmt.Fprintf(w, "%s/%d", addr, defaultSubnet.PrefixLen)
+		writeAddresses(w, addrs)
 	})

 	router.Methods("POST").Path("/ip/{id}/{ip}/{prefixlen}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		vars := mux.Vars(r)
-		if subnet, ok := parseCIDR(w, vars["ip"]+"/"+vars["prefixlen"]); ok {
+		if subnet, ok := parseCIDR(w, vars["ip"]+"/"+vars["prefixlen"], true); ok {
 			alloc.handleHTTPAllocate(dockerCli, w, vars["id"], r.FormValue("check-alive") == "true", subnet)
 		}
 	})
@@ -142,11 +171,11 @@ func (alloc *Allocator) HandleHTTP(router *mux.Router, defaultSubnet address.CID

 	router.Methods("DELETE").Path("/peer/{id}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		ident := mux.Vars(r)["id"]
-		if err := alloc.AdminTakeoverRanges(ident); err != nil {
-			badRequest(w, err)
-			return
-		}
+		transferred := alloc.AdminTakeoverRanges(ident)
+		fmt.Fprintf(w, "%d IPs taken over from %s\n", transferred, ident)
+	})

-		w.WriteHeader(204)
+	router.Methods("GET").Path("/ipinfo/tracker").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintf(w, tracker)
 	})
 }
@@ -43,7 +43,7 @@ func listenHTTP(alloc *Allocator, subnet address.CIDR) int {
 	router.HandleFunc("/status", func(w http.ResponseWriter, r *http.Request) {
 		io.WriteString(w, fmt.Sprintln(alloc))
 	})
-	alloc.HandleHTTP(router, subnet, nil)
+	alloc.HandleHTTP(router, subnet, "", nil)

 	httpListener, err := net.Listen("tcp", ":0")
 	if err != nil {
@@ -80,7 +80,7 @@ func TestHttp(t *testing.T) {
 	)

 	alloc, _ := makeAllocatorWithMockGossip(t, "08:00:27:01:c3:9a", universe, 1)
-	_, cidr, _ := address.ParseCIDR(universe)
+	cidr, _ := address.ParseCIDR(universe)
 	port := listenHTTP(alloc, cidr)
 	alloc.claimRingForTesting()

@@ -122,7 +122,7 @@ func TestBadHttp(t *testing.T) {

 	alloc, _ := makeAllocatorWithMockGossip(t, "08:00:27:01:c3:9a", testCIDR1, 1)
 	defer alloc.Stop()
-	_, cidr, _ := address.ParseCIDR(testCIDR1)
+	cidr, _ := address.ParseCIDR(testCIDR1)
 	port := listenHTTP(alloc, cidr)

 	alloc.claimRingForTesting()
@@ -149,29 +149,25 @@ func TestHTTPCancel(t *testing.T) {
 		testCIDR1   = "10.0.3.0/29"
 	)

-	alloc, _ := makeAllocatorWithMockGossip(t, "08:00:27:01:c3:9a", testCIDR1, 1)
+	// Say quorum=2, so the allocate won't go ahead
+	alloc, _ := makeAllocatorWithMockGossip(t, "08:00:27:01:c3:9a", testCIDR1, 2)
 	defer alloc.Stop()
-	alloc.claimRingForTesting()
-	_, cidr, _ := address.ParseCIDR(testCIDR1)
+	ExpectBroadcastMessage(alloc, nil) // trying to form consensus
+	cidr, _ := address.ParseCIDR(testCIDR1)
 	port := listenHTTP(alloc, cidr)

-	// Stop the alloc so nothing actually works
-	unpause := alloc.pause()
-
 	// Ask the http server for a new address
-	done := make(chan *http.Response)
 	req, _ := http.NewRequest("POST", allocURL(port, testCIDR1, containerID), nil)
+	// On another goroutine, wait for a bit then cancel the request
 	go func() {
-		res, _ := http.DefaultClient.Do(req)
-		done <- res
+		time.Sleep(100 * time.Millisecond)
+		common.Log.Debug("Cancelling allocate")
+		http.DefaultTransport.(*http.Transport).CancelRequest(req)
 	}()

-	time.Sleep(100 * time.Millisecond)
-	fmt.Println("Cancelling allocate")
-	http.DefaultTransport.(*http.Transport).CancelRequest(req)
-	unpause()
-	res := <-done
+	res, _ := http.DefaultClient.Do(req)
 	if res != nil {
-		require.FailNow(t, "Error: Allocate returned non-nil")
+		body, _ := ioutil.ReadAll(res.Body)
+		require.FailNow(t, "Error: Allocate returned non-nil", string(body))
 	}
 }
@@ -0,0 +1,44 @@
+package paxos
+
+type Participant interface {
+	GossipState() GossipState
+	Update(from GossipState) bool
+	SetQuorum(uint)
+	Propose()
+	Think() bool
+	Consensus() (bool, AcceptedValue)
+	IsElector() bool
+}
+
+type Observer struct {
+}
+
+func NewObserver() Participant {
+	return &Observer{}
+}
+
+func (observer *Observer) GossipState() GossipState {
+	return nil
+}
+
+func (observer *Observer) Update(from GossipState) bool {
+	return false
+}
+
+func (observer *Observer) Propose() {
+}
+
+func (observer *Observer) SetQuorum(uint) {
+}
+
+func (observer *Observer) Think() bool {
+	return false
+}
+
+func (observer *Observer) Consensus() (bool, AcceptedValue) {
+	return false, AcceptedValue{}
+}
+
+func (observer *Observer) IsElector() bool {
+	return false
+}
@@ -1,7 +1,7 @@
 package paxos

 import (
-	"github.com/weaveworks/weave/mesh"
+	"github.com/weaveworks/mesh"
 )

 // The node identifier.  The use of the UID here is important: Paxos
@@ -80,6 +80,10 @@ func NewNode(name mesh.PeerName, uid mesh.PeerUID, quorum uint) *Node {
 	}
 }

+func (node *Node) SetQuorum(quorum uint) {
+	node.quorum = quorum
+}
+
 func (node *Node) GossipState() GossipState {
 	return node.knows
 }
@@ -124,6 +128,9 @@ func max(a uint, b uint) uint {
 // simply a matter of gossipping a new proposal that supersedes all
 // others.
 func (node *Node) Propose() {
+	if node.quorum == 0 {
+		panic("Paxos node.Propose() called with no quorum set")
+	}
 	// Find the highest round number around
 	round := uint(0)

@@ -234,6 +241,9 @@ func (node *Node) pickValue() Value {

 // Has a consensus been reached, based on the known claims of other nodes?
 func (node *Node) Consensus() (bool, AcceptedValue) {
+	if node.quorum == 0 {
+		return false, AcceptedValue{}
+	}
 	counts := map[ProposalID]uint{}

 	for _, claims := range node.knows {
@@ -250,14 +260,16 @@ func (node *Node) Consensus() (bool, AcceptedValue) {
 	return false, AcceptedValue{}
 }

+func (node *Node) IsElector() bool {
+	return true
+}
+
 type Status struct {
+	Elector    bool
 	KnownNodes int
 	Quorum     uint
 }

 func NewStatus(node *Node) *Status {
-	if node == nil {
-		return nil
-	}
-	return &Status{len(node.knows), node.quorum}
+	return &Status{true, len(node.knows), node.quorum}
 }
@@ -6,7 +6,7 @@ import (
 	"testing"
 	"time"

-	"github.com/weaveworks/weave/mesh"
+	"github.com/weaveworks/mesh"
 )

 type TestNode struct {
@@ -300,14 +300,14 @@ func (m *Model) validate() {
 	for i := range m.nodes {
 		ok, val := m.nodes[i].Consensus()
 		if !ok {
-			//m.dump()
+			m.dump()
 			m.t.Fatal("Node doesn't know about consensus")
 		}

 		firstConsensus := m.nodes[i].firstConsensus
 		if firstConsensus.Origin.valid() &&
 			firstConsensus.Origin != val.Origin {
-			//m.dump()
+			m.dump()
 			m.t.Fatal("Consensus mismatch")
 		}

@@ -0,0 +1,24 @@
+package ipam
+
+type prime struct {
+	resultChan chan<- struct{}
+}
+
+func (c *prime) Try(alloc *Allocator) bool {
+	if !alloc.ring.Empty() {
+		close(c.resultChan)
+		return true
+	}
+
+	alloc.establishRing()
+
+	return false
+}
+
+func (c *prime) Cancel() {
+	close(c.resultChan)
+}
+
+func (c *prime) ForContainer(ident string) bool {
+	return false
+}
@@ -3,8 +3,9 @@ package ring
 import (
 	"sort"

+	"github.com/weaveworks/mesh"
+
 	"github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/mesh"
 	"github.com/weaveworks/weave/net/address"
 )

@@ -13,7 +14,7 @@ type entry struct {
 	Token   address.Address // The start of this range
 	Peer    mesh.PeerName   // Who owns this range
 	Version uint32          // Version of this range
-	Free    address.Offset  // Number of free IPs in this range
+	Free    address.Count   // Number of free IPs in this range
 }

 func (e *entry) Equal(e2 *entry) bool {
@@ -21,7 +22,7 @@ func (e *entry) Equal(e2 *entry) bool {
 		e.Version == e2.Version
 }

-func (e *entry) update(peername mesh.PeerName, free address.Offset) {
+func (e *entry) update(peername mesh.PeerName, free address.Count) {
 	e.Peer = peername
 	e.Version++
 	e.Free = free
@@ -12,17 +12,21 @@ import (
 	"sort"
 	"time"

+	"github.com/weaveworks/mesh"
+
 	"github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/mesh"
 	"github.com/weaveworks/weave/net/address"
 )

+type OnUpdate func(prev, curr []address.Range, local bool)
+
 // Ring represents the ring itself
 type Ring struct {
 	Start, End address.Address // [min, max) tokens in this ring.  Due to wrapping, min == max (effectively)
 	Peer       mesh.PeerName   // name of peer owning this ring instance
 	Entries    entries         // list of entries sorted by token
 	Seeds      []mesh.PeerName // peers with which the ring was seeded
+	onUpdate   OnUpdate
 }

 func (r *Ring) assertInvariants() {
@@ -39,40 +43,50 @@ var (
 	ErrTokenOutOfRange = errors.New("Token is out of range")
 	ErrDifferentSeeds  = errors.New("Received ring was seeded differently from ours!")
 	ErrDifferentRange  = errors.New("Received range differs from ours!")
-	ErrNewerVersion    = errors.New("Received new version for entry I own!")
-	ErrInvalidEntry    = errors.New("Received invalid state update!")
-	ErrEntryInMyRange  = errors.New("Received new entry in my range!")
-	ErrNotFound        = errors.New("No entries for peer found")
 )

+func errInconsistentEntry(mine, theirs *entry) error {
+	return fmt.Errorf("Inconsistent entries for %s: owned by %s but incoming message says %s", mine.Token, mine.Peer, theirs.Peer)
+}
+func errEntryInMyRange(theirs *entry) error {
+	return fmt.Errorf("Peer %s says it owns the IP range from %s, which I think I own", theirs.Peer, theirs.Token)
+}
+func errNewerVersion(mine, theirs *entry) error {
+	return fmt.Errorf("Received update for IP range I own at %s v%d: incoming message says owner %s v%d", mine.Token, mine.Version, theirs.Peer, theirs.Version)
+}
+
 func (r *Ring) checkInvariants() error {
-	if !sort.IsSorted(r.Entries) {
+	return r.checkEntries(r.Entries)
+}
+
+func (r *Ring) checkEntries(entries entries) error {
+	if !sort.IsSorted(entries) {
 		return ErrNotSorted
 	}

 	// Check no token appears twice
 	// We know it's sorted...
-	for i := 1; i < len(r.Entries); i++ {
-		if r.Entries[i-1].Token == r.Entries[i].Token {
+	for i := 1; i < len(entries); i++ {
+		if entries[i-1].Token == entries[i].Token {
 			return ErrTokenRepeated
 		}
 	}

-	if len(r.Entries) == 0 {
+	if len(entries) == 0 {
 		return nil
 	}

 	// Check tokens are in range
-	if r.Entries.entry(0).Token < r.Start {
+	if entries.entry(0).Token < r.Start {
 		return ErrTokenOutOfRange
 	}
-	if r.Entries.entry(-1).Token >= r.End {
+	if entries.entry(-1).Token >= r.End {
 		return ErrTokenOutOfRange
 	}

 	// Check all the freespaces are in range
-	for i, entry := range r.Entries {
-		next := r.Entries.entry(i + 1)
+	for i, entry := range entries {
+		next := entries.entry(i + 1)
 		distance := r.distance(entry.Token, next.Token)

 		if entry.Free > distance {
@@ -83,27 +97,45 @@ func (r *Ring) checkInvariants() error {
 	return nil
 }

+func (r *Ring) trackUpdates() func() {
+	return r.trackUpdatesOfPeer(r.Peer)
+}
+
+func (r *Ring) trackUpdatesOfPeer(peer mesh.PeerName) func() {
+	if r.onUpdate == nil {
+		return func() {}
+	}
+	ranges := r.OwnedRangesOfPeer(peer)
+	return func() { r.onUpdate(ranges, r.OwnedRangesOfPeer(peer), peer == r.Peer) }
+}
+
 // New creates an empty ring belonging to peer.
-func New(start, end address.Address, peer mesh.PeerName) *Ring {
+func New(start, end address.Address, peer mesh.PeerName, f OnUpdate) *Ring {
 	common.Assert(start < end)

-	ring := &Ring{Start: start, End: end, Peer: peer, Entries: make([]*entry, 0)}
+	ring := &Ring{Start: start, End: end, Peer: peer, Entries: make([]*entry, 0), onUpdate: f}
 	ring.updateExportedVariables()
 	return ring
 }

+func (r *Ring) Restore(other *Ring) {
+	onUpdate := r.onUpdate
+	*r = *other
+	r.onUpdate = onUpdate
+}
+
 func (r *Ring) Range() address.Range {
 	return address.Range{Start: r.Start, End: r.End}
 }

 // Returns the distance between two tokens on this ring, dealing
 // with ranges which cross the origin
-func (r *Ring) distance(start, end address.Address) address.Offset {
+func (r *Ring) distance(start, end address.Address) address.Count {
 	if end > start {
-		return address.Offset(end - start)
+		return address.Count(end - start)
 	}

-	return address.Offset((r.End - start) + (end - r.Start))
+	return address.Count((r.End - start) + (end - r.Start))
 }

 // GrantRangeToHost modifies the ring such that range [start, end)
@@ -115,6 +147,7 @@ func (r *Ring) GrantRangeToHost(start, end address.Address, peer mesh.PeerName)
 	//fmt.Printf("%s GrantRangeToHost [%v,%v) -> %s\n", r.Peer, start, end, peer)

 	r.assertInvariants()
+	defer r.trackUpdates()()
 	defer r.assertInvariants()
 	defer r.updateExportedVariables()

@@ -178,43 +211,70 @@ func (r *Ring) GrantRangeToHost(start, end address.Address, peer mesh.PeerName)
 	r.Entries.insert(entry{Token: end, Peer: r.Peer, Free: endFree})
 }

-// Merge the given ring into this ring and return any new ranges added
-func (r *Ring) Merge(gossip Ring) error {
+// Merge the given ring into this ring and indicate whether this ring
+// got updated as a result.
+func (r *Ring) Merge(gossip Ring) (bool, error) {
 	r.assertInvariants()
-	defer r.assertInvariants()
+	defer r.trackUpdates()()
 	defer r.updateExportedVariables()

 	// Don't panic when checking the gossiped in ring.
 	// In this case just return any error found.
 	if err := gossip.checkInvariants(); err != nil {
-		return err
+		return false, err
 	}

 	if len(gossip.Seeds) > 0 && len(r.Seeds) > 0 {
 		if len(gossip.Seeds) != len(r.Seeds) {
-			return ErrDifferentSeeds
+			return false, ErrDifferentSeeds
 		}
 		for i, seed := range gossip.Seeds {
 			if seed != r.Seeds[i] {
-				return ErrDifferentSeeds
+				return false, ErrDifferentSeeds
 			}
 		}
 	}

 	if r.Start != gossip.Start || r.End != gossip.End {
-		return ErrDifferentRange
+		return false, ErrDifferentRange
 	}

-	// Now merge their ring with yours, in a temporary ring.
-	var result entries
-	addToResult := func(e entry) { result = append(result, &e) }
+	result, updated, err := r.Entries.merge(gossip.Entries, r.Peer)

+	if err != nil {
+		return false, err
+	}
+
+	if err := r.checkEntries(result); err != nil {
+		return false, fmt.Errorf("Merge of incoming data causes: %s", err)
+	}
+
+	if len(r.Seeds) == 0 {
+		r.Seeds = gossip.Seeds
+	}
+	r.Entries = result
+
+	return updated, nil
+}
+
+// Merge other entries into ours, and complain when that stomps on
+// entries belonging to ourPeer. Returns the merged entries and an
+// indication whether the merge resulted in any changes, i.e. the
+// result differs from the original.
+func (es entries) merge(other entries, ourPeer mesh.PeerName) (result entries, updated bool, err error) {
 	var mine, theirs *entry
 	var previousOwner *mesh.PeerName
-	// i is index into r.Entries; j is index into gossip.Entries
+	addToResult := func(e entry) { result = append(result, &e) }
+	addTheirs := func(e entry) {
+		addToResult(e)
+		updated = true
+		previousOwner = nil
+	}
+
+	// i is index into es; j is index into other
 	var i, j int
-	for i < len(r.Entries) && j < len(gossip.Entries) {
-		mine, theirs = r.Entries[i], gossip.Entries[j]
+	for i < len(es) && j < len(other) {
+		mine, theirs = es[i], other[j]
 		switch {
 		case mine.Token < theirs.Token:
 			addToResult(*mine)
@@ -222,56 +282,52 @@ func (r *Ring) Merge(gossip Ring) error {
 			i++
 		case mine.Token > theirs.Token:
 			// insert, checking that a range owned by us hasn't been split
-			if previousOwner != nil && *previousOwner == r.Peer && theirs.Peer != r.Peer {
-				return ErrEntryInMyRange
+			if previousOwner != nil && *previousOwner == ourPeer && theirs.Peer != ourPeer {
+				err = errEntryInMyRange(theirs)
+				return
 			}
-			addToResult(*theirs)
-			previousOwner = nil
+			addTheirs(*theirs)
 			j++
 		case mine.Token == theirs.Token:
 			// merge
 			switch {
 			case mine.Version >= theirs.Version:
 				if mine.Version == theirs.Version && !mine.Equal(theirs) {
-					common.Log.Debugf("Error merging entries at %s - %v != %v", mine.Token, mine, theirs)
-					return ErrInvalidEntry
+					err = errInconsistentEntry(mine, theirs)
+					return
 				}
 				addToResult(*mine)
 				previousOwner = &mine.Peer
 			case mine.Version < theirs.Version:
-				if mine.Peer == r.Peer { // We shouldn't receive updates to our own tokens
-					return ErrNewerVersion
+				if mine.Peer == ourPeer { // We shouldn't receive updates to our own tokens
+					err = errNewerVersion(mine, theirs)
+					return
 				}
-				addToResult(*theirs)
-				previousOwner = nil
+				addTheirs(*theirs)
 			}
 			i++
 			j++
 		}
 	}

-	// At this point, either i is at the end of r or j is at the end
-	// of gossip, so copy over the remaining entries.
+	// At this point, either i is at the end of es or j is at the end
+	// of other, so copy over the remaining entries.

-	for ; i < len(r.Entries); i++ {
-		mine = r.Entries[i]
+	for ; i < len(es); i++ {
+		mine = es[i]
 		addToResult(*mine)
 	}

-	for ; j < len(gossip.Entries); j++ {
-		theirs = gossip.Entries[j]
-		if previousOwner != nil && *previousOwner == r.Peer && theirs.Peer != r.Peer {
-			return ErrEntryInMyRange
+	for ; j < len(other); j++ {
+		theirs = other[j]
+		if previousOwner != nil && *previousOwner == ourPeer && theirs.Peer != ourPeer {
+			err = errEntryInMyRange(theirs)
+			return
 		}
-		addToResult(*theirs)
-		previousOwner = nil
+		addTheirs(*theirs)
 	}

-	if len(r.Seeds) == 0 {
-		r.Seeds = gossip.Seeds
-	}
-	r.Entries = result
-	return nil
+	return
 }

 // Empty returns true if the ring has no entries
@@ -304,10 +360,14 @@ func (r *Ring) splitRangesOverZero(ranges []address.Range) []address.Range {
 // ranges are owned by this peer.  Will split ranges which
 // span 0 in the ring.
 func (r *Ring) OwnedRanges() (result []address.Range) {
+	return r.OwnedRangesOfPeer(r.Peer)
+}
+
+func (r *Ring) OwnedRangesOfPeer(peer mesh.PeerName) (result []address.Range) {
 	r.assertInvariants()

 	for i, entry := range r.Entries {
-		if entry.Peer == r.Peer {
+		if entry.Peer == peer {
 			nextEntry := r.Entries.entry(i + 1)
 			result = append(result, address.Range{Start: entry.Token, End: nextEntry.Token})
 		}
@@ -336,39 +396,38 @@ func (r *Ring) AllRangeInfo() (result []RangeInfo) {
 }

 // ClaimForPeers claims the entire ring for the array of peers passed
-// in.  Only works for empty rings.
+// in.  Only works for empty rings. Each claimed range is CIDR-aligned.
 func (r *Ring) ClaimForPeers(peers []mesh.PeerName) {
 	common.Assert(r.Empty())
+
+	defer r.trackUpdates()()
 	defer r.assertInvariants()
 	defer r.updateExportedVariables()
+	defer func() {
+		e := r.Entries[len(r.Entries)-1]
+		common.Assert(address.Add(e.Token, address.Offset(e.Free)) == r.End)
+	}()

-	totalSize := r.distance(r.Start, r.End)
-	share := totalSize/address.Offset(len(peers)) + 1
-	remainder := totalSize % address.Offset(len(peers))
-	pos := r.Start
-
-	for i, peer := range peers {
-		if address.Offset(i) == remainder {
-			share--
-			if share == 0 {
-				break
-			}
-		}
-
-		if e, found := r.Entries.get(pos); found {
-			e.update(peer, share)
-		} else {
-			r.Entries.insert(entry{Token: pos, Peer: peer, Free: share})
-		}
-
-		pos += address.Address(share)
-	}
-
-	common.Assert(pos == r.End)
-
+	r.subdivide(r.Start, r.End, peers)
 	r.Seeds = peers
 }

+// subdivide subdivides the [from,to) CIDR for the given peers into
+// CIDR-aligned subranges.
+func (r *Ring) subdivide(from, to address.Address, peers []mesh.PeerName) {
+	share := address.Length(to, from)
+	if share == 0 {
+		return
+	}
+	if share == 1 || len(peers) == 1 {
+		r.Entries.insert(entry{Token: from, Peer: peers[0], Free: share})
+		return
+	}
+	mid := address.Add(from, address.Offset(share/2))
+	r.subdivide(from, mid, peers[:len(peers)/2])
+	r.subdivide(address.Add(mid, address.Offset(share%2)), to, peers[len(peers)/2:])
+}
+
 func (r *Ring) FprintWithNicknames(w io.Writer, m map[mesh.PeerName]string) {
 	for _, entry := range r.Entries {
 		nickname, found := m[entry.Peer]
@@ -390,8 +449,8 @@ func (r *Ring) String() string {

 // ReportFree is used by the allocator to tell the ring how many free
 // ips are in a given range, so that ChoosePeersToAskForSpace can make
-// more intelligent decisions.
-func (r *Ring) ReportFree(freespace map[address.Address]address.Offset) {
+// more intelligent decisions.  Returns true if any changes made.
+func (r *Ring) ReportFree(freespace map[address.Address]address.Count) (updated bool) {
 	r.assertInvariants()
 	defer r.assertInvariants()
 	defer r.updateExportedVariables()
@@ -421,15 +480,17 @@ func (r *Ring) ReportFree(freespace map[address.Address]address.Offset) {
 		// Check we're not reporting more space than the range
 		entry, next := entries.entry(i), entries.entry(i+1)
 		maxSize := r.distance(entry.Token, next.Token)
-		common.Assert(free <= maxSize)
+		common.Assert(free <= address.Count(maxSize))

 		if entries[i].Free == free {
-			return
+			continue
 		}

 		entries[i].Free = free
 		entries[i].Version++
+		updated = true
 	}
+	return
 }

 type weightedPeer struct {
@@ -446,10 +507,7 @@ func (ws weightedPeers) Swap(i, j int)      { ws[i], ws[j] = ws[j], ws[i] }
 // ChoosePeersToAskForSpace returns all peers we can ask for space in
 // the range [start, end), in weighted-random order.  Assumes start<end.
 func (r *Ring) ChoosePeersToAskForSpace(start, end address.Address) []mesh.PeerName {
-	var (
-		sum               address.Offset
-		totalSpacePerPeer = make(map[mesh.PeerName]address.Offset) // Compute total free space per peer
-	)
+	totalSpacePerPeer := make(map[mesh.PeerName]address.Count)

 	// iterate through tokens
 	for i, entry := range r.Entries {
@@ -471,7 +529,6 @@ func (r *Ring) ChoosePeersToAskForSpace(start, end address.Address) []mesh.PeerN
 		}

 		totalSpacePerPeer[entry.Peer] += entry.Free
-		sum += entry.Free
 	}

 	// Compute weighted random numbers, then sort.
@@ -500,28 +557,24 @@ func (r *Ring) PickPeerForTransfer(isValid func(mesh.PeerName) bool) mesh.PeerNa

 // Transfer will mark all entries associated with 'from' peer as owned by 'to' peer
 // and return ranges indicating the new space we picked up
-func (r *Ring) Transfer(from, to mesh.PeerName) ([]address.Range, error) {
+func (r *Ring) Transfer(from, to mesh.PeerName) []address.Range {
 	r.assertInvariants()
+	defer r.trackUpdates()()
+	defer r.trackUpdatesOfPeer(from)()
 	defer r.assertInvariants()
 	defer r.updateExportedVariables()

 	var newRanges []address.Range
-	found := false

 	for i, entry := range r.Entries {
 		if entry.Peer == from {
-			found = true
 			entry.Peer = to
 			entry.Version++
 			newRanges = append(newRanges, address.Range{Start: entry.Token, End: r.Entries.entry(i + 1).Token})
 		}
 	}

-	if !found {
-		return nil, ErrNotFound
-	}
-
-	return r.splitRangesOverZero(newRanges), nil
+	return r.splitRangesOverZero(newRanges)
 }

 // Contains returns true if addr is in this ring
@@ -8,8 +8,9 @@ import (
 	"testing"

 	"github.com/stretchr/testify/require"
+	"github.com/weaveworks/mesh"
+
 	"github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/mesh"
 	"github.com/weaveworks/weave/net/address"
 )

@@ -18,7 +19,8 @@ var (
 	peer2name, _ = mesh.PeerNameFromString("02:00:00:00:02:00")
 	peer3name, _ = mesh.PeerNameFromString("03:00:00:00:02:00")

-	start, end    = ParseIP("10.0.0.0"), ParseIP("10.0.0.255")
+	start, end    = ParseIP("10.0.0.0"), ParseIP("10.0.1.0")
+	dot8          = ParseIP("10.0.0.8")
 	dot10, dot245 = ParseIP("10.0.0.10"), ParseIP("10.0.0.245")
 	dot250        = ParseIP("10.0.0.250")
 	middle        = ParseIP("10.0.0.128")
@@ -29,8 +31,17 @@ func ParseIP(s string) address.Address {
 	return addr
 }

+func merge(r1, r2 *Ring) error {
+	_, err := r1.Merge(*r2)
+	return err
+}
+
+func NewRing(start, end address.Address, peer mesh.PeerName) *Ring {
+	return New(start, end, peer, nil)
+}
+
 func TestInvariants(t *testing.T) {
-	ring := New(start, end, peer1name)
+	ring := NewRing(start, end, peer1name)

 	// Check ring is sorted
 	ring.Entries = []*entry{{Token: dot245, Peer: peer1name}, {Token: dot10, Peer: peer2name}}
@@ -41,7 +52,7 @@ func TestInvariants(t *testing.T) {
 	require.True(t, ring.checkInvariants() == ErrTokenRepeated, "Expected error")

 	// Check tokens are in bounds
-	ring = New(dot10, dot245, peer1name)
+	ring = NewRing(dot10, dot245, peer1name)
 	ring.Entries = []*entry{{Token: start, Peer: peer1name}}
 	require.True(t, ring.checkInvariants() == ErrTokenOutOfRange, "Expected error")

@@ -50,7 +61,7 @@ func TestInvariants(t *testing.T) {
 }

 func TestInsert(t *testing.T) {
-	ring := New(start, end, peer1name)
+	ring := NewRing(start, end, peer1name)
 	ring.Entries = []*entry{{Token: start, Peer: peer1name, Free: 255}}

 	require.Panics(t, func() {
@@ -59,17 +70,23 @@ func TestInsert(t *testing.T) {

 	ring.Entries.entry(0).Free = 0
 	ring.Entries.insert(entry{Token: dot245, Peer: peer1name})
-	ring2 := New(start, end, peer1name)
-	ring2.Entries = []*entry{{Token: start, Peer: peer1name, Free: 0}, {Token: dot245, Peer: peer1name}}
-	require.Equal(t, ring2, ring)
+	check := []RangeInfo{
+		{Peer: peer1name, Range: address.Range{Start: start, End: dot245}},
+		{Peer: peer1name, Range: address.Range{Start: dot245, End: end}},
+	}
+	require.Equal(t, check, ring.AllRangeInfo())

 	ring.Entries.insert(entry{Token: dot10, Peer: peer1name})
-	ring2.Entries = []*entry{{Token: start, Peer: peer1name, Free: 0}, {Token: dot10, Peer: peer1name}, {Token: dot245, Peer: peer1name}}
-	require.Equal(t, ring2, ring)
+	check2 := []RangeInfo{
+		{Peer: peer1name, Range: address.Range{Start: start, End: dot10}},
+		{Peer: peer1name, Range: address.Range{Start: dot10, End: dot245}},
+		{Peer: peer1name, Range: address.Range{Start: dot245, End: end}},
+	}
+	require.Equal(t, check2, ring.AllRangeInfo())
 }

 func TestBetween(t *testing.T) {
-	ring1 := New(start, end, peer1name)
+	ring1 := NewRing(start, end, peer1name)
 	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 255}}

 	// First off, in a ring where everything is owned by the peer
@@ -111,29 +128,29 @@ func TestBetween(t *testing.T) {
 }

 func TestGrantSimple(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)

 	// Claim everything for peer1
 	ring1.ClaimItAll()
-	require.Equal(t, entries{{Token: start, Peer: peer1name, Free: 255}}, ring1.Entries)
+	require.Equal(t, entries{{Token: start, Peer: peer1name, Free: 256}}, ring1.Entries)

 	// Now grant everything to peer2
 	ring1.GrantRangeToHost(start, end, peer2name)
-	ring2.Entries = []*entry{{Token: start, Peer: peer2name, Free: 255, Version: 1}}
+	ring2.Entries = []*entry{{Token: start, Peer: peer2name, Free: 256, Version: 1}}
 	require.Equal(t, ring2.Entries, ring1.Entries)

 	// Now spint back to peer 1
 	ring2.GrantRangeToHost(dot10, end, peer1name)
 	ring1.Entries = []*entry{{Token: start, Peer: peer2name, Free: 10, Version: 2},
-		{Token: dot10, Peer: peer1name, Free: 245}}
+		{Token: dot10, Peer: peer1name, Free: 246}}
 	require.Equal(t, ring2.Entries, ring1.Entries)

 	// And spint back to peer 2 again
 	ring1.GrantRangeToHost(dot245, end, peer2name)
 	require.Equal(t, entries{{Token: start, Peer: peer2name, Free: 10, Version: 2},
 		{Token: dot10, Peer: peer1name, Free: 235, Version: 1},
-		{Token: dot245, Peer: peer2name, Free: 10}}, ring1.Entries)
+		{Token: dot245, Peer: peer2name, Free: 11}}, ring1.Entries)

 	// Grant range spanning a live token
 	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 10, Version: 2},
@@ -146,19 +163,19 @@ func TestGrantSimple(t *testing.T) {
 }

 func TestGrantSplit(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)

 	// Claim everything for peer1
-	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 255}}
-	ring2.Merge(*ring1)
+	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 256}}
+	merge(ring2, ring1)
 	require.Equal(t, ring2.Entries, ring1.Entries)

 	// Now grant a split range to peer2
 	ring1.GrantRangeToHost(dot10, dot245, peer2name)
 	require.Equal(t, entries{{Token: start, Peer: peer1name, Free: 10, Version: 1},
 		{Token: dot10, Peer: peer2name, Free: 235},
-		{Token: dot245, Peer: peer1name, Free: 10}}, ring1.Entries)
+		{Token: dot245, Peer: peer1name, Free: 11}}, ring1.Entries)

 	ring1.assertInvariants()

@@ -169,22 +186,22 @@ func TestGrantSplit(t *testing.T) {
 	require.Equal(t, entries{{Token: start, Peer: peer1name, Free: 10, Version: 2},
 		{Token: dot10, Peer: peer2name, Free: 118, Version: 1},
 		{Token: middle, Peer: peer2name, Free: 117, Version: 1},
-		{Token: dot245, Peer: peer1name, Free: 10, Version: 0}}, ring1.Entries)
+		{Token: dot245, Peer: peer1name, Free: 11, Version: 0}}, ring1.Entries)

 	ring1.assertInvariants()
 }

 func TestMergeSimple(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)

 	// Claim everything for peer1
 	ring1.ClaimItAll()
 	ring1.GrantRangeToHost(middle, end, peer2name)
-	require.NoError(t, ring2.Merge(*ring1))
+	require.NoError(t, merge(ring2, ring1))

 	require.Equal(t, entries{{Token: start, Peer: peer1name, Free: 128, Version: 1},
-		{Token: middle, Peer: peer2name, Free: 127}}, ring1.Entries)
+		{Token: middle, Peer: peer2name, Free: 128}}, ring1.Entries)

 	require.Equal(t, ring2.Entries, ring1.Entries)

@@ -193,47 +210,48 @@ func TestMergeSimple(t *testing.T) {
 	ring1.GrantRangeToHost(start, middle, peer2name)
 	ring2.GrantRangeToHost(middle, end, peer1name)

-	require.NoError(t, ring2.Merge(*ring1))
-	require.NoError(t, ring1.Merge(*ring2))
+	require.NoError(t, merge(ring2, ring1))
+	require.NoError(t, merge(ring1, ring2))

 	require.Equal(t, entries{{Token: start, Peer: peer2name, Free: 128, Version: 2},
-		{Token: middle, Peer: peer1name, Free: 127, Version: 1}}, ring1.Entries)
+		{Token: middle, Peer: peer1name, Free: 128, Version: 1}}, ring1.Entries)

 	require.Equal(t, ring2.Entries, ring1.Entries)
 }

 func TestMergeErrors(t *testing.T) {
 	// Cannot Merge in an invalid ring
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)
 	ring2.Entries = []*entry{{Token: middle, Peer: peer2name}, {Token: start, Peer: peer2name}}
-	require.True(t, ring1.Merge(*ring2) == ErrNotSorted, "Expected ErrNotSorted")
+	require.True(t, merge(ring1, ring2) == ErrNotSorted, "Expected ErrNotSorted")

 	// Should Merge two rings for different ranges
-	ring2 = New(start, middle, peer2name)
+	ring2 = NewRing(start, middle, peer2name)
 	ring2.Entries = []*entry{}
-	require.True(t, ring1.Merge(*ring2) == ErrDifferentRange, "Expected ErrDifferentRange")
+	require.True(t, merge(ring1, ring2) == ErrDifferentRange, "Expected ErrDifferentRange")

 	// Cannot Merge newer version of entry I own
-	ring2 = New(start, end, peer2name)
+	ring2 = NewRing(start, end, peer2name)
 	ring1.Entries = []*entry{{Token: start, Peer: peer1name}}
 	ring2.Entries = []*entry{{Token: start, Peer: peer1name, Version: 1}}
-	require.True(t, ring1.Merge(*ring2) == ErrNewerVersion, "Expected ErrNewerVersion")
+	fmt.Println(merge(ring1, ring2))
+	require.Error(t, merge(ring1, ring2), "Expected error")

 	// Cannot Merge two entries with same version but different hosts
 	ring1.Entries = []*entry{{Token: start, Peer: peer1name}}
 	ring2.Entries = []*entry{{Token: start, Peer: peer2name}}
-	require.True(t, ring1.Merge(*ring2) == ErrInvalidEntry, "Expected ErrInvalidEntry")
+	require.Error(t, merge(ring1, ring2), "Expected error")

 	// Cannot Merge an entry into a range I own
 	ring1.Entries = []*entry{{Token: start, Peer: peer1name}}
 	ring2.Entries = []*entry{{Token: middle, Peer: peer2name}}
-	require.True(t, ring1.Merge(*ring2) == ErrEntryInMyRange, "Expected ErrEntryInMyRange")
+	require.Error(t, merge(ring1, ring2), "Expected error")
 }

 func TestMergeMore(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)

 	assertRing := func(ring *Ring, entries entries) {
 		require.Equal(t, entries, ring.Entries)
@@ -244,74 +262,74 @@ func TestMergeMore(t *testing.T) {

 	// Claim everything for peer1
 	ring1.ClaimItAll()
-	assertRing(ring1, []*entry{{Token: start, Peer: peer1name, Free: 255}})
+	assertRing(ring1, []*entry{{Token: start, Peer: peer1name, Free: 256}})
 	assertRing(ring2, []*entry{})

 	// Check the Merge sends it to the other ring
-	require.NoError(t, ring2.Merge(*ring1))
-	assertRing(ring1, []*entry{{Token: start, Peer: peer1name, Free: 255}})
-	assertRing(ring2, []*entry{{Token: start, Peer: peer1name, Free: 255}})
+	require.NoError(t, merge(ring2, ring1))
+	assertRing(ring1, []*entry{{Token: start, Peer: peer1name, Free: 256}})
+	assertRing(ring2, []*entry{{Token: start, Peer: peer1name, Free: 256}})

 	// Give everything to peer2
 	ring1.GrantRangeToHost(start, end, peer2name)
-	assertRing(ring1, []*entry{{Token: start, Peer: peer2name, Free: 255, Version: 1}})
-	assertRing(ring2, []*entry{{Token: start, Peer: peer1name, Free: 255}})
+	assertRing(ring1, []*entry{{Token: start, Peer: peer2name, Free: 256, Version: 1}})
+	assertRing(ring2, []*entry{{Token: start, Peer: peer1name, Free: 256}})

-	require.NoError(t, ring2.Merge(*ring1))
-	assertRing(ring1, []*entry{{Token: start, Peer: peer2name, Free: 255, Version: 1}})
-	assertRing(ring2, []*entry{{Token: start, Peer: peer2name, Free: 255, Version: 1}})
+	require.NoError(t, merge(ring2, ring1))
+	assertRing(ring1, []*entry{{Token: start, Peer: peer2name, Free: 256, Version: 1}})
+	assertRing(ring2, []*entry{{Token: start, Peer: peer2name, Free: 256, Version: 1}})

 	// And carve off some space
 	ring2.GrantRangeToHost(middle, end, peer1name)
 	assertRing(ring2, []*entry{{Token: start, Peer: peer2name, Free: 128, Version: 2},
-		{Token: middle, Peer: peer1name, Free: 127}})
-	assertRing(ring1, []*entry{{Token: start, Peer: peer2name, Free: 255, Version: 1}})
+		{Token: middle, Peer: peer1name, Free: 128}})
+	assertRing(ring1, []*entry{{Token: start, Peer: peer2name, Free: 256, Version: 1}})

 	// And Merge back
-	require.NoError(t, ring1.Merge(*ring2))
+	require.NoError(t, merge(ring1, ring2))
 	assertRing(ring1, []*entry{{Token: start, Peer: peer2name, Free: 128, Version: 2},
-		{Token: middle, Peer: peer1name, Free: 127}})
+		{Token: middle, Peer: peer1name, Free: 128}})
 	assertRing(ring2, []*entry{{Token: start, Peer: peer2name, Free: 128, Version: 2},
-		{Token: middle, Peer: peer1name, Free: 127}})
+		{Token: middle, Peer: peer1name, Free: 128}})

 	// This should be a no-op
-	require.NoError(t, ring2.Merge(*ring1))
+	require.NoError(t, merge(ring2, ring1))
 	assertRing(ring1, []*entry{{Token: start, Peer: peer2name, Free: 128, Version: 2},
-		{Token: middle, Peer: peer1name, Free: 127}})
+		{Token: middle, Peer: peer1name, Free: 128}})
 	assertRing(ring2, []*entry{{Token: start, Peer: peer2name, Free: 128, Version: 2},
-		{Token: middle, Peer: peer1name, Free: 127}})
+		{Token: middle, Peer: peer1name, Free: 128}})
 }

 func TestMergeSplit(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)

 	// Claim everything for peer2
-	ring1.Entries = []*entry{{Token: start, Peer: peer2name, Free: 255}}
-	require.NoError(t, ring2.Merge(*ring1))
+	ring1.Entries = []*entry{{Token: start, Peer: peer2name, Free: 256}}
+	require.NoError(t, merge(ring2, ring1))
 	require.Equal(t, ring2.Entries, ring1.Entries)

 	// Now grant a split range to peer1
 	ring2.GrantRangeToHost(dot10, dot245, peer1name)
 	require.Equal(t, entries{{Token: start, Peer: peer2name, Free: 10, Version: 1},
 		{Token: dot10, Peer: peer1name, Free: 235},
-		{Token: dot245, Peer: peer2name, Free: 10}}, ring2.Entries)
+		{Token: dot245, Peer: peer2name, Free: 11}}, ring2.Entries)

-	require.NoError(t, ring1.Merge(*ring2))
+	require.NoError(t, merge(ring1, ring2))
 	require.Equal(t, entries{{Token: start, Peer: peer2name, Free: 10, Version: 1},
 		{Token: dot10, Peer: peer1name, Free: 235},
-		{Token: dot245, Peer: peer2name, Free: 10}}, ring1.Entries)
+		{Token: dot245, Peer: peer2name, Free: 11}}, ring1.Entries)

 	require.Equal(t, ring2.Entries, ring1.Entries)
 }

 func TestMergeSplit2(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)

 	// Claim everything for peer2
 	ring1.Entries = []*entry{{Token: start, Peer: peer2name, Free: 250}, {Token: dot250, Peer: peer2name, Free: 5}}
-	require.NoError(t, ring2.Merge(*ring1))
+	require.NoError(t, merge(ring2, ring1))
 	require.Equal(t, ring2.Entries, ring1.Entries)

 	// Now grant a split range to peer1
@@ -320,7 +338,7 @@ func TestMergeSplit2(t *testing.T) {
 		{Token: dot10, Peer: peer1name, Free: 235},
 		{Token: dot245, Peer: peer2name, Free: 5}, {Token: dot250, Peer: peer2name, Free: 5}}, ring2.Entries)

-	require.NoError(t, ring1.Merge(*ring2))
+	require.NoError(t, merge(ring1, ring2))
 	require.Equal(t, entries{{Token: start, Peer: peer2name, Free: 10, Version: 1},
 		{Token: dot10, Peer: peer1name, Free: 235},
 		{Token: dot245, Peer: peer2name, Free: 5}, {Token: dot250, Peer: peer2name, Free: 5}}, ring1.Entries)
@@ -330,8 +348,8 @@ func TestMergeSplit2(t *testing.T) {

 // A simple test, very similar to above, but using the marshalling to byte[]s
 func TestGossip(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)

 	assertRing := func(ring *Ring, entries entries) {
 		require.Equal(t, entries, ring.Entries)
@@ -342,13 +360,13 @@ func TestGossip(t *testing.T) {

 	// Claim everything for peer1
 	ring1.ClaimItAll()
-	assertRing(ring1, []*entry{{Token: start, Peer: peer1name, Free: 255}})
+	assertRing(ring1, []*entry{{Token: start, Peer: peer1name, Free: 256}})
 	assertRing(ring2, []*entry{})

 	// Check the Merge sends it to the other ring
-	require.NoError(t, ring2.Merge(*ring1))
-	assertRing(ring1, []*entry{{Token: start, Peer: peer1name, Free: 255}})
-	assertRing(ring2, []*entry{{Token: start, Peer: peer1name, Free: 255}})
+	require.NoError(t, merge(ring2, ring1))
+	assertRing(ring1, []*entry{{Token: start, Peer: peer1name, Free: 256}})
+	assertRing(ring2, []*entry{{Token: start, Peer: peer1name, Free: 256}})
 }

 func assertPeersWithSpace(t *testing.T, ring *Ring, start, end address.Address, expected int) []mesh.PeerName {
@@ -358,7 +376,7 @@ func assertPeersWithSpace(t *testing.T, ring *Ring, start, end address.Address,
 }

 func TestFindFree(t *testing.T) {
-	ring1 := New(start, end, peer1name)
+	ring1 := NewRing(start, end, peer1name)

 	assertPeersWithSpace(t, ring1, start, end, 0)

@@ -366,7 +384,7 @@ func TestFindFree(t *testing.T) {
 	assertPeersWithSpace(t, ring1, start, end, 0)

 	// We shouldn't return outselves
-	ring1.ReportFree(map[address.Address]address.Offset{start: 10})
+	ring1.ReportFree(map[address.Address]address.Count{start: 10})
 	assertPeersWithSpace(t, ring1, start, end, 0)

 	ring1.Entries = []*entry{{Token: start, Peer: peer1name, Free: 1},
@@ -394,14 +412,14 @@ func TestFindFree(t *testing.T) {
 }

 func TestReportFree(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)

 	ring1.ClaimItAll()
 	ring1.GrantRangeToHost(middle, end, peer2name)
-	require.NoError(t, ring2.Merge(*ring1))
+	require.NoError(t, merge(ring2, ring1))

-	freespace := make(map[address.Address]address.Offset)
+	freespace := make(map[address.Address]address.Count)
 	for _, r := range ring2.OwnedRanges() {
 		freespace[r.Start] = 0
 	}
@@ -409,7 +427,7 @@ func TestReportFree(t *testing.T) {
 }

 func TestMisc(t *testing.T) {
-	ring := New(start, end, peer1name)
+	ring := NewRing(start, end, peer1name)

 	require.True(t, ring.Empty(), "empty")

@@ -418,38 +436,38 @@ func TestMisc(t *testing.T) {
 }

 func TestEmptyGossip(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)

 	ring1.ClaimItAll()
 	// This used to panic, and it shouldn't
-	require.NoError(t, ring1.Merge(*ring2))
+	require.NoError(t, merge(ring1, ring2))
 }

 func TestMergeOldMessage(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)

 	ring1.ClaimItAll()
-	require.NoError(t, ring2.Merge(*ring1))
+	require.NoError(t, merge(ring2, ring1))

 	ring1.GrantRangeToHost(middle, end, peer1name)
-	require.NoError(t, ring1.Merge(*ring2))
+	require.NoError(t, merge(ring1, ring2))
 }

 func TestSplitRangeAtBeginning(t *testing.T) {
-	ring1 := New(start, end, peer1name)
-	ring2 := New(start, end, peer2name)
+	ring1 := NewRing(start, end, peer1name)
+	ring2 := NewRing(start, end, peer2name)

 	ring1.ClaimItAll()
-	require.NoError(t, ring2.Merge(*ring1))
+	require.NoError(t, merge(ring2, ring1))

 	ring1.GrantRangeToHost(start, middle, peer2name)
-	require.NoError(t, ring2.Merge(*ring1))
+	require.NoError(t, merge(ring2, ring1))
 }

 func TestOwnedRange(t *testing.T) {
-	ring1 := New(start, end, peer1name)
+	ring1 := NewRing(start, end, peer1name)
 	ring1.ClaimItAll()

 	require.Equal(t, []address.Range{{Start: start, End: end}}, ring1.OwnedRanges())
@@ -457,8 +475,8 @@ func TestOwnedRange(t *testing.T) {
 	ring1.GrantRangeToHost(middle, end, peer2name)
 	require.Equal(t, []address.Range{{Start: start, End: middle}}, ring1.OwnedRanges())

-	ring2 := New(start, end, peer2name)
-	ring2.Merge(*ring1)
+	ring2 := NewRing(start, end, peer2name)
+	merge(ring2, ring1)
 	require.Equal(t, []address.Range{{Start: middle, End: end}}, ring2.OwnedRanges())

 	ring2.Entries = []*entry{{Token: middle, Peer: peer2name}}
@@ -472,7 +490,7 @@ func TestOwnedRange(t *testing.T) {

 func TestTransfer(t *testing.T) {
 	// First test just checks if we can grant some range to a host, when we transfer it, we get it back
-	ring1 := New(start, end, peer1name)
+	ring1 := NewRing(start, end, peer1name)
 	ring1.ClaimItAll()
 	ring1.GrantRangeToHost(middle, end, peer2name)
 	ring1.Transfer(peer2name, peer1name)
@@ -480,7 +498,7 @@ func TestTransfer(t *testing.T) {

 	// Second test is what happens when a token exists at the end of a range but is transferred
 	// - does it get resurrected correctly?
-	ring1 = New(start, end, peer1name)
+	ring1 = NewRing(start, end, peer1name)
 	ring1.ClaimItAll()
 	ring1.GrantRangeToHost(middle, end, peer2name)
 	ring1.Transfer(peer2name, peer1name)
@@ -489,7 +507,7 @@ func TestTransfer(t *testing.T) {
 }

 func TestOwner(t *testing.T) {
-	ring1 := New(start, end, peer1name)
+	ring1 := NewRing(start, end, peer1name)
 	require.True(t, ring1.Contains(start), "start should be in ring")
 	require.False(t, ring1.Contains(end), "end should not be in ring")

@@ -505,6 +523,36 @@ func TestOwner(t *testing.T) {

 }

+func makePeerName(i int) mesh.PeerName {
+	if i >= 10000 {
+		panic("makePeerName: invalid value")
+	}
+	peer, _ := mesh.PeerNameFromString(fmt.Sprintf("%02d:%02d:00:00:00:ff", i/100, i%100))
+	return peer
+}
+
+func makePeers(numPeers int) []mesh.PeerName {
+	peers := make([]mesh.PeerName, numPeers)
+	for i := 0; i < numPeers; i++ {
+		peers[i] = makePeerName(i)
+	}
+	return peers
+}
+
+func TestClaimForPeers(t *testing.T) {
+	const numPeers = 12
+	// Different end to usual so we get a number of addresses that a)
+	// is smaller than the max number of peers, and b) is divisible by
+	// some number of peers. This maximises coverage of edge cases.
+	end := dot8
+	peers := makePeers(numPeers)
+	// Test for a range of peer counts
+	for i := 0; i < numPeers; i++ {
+		ring := NewRing(start, end, peers[0])
+		ring.ClaimForPeers(peers[:i+1])
+	}
+}
+
 type addressSlice []address.Address

 func (s addressSlice) Len() int           { return len(s) }
@@ -519,8 +567,7 @@ func TestFuzzRing(t *testing.T) {

 	peers := make([]mesh.PeerName, numPeers)
 	for i := 0; i < numPeers; i++ {
-		peer, _ := mesh.PeerNameFromString(fmt.Sprintf("%02d:00:00:00:02:00", i))
-		peers[i] = peer
+		peers[i] = makePeerName(i)
 	}

 	// Make a valid, random ring
@@ -539,7 +586,7 @@ func TestFuzzRing(t *testing.T) {
 		sort.Sort(addressSlice(tokens))

 		peer := peers[rand.Intn(len(peers))]
-		ring := New(start, end, peer)
+		ring := NewRing(start, end, peer)
 		for _, token := range tokens {
 			peer = peers[rand.Intn(len(peers))]
 			ring.Entries = append(ring.Entries, &entry{Token: start + token, Peer: peer})
@@ -556,7 +603,7 @@ func TestFuzzRing(t *testing.T) {

 		// Merge them - this might fail, we don't care
 		// We just want to make sure it doesn't panic
-		ring1.Merge(*ring2)
+		merge(ring1, ring2)

 		// Check whats left still passes assertions
 		ring1.assertInvariants()
@@ -573,7 +620,7 @@ func TestFuzzRing(t *testing.T) {
 		}

 		peer := peers[rand.Intn(len(peers))]
-		ring := New(start, end, peer)
+		ring := NewRing(start, end, peer)
 		for _, token := range tokens {
 			peer = peers[rand.Intn(len(peers))]
 			ring.Entries = append(ring.Entries, &entry{Token: start + token, Peer: peer})
@@ -589,7 +636,7 @@ func TestFuzzRing(t *testing.T) {

 		// Merge them - this might fail, we don't care
 		// We just want to make sure it doesn't panic
-		ring1.Merge(*ring2)
+		merge(ring1, ring2)

 		// Check whats left still passes assertions
 		ring1.assertInvariants()
@@ -607,11 +654,11 @@ func TestFuzzRingHard(t *testing.T) {
 	)

 	addPeer := func() {
-		peer, _ := mesh.PeerNameFromString(fmt.Sprintf("%02d:%02d:00:00:00:00", nextPeerID/10, nextPeerID%10))
+		peer := makePeerName(nextPeerID)
 		common.Log.Debugf("%s: Adding peer", peer)
 		nextPeerID++
 		peers = append(peers, peer)
-		rings = append(rings, New(start, end, peer))
+		rings = append(rings, NewRing(start, end, peer))
 	}

 	for i := 0; i < numPeers; i++ {
@@ -650,7 +697,7 @@ func TestFuzzRingHard(t *testing.T) {

 		// We need to be in a ~converged ring to rmpeer
 		for _, ring := range rings {
-			require.NoError(t, otherRing.Merge(*ring))
+			require.NoError(t, merge(otherRing, ring))
 		}

 		common.Log.Debugf("%s: transferring from peer %s", otherPeername, peername)
@@ -664,7 +711,7 @@ func TestFuzzRingHard(t *testing.T) {
 		// And now tell everyone about the transfer - rmpeer is
 		// not partition safe
 		for i, ring := range rings {
-			require.NoError(t, ring.Merge(*otherRing))
+			require.NoError(t, merge(ring, otherRing))
 			theRanges[i] = ring.OwnedRanges()
 		}
 	}
@@ -693,7 +740,7 @@ func TestFuzzRingHard(t *testing.T) {
 			// Now 'gossip' this to a random host (note, note could be same host as above)
 			otherIndex, _, otherRing := randomPeer(-1)
 			common.Log.Debugf("%s: 'Gossiping' to %s", ring.Peer, otherRing.Peer)
-			require.NoError(t, otherRing.Merge(*ring))
+			require.NoError(t, merge(otherRing, ring))

 			theRanges[indexWithRanges] = ring.OwnedRanges()
 			theRanges[otherIndex] = otherRing.OwnedRanges()
@@ -712,7 +759,7 @@ func TestFuzzRingHard(t *testing.T) {
 		ring1 := ringsWithEntries[rand.Intn(len(ringsWithEntries))]
 		ring2index, _, ring2 := randomPeer(-1)
 		common.Log.Debugf("%s: 'Gossiping' to %s", ring1.Peer, ring2.Peer)
-		require.NoError(t, ring2.Merge(*ring1))
+		require.NoError(t, merge(ring2, ring1))
 		theRanges[ring2index] = ring2.OwnedRanges()
 	}

@@ -31,8 +31,8 @@ func (s *Space) Add(start address.Address, size address.Offset) {

 // Clear removes all spaces from this space set.  Used during node shutdown.
 func (s *Space) Clear() {
-	s.free = s.free[:0]
 	s.ours = s.ours[:0]
+	s.free = s.free[:0]
 }

 // Walk down the free list calling f() on the in-range portions, until
@@ -88,8 +88,16 @@ func (s *Space) Claim(addr address.Address) error {
 	return nil
 }

-func (s *Space) NumFreeAddressesInRange(r address.Range) address.Offset {
-	res := address.Offset(0)
+func (s *Space) NumFreeAddresses() address.Count {
+	res := address.Count(0)
+	for i := 0; i < len(s.free); i += 2 {
+		res += address.Length(s.free[i+1], s.free[i])
+	}
+	return res
+}
+
+func (s *Space) NumFreeAddressesInRange(r address.Range) address.Count {
+	res := address.Count(0)
 	s.walkFree(r, func(chunk address.Range) bool {
 		res += chunk.Size()
 		return false
@@ -111,11 +119,14 @@ func (s *Space) Free(addr address.Address) error {
 }

 func (s *Space) biggestFreeRange(r address.Range) (biggest address.Range) {
-	biggestSize := address.Offset(0)
+	biggestSize := address.Count(0)
 	s.walkFree(r, func(chunk address.Range) bool {
 		if size := chunk.Size(); size >= biggestSize {
-			biggest = chunk
-			biggestSize = size
+			chunk = chunk.BiggestCIDRRange()
+			if size = chunk.Size(); size >= biggestSize {
+				biggest = chunk
+				biggestSize = size
+			}
 		}
 		return false
 	})
@@ -129,9 +140,12 @@ func (s *Space) Donate(r address.Range) (address.Range, bool) {
 		return address.Range{}, false
 	}

-	// Donate half of that biggest free range. Note size/2 rounds down, so
-	// the resulting donation size rounds up, and in particular can't be empty.
-	biggest.Start = address.Add(biggest.Start, biggest.Size()/2)
+	// Donate no more than half what we have available
+	if biggest.Size() > s.NumFreeAddressesInRange(r)/2 {
+		// Note size/2 rounds down, so the resulting donation size
+		// rounds up, and in particular can't be empty.
+		biggest.Start = address.Add(biggest.Start, address.Offset(biggest.Size()/2))
+	}

 	s.ours = subtract(s.ours, biggest.Start, biggest.End)
 	s.free = subtract(s.free, biggest.Start, biggest.End)
@@ -19,16 +19,6 @@ func ip(s string) address.Address {
 	return addr
 }

-// Helper function to avoid 'NumFreeAddressesInRange(start, end)'
-// dozens of times in tests
-func (s *Space) NumFreeAddresses() address.Offset {
-	res := address.Offset(0)
-	for i := 0; i < len(s.free); i += 2 {
-		res += address.Subtract(s.free[i+1], s.free[i])
-	}
-	return res
-}
-
 func TestLowlevel(t *testing.T) {
 	a := []address.Address{}
 	a = add(a, 100, 200)
@@ -61,24 +51,24 @@ func TestLowlevel(t *testing.T) {
 	require.Equal(t, []address.Address{}, a)

 	s := New()
-	require.Equal(t, address.Offset(0), s.NumFreeAddresses())
+	require.Equal(t, address.Count(0), s.NumFreeAddresses())
 	ok, got := s.Allocate(address.NewRange(0, 1000))
 	require.False(t, ok, "allocate in empty space should fail")

 	s.Add(100, 100)
-	require.Equal(t, address.Offset(100), s.NumFreeAddresses())
+	require.Equal(t, address.Count(100), s.NumFreeAddresses())
 	ok, got = s.Allocate(address.NewRange(0, 1000))
 	require.True(t, ok && got == 100, "allocate")
-	require.Equal(t, address.Offset(99), s.NumFreeAddresses())
+	require.Equal(t, address.Count(99), s.NumFreeAddresses())
 	require.NoError(t, s.Claim(150))
-	require.Equal(t, address.Offset(98), s.NumFreeAddresses())
+	require.Equal(t, address.Count(98), s.NumFreeAddresses())
 	require.NoError(t, s.Free(100))
-	require.Equal(t, address.Offset(99), s.NumFreeAddresses())
+	require.Equal(t, address.Count(99), s.NumFreeAddresses())
 	wt.AssertErrorInterface(t, (*error)(nil), s.Free(0), "free not allocated")
 	wt.AssertErrorInterface(t, (*error)(nil), s.Free(100), "double free")

 	r, ok := s.Donate(address.NewRange(0, 1000))
-	require.True(t, ok && r.Start == 125 && r.Size() == 25, "donate")
+	require.Equal(t, address.NewRange(0xa0, 0x20), r, "donate")

 	// test Donate when addresses are scarce
 	s = New()
@@ -88,7 +78,7 @@ func TestLowlevel(t *testing.T) {
 	require.NoError(t, s.Claim(0))
 	require.NoError(t, s.Claim(2))
 	r, ok = s.Donate(address.NewRange(0, 1000))
-	require.True(t, ok && r.Start == 1 && r.End == 2, "donate")
+	require.Equal(t, address.NewRange(1, 1), r, "donate")
 	r, ok = s.Donate(address.NewRange(0, 1000))
 	require.True(t, !ok, "donate should fail")
 }
@@ -107,19 +97,19 @@ func TestSpaceAllocate(t *testing.T) {
 	)

 	space1 := makeSpace(start, size)
-	require.Equal(t, address.Offset(20), space1.NumFreeAddresses())
+	require.Equal(t, address.Count(20), space1.NumFreeAddresses())
 	space1.assertInvariants()

 	_, addr1 := space1.Allocate(address.NewRange(start, size))
 	require.Equal(t, testAddr1, addr1.String(), "address")
-	require.Equal(t, address.Offset(19), space1.NumFreeAddresses())
+	require.Equal(t, address.Count(19), space1.NumFreeAddresses())
 	space1.assertInvariants()

 	_, addr2 := space1.Allocate(address.NewRange(start, size))
 	require.False(t, addr2.String() == testAddr1, "address")
-	require.Equal(t, address.Offset(18), space1.NumFreeAddresses())
-	require.Equal(t, address.Offset(13), space1.NumFreeAddressesInRange(address.Range{Start: ip(testAddr1), End: ip(testAddrx)}))
-	require.Equal(t, address.Offset(18), space1.NumFreeAddressesInRange(address.Range{Start: ip(testAddr1), End: ip(testAddry)}))
+	require.Equal(t, address.Count(18), space1.NumFreeAddresses())
+	require.Equal(t, address.Count(13), space1.NumFreeAddressesInRange(address.Range{Start: ip(testAddr1), End: ip(testAddrx)}))
+	require.Equal(t, address.Count(18), space1.NumFreeAddressesInRange(address.Range{Start: ip(testAddr1), End: ip(testAddry)}))
 	space1.assertInvariants()

 	space1.Free(addr2)
@@ -134,20 +124,21 @@ func TestSpaceAllocate(t *testing.T) {

 func TestSpaceFree(t *testing.T) {
 	const (
-		testAddr1   = "10.0.3.4"
+		testAddr1   = "10.0.3.16"
 		testAddrx   = "10.0.3.19"
 		testAddry   = "10.0.9.19"
 		containerID = "deadbeef"
+		size        = 16
 	)

-	entireRange := address.NewRange(ip(testAddr1), 20)
-	space := makeSpace(ip(testAddr1), 20)
+	entireRange := address.NewRange(ip(testAddr1), size)
+	space := makeSpace(ip(testAddr1), size)

 	// Check we are prepared to give up the entire space
 	r := space.biggestFreeRange(entireRange)
-	require.True(t, r.Start == ip(testAddr1) && r.Size() == 20, "Wrong space")
+	require.Equal(t, address.NewRange(ip(testAddr1), size), r, "Wrong space")

-	for i := 0; i < 20; i++ {
+	for i := 0; i < size; i++ {
 		ok, _ := space.Allocate(entireRange)
 		require.True(t, ok, "Failed to get address")
 	}
@@ -155,48 +146,48 @@ func TestSpaceFree(t *testing.T) {
 	// Check we are full
 	ok, _ := space.Allocate(entireRange)
 	require.True(t, !ok, "Should have failed to get address")
-	r, ok = space.Donate(entireRange)
+	r, _ = space.Donate(entireRange)
 	require.True(t, r.Size() == 0, "Wrong space")

 	// Free in the middle
-	require.NoError(t, space.Free(ip("10.0.3.13")))
-	r = space.biggestFreeRange(entireRange)
-	require.True(t, r.Start == ip("10.0.3.13") && r.Size() == 1, "Wrong space")
-
-	// Free one at the end
 	require.NoError(t, space.Free(ip("10.0.3.23")))
 	r = space.biggestFreeRange(entireRange)
 	require.True(t, r.Start == ip("10.0.3.23") && r.Size() == 1, "Wrong space")

+	// Free one at the end
+	require.NoError(t, space.Free(ip("10.0.3.31")))
+	r = space.biggestFreeRange(entireRange)
+	require.True(t, r.Start == ip("10.0.3.31") && r.Size() == 1, "Wrong space")
+
 	// Now free a few at the end
+	require.NoError(t, space.Free(ip("10.0.3.30")))
+	require.NoError(t, space.Free(ip("10.0.3.29")))
+
+	require.Equal(t, address.Count(4), space.NumFreeAddresses())
+
+	// Now get the biggest free space; should be 3.30
+	r = space.biggestFreeRange(entireRange)
+	require.Equal(t, address.NewRange(ip("10.0.3.30"), 2), r, "Wrong space")
+
+	// Now free a few in the middle
+	require.NoError(t, space.Free(ip("10.0.3.24")))
 	require.NoError(t, space.Free(ip("10.0.3.22")))
 	require.NoError(t, space.Free(ip("10.0.3.21")))

-	require.Equal(t, address.Offset(4), space.NumFreeAddresses())
+	require.Equal(t, address.Count(7), space.NumFreeAddresses())

-	// Now get the biggest free space; should be 3.21
+	// Now get the biggest free space; should be 3.30
 	r = space.biggestFreeRange(entireRange)
-	require.True(t, r.Start == ip("10.0.3.21") && r.Size() == 3, "Wrong space")
+	require.Equal(t, address.NewRange(ip("10.0.3.30"), 2), r, "Wrong space")

-	// Now free a few in the middle
-	require.NoError(t, space.Free(ip("10.0.3.12")))
-	require.NoError(t, space.Free(ip("10.0.3.11")))
-	require.NoError(t, space.Free(ip("10.0.3.10")))
-
-	require.Equal(t, address.Offset(7), space.NumFreeAddresses())
-
-	// Now get the biggest free space; should be 3.21
-	r = space.biggestFreeRange(entireRange)
-	require.True(t, r.Start == ip("10.0.3.10") && r.Size() == 4, "Wrong space")
-
-	require.Equal(t, []address.Range{{Start: ip("10.0.3.4"), End: ip("10.0.3.24")}}, space.OwnedRanges())
+	require.Equal(t, []address.Range{{Start: ip("10.0.3.16"), End: ip("10.0.3.32")}}, space.OwnedRanges())
 }

 func TestDonateSimple(t *testing.T) {
 	const (
 		testAddr1 = "10.0.1.0"
 		testAddr2 = "10.0.1.32"
-		size      = 48
+		size      = 64
 	)

 	var (
@@ -209,9 +200,9 @@ func TestDonateSimple(t *testing.T) {
 	r, ok := ps1.Donate(address.NewRange(ip(testAddr1), size))
 	numGivenUp := r.Size()
 	require.True(t, ok, "Donate result")
-	require.Equal(t, "10.0.1.24", r.Start.String(), "Invalid start")
-	require.Equal(t, address.Offset(size/2), numGivenUp)
-	require.Equal(t, address.Offset(size/2), ps1.NumFreeAddresses())
+	require.Equal(t, "10.0.1.32", r.Start.String(), "Invalid start")
+	require.Equal(t, address.Count(size/2), numGivenUp)
+	require.Equal(t, address.Count(size/2), ps1.NumFreeAddresses())

 	// Now check we can give the rest up.
 	count := 0 // count to avoid infinite loop
@@ -222,8 +213,8 @@ func TestDonateSimple(t *testing.T) {
 		}
 		numGivenUp += r.Size()
 	}
-	require.Equal(t, address.Offset(0), ps1.NumFreeAddresses())
-	require.Equal(t, address.Offset(size), numGivenUp)
+	require.Equal(t, address.Count(0), ps1.NumFreeAddresses())
+	require.Equal(t, address.Count(size), numGivenUp)
 }

 func TestDonateHard(t *testing.T) {
@@ -240,7 +231,7 @@ func TestDonateHard(t *testing.T) {
 		require.True(t, ok, "Failed to get IP!")
 	}

-	require.Equal(t, address.Offset(0), spaceset.NumFreeAddresses())
+	require.Equal(t, address.Count(0), spaceset.NumFreeAddresses())

 	// Now free all but the last address
 	// this will force us to split the free list
@@ -251,13 +242,13 @@ func TestDonateHard(t *testing.T) {
 	// Now split
 	newRange, ok := spaceset.Donate(address.NewRange(start, size))
 	require.True(t, ok, "GiveUpSpace result")
-	require.Equal(t, ip("10.0.1.23"), newRange.Start)
-	require.Equal(t, address.Offset(24), newRange.Size())
-	require.Equal(t, address.Offset(23), spaceset.NumFreeAddresses())
+	require.Equal(t, address.NewRange(ip("10.0.1.16"), 16), newRange, "Wrong space")
+	require.Equal(t, address.Count(31), spaceset.NumFreeAddresses())

-	//Space set should now have 2 spaces
-	expected := New()
-	expected.Add(start, 23)
-	expected.ours = add(nil, ip("10.0.1.47"), ip("10.0.1.48"))
+	//Space set should now have 3 spaces
+	expected := &Space{
+		ours: add(nil, ip("10.0.1.47"), ip("10.0.1.48")),
+		free: add(add(nil, ip("10.0.1.0"), ip("10.0.1.16")), ip("10.0.1.32"), ip("10.0.1.47")),
+	}
 	require.Equal(t, expected, spaceset)
 }
@@ -26,8 +26,8 @@ type EntryStatus struct {
 }

 type ClaimStatus struct {
-	Ident   string
-	Address address.Address
+	Ident string
+	CIDR  address.CIDR
 }

 func NewStatus(allocator *Allocator, defaultSubnet address.CIDR) *Status {
@@ -36,8 +36,14 @@ func NewStatus(allocator *Allocator, defaultSubnet address.CIDR) *Status {
 	}

 	var paxosStatus *paxos.Status
-	if allocator.paxosTicker != nil {
-		paxosStatus = paxos.NewStatus(allocator.paxos)
+	if allocator.awaitingConsensus && allocator.paxos != nil {
+		if allocator.paxos.IsElector() {
+			if node, ok := allocator.paxos.(*paxos.Node); ok {
+				paxosStatus = paxos.NewStatus(node)
+			}
+		} else {
+			paxosStatus = &paxos.Status{Elector: false}
+		}
 	}

 	resultChan := make(chan *Status)
@@ -80,7 +86,7 @@ func newClaimStatusSlice(allocator *Allocator) []ClaimStatus {
 	var slice []ClaimStatus
 	for _, op := range allocator.pendingClaims {
 		claim := op.(*claim)
-		slice = append(slice, ClaimStatus{claim.ident, claim.addr})
+		slice = append(slice, ClaimStatus{claim.ident, claim.cidr})
 	}
 	return slice
 }
@@ -7,8 +7,9 @@ import (
 	"testing"
 	"time"

+	"github.com/weaveworks/mesh"
+
 	"github.com/stretchr/testify/require"
-	"github.com/weaveworks/weave/mesh"
 	"github.com/weaveworks/weave/net/address"
 	"github.com/weaveworks/weave/testing/gossip"
 )
@@ -48,7 +49,7 @@ func (m *mockGossipComms) String() string {
 // that the contents of messages are never re-ordered.  Which, for instance,
 // requires they are not based off iterating through a map.

-func (m *mockGossipComms) GossipBroadcast(update mesh.GossipData) error {
+func (m *mockGossipComms) GossipBroadcast(update mesh.GossipData) {
 	m.Lock()
 	defer m.Unlock()
 	buf := []byte{}
@@ -62,7 +63,6 @@ func (m *mockGossipComms) GossipBroadcast(update mesh.GossipData) error {
 		// Swallow this message
 		m.messages = m.messages[1:]
 	}
-	return nil
 }

 func equalByteBuffer(a, b []byte) bool {
@@ -123,24 +123,35 @@ func CheckAllExpectedMessagesSent(allocs ...*Allocator) {
 	}
 }

-func makeAllocator(name string, cidrStr string, quorum uint) (*Allocator, address.Range) {
+type mockDB struct{}
+
+func (d *mockDB) Load(_ string, _ interface{}) (bool, error) { return false, nil }
+func (d *mockDB) Save(_ string, _ interface{}) error         { return nil }
+
+func makeAllocator(name string, cidrStr string, quorum uint) (*Allocator, address.CIDR) {
 	peername, err := mesh.PeerNameFromString(name)
 	if err != nil {
 		panic(err)
 	}

-	_, cidr, err := address.ParseCIDR(cidrStr)
+	cidr, err := address.ParseCIDR(cidrStr)
 	if err != nil {
 		panic(err)
 	}

-	alloc := NewAllocator(peername, mesh.PeerUID(rand.Int63()),
-		"nick-"+name, cidr.Range(), quorum, func(mesh.PeerName) bool { return true })
-
-	return alloc, cidr.HostRange()
+	return NewAllocator(Config{
+		OurName:     peername,
+		OurUID:      mesh.PeerUID(rand.Int63()),
+		OurNickname: "nick-" + name,
+		Universe:    cidr,
+		IsObserver:  quorum == 0,
+		Quorum:      func() uint { return quorum },
+		Db:          new(mockDB),
+		IsKnownPeer: func(mesh.PeerName) bool { return true },
+	}), cidr
 }

-func makeAllocatorWithMockGossip(t *testing.T, name string, universeCIDR string, quorum uint) (*Allocator, address.Range) {
+func makeAllocatorWithMockGossip(t *testing.T, name string, universeCIDR string, quorum uint) (*Allocator, address.CIDR) {
 	alloc, subnet := makeAllocator(name, universeCIDR, quorum)
 	gossip := &mockGossipComms{T: t, name: name}
 	alloc.SetInterfaces(gossip)
@@ -157,14 +168,22 @@ func (alloc *Allocator) claimRingForTesting(allocs ...*Allocator) {
 	alloc.space.AddRanges(alloc.ring.OwnedRanges())
 }

-func (alloc *Allocator) NumFreeAddresses(r address.Range) address.Offset {
-	resultChan := make(chan address.Offset)
+func (alloc *Allocator) NumFreeAddresses(r address.Range) address.Count {
+	resultChan := make(chan address.Count)
 	alloc.actionChan <- func() {
 		resultChan <- alloc.space.NumFreeAddressesInRange(r)
 	}
 	return <-resultChan
 }

+func (alloc *Allocator) OwnedRanges() (result []address.Range) {
+	resultChan := make(chan []address.Range)
+	alloc.actionChan <- func() {
+		resultChan <- alloc.ring.OwnedRanges()
+	}
+	return <-resultChan
+}
+
 // Check whether or not something was sent on a channel
 func AssertSent(t *testing.T, ch <-chan bool) {
 	timeout := time.After(10 * time.Second)
@@ -194,10 +213,10 @@ func AssertNothingSentErr(t *testing.T, ch <-chan error) {
 	}
 }

-func makeNetworkOfAllocators(size int, cidr string) ([]*Allocator, *gossip.TestRouter, address.Range) {
+func makeNetworkOfAllocators(size int, cidr string) ([]*Allocator, *gossip.TestRouter, address.CIDR) {
 	gossipRouter := gossip.NewTestRouter(0.0)
 	allocs := make([]*Allocator, size)
-	var subnet address.Range
+	var subnet address.CIDR

 	for i := 0; i < size; i++ {
 		var alloc *Allocator
@@ -213,7 +232,10 @@ func makeNetworkOfAllocators(size int, cidr string) ([]*Allocator, *gossip.TestR
 	return allocs, gossipRouter, subnet
 }

-func stopNetworkOfAllocators(allocs []*Allocator) {
+func stopNetworkOfAllocators(allocs []*Allocator, gossipRouter *gossip.TestRouter) {
+	// NB: We must stop the router first since ipam gossip makes
+	// synchronous calls into the allocator.
+	gossipRouter.Stop()
 	for _, alloc := range allocs {
 		alloc.Stop()
 	}
@@ -0,0 +1,286 @@
+package tracker
+
+// The AWSVPC tracker tracks the IPAM ring changes and accordingly updates
+// the AWS VPC route table and, if the announced change is local
+// (denoted by local=true) to the host, the host route table.
+//
+// During the initialization, the tracker detects AWS VPC route table id which
+// is associated with the host's subnet on the AWS network. If such a table does
+// not exist, the default VPC route table is used.
+//
+// When a host A donates a range to a host B, the necessary route table
+// updates (removal) happen on the host A first, and afterwards on
+// the host B (installation).
+//
+// NB: there is a hard limit for 50 routes within any VPC route table
+// (practically, it is 48, because one route is used by the AWS Internet GW and
+// one by the AWS host subnet), therefore it is suggested to avoid
+// an excessive fragmentation within the IPAM ring which might happen due to
+// the claim operations or uneven distribution of containers across the hosts.
+
+import (
+	"fmt"
+	"net"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/ec2metadata"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/ec2"
+	"github.com/vishvananda/netlink"
+
+	"github.com/weaveworks/weave/common"
+	wnet "github.com/weaveworks/weave/net"
+	"github.com/weaveworks/weave/net/address"
+)
+
+type AWSVPCTracker struct {
+	ec2          *ec2.EC2
+	instanceID   string // EC2 Instance ID
+	routeTableID string // VPC Route Table ID
+	linkIndex    int    // The weave bridge link index
+}
+
+// NewAWSVPCTracker creates and initialises AWS VPC based tracker.
+func NewAWSVPCTracker() (*AWSVPCTracker, error) {
+	var (
+		err     error
+		session = session.New()
+		t       = &AWSVPCTracker{}
+	)
+
+	// Detect region and instance id
+	meta := ec2metadata.New(session)
+	t.instanceID, err = meta.GetMetadata("instance-id")
+	if err != nil {
+		return nil, fmt.Errorf("cannot detect instance-id: %s", err)
+	}
+	region, err := meta.Region()
+	if err != nil {
+		return nil, fmt.Errorf("cannot detect region: %s", err)
+	}
+
+	t.ec2 = ec2.New(session, aws.NewConfig().WithRegion(region))
+
+	routeTableID, err := t.detectRouteTableID()
+	if err != nil {
+		return nil, err
+	}
+	t.routeTableID = *routeTableID
+
+	// Detect Weave bridge link index
+	link, err := netlink.LinkByName(wnet.WeaveBridgeName)
+	if err != nil {
+		return nil, fmt.Errorf("cannot find \"%s\" interface: %s", wnet.WeaveBridgeName, err)
+	}
+	t.linkIndex = link.Attrs().Index
+
+	t.infof("AWSVPC has been initialized on %s instance for %s route table at %s region",
+		t.instanceID, t.routeTableID, region)
+
+	return t, nil
+}
+
+// HandleUpdate method updates the AWS VPC and the host route tables.
+func (t *AWSVPCTracker) HandleUpdate(prevRanges, currRanges []address.Range, local bool) error {
+	t.debugf("replacing %q by %q; local(%t)", prevRanges, currRanges, local)
+
+	prev, curr := removeCommon(address.NewCIDRs(merge(prevRanges)), address.NewCIDRs(merge(currRanges)))
+
+	// It might make sense to do the removal first and then add entries
+	// because of the 50 routes limit. However, in such case a container might
+	// not be reachable for a short period of time which is not a desired behavior.
+
+	// Add new entries
+	for _, cidr := range curr {
+		cidrStr := cidr.String()
+		t.debugf("adding route %s to %s", cidrStr, t.instanceID)
+		_, err := t.createVPCRoute(cidrStr)
+		if err != nil {
+			return fmt.Errorf("createVPCRoutes failed: %s", err)
+		}
+		if local {
+			err = t.createHostRoute(cidrStr)
+			if err != nil {
+				return fmt.Errorf("createHostRoute failed: %s", err)
+			}
+		}
+	}
+
+	// Remove obsolete entries
+	for _, cidr := range prev {
+		cidrStr := cidr.String()
+		t.debugf("removing %s route", cidrStr)
+		_, err := t.deleteVPCRoute(cidrStr)
+		if err != nil {
+			return fmt.Errorf("deleteVPCRoute failed: %s", err)
+		}
+		if local {
+			err = t.deleteHostRoute(cidrStr)
+			if err != nil {
+				return fmt.Errorf("deleteHostRoute failed: %s", err)
+			}
+		}
+	}
+
+	return nil
+}
+
+func (t *AWSVPCTracker) createVPCRoute(cidr string) (*ec2.CreateRouteOutput, error) {
+	route := &ec2.CreateRouteInput{
+		RouteTableId:         &t.routeTableID,
+		InstanceId:           &t.instanceID,
+		DestinationCidrBlock: &cidr,
+	}
+	return t.ec2.CreateRoute(route)
+}
+
+func (t *AWSVPCTracker) createHostRoute(cidr string) error {
+	dst, err := parseCIDR(cidr)
+	if err != nil {
+		return err
+	}
+	route := &netlink.Route{
+		LinkIndex: t.linkIndex,
+		Dst:       dst,
+		Scope:     netlink.SCOPE_LINK,
+	}
+	return netlink.RouteAdd(route)
+}
+
+func (t *AWSVPCTracker) deleteVPCRoute(cidr string) (*ec2.DeleteRouteOutput, error) {
+	route := &ec2.DeleteRouteInput{
+		RouteTableId:         &t.routeTableID,
+		DestinationCidrBlock: &cidr,
+	}
+	return t.ec2.DeleteRoute(route)
+}
+
+func (t *AWSVPCTracker) deleteHostRoute(cidr string) error {
+	dst, err := parseCIDR(cidr)
+	if err != nil {
+		return err
+	}
+	route := &netlink.Route{
+		LinkIndex: t.linkIndex,
+		Dst:       dst,
+		Scope:     netlink.SCOPE_LINK,
+	}
+	return netlink.RouteDel(route)
+}
+
+// detectRouteTableID detects AWS VPC Route Table ID of the given tracker instance.
+func (t *AWSVPCTracker) detectRouteTableID() (*string, error) {
+	instancesParams := &ec2.DescribeInstancesInput{
+		InstanceIds: []*string{aws.String(t.instanceID)},
+	}
+	instancesResp, err := t.ec2.DescribeInstances(instancesParams)
+	if err != nil {
+		return nil, fmt.Errorf("DescribeInstances failed: %s", err)
+	}
+	if len(instancesResp.Reservations) == 0 ||
+		len(instancesResp.Reservations[0].Instances) == 0 {
+		return nil, fmt.Errorf("cannot find %s instance within reservations", t.instanceID)
+	}
+	vpcID := instancesResp.Reservations[0].Instances[0].VpcId
+	subnetID := instancesResp.Reservations[0].Instances[0].SubnetId
+
+	// First try to find a routing table associated with the subnet of the instance
+	tablesParams := &ec2.DescribeRouteTablesInput{
+		Filters: []*ec2.Filter{
+			{
+				Name:   aws.String("association.subnet-id"),
+				Values: []*string{subnetID},
+			},
+		},
+	}
+	tablesResp, err := t.ec2.DescribeRouteTables(tablesParams)
+	if err != nil {
+		return nil, fmt.Errorf("DescribeRouteTables failed: %s", err)
+	}
+	if len(tablesResp.RouteTables) != 0 {
+		return tablesResp.RouteTables[0].RouteTableId, nil
+	}
+	// Fallback to the default routing table
+	tablesParams = &ec2.DescribeRouteTablesInput{
+		Filters: []*ec2.Filter{
+			{
+				Name:   aws.String("association.main"),
+				Values: []*string{aws.String("true")},
+			},
+			{
+				Name:   aws.String("vpc-id"),
+				Values: []*string{vpcID},
+			},
+		},
+	}
+	tablesResp, err = t.ec2.DescribeRouteTables(tablesParams)
+	if err != nil {
+		return nil, fmt.Errorf("DescribeRouteTables failed: %s", err)
+	}
+	if len(tablesResp.RouteTables) != 0 {
+		return tablesResp.RouteTables[0].RouteTableId, nil
+	}
+
+	return nil, fmt.Errorf("cannot find routetable for %s instance", t.instanceID)
+}
+
+func (t *AWSVPCTracker) debugf(fmt string, args ...interface{}) {
+	common.Log.Debugf("[tracker] "+fmt, args...)
+}
+
+func (t *AWSVPCTracker) infof(fmt string, args ...interface{}) {
+	common.Log.Infof("[tracker] "+fmt, args...)
+}
+
+// Helpers
+
+// merge merges adjacent range entries.
+// The given slice has to be sorted in increasing order.
+func merge(r []address.Range) []address.Range {
+	var merged []address.Range
+
+	for i := range r {
+		if prev := len(merged) - 1; prev >= 0 && merged[prev].End == r[i].Start {
+			merged[prev].End = r[i].End
+		} else {
+			merged = append(merged, r[i])
+		}
+	}
+
+	return merged
+}
+
+// removeCommon filters out CIDR ranges which are contained in both a and b slices.
+// Both slices have to be sorted in increasing order.
+func removeCommon(a, b []address.CIDR) (newA, newB []address.CIDR) {
+	i, j := 0, 0
+
+	for i < len(a) && j < len(b) {
+		switch {
+		case a[i].Start() < b[j].Start() || a[i].End() < b[j].End():
+			newA = append(newA, a[i])
+			i++
+		case a[i].Start() > b[j].Start() || a[i].End() > b[j].End():
+			newB = append(newB, b[j])
+			j++
+		default:
+			i++
+			j++
+		}
+
+	}
+	newA = append(newA, a[i:]...)
+	newB = append(newB, b[j:]...)
+
+	return
+}
+
+func parseCIDR(cidr string) (*net.IPNet, error) {
+	ip, ipnet, err := net.ParseCIDR(cidr)
+	if err != nil {
+		return nil, err
+	}
+	ipnet.IP = ip
+
+	return ipnet, nil
+}
@@ -0,0 +1,52 @@
+package tracker
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/weaveworks/weave/net/address"
+)
+
+var (
+	r0to127     = cidr("10.0.0.0", "10.0.0.127")
+	r128to255   = cidr("10.0.0.128", "10.0.0.255")
+	r0to255     = cidr("10.0.0.0", "10.0.0.255")
+	r1dot0to255 = cidr("10.0.1.0", "10.0.1.255")
+	r2dot0to255 = cidr("10.0.2.0", "10.0.2.255")
+)
+
+func TestRemoveCommon(t *testing.T) {
+	a := []address.CIDR{r0to127, r1dot0to255}
+	b := []address.CIDR{r1dot0to255, r2dot0to255}
+	newA, newB := removeCommon(a, b)
+	require.Equal(t, []address.CIDR{r0to127}, newA)
+	require.Equal(t, []address.CIDR{r2dot0to255}, newB)
+}
+
+func TestMerge(t *testing.T) {
+	ranges := []address.Range{
+		r0to127.Range(),
+		r128to255.Range(),
+		r2dot0to255.Range(),
+	}
+	require.Equal(t, []address.Range{r0to255.Range(), r2dot0to255.Range()}, merge(ranges))
+}
+
+// Helper
+
+// TODO(mp) DRY with helpers of other tests.
+
+func ip(s string) address.Address {
+	addr, _ := address.ParseIP(s)
+	return addr
+}
+
+// [start; end]
+func cidr(start, end string) address.CIDR {
+	c := address.Range{Start: ip(start), End: ip(end) + 1}.CIDRs()
+	if len(c) != 1 {
+		panic("invalid cidr")
+	}
+	return c[0]
+}
@@ -0,0 +1,20 @@
+package tracker
+
+import (
+	"github.com/weaveworks/weave/net/address"
+)
+
+// LocalRangeTracker is an interface for tracking changes in the IPAM ring.
+type LocalRangeTracker interface {
+	// HandleUpdate is called whenever an address ring gets updated.
+	//
+	// prevRanges corresponds to ranges which were owned by a peer before
+	// a change in the ring, while currRanges to the ones which are currently
+	// owned by the peer.
+	// Both slices have to be sorted in increasing order.
+	// Adjacent ranges within each slice might appear as separate ranges.
+	//
+	// The local parameter indicates whether the ranges belong to the peer
+	// by which the method is called.
+	HandleUpdate(prevRanges, currRanges []address.Range, local bool) error
+}
@@ -1,460 +0,0 @@
-package mesh
-
-import (
-	"fmt"
-	"net"
-	"strconv"
-	"sync"
-	"time"
-)
-
-type Connection interface {
-	Local() *Peer
-	Remote() *Peer
-	RemoteTCPAddr() string
-	Outbound() bool
-	Established() bool
-	BreakTie(Connection) ConnectionTieBreak
-	Shutdown(error)
-	Log(args ...interface{})
-}
-
-type ConnectionTieBreak int
-
-const (
-	TieBreakWon ConnectionTieBreak = iota
-	TieBreakLost
-	TieBreakTied
-)
-
-var ErrConnectToSelf = fmt.Errorf("Cannot connect to ourself")
-
-type RemoteConnection struct {
-	local         *Peer
-	remote        *Peer
-	remoteTCPAddr string
-	outbound      bool
-	established   bool
-}
-
-type LocalConnection struct {
-	sync.RWMutex
-	RemoteConnection
-	TCPConn         *net.TCPConn
-	TrustRemote     bool // is remote on a trusted subnet?
-	TrustedByRemote bool // does remote trust us?
-	version         byte
-	tcpSender       TCPSender
-	SessionKey      *[32]byte
-	heartbeatTCP    *time.Ticker
-	Router          *Router
-	uid             uint64
-	actionChan      chan<- ConnectionAction
-	errorChan       chan<- error
-	finished        <-chan struct{} // closed to signal that actorLoop has finished
-	OverlayConn     OverlayConnection
-}
-
-type ConnectionAction func() error
-
-func NewRemoteConnection(from, to *Peer, tcpAddr string, outbound bool, established bool) *RemoteConnection {
-	return &RemoteConnection{
-		local:         from,
-		remote:        to,
-		remoteTCPAddr: tcpAddr,
-		outbound:      outbound,
-		established:   established,
-	}
-}
-
-func (conn *RemoteConnection) Local() *Peer                           { return conn.local }
-func (conn *RemoteConnection) Remote() *Peer                          { return conn.remote }
-func (conn *RemoteConnection) RemoteTCPAddr() string                  { return conn.remoteTCPAddr }
-func (conn *RemoteConnection) Outbound() bool                         { return conn.outbound }
-func (conn *RemoteConnection) Established() bool                      { return conn.established }
-func (conn *RemoteConnection) BreakTie(Connection) ConnectionTieBreak { return TieBreakTied }
-func (conn *RemoteConnection) Shutdown(error)                         {}
-
-func (conn *RemoteConnection) Log(args ...interface{}) {
-	log.Println(append(append([]interface{}{}, fmt.Sprintf("->[%s|%s]:", conn.remoteTCPAddr, conn.remote)), args...)...)
-}
-
-func (conn *RemoteConnection) ErrorLog(args ...interface{}) {
-	log.Errorln(append(append([]interface{}{}, fmt.Sprintf("->[%s|%s]:", conn.remoteTCPAddr, conn.remote)), args...)...)
-}
-
-// Does not return anything. If the connection is successful, it will
-// end up in the local peer's connections map.
-func StartLocalConnection(connRemote *RemoteConnection, tcpConn *net.TCPConn, router *Router, acceptNewPeer bool) {
-	if connRemote.local != router.Ourself.Peer {
-		log.Fatal("Attempt to create local connection from a peer which is not ourself")
-	}
-	actionChan := make(chan ConnectionAction, ChannelSize)
-	errorChan := make(chan error, 1)
-	finished := make(chan struct{})
-	conn := &LocalConnection{
-		RemoteConnection: *connRemote, // NB, we're taking a copy of connRemote here.
-		Router:           router,
-		TCPConn:          tcpConn,
-		TrustRemote:      router.Trusts(connRemote),
-		uid:              randUint64(),
-		actionChan:       actionChan,
-		errorChan:        errorChan,
-		finished:         finished}
-	go conn.run(actionChan, errorChan, finished, acceptNewPeer)
-}
-
-func (conn *LocalConnection) BreakTie(dupConn Connection) ConnectionTieBreak {
-	dupConnLocal := dupConn.(*LocalConnection)
-	// conn.uid is used as the tie breaker here, in the knowledge that
-	// both sides will make the same decision.
-	if conn.uid < dupConnLocal.uid {
-		return TieBreakWon
-	} else if dupConnLocal.uid < conn.uid {
-		return TieBreakLost
-	} else {
-		return TieBreakTied
-	}
-}
-
-func (conn *LocalConnection) Established() bool {
-	return conn.established
-}
-
-func (conn *LocalConnection) SendProtocolMsg(m ProtocolMsg) {
-	if err := conn.sendProtocolMsg(m); err != nil {
-		conn.Shutdown(err)
-	}
-}
-
-// ACTOR methods
-
-// NB: The conn.* fields are only written by the connection actor
-// process, which is the caller of the ConnectionAction funs. Hence we
-// do not need locks for reading, and only need write locks for fields
-// read by other processes.
-
-// Non-blocking.
-func (conn *LocalConnection) Shutdown(err error) {
-	// err should always be a real error, even if only io.EOF
-	if err == nil {
-		panic("nil error")
-	}
-
-	select {
-	case conn.errorChan <- err:
-	default:
-	}
-}
-
-// Send an actor request to the actorLoop, but don't block if
-// actorLoop has exited - see http://blog.golang.org/pipelines for
-// pattern
-func (conn *LocalConnection) sendAction(action ConnectionAction) {
-	select {
-	case conn.actionChan <- action:
-	case <-conn.finished:
-	}
-}
-
-// ACTOR server
-
-func (conn *LocalConnection) run(actionChan <-chan ConnectionAction, errorChan <-chan error, finished chan<- struct{}, acceptNewPeer bool) {
-	var err error // important to use this var and not create another one with 'err :='
-	defer func() { conn.shutdown(err) }()
-	defer close(finished)
-
-	conn.TCPConn.SetLinger(0)
-	intro, err := ProtocolIntroParams{
-		MinVersion: conn.Router.ProtocolMinVersion,
-		MaxVersion: ProtocolMaxVersion,
-		Features:   conn.makeFeatures(),
-		Conn:       conn.TCPConn,
-		Password:   conn.Router.Password,
-		Outbound:   conn.outbound,
-	}.DoIntro()
-	if err != nil {
-		return
-	}
-
-	conn.SessionKey = intro.SessionKey
-	conn.tcpSender = intro.Sender
-	conn.version = intro.Version
-
-	remote, err := conn.parseFeatures(intro.Features)
-	if err != nil {
-		return
-	}
-
-	if err = conn.registerRemote(remote, acceptNewPeer); err != nil {
-		return
-	}
-
-	conn.Log("connection ready; using protocol version", conn.version)
-
-	// only use negotiated session key for untrusted connections
-	var sessionKey *[32]byte
-	if conn.Untrusted() {
-		sessionKey = conn.SessionKey
-	}
-
-	params := OverlayConnectionParams{
-		RemotePeer:         conn.remote,
-		LocalAddr:          conn.TCPConn.LocalAddr().(*net.TCPAddr),
-		RemoteAddr:         conn.TCPConn.RemoteAddr().(*net.TCPAddr),
-		Outbound:           conn.outbound,
-		ConnUID:            conn.uid,
-		SessionKey:         sessionKey,
-		SendControlMessage: conn.sendOverlayControlMessage,
-		Features:           intro.Features,
-	}
-	if conn.OverlayConn, err = conn.Router.Overlay.PrepareConnection(params); err != nil {
-		return
-	}
-
-	// As soon as we do AddConnection, the new connection becomes
-	// visible to the packet routing logic.  So AddConnection must
-	// come after PrepareConnection
-	if err = conn.Router.Ourself.AddConnection(conn); err != nil {
-		return
-	}
-	conn.Router.ConnectionMaker.ConnectionCreated(conn)
-
-	// OverlayConnection confirmation comes after AddConnection,
-	// because only after that completes do we know the connection is
-	// valid: in particular that it is not a duplicate connection to
-	// the same peer. Overlay communication on a duplicate connection
-	// can cause problems such as tripping up overlay crypto at the
-	// other end due to data being decoded by the other connection. It
-	// is also generally wasteful to engage in any interaction with
-	// the remote on a connection that turns out to be invalid.
-	conn.OverlayConn.Confirm()
-
-	// receiveTCP must follow also AddConnection. In the absence
-	// of any indirect connectivity to the remote peer, the first
-	// we hear about it (and any peers reachable from it) is
-	// through topology gossip it sends us on the connection. We
-	// must ensure that the connection has been added to Ourself
-	// prior to processing any such gossip, otherwise we risk
-	// immediately gc'ing part of that newly received portion of
-	// the topology (though not the remote peer itself, since that
-	// will have a positive ref count), leaving behind dangling
-	// references to peers. Hence we must invoke AddConnection,
-	// which is *synchronous*, first.
-	conn.heartbeatTCP = time.NewTicker(TCPHeartbeat)
-	go conn.receiveTCP(intro.Receiver)
-
-	// AddConnection must precede actorLoop. More precisely, it
-	// must precede shutdown, since that invokes DeleteConnection
-	// and is invoked on termination of this entire
-	// function. Essentially this boils down to a prohibition on
-	// running AddConnection in a separate goroutine, at least not
-	// without some synchronisation. Which in turn requires the
-	// launching of the receiveTCP goroutine to precede actorLoop.
-	err = conn.actorLoop(actionChan, errorChan)
-}
-
-func (conn *LocalConnection) makeFeatures() map[string]string {
-	features := map[string]string{
-		"PeerNameFlavour": PeerNameFlavour,
-		"Name":            conn.local.Name.String(),
-		"NickName":        conn.local.NickName,
-		"ShortID":         fmt.Sprint(conn.local.ShortID),
-		"UID":             fmt.Sprint(conn.local.UID),
-		"ConnID":          fmt.Sprint(conn.uid),
-		"Trusted":         fmt.Sprint(conn.TrustRemote),
-	}
-	conn.Router.Overlay.AddFeaturesTo(features)
-	return features
-}
-
-type features map[string]string
-
-func (features features) MustHave(keys []string) error {
-	for _, key := range keys {
-		if _, ok := features[key]; !ok {
-			return fmt.Errorf("Field %s is missing", key)
-		}
-	}
-	return nil
-}
-
-func (features features) Get(key string) string {
-	return features[key]
-}
-
-func (conn *LocalConnection) parseFeatures(features features) (*Peer, error) {
-	if err := features.MustHave([]string{"PeerNameFlavour", "Name", "NickName", "UID", "ConnID"}); err != nil {
-		return nil, err
-	}
-
-	remotePeerNameFlavour := features.Get("PeerNameFlavour")
-	if remotePeerNameFlavour != PeerNameFlavour {
-		return nil, fmt.Errorf("Peer name flavour mismatch (ours: '%s', theirs: '%s')", PeerNameFlavour, remotePeerNameFlavour)
-	}
-
-	name, err := PeerNameFromString(features.Get("Name"))
-	if err != nil {
-		return nil, err
-	}
-
-	nickName := features.Get("NickName")
-
-	var shortID uint64
-	var hasShortID bool
-	if shortIDStr, present := features["ShortID"]; present {
-		hasShortID = true
-		shortID, err = strconv.ParseUint(shortIDStr, 10, PeerShortIDBits)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	var trusted bool
-	if trustedStr, present := features["Trusted"]; present {
-		trusted, err = strconv.ParseBool(trustedStr)
-		if err != nil {
-			return nil, err
-		}
-	}
-	conn.TrustedByRemote = trusted
-
-	uid, err := ParsePeerUID(features.Get("UID"))
-	if err != nil {
-		return nil, err
-	}
-
-	remoteConnID, err := strconv.ParseUint(features.Get("ConnID"), 10, 64)
-	if err != nil {
-		return nil, err
-	}
-
-	conn.uid ^= remoteConnID
-	peer := NewPeer(name, nickName, uid, 0, PeerShortID(shortID))
-	peer.HasShortID = hasShortID
-	return peer, nil
-}
-
-func (conn *LocalConnection) registerRemote(remote *Peer, acceptNewPeer bool) error {
-	if acceptNewPeer {
-		conn.remote = conn.Router.Peers.FetchWithDefault(remote)
-	} else {
-		conn.remote = conn.Router.Peers.FetchAndAddRef(remote.Name)
-		if conn.remote == nil {
-			return fmt.Errorf("Found unknown remote name: %s at %s", remote.Name, conn.remoteTCPAddr)
-		}
-	}
-
-	if conn.remote == conn.local {
-		return ErrConnectToSelf
-	}
-
-	return nil
-}
-
-func (conn *LocalConnection) actorLoop(actionChan <-chan ConnectionAction, errorChan <-chan error) (err error) {
-	fwdErrorChan := conn.OverlayConn.ErrorChannel()
-	fwdEstablishedChan := conn.OverlayConn.EstablishedChannel()
-
-	for err == nil {
-		select {
-		case action := <-actionChan:
-			err = action()
-
-		case err = <-errorChan:
-
-		case <-conn.heartbeatTCP.C:
-			err = conn.sendSimpleProtocolMsg(ProtocolHeartbeat)
-
-		case <-fwdEstablishedChan:
-			conn.established = true
-			fwdEstablishedChan = nil
-			conn.Router.Ourself.ConnectionEstablished(conn)
-
-		case err = <-fwdErrorChan:
-		}
-	}
-	return
-}
-
-func (conn *LocalConnection) shutdown(err error) {
-	if conn.remote == nil {
-		log.Errorf("->[%s] connection shutting down due to error during handshake: %v", conn.remoteTCPAddr, err)
-	} else {
-		conn.ErrorLog("connection shutting down due to error:", err)
-	}
-
-	if conn.TCPConn != nil {
-		checkWarn(conn.TCPConn.Close())
-	}
-
-	if conn.remote != nil {
-		conn.Router.Peers.Dereference(conn.remote)
-		conn.Router.Ourself.DeleteConnection(conn)
-	}
-
-	if conn.heartbeatTCP != nil {
-		conn.heartbeatTCP.Stop()
-	}
-
-	if conn.OverlayConn != nil {
-		conn.OverlayConn.Stop()
-	}
-
-	conn.Router.ConnectionMaker.ConnectionTerminated(conn, err)
-}
-
-func (conn *LocalConnection) sendOverlayControlMessage(tag byte, msg []byte) error {
-	return conn.sendProtocolMsg(ProtocolMsg{ProtocolTag(tag), msg})
-}
-
-// Helpers
-
-func (conn *LocalConnection) sendSimpleProtocolMsg(tag ProtocolTag) error {
-	return conn.sendProtocolMsg(ProtocolMsg{tag: tag})
-}
-
-func (conn *LocalConnection) sendProtocolMsg(m ProtocolMsg) error {
-	return conn.tcpSender.Send(append([]byte{byte(m.tag)}, m.msg...))
-}
-
-func (conn *LocalConnection) receiveTCP(receiver TCPReceiver) {
-	var err error
-	for {
-		conn.extendReadDeadline()
-
-		var msg []byte
-		if msg, err = receiver.Receive(); err != nil {
-			break
-		}
-		if len(msg) < 1 {
-			conn.Log("ignoring blank msg")
-			continue
-		}
-		if err = conn.handleProtocolMsg(ProtocolTag(msg[0]), msg[1:]); err != nil {
-			break
-		}
-	}
-	conn.Shutdown(err)
-}
-
-func (conn *LocalConnection) handleProtocolMsg(tag ProtocolTag, payload []byte) error {
-	switch tag {
-	case ProtocolHeartbeat:
-	case ProtocolReserved1, ProtocolReserved2, ProtocolReserved3, ProtocolOverlayControlMsg:
-		conn.OverlayConn.ControlMessage(byte(tag), payload)
-	case ProtocolGossipUnicast, ProtocolGossipBroadcast, ProtocolGossip:
-		return conn.Router.handleGossip(tag, payload)
-	default:
-		conn.Log("ignoring unknown protocol tag:", tag)
-	}
-	return nil
-}
-
-func (conn *LocalConnection) extendReadDeadline() {
-	conn.TCPConn.SetReadDeadline(time.Now().Add(TCPHeartbeat * 2))
-}
-
-func (conn *LocalConnection) Untrusted() bool {
-	return !conn.TrustRemote || !conn.TrustedByRemote
-}
@@ -1,317 +0,0 @@
-package mesh
-
-import (
-	"fmt"
-	"math/rand"
-	"net"
-	"time"
-)
-
-const (
-	InitialInterval = 2 * time.Second
-	MaxInterval     = 6 * time.Minute
-	ResetAfter      = 1 * time.Minute
-)
-
-type peerAddrs map[string]*net.TCPAddr
-
-type ConnectionMaker struct {
-	ourself     *LocalPeer
-	peers       *Peers
-	port        int
-	discovery   bool
-	targets     map[string]*Target
-	connections map[Connection]struct{}
-	directPeers peerAddrs
-	actionChan  chan<- ConnectionMakerAction
-}
-
-type TargetState int
-
-const (
-	TargetWaiting    TargetState = iota // we are waiting to connect there
-	TargetAttempting                    // we are attempting to connect there
-	TargetConnected                     // we are connected to there
-)
-
-// Information about an address where we may find a peer
-type Target struct {
-	state       TargetState
-	lastError   error         // reason for disconnection last time
-	tryAfter    time.Time     // next time to try this address
-	tryInterval time.Duration // retry delay on next failure
-}
-
-type ConnectionMakerAction func() bool
-
-func NewConnectionMaker(ourself *LocalPeer, peers *Peers, port int, discovery bool) *ConnectionMaker {
-	actionChan := make(chan ConnectionMakerAction, ChannelSize)
-	cm := &ConnectionMaker{
-		ourself:     ourself,
-		peers:       peers,
-		port:        port,
-		discovery:   discovery,
-		directPeers: peerAddrs{},
-		targets:     make(map[string]*Target),
-		connections: make(map[Connection]struct{}),
-		actionChan:  actionChan}
-	go cm.queryLoop(actionChan)
-	return cm
-}
-
-func (cm *ConnectionMaker) InitiateConnections(peers []string, replace bool) []error {
-	errors := []error{}
-	addrs := peerAddrs{}
-	for _, peer := range peers {
-		host, port, err := net.SplitHostPort(peer)
-		if err != nil {
-			host = peer
-			port = "0" // we use that as an indication that "no port was supplied"
-		}
-		if addr, err := net.ResolveTCPAddr("tcp4", fmt.Sprintf("%s:%s", host, port)); err != nil {
-			errors = append(errors, err)
-		} else {
-			addrs[peer] = addr
-		}
-	}
-	cm.actionChan <- func() bool {
-		if replace {
-			cm.directPeers = peerAddrs{}
-		}
-		for peer, addr := range addrs {
-			cm.directPeers[peer] = addr
-			// curtail any existing reconnect interval
-			if target, found := cm.targets[cm.completeAddr(*addr)]; found {
-				target.nextTryNow()
-			}
-		}
-		return true
-	}
-	return errors
-}
-
-func (cm *ConnectionMaker) ForgetConnections(peers []string) {
-	cm.actionChan <- func() bool {
-		for _, peer := range peers {
-			delete(cm.directPeers, peer)
-		}
-		return false
-	}
-}
-
-func (cm *ConnectionMaker) ConnectionAborted(address string, err error) {
-	cm.actionChan <- func() bool {
-		target := cm.targets[address]
-		target.state = TargetWaiting
-		target.lastError = err
-		target.nextTryLater()
-		return true
-	}
-}
-
-func (cm *ConnectionMaker) ConnectionCreated(conn Connection) {
-	cm.actionChan <- func() bool {
-		cm.connections[conn] = void
-		if conn.Outbound() {
-			target := cm.targets[conn.RemoteTCPAddr()]
-			target.state = TargetConnected
-		}
-		return false
-	}
-}
-
-func (cm *ConnectionMaker) ConnectionTerminated(conn Connection, err error) {
-	cm.actionChan <- func() bool {
-		delete(cm.connections, conn)
-		if conn.Outbound() {
-			target := cm.targets[conn.RemoteTCPAddr()]
-			target.state = TargetWaiting
-			target.lastError = err
-			switch {
-			case err == ErrConnectToSelf:
-				target.nextTryNever()
-			case time.Now().After(target.tryAfter.Add(ResetAfter)):
-				target.nextTryNow()
-			default:
-				target.nextTryLater()
-			}
-		}
-		return true
-	}
-}
-
-func (cm *ConnectionMaker) Refresh() {
-	cm.actionChan <- func() bool { return true }
-}
-
-func (cm *ConnectionMaker) queryLoop(actionChan <-chan ConnectionMakerAction) {
-	timer := time.NewTimer(MaxDuration)
-	run := func() { timer.Reset(cm.checkStateAndAttemptConnections()) }
-	for {
-		select {
-		case action := <-actionChan:
-			if action() {
-				run()
-			}
-		case <-timer.C:
-			run()
-		}
-	}
-}
-
-func (cm *ConnectionMaker) completeAddr(addr net.TCPAddr) string {
-	if addr.Port == 0 {
-		addr.Port = cm.port
-	}
-	return addr.String()
-}
-
-func (cm *ConnectionMaker) checkStateAndAttemptConnections() time.Duration {
-	var (
-		validTarget  = make(map[string]struct{})
-		directTarget = make(map[string]struct{})
-	)
-	ourConnectedPeers, ourConnectedTargets, ourInboundIPs := cm.ourConnections()
-
-	addTarget := func(address string) {
-		if _, connected := ourConnectedTargets[address]; connected {
-			return
-		}
-		validTarget[address] = void
-		if _, found := cm.targets[address]; found {
-			return
-		}
-		target := &Target{state: TargetWaiting}
-		target.nextTryNow()
-		cm.targets[address] = target
-	}
-
-	// Add direct targets that are not connected
-	for _, addr := range cm.directPeers {
-		attempt := true
-		if addr.Port == 0 {
-			// If a peer was specified w/o a port, then we do not
-			// attempt to connect to it if we have any inbound
-			// connections from that IP.
-			if _, connected := ourInboundIPs[addr.IP.String()]; connected {
-				attempt = false
-			}
-		}
-		address := cm.completeAddr(*addr)
-		directTarget[address] = void
-		if attempt {
-			addTarget(address)
-		}
-	}
-
-	// Add targets for peers that someone else is connected to, but we
-	// aren't
-	if cm.discovery {
-		cm.addPeerTargets(ourConnectedPeers, addTarget)
-	}
-
-	return cm.connectToTargets(validTarget, directTarget)
-}
-
-func (cm *ConnectionMaker) ourConnections() (PeerNameSet, map[string]struct{}, map[string]struct{}) {
-	var (
-		ourConnectedPeers   = make(PeerNameSet)
-		ourConnectedTargets = make(map[string]struct{})
-		ourInboundIPs       = make(map[string]struct{})
-	)
-	for conn := range cm.connections {
-		address := conn.RemoteTCPAddr()
-		ourConnectedPeers[conn.Remote().Name] = void
-		ourConnectedTargets[address] = void
-		if conn.Outbound() {
-			continue
-		}
-		if ip, _, err := net.SplitHostPort(address); err == nil { // should always succeed
-			ourInboundIPs[ip] = void
-		}
-	}
-	return ourConnectedPeers, ourConnectedTargets, ourInboundIPs
-}
-
-func (cm *ConnectionMaker) addPeerTargets(ourConnectedPeers PeerNameSet, addTarget func(string)) {
-	cm.peers.ForEach(func(peer *Peer) {
-		if peer == cm.ourself.Peer {
-			return
-		}
-		// Modifying peer.connections requires a write lock on Peers,
-		// and since we are holding a read lock (due to the ForEach),
-		// access without locking the peer is safe.
-		for otherPeer, conn := range peer.connections {
-			if otherPeer == cm.ourself.Name {
-				continue
-			}
-			if _, connected := ourConnectedPeers[otherPeer]; connected {
-				continue
-			}
-			address := conn.RemoteTCPAddr()
-			if conn.Outbound() {
-				addTarget(address)
-			} else if ip, _, err := net.SplitHostPort(address); err == nil {
-				// There is no point connecting to the (likely
-				// ephemeral) remote port of an inbound connection
-				// that some peer has. Let's try to connect on the
-				// weave port instead.
-				addTarget(fmt.Sprintf("%s:%d", ip, cm.port))
-			}
-		}
-	})
-}
-
-func (cm *ConnectionMaker) connectToTargets(validTarget map[string]struct{}, directTarget map[string]struct{}) time.Duration {
-	now := time.Now() // make sure we catch items just added
-	after := MaxDuration
-	for address, target := range cm.targets {
-		if target.state != TargetWaiting {
-			continue
-		}
-		if _, valid := validTarget[address]; !valid {
-			delete(cm.targets, address)
-			continue
-		}
-		if target.tryAfter.IsZero() {
-			continue
-		}
-		switch duration := target.tryAfter.Sub(now); {
-		case duration <= 0:
-			target.state = TargetAttempting
-			_, isCmdLineTarget := directTarget[address]
-			go cm.attemptConnection(address, isCmdLineTarget)
-		case duration < after:
-			after = duration
-		}
-	}
-	return after
-}
-
-func (cm *ConnectionMaker) attemptConnection(address string, acceptNewPeer bool) {
-	log.Printf("->[%s] attempting connection", address)
-	if err := cm.ourself.CreateConnection(address, acceptNewPeer); err != nil {
-		log.Errorf("->[%s] error during connection attempt: %v", address, err)
-		cm.ConnectionAborted(address, err)
-	}
-}
-
-func (t *Target) nextTryNever() {
-	t.tryAfter = time.Time{}
-	t.tryInterval = MaxInterval
-}
-
-func (t *Target) nextTryNow() {
-	t.tryAfter = time.Now()
-	t.tryInterval = InitialInterval
-}
-
-// The delay at the nth retry is a random value in the range
-// [i-i/2,i+i/2], where i = InitialInterval * 1.5^(n-1).
-func (t *Target) nextTryLater() {
-	t.tryAfter = time.Now().Add(t.tryInterval/2 + time.Duration(rand.Int63n(int64(t.tryInterval))))
-	t.tryInterval = t.tryInterval * 3 / 2
-	if t.tryInterval > MaxInterval {
-		t.tryInterval = MaxInterval
-	}
-}
@@ -1,170 +0,0 @@
-package mesh
-
-import (
-	"fmt"
-)
-
-type GossipData interface {
-	Encode() [][]byte
-	Merge(GossipData) GossipData
-}
-
-type Gossip interface {
-	// specific message from one peer to another
-	// intermediate peers relay it using unicast topology.
-	GossipUnicast(dstPeerName PeerName, msg []byte) error
-	// send gossip to every peer, relayed using broadcast topology.
-	GossipBroadcast(update GossipData) error
-}
-
-type Gossiper interface {
-	OnGossipUnicast(sender PeerName, msg []byte) error
-	// merge received data into state and return a representation of
-	// the received data, for further propagation
-	OnGossipBroadcast(sender PeerName, update []byte) (GossipData, error)
-	// return state of everything we know; gets called periodically
-	Gossip() GossipData
-	// merge received data into state and return "everything new I've
-	// just learnt", or nil if nothing in the received data was new
-	OnGossip(update []byte) (GossipData, error)
-}
-
-// Accumulates GossipData that needs to be sent to one destination,
-// and sends it when possible.
-type GossipSender struct {
-	send func(GossipData)
-	cell chan GossipData
-	// for testing
-	sent    bool
-	flushch chan chan bool
-}
-
-func NewGossipSender(send func(GossipData)) *GossipSender {
-	cell := make(chan GossipData, 1)
-	flushch := make(chan chan bool)
-	sender := &GossipSender{
-		send:    send,
-		cell:    cell,
-		flushch: flushch,
-	}
-	go sender.run()
-	return sender
-}
-
-func (sender *GossipSender) run() {
-	for {
-		select {
-		case pending := <-sender.cell:
-			if pending == nil { // receive zero value when chan is closed
-				return
-			}
-			sender.send(pending)
-			sender.sent = true
-		case ch := <-sender.flushch:
-			// send anything pending, then reply back whether we sent
-			// anything since previous flush
-			select {
-			case pending := <-sender.cell:
-				sender.send(pending)
-				sender.sent = true
-			default:
-			}
-			ch <- sender.sent
-			sender.sent = false
-		}
-	}
-}
-
-func (sender *GossipSender) Send(data GossipData) {
-	// NB: this must not be invoked concurrently
-	select {
-	case pending := <-sender.cell:
-		sender.cell <- pending.Merge(data)
-	default:
-		sender.cell <- data
-	}
-}
-
-func (sender *GossipSender) Stop() {
-	close(sender.cell)
-}
-
-type GossipChannels map[string]*GossipChannel
-
-func (router *Router) NewGossip(channelName string, g Gossiper) Gossip {
-	channel := NewGossipChannel(channelName, router.Ourself, router.Routes, g)
-	router.gossipLock.Lock()
-	defer router.gossipLock.Unlock()
-	if _, found := router.gossipChannels[channelName]; found {
-		checkFatal(fmt.Errorf("[gossip] duplicate channel %s", channelName))
-	}
-	router.gossipChannels[channelName] = channel
-	return channel
-}
-
-func (router *Router) gossipChannel(channelName string) *GossipChannel {
-	router.gossipLock.RLock()
-	channel, found := router.gossipChannels[channelName]
-	router.gossipLock.RUnlock()
-	if found {
-		return channel
-	}
-	router.gossipLock.Lock()
-	defer router.gossipLock.Unlock()
-	if channel, found = router.gossipChannels[channelName]; found {
-		return channel
-	}
-	channel = NewGossipChannel(channelName, router.Ourself, router.Routes, &surrogateGossiper)
-	channel.log("created surrogate channel")
-	router.gossipChannels[channelName] = channel
-	return channel
-}
-
-func (router *Router) gossipChannelSet() map[*GossipChannel]struct{} {
-	channels := make(map[*GossipChannel]struct{})
-	router.gossipLock.RLock()
-	defer router.gossipLock.RUnlock()
-	for _, channel := range router.gossipChannels {
-		channels[channel] = void
-	}
-	return channels
-}
-
-func (router *Router) SendAllGossip() {
-	for channel := range router.gossipChannelSet() {
-		if gossip := channel.gossiper.Gossip(); gossip != nil {
-			channel.Send(router.Ourself.Name, gossip)
-		}
-	}
-}
-
-func (router *Router) SendAllGossipDown(conn Connection) {
-	for channel := range router.gossipChannelSet() {
-		if gossip := channel.gossiper.Gossip(); gossip != nil {
-			channel.SendDown(conn, gossip)
-		}
-	}
-}
-
-// for testing
-
-func (router *Router) sendPendingGossip() bool {
-	sentSomething := false
-	for channel := range router.gossipChannelSet() {
-		channel.Lock()
-		for _, sender := range channel.senders {
-			sentSomething = sender.flush() || sentSomething
-		}
-		for _, sender := range channel.broadcasters {
-			sentSomething = sender.flush() || sentSomething
-		}
-		channel.Unlock()
-	}
-	return sentSomething
-}
-
-func (sender *GossipSender) flush() bool {
-	ch := make(chan bool)
-	sender.flushch <- ch
-	return <-ch
-}
@@ -1,244 +0,0 @@
-package mesh
-
-import (
-	"bytes"
-	"encoding/gob"
-	"fmt"
-	"sync"
-)
-
-type GossipChannel struct {
-	sync.Mutex
-	name         string
-	ourself      *LocalPeer
-	routes       *Routes
-	gossiper     Gossiper
-	senders      connectionSenders
-	broadcasters peerSenders
-}
-
-type connectionSenders map[Connection]*GossipSender
-type peerSenders map[PeerName]*GossipSender
-
-func NewGossipChannel(channelName string, ourself *LocalPeer, routes *Routes, g Gossiper) *GossipChannel {
-	return &GossipChannel{
-		name:         channelName,
-		ourself:      ourself,
-		routes:       routes,
-		gossiper:     g,
-		senders:      make(connectionSenders),
-		broadcasters: make(peerSenders)}
-}
-
-func (router *Router) handleGossip(tag ProtocolTag, payload []byte) error {
-	decoder := gob.NewDecoder(bytes.NewReader(payload))
-	var channelName string
-	if err := decoder.Decode(&channelName); err != nil {
-		return err
-	}
-	channel := router.gossipChannel(channelName)
-	var srcName PeerName
-	if err := decoder.Decode(&srcName); err != nil {
-		return err
-	}
-	switch tag {
-	case ProtocolGossipUnicast:
-		return channel.deliverUnicast(srcName, payload, decoder)
-	case ProtocolGossipBroadcast:
-		return channel.deliverBroadcast(srcName, payload, decoder)
-	case ProtocolGossip:
-		return channel.deliver(srcName, payload, decoder)
-	}
-	return nil
-}
-
-func (c *GossipChannel) deliverUnicast(srcName PeerName, origPayload []byte, dec *gob.Decoder) error {
-	var destName PeerName
-	if err := dec.Decode(&destName); err != nil {
-		return err
-	}
-	if c.ourself.Name != destName {
-		if err := c.relayUnicast(destName, origPayload); err != nil {
-			// just log errors from relayUnicast; a problem between us and destination
-			// is not enough reason to break the connection from the source
-			c.log(err)
-		}
-		return nil
-	}
-	var payload []byte
-	if err := dec.Decode(&payload); err != nil {
-		return err
-	}
-	return c.gossiper.OnGossipUnicast(srcName, payload)
-}
-
-func (c *GossipChannel) deliverBroadcast(srcName PeerName, _ []byte, dec *gob.Decoder) error {
-	var payload []byte
-	if err := dec.Decode(&payload); err != nil {
-		return err
-	}
-	data, err := c.gossiper.OnGossipBroadcast(srcName, payload)
-	if err != nil || data == nil {
-		return err
-	}
-	return c.relayBroadcast(srcName, data)
-}
-
-func (c *GossipChannel) deliver(srcName PeerName, _ []byte, dec *gob.Decoder) error {
-	var payload []byte
-	if err := dec.Decode(&payload); err != nil {
-		return err
-	}
-	if data, err := c.gossiper.OnGossip(payload); err != nil {
-		return err
-	} else if data != nil {
-		c.Send(srcName, data)
-	}
-	return nil
-}
-
-func (c *GossipChannel) GossipUnicast(dstPeerName PeerName, msg []byte) error {
-	return c.relayUnicast(dstPeerName, GobEncode(c.name, c.ourself.Name, dstPeerName, msg))
-}
-
-func (c *GossipChannel) GossipBroadcast(update GossipData) error {
-	return c.relayBroadcast(c.ourself.Name, update)
-}
-
-func (c *GossipChannel) relayUnicast(dstPeerName PeerName, buf []byte) (err error) {
-	if relayPeerName, found := c.routes.UnicastAll(dstPeerName); !found {
-		err = fmt.Errorf("unknown relay destination: %s", dstPeerName)
-	} else if conn, found := c.ourself.ConnectionTo(relayPeerName); !found {
-		err = fmt.Errorf("unable to find connection to relay peer %s", relayPeerName)
-	} else {
-		conn.(ProtocolSender).SendProtocolMsg(ProtocolMsg{ProtocolGossipUnicast, buf})
-	}
-	return err
-}
-
-func (c *GossipChannel) relayBroadcast(srcName PeerName, update GossipData) error {
-	names := c.routes.PeerNames() // do this outside the lock so they don't nest
-	c.Lock()
-	defer c.Unlock()
-	// GC - randomly (courtesy of go's map iterator) pick some
-	// existing broadcasters and stop&remove them if their source peer
-	// is unknown. We stop as soon as we encounter a valid entry; the
-	// idea being that when there is little or no garbage then this
-	// executes close to O(1)[1], whereas when there is lots of
-	// garbage we remove it quickly.
-	//
-	// [1] TODO Unfortunately, due to the desire to avoid nested
-	// locks, instead of simply invoking Peers.Fetch(name) below, we
-	// have that Peers.Names() invocation above. That is O(n_peers) at
-	// best.
-	for name, broadcaster := range c.broadcasters {
-		if _, found := names[name]; !found {
-			delete(c.broadcasters, name)
-			broadcaster.Stop()
-		} else {
-			break
-		}
-	}
-	broadcaster, found := c.broadcasters[srcName]
-	if !found {
-		broadcaster = NewGossipSender(func(pending GossipData) { c.sendBroadcast(srcName, pending) })
-		c.broadcasters[srcName] = broadcaster
-	}
-	broadcaster.Send(update)
-	return nil
-}
-
-func (c *GossipChannel) sendBroadcast(srcName PeerName, update GossipData) {
-	c.routes.EnsureRecalculated()
-	nextHops := c.routes.BroadcastAll(srcName)
-	if len(nextHops) == 0 {
-		return
-	}
-	connections := c.ourself.ConnectionsTo(nextHops)
-	for _, msg := range update.Encode() {
-		protocolMsg := ProtocolMsg{ProtocolGossipBroadcast, GobEncode(c.name, srcName, msg)}
-		// FIXME a single blocked connection can stall us
-		for _, conn := range connections {
-			conn.(ProtocolSender).SendProtocolMsg(protocolMsg)
-		}
-	}
-}
-
-func (c *GossipChannel) Send(srcName PeerName, data GossipData) {
-	c.routes.EnsureRecalculated()
-	destinations := c.routes.RandomNeighbours(srcName)
-	if len(destinations) == 0 {
-		return
-	}
-	c.sendDown(c.ourself.ConnectionsTo(destinations), data)
-}
-
-func (c *GossipChannel) SendDown(conn Connection, data GossipData) {
-	c.sendDown([]Connection{conn}, data)
-}
-
-func (c *GossipChannel) sendDown(selectedConnections []Connection, data GossipData) {
-	if len(selectedConnections) == 0 {
-		return
-	}
-	connections := c.ourself.Connections()
-	c.Lock()
-	defer c.Unlock()
-	// GC - randomly (courtesy of go's map iterator) pick some
-	// existing senders and stop&remove them if the associated
-	// connection is no longer active.  We stop as soon as we
-	// encounter a valid entry; the idea being that when there is
-	// little or no garbage then this executes close to O(1)[1],
-	// whereas when there is lots of garbage we remove it quickly.
-	//
-	// [1] TODO Unfortunately, due to the desire to avoid nested
-	// locks, instead of simply invoking LocalPeer.ConnectionTo(name),
-	// we operate on LocalPeer.Connections(). That is
-	// O(n_our_connections) at best.
-	for conn, sender := range c.senders {
-		if _, found := connections[conn]; !found {
-			delete(c.senders, conn)
-			sender.Stop()
-		} else {
-			break
-		}
-	}
-	// start senders, if necessary, and send.
-	for _, conn := range selectedConnections {
-		sender, found := c.senders[conn]
-		if !found {
-			sender = c.makeSender(conn)
-			c.senders[conn] = sender
-		}
-		sender.Send(data)
-	}
-}
-
-// We have seen a couple of failures which suggest a >128GB slice was encountered.
-// 100MB should be enough for anyone.
-const maxFeasibleMessageLen = 100 * 1024 * 1024
-
-func (c *GossipChannel) makeSender(conn Connection) *GossipSender {
-	return NewGossipSender(func(pending GossipData) {
-		for _, msg := range pending.Encode() {
-			if len(msg) > maxFeasibleMessageLen {
-				panic(fmt.Sprintf("Gossip message too large: len=%d bytes; on channel '%s' from %+v", len(msg), c.name, pending))
-			}
-			protocolMsg := ProtocolMsg{ProtocolGossip, GobEncode(c.name, c.ourself.Name, msg)}
-			conn.(ProtocolSender).SendProtocolMsg(protocolMsg)
-		}
-	})
-}
-
-func (c *GossipChannel) log(args ...interface{}) {
-	log.Println(append(append([]interface{}{}, "[gossip "+c.name+"]:"), args...)...)
-}
-
-func GobEncode(items ...interface{}) []byte {
-	buf := new(bytes.Buffer)
-	enc := gob.NewEncoder(buf)
-	for _, i := range items {
-		checkFatal(enc.Encode(i))
-	}
-	return buf.Bytes()
-}
@@ -1,230 +0,0 @@
-package mesh
-
-import (
-	"fmt"
-	"sync"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// TODO test gossip unicast; atm we only test topology gossip and
-// surrogates, neither of which employ unicast.
-
-type mockGossipConnection struct {
-	RemoteConnection
-	dest  *Router
-	start chan struct{}
-}
-
-func NewTestRouter(name string) *Router {
-	peerName, _ := PeerNameFromString(name)
-	router := NewRouter(Config{}, peerName, "nick", nil)
-	router.Start()
-	return router
-}
-
-func (conn *mockGossipConnection) SendProtocolMsg(protocolMsg ProtocolMsg) {
-	<-conn.start
-	if err := conn.dest.handleGossip(protocolMsg.tag, protocolMsg.msg); err != nil {
-		panic(err)
-	}
-}
-
-func (conn *mockGossipConnection) Start() {
-	close(conn.start)
-}
-
-func sendPendingGossip(routers ...*Router) {
-	// Loop until all routers report they didn't send anything
-	for sentSomething := true; sentSomething; {
-		sentSomething = false
-		for _, router := range routers {
-			sentSomething = router.sendPendingGossip() || sentSomething
-		}
-	}
-}
-
-func AddTestGossipConnection(r1, r2 *Router) {
-	c1 := r1.NewTestGossipConnection(r2)
-	c2 := r2.NewTestGossipConnection(r1)
-	c1.Start()
-	c2.Start()
-}
-
-func (router *Router) NewTestGossipConnection(r *Router) *mockGossipConnection {
-	to := r.Ourself.Peer
-	toPeer := NewPeer(to.Name, to.NickName, to.UID, 0, to.ShortID)
-	toPeer = router.Peers.FetchWithDefault(toPeer) // Has side-effect of incrementing refcount
-
-	conn := &mockGossipConnection{
-		RemoteConnection{router.Ourself.Peer, toPeer, "", false, true}, r, make(chan struct{})}
-	router.Ourself.handleAddConnection(conn)
-	router.Ourself.handleConnectionEstablished(conn)
-	return conn
-}
-
-func (router *Router) DeleteTestGossipConnection(r *Router) {
-	toName := r.Ourself.Peer.Name
-	conn, _ := router.Ourself.ConnectionTo(toName)
-	router.Peers.Dereference(conn.Remote())
-	router.Ourself.handleDeleteConnection(conn)
-}
-
-// Create a Peer representing the receiver router, with connections to
-// the routers supplied as arguments, carrying across all UID and
-// version information.
-func (router *Router) tp(routers ...*Router) *Peer {
-	peer := NewPeerFrom(router.Ourself.Peer)
-	connections := make(map[PeerName]Connection)
-	for _, r := range routers {
-		p := NewPeerFrom(r.Ourself.Peer)
-		connections[r.Ourself.Peer.Name] = newMockConnection(peer, p)
-	}
-	peer.Version = router.Ourself.Peer.Version
-	peer.connections = connections
-	return peer
-}
-
-// Check that the topology of router matches the peers and all of their connections
-func checkTopology(t *testing.T, router *Router, wantedPeers ...*Peer) {
-	router.Peers.RLock()
-	checkTopologyPeers(t, true, router.Peers.allPeers(), wantedPeers...)
-	router.Peers.RUnlock()
-}
-
-func flushAndCheckTopology(t *testing.T, routers []*Router, wantedPeers ...*Peer) {
-	sendPendingGossip(routers...)
-	for _, r := range routers {
-		checkTopology(t, r, wantedPeers...)
-	}
-}
-
-func TestGossipTopology(t *testing.T) {
-	// Create some peers that will talk to each other
-	r1 := NewTestRouter("01:00:00:01:00:00")
-	r2 := NewTestRouter("02:00:00:02:00:00")
-	r3 := NewTestRouter("03:00:00:03:00:00")
-	routers := []*Router{r1, r2, r3}
-	// Check state when they have no connections
-	checkTopology(t, r1, r1.tp())
-	checkTopology(t, r2, r2.tp())
-
-	// Now try adding some connections
-	AddTestGossipConnection(r1, r2)
-	sendPendingGossip(r1, r2)
-	checkTopology(t, r1, r1.tp(r2), r2.tp(r1))
-	checkTopology(t, r2, r1.tp(r2), r2.tp(r1))
-
-	AddTestGossipConnection(r2, r3)
-	flushAndCheckTopology(t, routers, r1.tp(r2), r2.tp(r1, r3), r3.tp(r2))
-
-	AddTestGossipConnection(r3, r1)
-	flushAndCheckTopology(t, routers, r1.tp(r2, r3), r2.tp(r1, r3), r3.tp(r1, r2))
-
-	// Drop the connection from 2 to 3
-	r2.DeleteTestGossipConnection(r3)
-	flushAndCheckTopology(t, routers, r1.tp(r2, r3), r2.tp(r1), r3.tp(r1, r2))
-
-	// Drop the connection from 1 to 3
-	r1.DeleteTestGossipConnection(r3)
-	sendPendingGossip(r1, r2, r3)
-	checkTopology(t, r1, r1.tp(r2), r2.tp(r1))
-	checkTopology(t, r2, r1.tp(r2), r2.tp(r1))
-	// r3 still thinks r1 has a connection to it
-	checkTopology(t, r3, r1.tp(r2, r3), r2.tp(r1), r3.tp(r1, r2))
-}
-
-func TestGossipSurrogate(t *testing.T) {
-	// create the topology r1 <-> r2 <-> r3
-	r1 := NewTestRouter("01:00:00:01:00:00")
-	r2 := NewTestRouter("02:00:00:02:00:00")
-	r3 := NewTestRouter("03:00:00:03:00:00")
-	routers := []*Router{r1, r2, r3}
-	AddTestGossipConnection(r1, r2)
-	AddTestGossipConnection(r3, r2)
-	flushAndCheckTopology(t, routers, r1.tp(r2), r2.tp(r1, r3), r3.tp(r2))
-
-	// create a gossiper at either end, but not the middle
-	g1 := newTestGossiper()
-	g3 := newTestGossiper()
-	s1 := r1.NewGossip("Test", g1)
-	s3 := r3.NewGossip("Test", g3)
-
-	// broadcast a message from each end, check it reaches the other
-	broadcast(s1, 1)
-	broadcast(s3, 2)
-	sendPendingGossip(r1, r2, r3)
-	g1.checkHas(t, 2)
-	g3.checkHas(t, 1)
-
-	// check that each end gets their message back through periodic
-	// gossip
-	r1.SendAllGossip()
-	r3.SendAllGossip()
-	sendPendingGossip(r1, r2, r3)
-	g1.checkHas(t, 1, 2)
-	g3.checkHas(t, 1, 2)
-}
-
-type testGossiper struct {
-	sync.RWMutex
-	state map[byte]struct{}
-}
-
-func newTestGossiper() *testGossiper {
-	return &testGossiper{state: make(map[byte]struct{})}
-}
-
-func (g *testGossiper) OnGossipUnicast(sender PeerName, msg []byte) error {
-	return nil
-}
-
-func (g *testGossiper) OnGossipBroadcast(_ PeerName, update []byte) (GossipData, error) {
-	g.Lock()
-	defer g.Unlock()
-	for _, v := range update {
-		g.state[v] = void
-	}
-	return NewSurrogateGossipData(update), nil
-}
-
-func (g *testGossiper) Gossip() GossipData {
-	g.RLock()
-	defer g.RUnlock()
-	state := make([]byte, len(g.state))
-	for v := range g.state {
-		state = append(state, v)
-	}
-	return NewSurrogateGossipData(state)
-}
-
-func (g *testGossiper) OnGossip(update []byte) (GossipData, error) {
-	g.Lock()
-	defer g.Unlock()
-	var delta []byte
-	for _, v := range update {
-		if _, found := g.state[v]; !found {
-			delta = append(delta, v)
-			g.state[v] = void
-		}
-	}
-	if len(delta) == 0 {
-		return nil, nil
-	}
-	return NewSurrogateGossipData(delta), nil
-}
-
-func (g *testGossiper) checkHas(t *testing.T, vs ...byte) {
-	g.RLock()
-	defer g.RUnlock()
-	for _, v := range vs {
-		if _, found := g.state[v]; !found {
-			require.FailNow(t, fmt.Sprintf("%d is missing", v))
-		}
-	}
-}
-
-func broadcast(s Gossip, v byte) {
-	s.GossipBroadcast(NewSurrogateGossipData([]byte{v}))
-}
@@ -1,261 +0,0 @@
-package mesh
-
-import (
-	"fmt"
-	"net"
-	"sync"
-	"time"
-)
-
-type LocalPeer struct {
-	sync.RWMutex
-	*Peer
-	router     *Router
-	actionChan chan<- LocalPeerAction
-}
-
-type LocalPeerAction func()
-
-func NewLocalPeer(name PeerName, nickName string, router *Router) *LocalPeer {
-	actionChan := make(chan LocalPeerAction, ChannelSize)
-	peer := &LocalPeer{
-		Peer:       NewPeer(name, nickName, randomPeerUID(), 0, randomPeerShortID()),
-		router:     router,
-		actionChan: actionChan,
-	}
-	go peer.actorLoop(actionChan)
-	return peer
-}
-
-func (peer *LocalPeer) Connections() ConnectionSet {
-	connections := make(ConnectionSet)
-	peer.RLock()
-	defer peer.RUnlock()
-	for _, conn := range peer.connections {
-		connections[conn] = void
-	}
-	return connections
-}
-
-func (peer *LocalPeer) ConnectionTo(name PeerName) (Connection, bool) {
-	peer.RLock()
-	defer peer.RUnlock()
-	conn, found := peer.connections[name]
-	return conn, found // yes, you really can't inline that. FFS.
-}
-
-func (peer *LocalPeer) ConnectionsTo(names []PeerName) []Connection {
-	conns := make([]Connection, 0, len(names))
-	peer.RLock()
-	defer peer.RUnlock()
-	for _, name := range names {
-		conn, found := peer.connections[name]
-		// Again, !found could just be due to a race.
-		if found {
-			conns = append(conns, conn)
-		}
-	}
-	return conns
-}
-
-func (peer *LocalPeer) CreateConnection(peerAddr string, acceptNewPeer bool) error {
-	if err := peer.checkConnectionLimit(); err != nil {
-		return err
-	}
-	tcpAddr, err := net.ResolveTCPAddr("tcp4", peerAddr)
-	if err != nil {
-		return err
-	}
-	tcpConn, err := net.DialTCP("tcp4", nil, tcpAddr)
-	if err != nil {
-		return err
-	}
-	connRemote := NewRemoteConnection(peer.Peer, nil, tcpConn.RemoteAddr().String(), true, false)
-	StartLocalConnection(connRemote, tcpConn, peer.router, acceptNewPeer)
-	return nil
-}
-
-// ACTOR client API
-
-// Sync.
-func (peer *LocalPeer) AddConnection(conn *LocalConnection) error {
-	resultChan := make(chan error)
-	peer.actionChan <- func() {
-		resultChan <- peer.handleAddConnection(conn)
-	}
-	return <-resultChan
-}
-
-// Async.
-func (peer *LocalPeer) ConnectionEstablished(conn *LocalConnection) {
-	peer.actionChan <- func() {
-		peer.handleConnectionEstablished(conn)
-	}
-}
-
-// Sync.
-func (peer *LocalPeer) DeleteConnection(conn *LocalConnection) {
-	resultChan := make(chan interface{})
-	peer.actionChan <- func() {
-		peer.handleDeleteConnection(conn)
-		resultChan <- nil
-	}
-	<-resultChan
-}
-
-// ACTOR server
-
-func (peer *LocalPeer) actorLoop(actionChan <-chan LocalPeerAction) {
-	gossipTimer := time.Tick(GossipInterval)
-	for {
-		select {
-		case action := <-actionChan:
-			action()
-		case <-gossipTimer:
-			peer.router.SendAllGossip()
-		}
-	}
-}
-
-func (peer *LocalPeer) handleAddConnection(conn Connection) error {
-	if peer.Peer != conn.Local() {
-		log.Fatal("Attempt made to add connection to peer where peer is not the source of connection")
-	}
-	if conn.Remote() == nil {
-		log.Fatal("Attempt made to add connection to peer with unknown remote peer")
-	}
-	toName := conn.Remote().Name
-	dupErr := fmt.Errorf("Multiple connections to %s added to %s", conn.Remote(), peer.String())
-	// deliberately non symmetrical
-	if dupConn, found := peer.connections[toName]; found {
-		if dupConn == conn {
-			return nil
-		}
-		switch conn.BreakTie(dupConn) {
-		case TieBreakWon:
-			dupConn.Shutdown(dupErr)
-			peer.handleDeleteConnection(dupConn)
-		case TieBreakLost:
-			return dupErr
-		case TieBreakTied:
-			// oh good grief. Sod it, just kill both of them.
-			dupConn.Shutdown(dupErr)
-			peer.handleDeleteConnection(dupConn)
-			return dupErr
-		}
-	}
-	if err := peer.checkConnectionLimit(); err != nil {
-		return err
-	}
-	_, isConnectedPeer := peer.router.Routes.Unicast(toName)
-	peer.addConnection(conn)
-	if isConnectedPeer {
-		conn.Log("connection added")
-	} else {
-		conn.Log("connection added (new peer)")
-		peer.router.SendAllGossipDown(conn)
-	}
-
-	peer.router.Routes.Recalculate()
-	peer.broadcastPeerUpdate(conn.Remote())
-
-	return nil
-}
-
-func (peer *LocalPeer) handleConnectionEstablished(conn Connection) {
-	if peer.Peer != conn.Local() {
-		log.Fatal("Peer informed of active connection where peer is not the source of connection")
-	}
-	if dupConn, found := peer.connections[conn.Remote().Name]; !found || conn != dupConn {
-		conn.Shutdown(fmt.Errorf("Cannot set unknown connection active"))
-		return
-	}
-	peer.connectionEstablished(conn)
-	conn.Log("connection fully established")
-
-	peer.router.Routes.Recalculate()
-	peer.broadcastPeerUpdate()
-}
-
-func (peer *LocalPeer) handleDeleteConnection(conn Connection) {
-	if peer.Peer != conn.Local() {
-		log.Fatal("Attempt made to delete connection from peer where peer is not the source of connection")
-	}
-	if conn.Remote() == nil {
-		log.Fatal("Attempt made to delete connection to peer with unknown remote peer")
-	}
-	toName := conn.Remote().Name
-	if connFound, found := peer.connections[toName]; !found || connFound != conn {
-		return
-	}
-	peer.deleteConnection(conn)
-	conn.Log("connection deleted")
-	// Must do garbage collection first to ensure we don't send out an
-	// update with unreachable peers (can cause looping)
-	peer.router.Peers.GarbageCollect()
-	peer.router.Routes.Recalculate()
-	peer.broadcastPeerUpdate()
-}
-
-// helpers
-
-func (peer *LocalPeer) broadcastPeerUpdate(peers ...*Peer) {
-	// Some tests run without a router.  This should be fixed so
-	// that the relevant part of Router can be easily run in the
-	// context of a test, but that will involve significant
-	// reworking of tests.
-	if peer.router != nil {
-		peer.router.BroadcastTopologyUpdate(append(peers, peer.Peer))
-	}
-}
-
-func (peer *LocalPeer) checkConnectionLimit() error {
-	limit := peer.router.ConnLimit
-	if 0 != limit && peer.connectionCount() >= limit {
-		return fmt.Errorf("Connection limit reached (%v)", limit)
-	}
-	return nil
-}
-
-func (peer *LocalPeer) addConnection(conn Connection) {
-	peer.Lock()
-	defer peer.Unlock()
-	peer.connections[conn.Remote().Name] = conn
-	peer.Version++
-}
-
-func (peer *LocalPeer) deleteConnection(conn Connection) {
-	peer.Lock()
-	defer peer.Unlock()
-	delete(peer.connections, conn.Remote().Name)
-	peer.Version++
-}
-
-func (peer *LocalPeer) connectionEstablished(conn Connection) {
-	peer.Lock()
-	defer peer.Unlock()
-	peer.Version++
-}
-
-func (peer *LocalPeer) connectionCount() int {
-	peer.RLock()
-	defer peer.RUnlock()
-	return len(peer.connections)
-}
-
-func (peer *LocalPeer) setShortID(shortID PeerShortID) {
-	peer.Lock()
-	defer peer.Unlock()
-	peer.ShortID = shortID
-	peer.Version++
-}
-
-func (peer *LocalPeer) setVersionBeyond(version uint64) bool {
-	peer.Lock()
-	defer peer.Unlock()
-	if version >= peer.Version {
-		peer.Version = version + 1
-		return true
-	}
-	return false
-}
@@ -1,115 +0,0 @@
-// No mocks are tested by this file.
-//
-// It supplies some mock implementations to other unit tests, and is
-// named "...test.go" so it is only compiled under `go test`.
-
-package mesh
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// Add to peers a connection from peers.ourself to p
-func (peers *Peers) AddTestConnection(p *Peer) {
-	summary := p.PeerSummary
-	summary.Version = 0
-	toPeer := NewPeerFromSummary(summary)
-	toPeer = peers.FetchWithDefault(toPeer) // Has side-effect of incrementing refcount
-	conn := newMockConnection(peers.ourself.Peer, toPeer)
-	peers.ourself.addConnection(conn)
-	peers.ourself.connectionEstablished(conn)
-}
-
-// Add to peers a connection from p1 to p2
-func (peers *Peers) AddTestRemoteConnection(p1, p2 *Peer) {
-	fromPeer := NewPeerFrom(p1)
-	fromPeer = peers.FetchWithDefault(fromPeer)
-	toPeer := NewPeerFrom(p2)
-	toPeer = peers.FetchWithDefault(toPeer)
-	peers.ourself.addConnection(&RemoteConnection{fromPeer, toPeer, "", false, false})
-}
-
-func (peers *Peers) DeleteTestConnection(p *Peer) {
-	toName := p.Name
-	toPeer := peers.Fetch(toName)
-	peers.Dereference(toPeer)
-	conn, _ := peers.ourself.ConnectionTo(toName)
-	peers.ourself.deleteConnection(conn)
-}
-
-// mockConnection used in testing is very similar to a
-// RemoteConnection, without the RemoteTCPAddr(). We are making it a
-// separate type in order to distinguish what is created by the test
-// from what is created by the real code.
-func newMockConnection(from, to *Peer) Connection {
-	type mockConnection struct{ RemoteConnection }
-	return &mockConnection{RemoteConnection{from, to, "", false, false}}
-}
-
-func checkEqualConns(t *testing.T, ourName PeerName, got, wanted map[PeerName]Connection) {
-	checkConns := make(PeerNameSet)
-	for _, conn := range wanted {
-		checkConns[conn.Remote().Name] = void
-	}
-	for _, conn := range got {
-		remoteName := conn.Remote().Name
-		if _, found := checkConns[remoteName]; found {
-			delete(checkConns, remoteName)
-		} else {
-			require.FailNow(t, fmt.Sprintf("Unexpected connection from %s to %s", ourName, remoteName))
-		}
-	}
-	if len(checkConns) > 0 {
-		require.FailNow(t, fmt.Sprintf("Expected connections not found: from %s to %v", ourName, checkConns))
-	}
-}
-
-// Get all the peers from a Peers in a slice
-func (peers *Peers) allPeers() []*Peer {
-	var res []*Peer
-	for _, peer := range peers.byName {
-		res = append(res, peer)
-	}
-	return res
-}
-
-func (peers *Peers) allPeersExcept(excludeName PeerName) []*Peer {
-	res := peers.allPeers()
-	for i, peer := range res {
-		if peer.Name == excludeName {
-			return append(res[:i], res[i+1:]...)
-		}
-	}
-	return res
-}
-
-// Check that the peers slice matches the wanted peers
-func checkPeerArray(t *testing.T, peers []*Peer, wantedPeers ...*Peer) {
-	checkTopologyPeers(t, false, peers, wantedPeers...)
-}
-
-// Check that the peers slice matches the wanted peers and optionally
-// all of their connections
-func checkTopologyPeers(t *testing.T, checkConns bool, peers []*Peer, wantedPeers ...*Peer) {
-	check := make(map[PeerName]*Peer)
-	for _, peer := range wantedPeers {
-		check[peer.Name] = peer
-	}
-	for _, peer := range peers {
-		name := peer.Name
-		if wantedPeer, found := check[name]; found {
-			if checkConns {
-				checkEqualConns(t, name, peer.connections, wantedPeer.connections)
-			}
-			delete(check, name)
-		} else {
-			require.FailNow(t, fmt.Sprintf("Unexpected peer: %s", name))
-		}
-	}
-	if len(check) > 0 {
-		require.FailNow(t, fmt.Sprintf("Expected peers not found: %v", check))
-	}
-}
@@ -1,116 +0,0 @@
-package mesh
-
-import (
-	"net"
-)
-
-type Overlay interface {
-	// Enhance a features map with overlay-related features
-	AddFeaturesTo(map[string]string)
-
-	// Prepare on overlay connection. The connection should remain
-	// passive until it has been Confirm()ed.
-	PrepareConnection(OverlayConnectionParams) (OverlayConnection, error)
-
-	// Obtain diagnostic information specific to the overlay
-	Diagnostics() interface{}
-}
-
-type OverlayConnectionParams struct {
-	RemotePeer *Peer
-
-	// The local address of the corresponding TCP connection. Used to
-	// derive the local IP address for sending. May differ for
-	// different overlay connections.
-	LocalAddr *net.TCPAddr
-
-	// The remote address of the corresponding TCP connection. Used to
-	// determine the address to send to, but only if the TCP
-	// connection is outbound. Otherwise the Overlay needs to discover
-	// it (e.g. from incoming datagrams).
-	RemoteAddr *net.TCPAddr
-
-	// Is the corresponding TCP connection outbound?
-	Outbound bool
-
-	// Unique identifier for this connection
-	ConnUID uint64
-
-	// Session key, if connection is encrypted; nil otherwise.
-	//
-	// NB: overlay connections must take care not to use nonces which
-	// may collide with those of the main connection. These nonces are
-	// 192 bits, with the top most bit unspecified, the next bit set
-	// to 1, followed by 126 zero bits, and a message sequence number
-	// in the lowest 64 bits.
-	SessionKey *[32]byte
-
-	// Function to send a control message to the counterpart
-	// overlay connection.
-	SendControlMessage func(tag byte, msg []byte) error
-
-	// Features passed at connection initiation
-	Features map[string]string
-}
-
-// All of the machinery to manage overlay connectivity to a particular
-// peer
-type OverlayConnection interface {
-	// Confirm that the connection is really wanted, and so the
-	// Overlay should begin heartbeats etc. to verify the operation of
-	// the overlay connection.
-	Confirm()
-
-	// A channel indicating that the overlay connection is
-	// established, i.e. its operation has been confirmed.
-	EstablishedChannel() <-chan struct{}
-
-	// A channel indicating an error from the overlay connection.  The
-	// overlay connection is not expected to be operational after the
-	// first error, so the channel only needs to buffer a single
-	// error.
-	ErrorChannel() <-chan error
-
-	Stop()
-
-	// Handle a message from the peer.  'tag' exists for
-	// compatibility, and should always be
-	// ProtocolOverlayControlMessage for non-sleeve overlays.
-	ControlMessage(tag byte, msg []byte)
-
-	// User facing overlay name
-	DisplayName() string
-}
-
-type NullOverlay struct{}
-
-func (NullOverlay) AddFeaturesTo(map[string]string) {
-}
-
-func (NullOverlay) PrepareConnection(OverlayConnectionParams) (OverlayConnection, error) {
-	return NullOverlay{}, nil
-}
-
-func (NullOverlay) Diagnostics() interface{} {
-	return nil
-}
-func (NullOverlay) Confirm() {
-}
-
-func (NullOverlay) EstablishedChannel() <-chan struct{} {
-	return nil
-}
-
-func (NullOverlay) ErrorChannel() <-chan error {
-	return nil
-}
-
-func (NullOverlay) Stop() {
-}
-
-func (NullOverlay) ControlMessage(byte, []byte) {
-}
-
-func (NullOverlay) DisplayName() string {
-	return "null"
-}
@@ -1,182 +0,0 @@
-package mesh
-
-import (
-	"crypto/rand"
-	"encoding/binary"
-	"fmt"
-	"sort"
-	"strconv"
-)
-
-func randBytes(n int) []byte {
-	buf := make([]byte, n)
-	_, err := rand.Read(buf)
-	checkFatal(err)
-	return buf
-}
-
-func randUint64() (r uint64) {
-	return binary.LittleEndian.Uint64(randBytes(8))
-}
-
-func randUint16() (r uint16) {
-	return binary.LittleEndian.Uint16(randBytes(2))
-}
-
-type PeerUID uint64
-
-func randomPeerUID() PeerUID {
-	for {
-		uid := randUint64()
-		if uid != 0 { // uid 0 is reserved for peer placeholder
-			return PeerUID(uid)
-		}
-	}
-}
-
-func ParsePeerUID(s string) (PeerUID, error) {
-	uid, err := strconv.ParseUint(s, 10, 64)
-	return PeerUID(uid), err
-}
-
-// Short IDs exist for the sake of fast datapath.  They are 12 bits,
-// randomly assigned, but we detect and recover from collisions.  This
-// does limit us to 4096 peers, but that should be sufficient for a
-// while.
-type PeerShortID uint16
-
-const PeerShortIDBits = 12
-
-func randomPeerShortID() PeerShortID {
-	return PeerShortID(randUint16() & (1<<PeerShortIDBits - 1))
-}
-
-type PeerSummary struct {
-	NameByte   []byte
-	NickName   string
-	UID        PeerUID
-	Version    uint64
-	ShortID    PeerShortID
-	HasShortID bool
-}
-
-type Peer struct {
-	Name PeerName
-	PeerSummary
-	localRefCount uint64 // maintained by Peers
-	connections   map[PeerName]Connection
-}
-
-type ListOfPeers []*Peer
-
-func (lop ListOfPeers) Len() int {
-	return len(lop)
-}
-func (lop ListOfPeers) Swap(i, j int) {
-	lop[i], lop[j] = lop[j], lop[i]
-}
-func (lop ListOfPeers) Less(i, j int) bool {
-	return lop[i].Name < lop[j].Name
-}
-
-type ConnectionSet map[Connection]struct{}
-
-func NewPeerFromSummary(summary PeerSummary) *Peer {
-	return &Peer{
-		Name:        PeerNameFromBin(summary.NameByte),
-		PeerSummary: summary,
-		connections: make(map[PeerName]Connection),
-	}
-}
-
-func NewPeer(name PeerName, nickName string, uid PeerUID, version uint64, shortID PeerShortID) *Peer {
-	return NewPeerFromSummary(PeerSummary{
-		NameByte:   name.Bin(),
-		NickName:   nickName,
-		UID:        uid,
-		Version:    version,
-		ShortID:    shortID,
-		HasShortID: true,
-	})
-}
-
-func NewPeerPlaceholder(name PeerName) *Peer {
-	return NewPeerFromSummary(PeerSummary{NameByte: name.Bin()})
-}
-
-func NewPeerFrom(peer *Peer) *Peer {
-	return NewPeerFromSummary(peer.PeerSummary)
-}
-
-func (peer *Peer) String() string {
-	return fmt.Sprint(peer.Name, "(", peer.NickName, ")")
-}
-
-// Calculate the routing table from this peer to all peers reachable
-// from it, returning a "next hop" map of PeerNameX -> PeerNameY,
-// which says "in order to send a message to X, the peer should send
-// the message to its neighbour Y".
-//
-// Because currently we do not have weightings on the connections
-// between peers, there is no need to use a minimum spanning tree
-// algorithm. Instead we employ the simpler and cheaper breadth-first
-// widening. The computation is deterministic, which ensures that when
-// it is performed on the same data by different peers, they get the
-// same result. This is important since otherwise we risk message loss
-// or routing cycles.
-//
-// When the 'establishedAndSymmetric' flag is set, only connections
-// that are marked as 'established' and are symmetric (i.e. where both
-// sides indicate they have a connection to the other) are considered.
-//
-// When a non-nil stopAt peer is supplied, the widening stops when it
-// reaches that peer. The boolean return indicates whether that has
-// happened.
-//
-// NB: This function should generally be invoked while holding a read
-// lock on Peers and LocalPeer.
-func (peer *Peer) Routes(stopAt *Peer, establishedAndSymmetric bool) (bool, map[PeerName]PeerName) {
-	routes := make(unicastRoutes)
-	routes[peer.Name] = UnknownPeerName
-	nextWorklist := []*Peer{peer}
-	for len(nextWorklist) > 0 {
-		worklist := nextWorklist
-		sort.Sort(ListOfPeers(worklist))
-		nextWorklist = []*Peer{}
-		for _, curPeer := range worklist {
-			if curPeer == stopAt {
-				return true, routes
-			}
-			curPeer.ForEachConnectedPeer(establishedAndSymmetric, routes,
-				func(remotePeer *Peer) {
-					nextWorklist = append(nextWorklist, remotePeer)
-					remoteName := remotePeer.Name
-					// We now know how to get to remoteName: the same
-					// way we get to curPeer. Except, if curPeer is
-					// the starting peer in which case we know we can
-					// reach remoteName directly.
-					if curPeer == peer {
-						routes[remoteName] = remoteName
-					} else {
-						routes[remoteName] = routes[curPeer.Name]
-					}
-				})
-		}
-	}
-	return false, routes
-}
-
-func (peer *Peer) ForEachConnectedPeer(establishedAndSymmetric bool, exclude map[PeerName]PeerName, f func(*Peer)) {
-	for remoteName, conn := range peer.connections {
-		if establishedAndSymmetric && !conn.Established() {
-			continue
-		}
-		if _, found := exclude[remoteName]; found {
-			continue
-		}
-		remotePeer := conn.Remote()
-		if remoteConn, found := remotePeer.connections[peer.Name]; !establishedAndSymmetric || (found && remoteConn.Established()) {
-			f(remotePeer)
-		}
-	}
-}
@@ -1,46 +0,0 @@
-// +build peer_name_hash
-
-// Let peer names be sha256 hashes...of anything (as long as it's
-// unique).
-
-package mesh
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-)
-
-type PeerName string
-
-const (
-	PeerNameFlavour = "hash"
-	NameSize        = sha256.Size >> 1
-	UnknownPeerName = PeerName("")
-)
-
-func PeerNameFromUserInput(userInput string) (PeerName, error) {
-	// fixed-length identity
-	nameByteAry := sha256.Sum256([]byte(userInput))
-	return PeerNameFromBin(nameByteAry[:NameSize]), nil
-}
-
-func PeerNameFromString(nameStr string) (PeerName, error) {
-	if _, err := hex.DecodeString(nameStr); err != nil {
-		return UnknownPeerName, err
-	}
-	return PeerName(nameStr), nil
-}
-
-func PeerNameFromBin(nameByte []byte) PeerName {
-	return PeerName(hex.EncodeToString(nameByte))
-}
-
-func (name PeerName) Bin() []byte {
-	res, err := hex.DecodeString(string(name))
-	checkFatal(err)
-	return res
-}
-
-func (name PeerName) String() string {
-	return string(name)
-}
@@ -1,75 +0,0 @@
-// The !peer_name_alternative effectively makes this the default,
-// i.e. to choose an alternative, run "go build -tags
-// 'peer_name_alternative peer_name_hash'"
-
-// +build peer_name_mac !peer_name_alternative
-
-// Let peer names be MACs...
-//
-// MACs need to be unique across our network, or bad things will
-// happen anyway. So they make pretty good candidates for peer
-// names. And doing so is pretty efficient both computationally and
-// network overhead wise.
-//
-// Note that we do not mandate *what* MAC should be used as the peer
-// name. In particular it doesn't actually have to be the MAC of, say,
-// the network interface the peer is sniffing on.
-
-package mesh
-
-import (
-	"net"
-)
-
-// PeerName is used as a map key. Since net.HardwareAddr isn't
-// suitable for that - it's a slice, and slices can't be map keys - we
-// convert that to/from uint64.
-type PeerName uint64
-
-const (
-	PeerNameFlavour = "mac"
-	NameSize        = 6
-	UnknownPeerName = PeerName(0)
-)
-
-func PeerNameFromUserInput(userInput string) (PeerName, error) {
-	res, err := PeerNameFromString(userInput)
-	return res, err
-}
-
-func PeerNameFromString(nameStr string) (PeerName, error) {
-	mac, err := net.ParseMAC(nameStr)
-	if err != nil {
-		return UnknownPeerName, err
-	}
-	return PeerName(macint(mac)), nil
-}
-
-func PeerNameFromBin(nameByte []byte) PeerName {
-	return PeerName(macint(net.HardwareAddr(nameByte)))
-}
-
-func (name PeerName) Bin() []byte {
-	return intmac(uint64(name))
-}
-
-func (name PeerName) String() string {
-	return intmac(uint64(name)).String()
-}
-
-func macint(mac net.HardwareAddr) (r uint64) {
-	for _, b := range mac {
-		r <<= 8
-		r |= uint64(b)
-	}
-	return
-}
-
-func intmac(key uint64) (r net.HardwareAddr) {
-	r = make([]byte, 6)
-	for i := 5; i >= 0; i-- {
-		r[i] = byte(key)
-		key >>= 8
-	}
-	return
-}
@@ -1,530 +0,0 @@
-package mesh
-
-import (
-	"bytes"
-	"encoding/gob"
-	"io"
-	"math/rand"
-	"sync"
-)
-
-var void = struct{}{}
-
-type Peers struct {
-	sync.RWMutex
-	ourself   *LocalPeer
-	byName    map[PeerName]*Peer
-	byShortID map[PeerShortID]ShortIDPeers
-	onGC      []func(*Peer)
-
-	// Called when the mapping from short ids to peers changes
-	onInvalidateShortIDs []func()
-}
-
-type ShortIDPeers struct {
-	// If we know about a single peer with the short id, this is
-	// that peer.  If there is a collision, this is the peer with
-	// the lowest Name.
-	peer *Peer
-
-	// In case of a collision, this holds the other peers.
-	others []*Peer
-}
-
-type PeerNameSet map[PeerName]struct{}
-
-type ConnectionSummary struct {
-	NameByte      []byte
-	RemoteTCPAddr string
-	Outbound      bool
-	Established   bool
-}
-
-// Pending notifications due to changes to Peers that need to be sent
-// out once the Peers is unlocked.
-type PeersPendingNotifications struct {
-	// Peers that have been GCed
-	removed []*Peer
-
-	// The mapping from shorts ids to peers changed
-	invalidateShortIDs bool
-
-	// The local short ID needs reassigning due to a collision
-	reassignLocalShortID bool
-
-	// The local peer was modified
-	localPeerModified bool
-}
-
-func NewPeers(ourself *LocalPeer) *Peers {
-	peers := &Peers{
-		ourself:   ourself,
-		byName:    make(map[PeerName]*Peer),
-		byShortID: make(map[PeerShortID]ShortIDPeers),
-	}
-	peers.FetchWithDefault(ourself.Peer)
-	return peers
-}
-
-func (peers *Peers) OnGC(callback func(*Peer)) {
-	peers.Lock()
-	defer peers.Unlock()
-
-	// Although the array underlying peers.onGC might be accessed
-	// without holding the lock in unlockAndNotify, we don't
-	// support removing callbacks, so a simple append here is
-	// safe.
-	peers.onGC = append(peers.onGC, callback)
-}
-
-func (peers *Peers) OnInvalidateShortIDs(callback func()) {
-	peers.Lock()
-	defer peers.Unlock()
-
-	// Safe, as in OnGC
-	peers.onInvalidateShortIDs = append(peers.onInvalidateShortIDs, callback)
-}
-
-func (peers *Peers) unlockAndNotify(pending *PeersPendingNotifications) {
-	broadcastLocalPeer := (pending.reassignLocalShortID && peers.reassignLocalShortID(pending)) ||
-		pending.localPeerModified
-	onGC := peers.onGC
-	onInvalidateShortIDs := peers.onInvalidateShortIDs
-	peers.Unlock()
-
-	if pending.removed != nil {
-		for _, callback := range onGC {
-			for _, peer := range pending.removed {
-				callback(peer)
-			}
-		}
-	}
-
-	if pending.invalidateShortIDs {
-		for _, callback := range onInvalidateShortIDs {
-			callback()
-		}
-	}
-
-	if broadcastLocalPeer {
-		peers.ourself.broadcastPeerUpdate()
-	}
-}
-
-func (peers *Peers) addByShortID(peer *Peer, pending *PeersPendingNotifications) {
-	if !peer.HasShortID {
-		return
-	}
-
-	entry, ok := peers.byShortID[peer.ShortID]
-	if !ok {
-		entry = ShortIDPeers{peer: peer}
-	} else if entry.peer == nil {
-		// This short ID is free, but was used in the past.
-		// Because we are reusing it, it's an invalidation
-		// event.
-		entry.peer = peer
-		pending.invalidateShortIDs = true
-	} else if peer.Name < entry.peer.Name {
-		// Short ID collision, this peer becomes the principal
-		// peer for the short ID, bumping the previous one
-		// into others.
-
-		if entry.peer == peers.ourself.Peer {
-			// The bumped peer is peers.ourself, so we
-			// need to look for a new short id
-			pending.reassignLocalShortID = true
-		}
-
-		entry.others = append(entry.others, entry.peer)
-		entry.peer = peer
-		pending.invalidateShortIDs = true
-	} else {
-		// Short ID collision, this peer is secondary
-		entry.others = append(entry.others, peer)
-	}
-
-	peers.byShortID[peer.ShortID] = entry
-}
-
-func (peers *Peers) deleteByShortID(peer *Peer, pending *PeersPendingNotifications) {
-	if !peer.HasShortID {
-		return
-	}
-
-	entry := peers.byShortID[peer.ShortID]
-	var otherIndex int
-
-	if peer != entry.peer {
-		// peer is secondary, find its index in others
-		otherIndex = -1
-
-		for i, other := range entry.others {
-			if peer == other {
-				otherIndex = i
-				break
-			}
-		}
-
-		if otherIndex < 0 {
-			return
-		}
-	} else if len(entry.others) != 0 {
-		// need to find the peer with the lowest name to
-		// become the new principal one
-		otherIndex = 0
-		minName := entry.others[0].Name
-
-		for i := 1; i < len(entry.others); i++ {
-			otherName := entry.others[i].Name
-			if otherName < minName {
-				minName = otherName
-				otherIndex = i
-			}
-		}
-
-		entry.peer = entry.others[otherIndex]
-		pending.invalidateShortIDs = true
-	} else {
-		// This is the last peer with the short id.  We clear
-		// the entry, don't delete it, in order to detect when
-		// it gets re-used.
-		peers.byShortID[peer.ShortID] = ShortIDPeers{}
-		return
-	}
-
-	entry.others[otherIndex] = entry.others[len(entry.others)-1]
-	entry.others = entry.others[:len(entry.others)-1]
-	peers.byShortID[peer.ShortID] = entry
-}
-
-func (peers *Peers) reassignLocalShortID(pending *PeersPendingNotifications) bool {
-	newShortID, ok := peers.chooseShortID()
-	if ok {
-		peers.setLocalShortID(newShortID, pending)
-		return true
-	}
-
-	// Otherwise we'll try again later on in garbageColleect
-	return false
-}
-
-func (peers *Peers) setLocalShortID(newShortID PeerShortID, pending *PeersPendingNotifications) {
-	peers.deleteByShortID(peers.ourself.Peer, pending)
-	peers.ourself.setShortID(newShortID)
-	peers.addByShortID(peers.ourself.Peer, pending)
-}
-
-// Choose an available short id at random
-func (peers *Peers) chooseShortID() (PeerShortID, bool) {
-	rng := rand.New(rand.NewSource(int64(randUint64())))
-
-	// First, just try picking some short ids at random, and
-	// seeing if they are available:
-	for i := 0; i < 10; i++ {
-		shortID := PeerShortID(rng.Intn(1 << PeerShortIDBits))
-		if peers.byShortID[shortID].peer == nil {
-			return shortID, true
-		}
-	}
-
-	// Looks like most short ids are used.  So count the number of
-	// unused ones, and pick one at random.
-	available := int(1 << PeerShortIDBits)
-	for _, entry := range peers.byShortID {
-		if entry.peer != nil {
-			available--
-		}
-	}
-
-	if available == 0 {
-		// All short ids are used.
-		return 0, false
-	}
-
-	n := rng.Intn(available)
-	var i PeerShortID
-	for {
-		if peers.byShortID[i].peer == nil {
-			if n == 0 {
-				return PeerShortID(i), true
-			}
-
-			n--
-		}
-
-		i++
-	}
-}
-
-func (peers *Peers) FetchWithDefault(peer *Peer) *Peer {
-	peers.Lock()
-	var pending PeersPendingNotifications
-	defer peers.unlockAndNotify(&pending)
-
-	if existingPeer, found := peers.byName[peer.Name]; found {
-		existingPeer.localRefCount++
-		return existingPeer
-	}
-
-	peers.byName[peer.Name] = peer
-	peers.addByShortID(peer, &pending)
-	peer.localRefCount++
-	return peer
-}
-
-func (peers *Peers) Fetch(name PeerName) *Peer {
-	peers.RLock()
-	defer peers.RUnlock()
-	return peers.byName[name]
-}
-
-func (peers *Peers) FetchAndAddRef(name PeerName) *Peer {
-	peers.Lock()
-	defer peers.Unlock()
-	peer := peers.byName[name]
-	if peer != nil {
-		peer.localRefCount++
-	}
-	return peer
-}
-
-func (peers *Peers) FetchByShortID(shortID PeerShortID) *Peer {
-	peers.RLock()
-	defer peers.RUnlock()
-	return peers.byShortID[shortID].peer
-}
-
-func (peers *Peers) Dereference(peer *Peer) {
-	peers.Lock()
-	defer peers.Unlock()
-	peer.localRefCount--
-}
-
-func (peers *Peers) ForEach(fun func(*Peer)) {
-	peers.RLock()
-	defer peers.RUnlock()
-	for _, peer := range peers.byName {
-		fun(peer)
-	}
-}
-
-// Merge an incoming update with our own topology.
-//
-// We add peers hitherto unknown to us, and update peers for which the
-// update contains a more recent version than known to us. The return
-// value is a) a representation of the received update, and b) an
-// "improved" update containing just these new/updated elements.
-func (peers *Peers) ApplyUpdate(update []byte) (PeerNameSet, PeerNameSet, error) {
-	peers.Lock()
-	var pending PeersPendingNotifications
-	defer peers.unlockAndNotify(&pending)
-
-	newPeers, decodedUpdate, decodedConns, err := peers.decodeUpdate(update)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	// Add new peers
-	for name, newPeer := range newPeers {
-		peers.byName[name] = newPeer
-		peers.addByShortID(newPeer, &pending)
-	}
-
-	// Now apply the updates
-	newUpdate := peers.applyUpdate(decodedUpdate, decodedConns, &pending)
-	peers.garbageCollect(&pending)
-	for _, peerRemoved := range pending.removed {
-		delete(newUpdate, peerRemoved.Name)
-	}
-
-	updateNames := make(PeerNameSet)
-	for _, peer := range decodedUpdate {
-		updateNames[peer.Name] = void
-	}
-
-	return updateNames, newUpdate, nil
-}
-
-func (peers *Peers) Names() PeerNameSet {
-	peers.RLock()
-	defer peers.RUnlock()
-
-	names := make(PeerNameSet)
-	for name := range peers.byName {
-		names[name] = void
-	}
-	return names
-}
-
-func (peers *Peers) EncodePeers(names PeerNameSet) []byte {
-	buf := new(bytes.Buffer)
-	enc := gob.NewEncoder(buf)
-	peers.RLock()
-	defer peers.RUnlock()
-	for name := range names {
-		if peer, found := peers.byName[name]; found {
-			if peer == peers.ourself.Peer {
-				peers.ourself.Encode(enc)
-			} else {
-				peer.Encode(enc)
-			}
-		}
-	}
-	return buf.Bytes()
-}
-
-func (peers *Peers) GarbageCollect() {
-	peers.Lock()
-	var pending PeersPendingNotifications
-	defer peers.unlockAndNotify(&pending)
-
-	peers.garbageCollect(&pending)
-}
-
-func (peers *Peers) garbageCollect(pending *PeersPendingNotifications) {
-	peers.ourself.RLock()
-	_, reached := peers.ourself.Routes(nil, false)
-	peers.ourself.RUnlock()
-
-	for name, peer := range peers.byName {
-		if _, found := reached[peer.Name]; !found && peer.localRefCount == 0 {
-			delete(peers.byName, name)
-			peers.deleteByShortID(peer, pending)
-			pending.removed = append(pending.removed, peer)
-		}
-	}
-
-	if peers.byShortID[peers.ourself.ShortID].peer != peers.ourself.Peer {
-		// The local peer doesn't own its short id.  Garbage
-		// collection might have freed some up, so try to
-		// reassign.
-		pending.reassignLocalShortID = true
-	}
-}
-
-func (peers *Peers) decodeUpdate(update []byte) (newPeers map[PeerName]*Peer, decodedUpdate []*Peer, decodedConns [][]ConnectionSummary, err error) {
-	newPeers = make(map[PeerName]*Peer)
-	decodedUpdate = []*Peer{}
-	decodedConns = [][]ConnectionSummary{}
-
-	decoder := gob.NewDecoder(bytes.NewReader(update))
-
-	for {
-		peerSummary, connSummaries, decErr := decodePeer(decoder)
-		if decErr == io.EOF {
-			break
-		} else if decErr != nil {
-			err = decErr
-			return
-		}
-		newPeer := NewPeerFromSummary(peerSummary)
-		decodedUpdate = append(decodedUpdate, newPeer)
-		decodedConns = append(decodedConns, connSummaries)
-		if _, found := peers.byName[newPeer.Name]; !found {
-			newPeers[newPeer.Name] = newPeer
-		}
-	}
-
-	for _, connSummaries := range decodedConns {
-		for _, connSummary := range connSummaries {
-			remoteName := PeerNameFromBin(connSummary.NameByte)
-			if _, found := newPeers[remoteName]; found {
-				continue
-			}
-			if _, found := peers.byName[remoteName]; found {
-				continue
-			}
-			// Update refers to a peer which we have no knowledge of.
-			newPeers[remoteName] = NewPeerPlaceholder(remoteName)
-		}
-	}
-	return
-}
-
-func (peers *Peers) applyUpdate(decodedUpdate []*Peer, decodedConns [][]ConnectionSummary, pending *PeersPendingNotifications) PeerNameSet {
-	newUpdate := make(PeerNameSet)
-	for idx, newPeer := range decodedUpdate {
-		connSummaries := decodedConns[idx]
-		name := newPeer.Name
-		// guaranteed to find peer in the peers.byName
-		switch peer := peers.byName[name]; peer {
-		case peers.ourself.Peer:
-			if newPeer.UID != peer.UID {
-				// The update contains information about an old
-				// incarnation of ourselves. We increase our version
-				// number beyond that which we received, so our
-				// information supersedes the old one when it is
-				// received by other peers.
-				pending.localPeerModified = peers.ourself.setVersionBeyond(newPeer.Version)
-			}
-		case newPeer:
-			peer.connections = makeConnsMap(peer, connSummaries, peers.byName)
-			newUpdate[name] = void
-		default: // existing peer
-			if newPeer.Version < peer.Version ||
-				(newPeer.Version == peer.Version &&
-					(newPeer.UID < peer.UID ||
-						(newPeer.UID == peer.UID &&
-							(!newPeer.HasShortID || peer.HasShortID)))) {
-				continue
-			}
-			peer.Version = newPeer.Version
-			peer.UID = newPeer.UID
-			peer.NickName = newPeer.NickName
-			peer.connections = makeConnsMap(peer, connSummaries, peers.byName)
-
-			if newPeer.ShortID != peer.ShortID || newPeer.HasShortID != peer.HasShortID {
-				peers.deleteByShortID(peer, pending)
-				peer.ShortID = newPeer.ShortID
-				peer.HasShortID = newPeer.HasShortID
-				peers.addByShortID(peer, pending)
-			}
-			newUpdate[name] = void
-		}
-	}
-	return newUpdate
-}
-
-func (peer *Peer) Encode(enc *gob.Encoder) {
-	checkFatal(enc.Encode(peer.PeerSummary))
-
-	connSummaries := []ConnectionSummary{}
-	for _, conn := range peer.connections {
-		connSummaries = append(connSummaries, ConnectionSummary{
-			conn.Remote().NameByte,
-			conn.RemoteTCPAddr(),
-			conn.Outbound(),
-			conn.Established(),
-		})
-	}
-
-	checkFatal(enc.Encode(connSummaries))
-}
-
-func (peer *LocalPeer) Encode(enc *gob.Encoder) {
-	peer.RLock()
-	defer peer.RUnlock()
-	peer.Peer.Encode(enc)
-}
-
-func decodePeer(dec *gob.Decoder) (peerSummary PeerSummary, connSummaries []ConnectionSummary, err error) {
-	if err = dec.Decode(&peerSummary); err != nil {
-		return
-	}
-	if err = dec.Decode(&connSummaries); err != nil {
-		return
-	}
-	return
-}
-
-func makeConnsMap(peer *Peer, connSummaries []ConnectionSummary, byName map[PeerName]*Peer) map[PeerName]Connection {
-	conns := make(map[PeerName]Connection)
-	for _, connSummary := range connSummaries {
-		name := PeerNameFromBin(connSummary.NameByte)
-		remotePeer := byName[name]
-		conn := NewRemoteConnection(peer, remotePeer, connSummary.RemoteTCPAddr, connSummary.Outbound, connSummary.Established)
-		conns[name] = conn
-	}
-	return conns
-}
@@ -1,376 +0,0 @@
-package mesh
-
-import (
-	"fmt"
-	"math/rand"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-// TODO we should also test:
-//
-// - applying an incremental update, including the case where that
-//   leads to an UnknownPeerError
-//
-// - the "improved update" calculation
-//
-// - non-gc of peers that are only referenced locally
-
-func newNode(name PeerName) (*Peer, *Peers) {
-	peer := NewLocalPeer(name, "", nil)
-	peers := NewPeers(peer)
-	return peer.Peer, peers
-}
-
-// Check that ApplyUpdate copies the whole topology from peers
-func checkApplyUpdate(t *testing.T, peers *Peers) {
-	dummyName, _ := PeerNameFromString("99:00:00:01:00:00")
-	// We need a new node outside of the network, with a connection
-	// into it.
-	_, testBedPeers := newNode(dummyName)
-	testBedPeers.AddTestConnection(peers.ourself.Peer)
-	testBedPeers.ApplyUpdate(peers.EncodePeers(peers.Names()))
-
-	checkTopologyPeers(t, true, testBedPeers.allPeersExcept(dummyName), peers.allPeers()...)
-}
-
-func TestPeersEncoding(t *testing.T) {
-	const numNodes = 20
-	const numIters = 1000
-	var peer [numNodes]*Peer
-	var ps [numNodes]*Peers
-	for i := 0; i < numNodes; i++ {
-		name, _ := PeerNameFromString(fmt.Sprintf("%02d:00:00:01:00:00", i))
-		peer[i], ps[i] = newNode(name)
-	}
-
-	var conns []struct{ from, to int }
-	for i := 0; i < numIters; i++ {
-		oper := rand.Intn(2)
-		switch oper {
-		case 0:
-			from, to := rand.Intn(numNodes), rand.Intn(numNodes)
-			if from != to {
-				if _, found := peer[from].connections[peer[to].Name]; !found {
-					ps[from].AddTestConnection(peer[to])
-					conns = append(conns, struct{ from, to int }{from, to})
-					checkApplyUpdate(t, ps[from])
-				}
-			}
-		case 1:
-			if len(conns) > 0 {
-				n := rand.Intn(len(conns))
-				c := conns[n]
-				ps[c.from].DeleteTestConnection(peer[c.to])
-				ps[c.from].GarbageCollect()
-				checkApplyUpdate(t, ps[c.from])
-				conns = append(conns[:n], conns[n+1:]...)
-			}
-		}
-	}
-}
-
-func garbageCollect(peers *Peers) []*Peer {
-	var removed []*Peer
-	peers.OnGC(func(peer *Peer) { removed = append(removed, peer) })
-	peers.GarbageCollect()
-	return removed
-}
-
-func TestPeersGarbageCollection(t *testing.T) {
-	const (
-		peer1NameString = "01:00:00:01:00:00"
-		peer2NameString = "02:00:00:02:00:00"
-		peer3NameString = "03:00:00:03:00:00"
-	)
-	var (
-		peer1Name, _ = PeerNameFromString(peer1NameString)
-		peer2Name, _ = PeerNameFromString(peer2NameString)
-		peer3Name, _ = PeerNameFromString(peer3NameString)
-	)
-
-	// Create some peers with some connections to each other
-	p1, ps1 := newNode(peer1Name)
-	p2, ps2 := newNode(peer2Name)
-	p3, ps3 := newNode(peer3Name)
-	ps1.AddTestConnection(p2)
-	ps2.AddTestRemoteConnection(p1, p2)
-	ps2.AddTestConnection(p1)
-	ps2.AddTestConnection(p3)
-	ps3.AddTestConnection(p1)
-	ps1.AddTestConnection(p3)
-	ps2.AddTestRemoteConnection(p1, p3)
-	ps2.AddTestRemoteConnection(p3, p1)
-
-	// Every peer is referenced, so nothing should be dropped
-	require.Empty(t, garbageCollect(ps1), "peers removed")
-	require.Empty(t, garbageCollect(ps2), "peers removed")
-	require.Empty(t, garbageCollect(ps3), "peers removed")
-
-	// Drop the connection from 2 to 3, and 3 isn't garbage-collected
-	// because 1 has a connection to 3
-	ps2.DeleteTestConnection(p3)
-	require.Empty(t, garbageCollect(ps2), "peers removed")
-
-	// Drop the connection from 1 to 3, and 3 will get removed by
-	// garbage-collection
-	ps1.DeleteTestConnection(p3)
-	checkPeerArray(t, garbageCollect(ps1), p3)
-}
-
-func TestShortIDCollisions(t *testing.T) {
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
-	_, peers := newNode(PeerName(1 << PeerShortIDBits))
-
-	// Make enough peers that short id collisions are
-	// overwhelmingly likely
-	ps := make([]*Peer, 1<<PeerShortIDBits)
-	for i := 0; i < 1<<PeerShortIDBits; i++ {
-		ps[i] = NewPeer(PeerName(i), "", PeerUID(i), 0,
-			PeerShortID(rng.Intn(1<<PeerShortIDBits)))
-	}
-
-	shuffle := func() {
-		for i := range ps {
-			j := rng.Intn(i + 1)
-			ps[i], ps[j] = ps[j], ps[i]
-		}
-	}
-
-	// Fill peers
-	shuffle()
-	var pending PeersPendingNotifications
-	for _, p := range ps {
-		peers.addByShortID(p, &pending)
-	}
-
-	// Check invariants
-	counts := make([]int, 1<<PeerShortIDBits)
-	saw := func(p *Peer) {
-		if p != peers.ourself.Peer {
-			counts[p.UID]++
-		}
-	}
-
-	for shortID, entry := range peers.byShortID {
-		if entry.peer == nil {
-			// no principal peer for this short id, so
-			// others must be empty
-			require.Empty(t, entry.others)
-			continue
-		}
-
-		require.Equal(t, shortID, entry.peer.ShortID)
-		saw(entry.peer)
-
-		for _, p := range entry.others {
-			saw(p)
-			require.Equal(t, shortID, p.ShortID)
-
-			// the principal peer should have the lowest name
-			require.True(t, p.Name > entry.peer.Name)
-		}
-	}
-
-	// Check that every peer was seen
-	for _, n := range counts {
-		require.Equal(t, 1, n)
-	}
-
-	// Delete all the peers
-	shuffle()
-	for _, p := range ps {
-		peers.deleteByShortID(p, &pending)
-	}
-
-	for _, entry := range peers.byShortID {
-		if entry.peer != peers.ourself.Peer {
-			require.Nil(t, entry.peer)
-		}
-
-		require.Empty(t, entry.others)
-	}
-}
-
-// Test the easy case of short id reassignment, when few short ids are taken
-func TestShortIDReassignmentEasy(t *testing.T) {
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
-	_, peers := newNode(PeerName(0))
-
-	for i := 1; i <= 10; i++ {
-		peers.FetchWithDefault(NewPeer(PeerName(i), "", PeerUID(i), 0,
-			PeerShortID(rng.Intn(1<<PeerShortIDBits))))
-	}
-
-	checkShortIDReassignment(t, peers)
-}
-
-// Test the hard case of short id reassignment, when most short ids are taken
-func TestShortIDReassignmentHard(t *testing.T) {
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
-	_, peers := newNode(PeerName(1 << PeerShortIDBits))
-
-	// Take all short ids
-	ps := make([]*Peer, 1<<PeerShortIDBits)
-	var pending PeersPendingNotifications
-	for i := 0; i < 1<<PeerShortIDBits; i++ {
-		ps[i] = NewPeer(PeerName(i), "", PeerUID(i), 0,
-			PeerShortID(i))
-		peers.addByShortID(ps[i], &pending)
-	}
-
-	// As all short ids are taken, an attempted reassigment won't
-	// do anything
-	oldShortID := peers.ourself.ShortID
-	require.False(t, peers.reassignLocalShortID(&pending))
-	require.Equal(t, oldShortID, peers.ourself.ShortID)
-
-	// Free up a few ids
-	for i := 0; i < 10; i++ {
-		x := rng.Intn(len(ps))
-		if ps[x] != nil {
-			peers.deleteByShortID(ps[x], &pending)
-			ps[x] = nil
-		}
-	}
-
-	checkShortIDReassignment(t, peers)
-}
-
-func checkShortIDReassignment(t *testing.T, peers *Peers) {
-	oldShortID := peers.ourself.ShortID
-	peers.reassignLocalShortID(&PeersPendingNotifications{})
-	require.NotEqual(t, oldShortID, peers.ourself.ShortID)
-	require.Equal(t, peers.ourself.Peer, peers.byShortID[peers.ourself.ShortID].peer)
-}
-
-func TestShortIDInvalidation(t *testing.T) {
-	_, peers := newNode(PeerName(1 << PeerShortIDBits))
-
-	// need to use a short id that is not the local peer's
-	shortID := peers.ourself.ShortID + 1
-
-	var pending PeersPendingNotifications
-
-	requireInvalidateShortIDs := func(expect bool) {
-		require.Equal(t, expect, pending.invalidateShortIDs)
-		pending.invalidateShortIDs = false
-	}
-
-	// The use of a fresh short id does not cause invalidation
-	a := NewPeer(PeerName(1), "", PeerUID(1), 0, shortID)
-	peers.addByShortID(a, &pending)
-	requireInvalidateShortIDs(false)
-
-	// An addition which does not change the mapping
-	b := NewPeer(PeerName(2), "", PeerUID(2), 0, shortID)
-	peers.addByShortID(b, &pending)
-	requireInvalidateShortIDs(false)
-
-	// An addition which does change the mapping
-	c := NewPeer(PeerName(0), "", PeerUID(0), 0, shortID)
-	peers.addByShortID(c, &pending)
-	requireInvalidateShortIDs(true)
-
-	// A deletion which does not change the mapping
-	peers.deleteByShortID(b, &pending)
-	requireInvalidateShortIDs(false)
-
-	// A deletion which does change the mapping
-	peers.deleteByShortID(c, &pending)
-	requireInvalidateShortIDs(true)
-
-	// Deleting the last peer with a short id does not cause invalidation
-	peers.deleteByShortID(a, &pending)
-	requireInvalidateShortIDs(false)
-
-	// .. but subsequent reuse of that short id does cause invalidation
-	peers.addByShortID(a, &pending)
-	requireInvalidateShortIDs(true)
-}
-
-func TestShortIDPropagation(t *testing.T) {
-	_, peers1 := newNode(PeerName(1))
-	_, peers2 := newNode(PeerName(2))
-
-	peers1.AddTestConnection(peers2.ourself.Peer)
-	peers1.ApplyUpdate(peers2.EncodePeers(peers2.Names()))
-	peers12 := peers1.Fetch(PeerName(2))
-	old := peers12.PeerSummary
-
-	require.True(t,
-		peers2.reassignLocalShortID(&PeersPendingNotifications{}))
-	peers1.ApplyUpdate(peers2.EncodePeers(peers2.Names()))
-	require.NotEqual(t, old.Version, peers12.Version)
-	require.NotEqual(t, old.ShortID, peers12.ShortID)
-}
-
-func TestShortIDCollision(t *testing.T) {
-	// Create 3 peers
-	_, peers1 := newNode(PeerName(1))
-	_, peers2 := newNode(PeerName(2))
-	_, peers3 := newNode(PeerName(3))
-
-	var pending PeersPendingNotifications
-	peers1.setLocalShortID(1, &pending)
-	peers2.setLocalShortID(2, &pending)
-	peers3.setLocalShortID(3, &pending)
-
-	peers2.AddTestConnection(peers1.ourself.Peer)
-	peers3.AddTestConnection(peers2.ourself.Peer)
-
-	// Propogate from 1 to 2 to 3
-	peers2.ApplyUpdate(peers1.EncodePeers(peers1.Names()))
-	peers3.ApplyUpdate(peers2.EncodePeers(peers2.Names()))
-
-	// Force the short id of peer 1 to collide with peer 2.  Peer
-	// 1 has the lowest name, so it gets to keep the short id
-	peers1.setLocalShortID(2, &pending)
-
-	oldShortID := peers2.ourself.ShortID
-	_, updated, _ := peers2.ApplyUpdate(peers1.EncodePeers(peers1.Names()))
-
-	// peer 2 should have noticed the collision and resolved it
-	require.NotEqual(t, oldShortID, peers2.ourself.ShortID)
-
-	// The Peers do not have a Router, so broadcastPeerUpdate does
-	// nothing in the context of this test.  So we fake what it
-	// would do.
-	updated[PeerName(2)] = void
-
-	// the update from peer 2 should include its short id change
-	peers3.ApplyUpdate(peers2.EncodePeers(updated))
-	require.Equal(t, peers2.ourself.ShortID,
-		peers3.Fetch(PeerName(2)).ShortID)
-}
-
-// Test the case where all short ids are taken, but then some peers go
-// away, so the local peer reassigns
-func TestDeferredShortIDReassignment(t *testing.T) {
-	rng := rand.New(rand.NewSource(time.Now().UnixNano()))
-	_, us := newNode(PeerName(1 << PeerShortIDBits))
-
-	// Connect us to other peers occupying all short ids
-	others := make([]*Peers, 1<<PeerShortIDBits)
-	var pending PeersPendingNotifications
-	for i := range others {
-		_, others[i] = newNode(PeerName(i))
-		others[i].setLocalShortID(PeerShortID(i), &pending)
-		us.AddTestConnection(others[i].ourself.Peer)
-	}
-
-	// Check that, as expected, the local peer does not own its
-	// short id
-	require.NotEqual(t, us.ourself.Peer,
-		us.byShortID[us.ourself.ShortID].peer)
-
-	// Disconnect one peer, and we should now be able to claim its
-	// short id
-	other := others[rng.Intn(1<<PeerShortIDBits)]
-	us.DeleteTestConnection(other.ourself.Peer)
-	us.GarbageCollect()
-
-	require.Equal(t, us.ourself.Peer, us.byShortID[us.ourself.ShortID].peer)
-}
@@ -1,348 +0,0 @@
-package mesh
-
-import (
-	"bytes"
-	"encoding/gob"
-	"encoding/hex"
-	"fmt"
-	"io"
-	"time"
-)
-
-const (
-	Protocol           = "weave"
-	ProtocolMinVersion = 1
-	ProtocolMaxVersion = 2
-)
-
-var (
-	ProtocolBytes = []byte(Protocol)
-
-	HeaderTimeout = 10 * time.Second
-
-	ProtocolV1Features = []string{
-		"ConnID",
-		"Name",
-		"NickName",
-		"PeerNameFlavour",
-		"UID",
-	}
-
-	ErrExpectedCrypto   = fmt.Errorf("Password specified, but peer requested an unencrypted connection")
-	ErrExpectedNoCrypto = fmt.Errorf("No password specificed, but peer requested an encrypted connection")
-)
-
-// We don't need the full net.TCPConn to do the protocol intro.  This
-// interface contains just the parts we do need, to support testing
-type ProtocolIntroConn interface {
-	// io.Reader
-	Read(b []byte) (n int, err error)
-
-	// io.Writer
-	Write(b []byte) (n int, err error)
-
-	// net.Conn's deadline methods
-	SetDeadline(t time.Time) error
-	SetReadDeadline(t time.Time) error
-	SetWriteDeadline(t time.Time) error
-}
-
-type ProtocolIntroParams struct {
-	MinVersion byte
-	MaxVersion byte
-	Features   map[string]string
-	Conn       ProtocolIntroConn
-	Password   []byte
-	Outbound   bool
-}
-
-type ProtocolIntroResults struct {
-	Features   map[string]string
-	Receiver   TCPReceiver
-	Sender     TCPSender
-	SessionKey *[32]byte
-	Version    byte
-}
-
-func (params ProtocolIntroParams) DoIntro() (res ProtocolIntroResults, err error) {
-	if err = params.Conn.SetDeadline(time.Now().Add(HeaderTimeout)); err != nil {
-		return
-	}
-
-	if res.Version, err = params.exchangeProtocolHeader(); err != nil {
-		return
-	}
-
-	var pubKey, privKey *[32]byte
-	if params.Password != nil {
-		if pubKey, privKey, err = GenerateKeyPair(); err != nil {
-			return
-		}
-	}
-
-	if err = params.Conn.SetWriteDeadline(time.Time{}); err != nil {
-		return
-	}
-	if err = params.Conn.SetReadDeadline(time.Now().Add(TCPHeartbeat * 2)); err != nil {
-		return
-	}
-
-	switch res.Version {
-	case 1:
-		err = res.doIntroV1(params, pubKey, privKey)
-	case 2:
-		err = res.doIntroV2(params, pubKey, privKey)
-	default:
-		panic("unhandled protocol version")
-	}
-
-	return
-}
-
-func (params ProtocolIntroParams) exchangeProtocolHeader() (byte, error) {
-	// Write in a separate goroutine to avoid the possibility of
-	// deadlock.  The result channel is of size 1 so that the
-	// goroutine does not linger even if we encounter an error on
-	// the read side.
-	sendHeader := append(ProtocolBytes, params.MinVersion, params.MaxVersion)
-	writeDone := make(chan error, 1)
-	go func() {
-		_, err := params.Conn.Write(sendHeader)
-		writeDone <- err
-	}()
-
-	header := make([]byte, len(ProtocolBytes)+2)
-	if n, err := io.ReadFull(params.Conn, header); err != nil && n == 0 {
-		return 0, fmt.Errorf("failed to receive remote protocol header: %s", err)
-	} else if err != nil {
-		return 0, fmt.Errorf("received incomplete remote protocol header (%d octets instead of %d): %v; error: %s",
-			n, len(header), header[:n], err)
-	}
-
-	if !bytes.Equal(ProtocolBytes, header[:len(ProtocolBytes)]) {
-		return 0, fmt.Errorf("remote protocol header not recognised: %v", header[:len(ProtocolBytes)])
-	}
-
-	theirMinVersion := header[len(ProtocolBytes)]
-	minVersion := theirMinVersion
-	if params.MinVersion > minVersion {
-		minVersion = params.MinVersion
-	}
-
-	theirMaxVersion := header[len(ProtocolBytes)+1]
-	maxVersion := theirMaxVersion
-	if maxVersion > params.MaxVersion {
-		maxVersion = params.MaxVersion
-	}
-
-	if minVersion > maxVersion {
-		return 0, fmt.Errorf("remote version range [%d,%d] is incompatible with ours [%d,%d]",
-			theirMinVersion, theirMaxVersion,
-			params.MinVersion, params.MaxVersion)
-	}
-
-	if err := <-writeDone; err != nil {
-		return 0, err
-	}
-
-	return maxVersion, nil
-}
-
-// The V1 procotol consists of the protocol identification/version
-// header, followed by a stream of gobified values.  The first value
-// is the encoded features map (never encrypted).  The subsequent
-// values are the messages on the connection (encrypted for an
-// encrypted connection).  For an encrypted connection, the public key
-// is passed in the "PublicKey" feature as a string of hex digits.
-func (res *ProtocolIntroResults) doIntroV1(params ProtocolIntroParams, pubKey, privKey *[32]byte) error {
-	features := filterV1Features(params.Features)
-	if pubKey != nil {
-		features["PublicKey"] = hex.EncodeToString(pubKey[:])
-	}
-
-	enc := gob.NewEncoder(params.Conn)
-	dec := gob.NewDecoder(params.Conn)
-
-	// Encode in a separate goroutine to avoid the possibility of
-	// deadlock.  The result channel is of size 1 so that the
-	// goroutine does not linger even if we encounter an error on
-	// the read side.
-	encodeDone := make(chan error, 1)
-	go func() {
-		encodeDone <- enc.Encode(features)
-	}()
-
-	if err := dec.Decode(&res.Features); err != nil {
-		return err
-	}
-
-	if err := <-encodeDone; err != nil {
-		return err
-	}
-
-	res.Sender = NewGobTCPSender(enc)
-	res.Receiver = NewGobTCPReceiver(dec)
-
-	if pubKey == nil {
-		if _, present := res.Features["PublicKey"]; present {
-			return ErrExpectedNoCrypto
-		}
-	} else {
-		remotePubKeyStr, ok := res.Features["PublicKey"]
-		if !ok {
-			return ErrExpectedCrypto
-		}
-
-		remotePubKey, err := hex.DecodeString(remotePubKeyStr)
-		if err != nil {
-			return err
-		}
-
-		res.setupCrypto(params, remotePubKey, privKey)
-	}
-
-	res.Features = filterV1Features(res.Features)
-	return nil
-}
-
-// In the V1 protocol, the intro fields are sent unencrypted.  So we
-// restrict them to an established subset of fields that are assumed
-// to be safe.
-func filterV1Features(intro map[string]string) map[string]string {
-	safe := make(map[string]string)
-	for _, k := range ProtocolV1Features {
-		if val, ok := intro[k]; ok {
-			safe[k] = val
-		}
-	}
-
-	return safe
-}
-
-// The V2 procotol consists of the protocol identification/version
-// header, followed by:
-//
-// - A single "encryption flag" byte: 0 for no encryption, 1 for
-// encryption.
-//
-// - When the connection is encrypted, 32 bytes follow containing the
-// public key.
-//
-// - Then a stream of length-prefixed messages, which are encrypted
-// for an encrypted connection.
-//
-// The first message contains the encoded features map (so in contrast
-// to V1, it will be encrypted on an encrypted connection).
-func (res *ProtocolIntroResults) doIntroV2(params ProtocolIntroParams, pubKey, privKey *[32]byte) error {
-	// Public key exchange
-	var wbuf []byte
-	if pubKey == nil {
-		wbuf = []byte{0}
-	} else {
-		wbuf = make([]byte, 1+len(*pubKey))
-		wbuf[0] = 1
-		copy(wbuf[1:], (*pubKey)[:])
-	}
-
-	// Write in a separate goroutine to avoid the possibility of
-	// deadlock.  The result channel is of size 1 so that the
-	// goroutine does not linger even if we encounter an error on
-	// the read side.
-	writeDone := make(chan error, 1)
-	go func() {
-		_, err := params.Conn.Write(wbuf)
-		writeDone <- err
-	}()
-
-	rbuf := make([]byte, 1)
-	if _, err := io.ReadFull(params.Conn, rbuf); err != nil {
-		return err
-	}
-
-	switch rbuf[0] {
-	case 0:
-		if pubKey != nil {
-			return ErrExpectedCrypto
-		}
-
-		res.Sender = NewLengthPrefixTCPSender(params.Conn)
-		res.Receiver = NewLengthPrefixTCPReceiver(params.Conn)
-
-	case 1:
-		if pubKey == nil {
-			return ErrExpectedNoCrypto
-		}
-
-		rbuf = make([]byte, len(pubKey))
-		if _, err := io.ReadFull(params.Conn, rbuf); err != nil {
-			return err
-		}
-
-		res.Sender = NewLengthPrefixTCPSender(params.Conn)
-		res.Receiver = NewLengthPrefixTCPReceiver(params.Conn)
-		res.setupCrypto(params, rbuf, privKey)
-
-	default:
-		return fmt.Errorf("Bad encryption flag %d", rbuf[0])
-	}
-
-	if err := <-writeDone; err != nil {
-		return err
-	}
-
-	// Features exchange
-	go func() {
-		buf := new(bytes.Buffer)
-		if err := gob.NewEncoder(buf).Encode(&params.Features); err != nil {
-			writeDone <- err
-			return
-		}
-
-		writeDone <- res.Sender.Send(buf.Bytes())
-	}()
-
-	rbuf, err := res.Receiver.Receive()
-	if err != nil {
-		return err
-	}
-
-	if err := gob.NewDecoder(bytes.NewReader(rbuf)).Decode(&res.Features); err != nil {
-		return err
-	}
-
-	if err := <-writeDone; err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (res *ProtocolIntroResults) setupCrypto(params ProtocolIntroParams, remotePubKey []byte, privKey *[32]byte) {
-	var remotePubKeyArr [32]byte
-	copy(remotePubKeyArr[:], remotePubKey)
-	res.SessionKey = FormSessionKey(&remotePubKeyArr, privKey, params.Password)
-	res.Sender = NewEncryptedTCPSender(res.Sender, res.SessionKey, params.Outbound)
-	res.Receiver = NewEncryptedTCPReceiver(res.Receiver, res.SessionKey, params.Outbound)
-}
-
-type ProtocolTag byte
-
-const (
-	ProtocolHeartbeat = iota
-	ProtocolReserved1 // legacy overlay control messages
-	ProtocolReserved2 //
-	ProtocolReserved3 //
-	ProtocolGossip
-	ProtocolGossipUnicast
-	ProtocolGossipBroadcast
-	ProtocolOverlayControlMsg
-)
-
-type ProtocolMsg struct {
-	tag ProtocolTag
-	msg []byte
-}
-
-type ProtocolSender interface {
-	SendProtocolMsg(m ProtocolMsg)
-}
@@ -1,180 +0,0 @@
-package mesh
-
-import (
-	"crypto/rand"
-	"crypto/sha256"
-	"encoding/binary"
-	"encoding/gob"
-	"fmt"
-	"io"
-	"sync"
-
-	"golang.org/x/crypto/nacl/box"
-	"golang.org/x/crypto/nacl/secretbox"
-)
-
-const MaxTCPMsgSize = 10 * 1024 * 1024
-
-func GenerateKeyPair() (publicKey, privateKey *[32]byte, err error) {
-	return box.GenerateKey(rand.Reader)
-}
-
-func FormSessionKey(remotePublicKey, localPrivateKey *[32]byte, secretKey []byte) *[32]byte {
-	var sharedKey [32]byte
-	box.Precompute(&sharedKey, remotePublicKey, localPrivateKey)
-	sharedKeySlice := sharedKey[:]
-	sharedKeySlice = append(sharedKeySlice, secretKey...)
-	sessionKey := sha256.Sum256(sharedKeySlice)
-	return &sessionKey
-}
-
-// TCP Senders/Receivers
-
-// The lowest 64 bits of the nonce contain the message sequence
-// number. The top most bit indicates the connection polarity at the
-// sender - '1' for outbound; the next indicates protocol type - '1'
-// for TCP. The remaining 126 bits are zero. The polarity is needed so
-// that the two ends of a connection do not use the same nonces; the
-// protocol type so that the TCP connection nonces are distinct from
-// nonces used by overlay connections, if they share the session key.
-// This is a requirement of the NaCl Security Model; see
-// http://nacl.cr.yp.to/box.html.
-type TCPCryptoState struct {
-	sessionKey *[32]byte
-	nonce      [24]byte
-	seqNo      uint64
-}
-
-func NewTCPCryptoState(sessionKey *[32]byte, outbound bool) *TCPCryptoState {
-	s := &TCPCryptoState{sessionKey: sessionKey}
-	if outbound {
-		s.nonce[0] |= (1 << 7)
-	}
-	s.nonce[0] |= (1 << 6)
-	return s
-}
-
-func (s *TCPCryptoState) advance() {
-	s.seqNo++
-	binary.BigEndian.PutUint64(s.nonce[16:24], s.seqNo)
-}
-
-type TCPSender interface {
-	Send([]byte) error
-}
-
-type GobTCPSender struct {
-	encoder *gob.Encoder
-}
-
-type LengthPrefixTCPSender struct {
-	writer io.Writer
-}
-
-type EncryptedTCPSender struct {
-	sync.RWMutex
-	sender TCPSender
-	state  *TCPCryptoState
-}
-
-func NewGobTCPSender(encoder *gob.Encoder) *GobTCPSender {
-	return &GobTCPSender{encoder: encoder}
-}
-
-func (sender *GobTCPSender) Send(msg []byte) error {
-	return sender.encoder.Encode(msg)
-}
-
-func NewLengthPrefixTCPSender(writer io.Writer) *LengthPrefixTCPSender {
-	return &LengthPrefixTCPSender{writer: writer}
-}
-
-func (sender *LengthPrefixTCPSender) Send(msg []byte) error {
-	l := len(msg)
-	if l > MaxTCPMsgSize {
-		return fmt.Errorf("outgoing message exceeds maximum size: %d > %d", l, MaxTCPMsgSize)
-	}
-	// We copy the message so we can send it in a single Write
-	// operation, thus making this thread-safe without locking.
-	prefixedMsg := make([]byte, 4+l)
-	binary.BigEndian.PutUint32(prefixedMsg, uint32(l))
-	copy(prefixedMsg[4:], msg)
-	_, err := sender.writer.Write(prefixedMsg)
-	return err
-}
-
-func NewEncryptedTCPSender(sender TCPSender, sessionKey *[32]byte, outbound bool) *EncryptedTCPSender {
-	return &EncryptedTCPSender{sender: sender, state: NewTCPCryptoState(sessionKey, outbound)}
-}
-
-func (sender *EncryptedTCPSender) Send(msg []byte) error {
-	sender.Lock()
-	defer sender.Unlock()
-	encodedMsg := secretbox.Seal(nil, msg, &sender.state.nonce, sender.state.sessionKey)
-	sender.state.advance()
-	return sender.sender.Send(encodedMsg)
-}
-
-type TCPReceiver interface {
-	Receive() ([]byte, error)
-}
-
-type GobTCPReceiver struct {
-	decoder *gob.Decoder
-}
-
-type LengthPrefixTCPReceiver struct {
-	reader io.Reader
-}
-
-type EncryptedTCPReceiver struct {
-	receiver TCPReceiver
-	state    *TCPCryptoState
-}
-
-func NewGobTCPReceiver(decoder *gob.Decoder) *GobTCPReceiver {
-	return &GobTCPReceiver{decoder: decoder}
-}
-
-func (receiver *GobTCPReceiver) Receive() ([]byte, error) {
-	var msg []byte
-	err := receiver.decoder.Decode(&msg)
-	return msg, err
-}
-
-func NewLengthPrefixTCPReceiver(reader io.Reader) *LengthPrefixTCPReceiver {
-	return &LengthPrefixTCPReceiver{reader: reader}
-}
-
-func (receiver *LengthPrefixTCPReceiver) Receive() ([]byte, error) {
-	lenPrefix := make([]byte, 4)
-	if _, err := io.ReadFull(receiver.reader, lenPrefix); err != nil {
-		return nil, err
-	}
-	l := binary.BigEndian.Uint32(lenPrefix)
-	if l > MaxTCPMsgSize {
-		return nil, fmt.Errorf("incoming message exceeds maximum size: %d > %d", l, MaxTCPMsgSize)
-	}
-	msg := make([]byte, l)
-	_, err := io.ReadFull(receiver.reader, msg)
-	return msg, err
-}
-
-func NewEncryptedTCPReceiver(receiver TCPReceiver, sessionKey *[32]byte, outbound bool) *EncryptedTCPReceiver {
-	return &EncryptedTCPReceiver{receiver: receiver, state: NewTCPCryptoState(sessionKey, !outbound)}
-}
-
-func (receiver *EncryptedTCPReceiver) Receive() ([]byte, error) {
-	msg, err := receiver.receiver.Receive()
-	if err != nil {
-		return nil, err
-	}
-
-	decodedMsg, success := secretbox.Open(nil, msg, &receiver.state.nonce, receiver.state.sessionKey)
-	if !success {
-		return nil, fmt.Errorf("Unable to decrypt TCP msg")
-	}
-
-	receiver.state.advance()
-	return decodedMsg, nil
-}
@@ -1,96 +0,0 @@
-package mesh
-
-import (
-	"io"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-type testConn struct {
-	io.Writer
-	io.Reader
-}
-
-func (testConn) SetDeadline(t time.Time) error {
-	return nil
-}
-
-func (testConn) SetReadDeadline(t time.Time) error {
-	return nil
-}
-
-func (testConn) SetWriteDeadline(t time.Time) error {
-	return nil
-}
-
-func connPair() (ProtocolIntroConn, ProtocolIntroConn) {
-	a := testConn{}
-	b := testConn{}
-	a.Reader, b.Writer = io.Pipe()
-	b.Reader, a.Writer = io.Pipe()
-	return &a, &b
-}
-
-func doIntro(t *testing.T, params ProtocolIntroParams) <-chan ProtocolIntroResults {
-	ch := make(chan ProtocolIntroResults, 1)
-	go func() {
-		res, err := params.DoIntro()
-		require.Nil(t, err)
-		ch <- res
-	}()
-	return ch
-}
-
-func doProtocolIntro(t *testing.T, aver, bver byte, password []byte) byte {
-	aconn, bconn := connPair()
-	aresch := doIntro(t, ProtocolIntroParams{
-		MinVersion: ProtocolMinVersion,
-		MaxVersion: aver,
-		Features:   map[string]string{"Name": "A"},
-		Conn:       aconn,
-		Outbound:   true,
-		Password:   password,
-	})
-	bresch := doIntro(t, ProtocolIntroParams{
-		MinVersion: ProtocolMinVersion,
-		MaxVersion: bver,
-		Features:   map[string]string{"Name": "B"},
-		Conn:       bconn,
-		Outbound:   false,
-		Password:   password,
-	})
-	ares := <-aresch
-	bres := <-bresch
-
-	// Check that features were conveyed
-	require.Equal(t, "B", ares.Features["Name"])
-	require.Equal(t, "A", bres.Features["Name"])
-
-	// Check that Senders and Receivers work
-	go func() {
-		require.Nil(t, ares.Sender.Send([]byte("Hello from A")))
-		require.Nil(t, bres.Sender.Send([]byte("Hello from B")))
-	}()
-
-	data, err := bres.Receiver.Receive()
-	require.Nil(t, err)
-	require.Equal(t, "Hello from A", string(data))
-
-	data, err = ares.Receiver.Receive()
-	require.Nil(t, err)
-	require.Equal(t, "Hello from B", string(data))
-
-	require.Equal(t, ares.Version, bres.Version)
-	return ares.Version
-}
-
-func TestProtocolIntro(t *testing.T) {
-	require.Equal(t, 2, int(doProtocolIntro(t, 2, 2, nil)))
-	require.Equal(t, 2, int(doProtocolIntro(t, 2, 2, []byte("sekr1t"))))
-	require.Equal(t, 1, int(doProtocolIntro(t, 1, 2, nil)))
-	require.Equal(t, 1, int(doProtocolIntro(t, 1, 2, []byte("pa55"))))
-	require.Equal(t, 1, int(doProtocolIntro(t, 2, 1, nil)))
-	require.Equal(t, 1, int(doProtocolIntro(t, 2, 1, []byte("w0rd"))))
-}
@@ -1,198 +0,0 @@
-package mesh
-
-import (
-	"fmt"
-	"math"
-	"net"
-	"sync"
-	"time"
-
-	"github.com/weaveworks/weave/common"
-)
-
-const (
-	Port           = 6783
-	ChannelSize    = 16
-	TCPHeartbeat   = 30 * time.Second
-	GossipInterval = 30 * time.Second
-	MaxDuration    = time.Duration(math.MaxInt64)
-
-	acceptMaxTokens  = 100                    // [1]
-	acceptTokenDelay = 100 * time.Millisecond // [2]
-)
-
-// [1] capacity of token bucket for rate limiting accepts
-
-// [2] control rate at which new tokens are added to the bucket
-
-var (
-	log        = common.Log
-	checkFatal = common.CheckFatal
-	checkWarn  = common.CheckWarn
-)
-
-type Config struct {
-	Port               int
-	ProtocolMinVersion byte
-	Password           []byte
-	ConnLimit          int
-	PeerDiscovery      bool
-	TrustedSubnets     []*net.IPNet
-}
-
-type Router struct {
-	Config
-	Overlay         Overlay
-	Ourself         *LocalPeer
-	Peers           *Peers
-	Routes          *Routes
-	ConnectionMaker *ConnectionMaker
-	gossipLock      sync.RWMutex
-	gossipChannels  GossipChannels
-	TopologyGossip  Gossip
-	acceptLimiter   *TokenBucket
-}
-
-func NewRouter(config Config, name PeerName, nickName string, overlay Overlay) *Router {
-	router := &Router{Config: config, gossipChannels: make(GossipChannels)}
-
-	if overlay == nil {
-		overlay = NullOverlay{}
-	}
-
-	router.Overlay = overlay
-	router.Ourself = NewLocalPeer(name, nickName, router)
-	router.Peers = NewPeers(router.Ourself)
-	router.Peers.OnGC(func(peer *Peer) {
-		log.Println("Removed unreachable peer", peer)
-	})
-	router.Routes = NewRoutes(router.Ourself, router.Peers)
-	router.ConnectionMaker = NewConnectionMaker(router.Ourself, router.Peers, router.Port, router.PeerDiscovery)
-	router.TopologyGossip = router.NewGossip("topology", router)
-	router.acceptLimiter = NewTokenBucket(acceptMaxTokens, acceptTokenDelay)
-
-	return router
-}
-
-// Start listening for TCP connections. This is separate from
-// NewRouter so that gossipers can register before we start forming
-// connections.
-func (router *Router) Start() {
-	router.listenTCP(router.Port)
-}
-
-func (router *Router) Stop() error {
-	// TODO: perform graceful shutdown...
-	return nil
-}
-
-func (router *Router) UsingPassword() bool {
-	return router.Password != nil
-}
-
-func (router *Router) listenTCP(localPort int) {
-	localAddr, err := net.ResolveTCPAddr("tcp4", fmt.Sprint(":", localPort))
-	checkFatal(err)
-	ln, err := net.ListenTCP("tcp4", localAddr)
-	checkFatal(err)
-	go func() {
-		defer ln.Close()
-		for {
-			tcpConn, err := ln.AcceptTCP()
-			if err != nil {
-				log.Errorln(err)
-				continue
-			}
-			router.acceptTCP(tcpConn)
-			router.acceptLimiter.Wait()
-		}
-	}()
-}
-
-func (router *Router) acceptTCP(tcpConn *net.TCPConn) {
-	remoteAddrStr := tcpConn.RemoteAddr().String()
-	log.Printf("->[%s] connection accepted", remoteAddrStr)
-	connRemote := NewRemoteConnection(router.Ourself.Peer, nil, remoteAddrStr, false, false)
-	StartLocalConnection(connRemote, tcpConn, router, true)
-}
-
-// Gossiper methods - the Router is the topology Gossiper
-
-type TopologyGossipData struct {
-	peers  *Peers
-	update PeerNameSet
-}
-
-func (d *TopologyGossipData) Merge(other GossipData) GossipData {
-	names := make(PeerNameSet)
-	for name := range d.update {
-		names[name] = void
-	}
-	for name := range other.(*TopologyGossipData).update {
-		names[name] = void
-	}
-	return &TopologyGossipData{peers: d.peers, update: names}
-}
-
-func (d *TopologyGossipData) Encode() [][]byte {
-	return [][]byte{d.peers.EncodePeers(d.update)}
-}
-
-func (router *Router) BroadcastTopologyUpdate(update []*Peer) {
-	names := make(PeerNameSet)
-	for _, p := range update {
-		names[p.Name] = void
-	}
-	router.TopologyGossip.GossipBroadcast(
-		&TopologyGossipData{peers: router.Peers, update: names})
-}
-
-func (router *Router) OnGossipUnicast(sender PeerName, msg []byte) error {
-	return fmt.Errorf("unexpected topology gossip unicast: %v", msg)
-}
-
-func (router *Router) OnGossipBroadcast(_ PeerName, update []byte) (GossipData, error) {
-	origUpdate, _, err := router.applyTopologyUpdate(update)
-	if err != nil || len(origUpdate) == 0 {
-		return nil, err
-	}
-	return &TopologyGossipData{peers: router.Peers, update: origUpdate}, nil
-}
-
-func (router *Router) Gossip() GossipData {
-	return &TopologyGossipData{peers: router.Peers, update: router.Peers.Names()}
-}
-
-func (router *Router) OnGossip(update []byte) (GossipData, error) {
-	_, newUpdate, err := router.applyTopologyUpdate(update)
-	if err != nil || len(newUpdate) == 0 {
-		return nil, err
-	}
-	return &TopologyGossipData{peers: router.Peers, update: newUpdate}, nil
-}
-
-func (router *Router) applyTopologyUpdate(update []byte) (PeerNameSet, PeerNameSet, error) {
-	origUpdate, newUpdate, err := router.Peers.ApplyUpdate(update)
-	if err != nil {
-		return nil, nil, err
-	}
-	if len(newUpdate) > 0 {
-		router.ConnectionMaker.Refresh()
-		router.Routes.Recalculate()
-	}
-	return origUpdate, newUpdate, nil
-}
-
-func (router *Router) Trusts(remote *RemoteConnection) bool {
-	if tcpAddr, err := net.ResolveTCPAddr("tcp4", remote.remoteTCPAddr); err == nil {
-		for _, trustedSubnet := range router.TrustedSubnets {
-			if trustedSubnet.Contains(tcpAddr.IP) {
-				return true
-			}
-		}
-	} else {
-		// Should not happen as remoteTCPAddr was obtained from TCPConn
-		log.Errorf("Unable to parse remote TCP addr: %s", err)
-	}
-	return false
-}
@@ -1,276 +0,0 @@
-package mesh
-
-import (
-	"math"
-	"sync"
-)
-
-type unicastRoutes map[PeerName]PeerName
-type broadcastRoutes map[PeerName][]PeerName
-
-type Routes struct {
-	sync.RWMutex
-	ourself      *LocalPeer
-	peers        *Peers
-	onChange     []func()
-	unicast      unicastRoutes
-	unicastAll   unicastRoutes // [1]
-	broadcast    broadcastRoutes
-	broadcastAll broadcastRoutes // [1]
-	recalculate  chan<- *struct{}
-	wait         chan<- chan struct{}
-	// [1] based on *all* connections, not just established &
-	// symmetric ones
-}
-
-func NewRoutes(ourself *LocalPeer, peers *Peers) *Routes {
-	recalculate := make(chan *struct{}, 1)
-	wait := make(chan chan struct{})
-	routes := &Routes{
-		ourself:      ourself,
-		peers:        peers,
-		unicast:      make(unicastRoutes),
-		unicastAll:   make(unicastRoutes),
-		broadcast:    make(broadcastRoutes),
-		broadcastAll: make(broadcastRoutes),
-		recalculate:  recalculate,
-		wait:         wait}
-	routes.unicast[ourself.Name] = UnknownPeerName
-	routes.unicastAll[ourself.Name] = UnknownPeerName
-	routes.broadcast[ourself.Name] = []PeerName{}
-	routes.broadcastAll[ourself.Name] = []PeerName{}
-	go routes.run(recalculate, wait)
-	return routes
-}
-
-func (routes *Routes) OnChange(callback func()) {
-	routes.Lock()
-	defer routes.Unlock()
-	routes.onChange = append(routes.onChange, callback)
-}
-
-func (routes *Routes) PeerNames() PeerNameSet {
-	return routes.peers.Names()
-}
-
-func (routes *Routes) Unicast(name PeerName) (PeerName, bool) {
-	routes.RLock()
-	defer routes.RUnlock()
-	hop, found := routes.unicast[name]
-	return hop, found
-}
-
-func (routes *Routes) UnicastAll(name PeerName) (PeerName, bool) {
-	routes.RLock()
-	defer routes.RUnlock()
-	hop, found := routes.unicastAll[name]
-	return hop, found
-}
-
-func (routes *Routes) Broadcast(name PeerName) []PeerName {
-	routes.RLock()
-	defer routes.RUnlock()
-	return routes.broadcast[name]
-}
-
-func (routes *Routes) BroadcastAll(name PeerName) []PeerName {
-	routes.RLock()
-	defer routes.RUnlock()
-	return routes.broadcastAll[name]
-}
-
-// Choose min(log2(n_peers), n_neighbouring_peers) neighbours, with a
-// random distribution that is topology-sensitive, favouring
-// neighbours at the end of "bottleneck links". We determine the
-// latter based on the unicast routing table. If a neighbour appears
-// as the value more frequently than others - meaning that we reach a
-// higher proportion of peers via that neighbour than other neighbours
-// - then it is chosen with a higher probability.
-//
-// Note that we choose log2(n_peers) *neighbours*, not
-// peers. Consequently, on sparsely connected peers this function
-// returns a higher proportion of neighbours than elsewhere. In
-// extremis, on peers with fewer than log2(n_peers) neighbours, all
-// neighbours are returned.
-func (routes *Routes) RandomNeighbours(except PeerName) []PeerName {
-	destinations := make(PeerNameSet)
-	routes.RLock()
-	defer routes.RUnlock()
-	count := int(math.Log2(float64(len(routes.unicastAll))))
-	// depends on go's random map iteration
-	for _, dst := range routes.unicastAll {
-		if dst != UnknownPeerName && dst != except {
-			destinations[dst] = void
-			if len(destinations) >= count {
-				break
-			}
-		}
-	}
-	res := make([]PeerName, 0, len(destinations))
-	for dst := range destinations {
-		res = append(res, dst)
-	}
-	return res
-}
-
-// Request recalculation of the routing table. This is async but can
-// effectively be made synchronous with a subsequent call to
-// EnsureRecalculated.
-func (routes *Routes) Recalculate() {
-	// The use of a 1-capacity channel in combination with the
-	// non-blocking send is an optimisation that results in multiple
-	// requests being coalesced.
-	select {
-	case routes.recalculate <- nil:
-	default:
-	}
-}
-
-// Wait for any preceding Recalculate requests to be processed.
-func (routes *Routes) EnsureRecalculated() {
-	done := make(chan struct{})
-	routes.wait <- done
-	<-done
-}
-
-func (routes *Routes) run(recalculate <-chan *struct{}, wait <-chan chan struct{}) {
-	for {
-		select {
-		case <-recalculate:
-			routes.calculate()
-		case done := <-wait:
-			select {
-			case <-recalculate:
-				routes.calculate()
-			default:
-			}
-			close(done)
-		}
-	}
-}
-
-func (routes *Routes) calculate() {
-	routes.peers.RLock()
-	routes.ourself.RLock()
-	var (
-		oldUnicast   = routes.unicast
-		oldBroadcast = routes.broadcast
-		unicast      = routes.calculateUnicast(true)
-		unicastAll   = routes.calculateUnicast(false)
-		broadcast    = routes.calculateBroadcast(true)
-		broadcastAll = routes.calculateBroadcast(false)
-	)
-	routes.ourself.RUnlock()
-	routes.peers.RUnlock()
-
-	routes.Lock()
-	routes.unicast = unicast
-	routes.unicastAll = unicastAll
-	routes.broadcast = broadcast
-	routes.broadcastAll = broadcastAll
-	onChange := routes.onChange
-	routes.Unlock()
-
-	if !unicast.equals(oldUnicast) || !broadcast.equals(oldBroadcast) {
-		for _, callback := range onChange {
-			callback()
-		}
-	}
-}
-
-// Calculate all the routes for the question: if *we* want to send a
-// packet to Peer X, what is the next hop?
-//
-// When we sniff a packet, we determine the destination peer
-// ourself. Consequently, we can relay the packet via any
-// arbitrary peers - the intermediate peers do not have to have
-// any knowledge of the MAC address at all. Thus there's no need
-// to exchange knowledge of MAC addresses, nor any constraints on
-// the routes that we construct.
-func (routes *Routes) calculateUnicast(establishedAndSymmetric bool) unicastRoutes {
-	_, unicast := routes.ourself.Routes(nil, establishedAndSymmetric)
-	return unicast
-}
-
-// Calculate all the routes for the question: if we receive a
-// broadcast originally from Peer X, which peers should we pass the
-// frames on to?
-//
-// When the topology is stable, and thus all peers perform route
-// calculations based on the same data, the algorithm ensures that
-// broadcasts reach every peer exactly once.
-//
-// This is largely due to properties of the Peer.Routes algorithm. In
-// particular:
-//
-// ForAll X,Y,Z in Peers.
-//     X.Routes(Y) <= X.Routes(Z) \/
-//     X.Routes(Z) <= X.Routes(Y)
-// ForAll X,Y,Z in Peers.
-//     Y =/= Z /\ X.Routes(Y) <= X.Routes(Z) =>
-//     X.Routes(Y) u [P | Y.HasSymmetricConnectionTo(P)] <= X.Routes(Z)
-// where <= is the subset relationship on keys of the returned map.
-func (routes *Routes) calculateBroadcast(establishedAndSymmetric bool) broadcastRoutes {
-	broadcast := make(broadcastRoutes)
-	for _, peer := range routes.peers.byName {
-		hops := []PeerName{}
-		if found, reached := peer.Routes(routes.ourself.Peer, establishedAndSymmetric); found {
-			routes.ourself.ForEachConnectedPeer(establishedAndSymmetric, reached,
-				func(remotePeer *Peer) { hops = append(hops, remotePeer.Name) })
-		}
-		broadcast[peer.Name] = hops
-	}
-	return broadcast
-}
-
-func (a unicastRoutes) equals(b unicastRoutes) bool {
-	for key, aval := range a {
-		if bval, ok := b[key]; !ok || bval != aval {
-			return false
-		}
-	}
-
-	for key := range b {
-		if _, ok := a[key]; !ok {
-			return false
-		}
-	}
-
-	return true
-}
-
-func (a broadcastRoutes) equals(b broadcastRoutes) bool {
-	set := make(map[PeerName]struct{})
-
-	for key, aval := range a {
-		bval, ok := b[key]
-		if !ok {
-			return false
-		}
-
-		for _, peer := range aval {
-			set[peer] = struct{}{}
-		}
-
-		for _, peer := range bval {
-			if _, ok := set[peer]; !ok {
-				return false
-			}
-
-			delete(set, peer)
-		}
-
-		if len(set) != 0 {
-			return false
-		}
-
-	}
-
-	for key := range b {
-		if _, ok := a[key]; !ok {
-			return false
-		}
-	}
-
-	return true
-}
@@ -1,211 +0,0 @@
-package mesh
-
-import (
-	"fmt"
-	"net"
-)
-
-type Status struct {
-	Protocol           string
-	ProtocolMinVersion int
-	ProtocolMaxVersion int
-	Encryption         bool
-	PeerDiscovery      bool
-	Name               string
-	NickName           string
-	Port               int
-	Peers              []PeerStatus
-	UnicastRoutes      []UnicastRouteStatus
-	BroadcastRoutes    []BroadcastRouteStatus
-	Connections        []LocalConnectionStatus
-	Targets            []string
-	OverlayDiagnostics interface{}
-	TrustedSubnets     []string
-}
-
-type PeerStatus struct {
-	Name        string
-	NickName    string
-	UID         PeerUID
-	ShortID     PeerShortID
-	Version     uint64
-	Connections []ConnectionStatus
-}
-
-type ConnectionStatus struct {
-	Name        string
-	NickName    string
-	Address     string
-	Outbound    bool
-	Established bool
-}
-
-type UnicastRouteStatus struct {
-	Dest, Via string
-}
-
-type BroadcastRouteStatus struct {
-	Source string
-	Via    []string
-}
-
-type LocalConnectionStatus struct {
-	Address  string
-	Outbound bool
-	State    string
-	Info     string
-}
-
-func NewStatus(router *Router) *Status {
-	return &Status{
-		Protocol,
-		ProtocolMinVersion,
-		ProtocolMaxVersion,
-		router.UsingPassword(),
-		router.PeerDiscovery,
-		router.Ourself.Name.String(),
-		router.Ourself.NickName,
-		router.Port,
-		NewPeerStatusSlice(router.Peers),
-		NewUnicastRouteStatusSlice(router.Routes),
-		NewBroadcastRouteStatusSlice(router.Routes),
-		NewLocalConnectionStatusSlice(router.ConnectionMaker),
-		NewTargetSlice(router.ConnectionMaker),
-		router.Overlay.Diagnostics(),
-		NewTrustedSubnetsSlice(router.TrustedSubnets)}
-}
-
-func NewPeerStatusSlice(peers *Peers) []PeerStatus {
-	var slice []PeerStatus
-
-	peers.ForEach(func(peer *Peer) {
-		var connections []ConnectionStatus
-		if peer == peers.ourself.Peer {
-			for conn := range peers.ourself.Connections() {
-				connections = append(connections, newConnectionStatus(conn))
-			}
-		} else {
-			// Modifying peer.connections requires a write lock on
-			// Peers, and since we are holding a read lock (due to the
-			// ForEach), access without locking the peer is safe.
-			for _, conn := range peer.connections {
-				connections = append(connections, newConnectionStatus(conn))
-			}
-		}
-		slice = append(slice, PeerStatus{
-			peer.Name.String(),
-			peer.NickName,
-			peer.UID,
-			peer.ShortID,
-			peer.Version,
-			connections})
-	})
-
-	return slice
-}
-
-func newConnectionStatus(c Connection) ConnectionStatus {
-	return ConnectionStatus{
-		c.Remote().Name.String(),
-		c.Remote().NickName,
-		c.RemoteTCPAddr(),
-		c.Outbound(),
-		c.Established()}
-}
-
-func NewUnicastRouteStatusSlice(routes *Routes) []UnicastRouteStatus {
-	routes.RLock()
-	defer routes.RUnlock()
-
-	var slice []UnicastRouteStatus
-	for dest, via := range routes.unicast {
-		slice = append(slice, UnicastRouteStatus{dest.String(), via.String()})
-	}
-	return slice
-}
-
-func NewBroadcastRouteStatusSlice(routes *Routes) []BroadcastRouteStatus {
-	routes.RLock()
-	defer routes.RUnlock()
-
-	var slice []BroadcastRouteStatus
-	for source, via := range routes.broadcast {
-		var hops []string
-		for _, hop := range via {
-			hops = append(hops, hop.String())
-		}
-		slice = append(slice, BroadcastRouteStatus{source.String(), hops})
-	}
-	return slice
-}
-
-func NewLocalConnectionStatusSlice(cm *ConnectionMaker) []LocalConnectionStatus {
-	resultChan := make(chan []LocalConnectionStatus, 0)
-	cm.actionChan <- func() bool {
-		var slice []LocalConnectionStatus
-		for conn := range cm.connections {
-			state := "pending"
-			if conn.Established() {
-				state = "established"
-			}
-			lc, _ := conn.(*LocalConnection)
-			info := fmt.Sprintf("%-6v %v", lc.OverlayConn.DisplayName(), conn.Remote())
-			if lc.Router.UsingPassword() {
-				if lc.Untrusted() {
-					info = fmt.Sprintf("%-11v %v", "encrypted", info)
-				} else {
-					info = fmt.Sprintf("%-11v %v", "unencrypted", info)
-				}
-			}
-			slice = append(slice, LocalConnectionStatus{conn.RemoteTCPAddr(), conn.Outbound(), state, info})
-		}
-		for address, target := range cm.targets {
-			add := func(state, info string) {
-				slice = append(slice, LocalConnectionStatus{address, true, state, info})
-			}
-			switch target.state {
-			case TargetWaiting:
-				until := "never"
-				if !target.tryAfter.IsZero() {
-					until = target.tryAfter.String()
-				}
-				if target.lastError == nil { // shouldn't happen
-					add("waiting", "until: "+until)
-				} else {
-					add("failed", target.lastError.Error()+", retry: "+until)
-				}
-			case TargetAttempting:
-				if target.lastError == nil {
-					add("connecting", "")
-				} else {
-					add("retrying", target.lastError.Error())
-				}
-			case TargetConnected:
-			}
-		}
-		resultChan <- slice
-		return false
-	}
-	return <-resultChan
-}
-
-func NewTargetSlice(cm *ConnectionMaker) []string {
-	resultChan := make(chan []string, 0)
-	cm.actionChan <- func() bool {
-		var slice []string
-		for peer := range cm.directPeers {
-			slice = append(slice, peer)
-		}
-		resultChan <- slice
-		return false
-	}
-	return <-resultChan
-}
-
-func NewTrustedSubnetsSlice(trustedSubnets []*net.IPNet) []string {
-	trustedSubnetStrs := []string{}
-	for _, trustedSubnet := range trustedSubnets {
-		trustedSubnetStrs = append(trustedSubnetStrs, trustedSubnet.String())
-	}
-	return trustedSubnetStrs
-}
@@ -1,45 +0,0 @@
-package mesh
-
-type SurrogateGossipData struct {
-	messages [][]byte
-}
-
-func NewSurrogateGossipData(msg []byte) *SurrogateGossipData {
-	return &SurrogateGossipData{messages: [][]byte{msg}}
-}
-
-func (d *SurrogateGossipData) Encode() [][]byte {
-	return d.messages
-}
-
-func (d *SurrogateGossipData) Merge(other GossipData) GossipData {
-	o := other.(*SurrogateGossipData)
-	messages := make([][]byte, 0, len(d.messages)+len(o.messages))
-	messages = append(messages, d.messages...)
-	messages = append(messages, o.messages...)
-	return &SurrogateGossipData{messages: messages}
-}
-
-// SurrogateGossiper ignores unicasts and relays broadcasts and gossips.
-
-type SurrogateGossiper struct{}
-
-func (*SurrogateGossiper) OnGossipUnicast(sender PeerName, msg []byte) error {
-	return nil
-}
-
-func (*SurrogateGossiper) OnGossipBroadcast(_ PeerName, update []byte) (GossipData, error) {
-	return NewSurrogateGossipData(update), nil
-}
-
-func (*SurrogateGossiper) Gossip() GossipData {
-	return nil
-}
-
-func (*SurrogateGossiper) OnGossip(update []byte) (GossipData, error) {
-	return NewSurrogateGossipData(update), nil
-}
-
-var (
-	surrogateGossiper SurrogateGossiper
-)
@@ -1,42 +0,0 @@
-package mesh
-
-import (
-	"time"
-)
-
-type TokenBucket struct {
-	capacity             int64         // Maximum capacity of bucket
-	tokenInterval        time.Duration // Token replenishment rate
-	refillDuration       time.Duration // Time to refill from empty
-	earliestUnspentToken time.Time
-}
-
-func NewTokenBucket(capacity int64, tokenInterval time.Duration) *TokenBucket {
-	tb := TokenBucket{
-		capacity:       capacity,
-		tokenInterval:  tokenInterval,
-		refillDuration: tokenInterval * time.Duration(capacity)}
-
-	tb.earliestUnspentToken = tb.capacityToken()
-
-	return &tb
-}
-
-func (tb *TokenBucket) Wait() {
-	// If earliest unspent token is in the future, sleep until then
-	time.Sleep(tb.earliestUnspentToken.Sub(time.Now()))
-
-	// Alternatively, enforce bucket capacity if necessary
-	capacityToken := tb.capacityToken()
-	if tb.earliestUnspentToken.Before(capacityToken) {
-		tb.earliestUnspentToken = capacityToken
-	}
-
-	// 'Remove' a token from the bucket
-	tb.earliestUnspentToken = tb.earliestUnspentToken.Add(tb.tokenInterval)
-}
-
-// Determine the historic token timestamp representing a full bucket
-func (tb *TokenBucket) capacityToken() time.Time {
-	return time.Now().Add(-tb.refillDuration).Truncate(tb.tokenInterval)
-}
@@ -5,8 +5,10 @@ import (
 	"fmt"
 	"math/rand"
 	"net"
+	"os"
 	"sort"
 	"strings"
+	"sync"
 	"time"

 	"github.com/miekg/dns"
@@ -17,7 +19,6 @@ import (
 const (
 	topDomain        = "."
 	reverseDNSdomain = "in-addr.arpa."
-	etcResolvConf    = "/etc/resolv.conf"
 	udpBuffSize      = uint16(4096)
 	minUDPSize       = 512

@@ -26,16 +27,48 @@ const (
 	DefaultClientTimeout = 5 * time.Second
 )

-type DNSServer struct {
-	ns      *Nameserver
-	domain  string
-	ttl     uint32
-	address string
+type Upstream interface {
+	Config() *dns.ClientConfig
+}

-	servers   []*dns.Server
-	upstream  *dns.ClientConfig
-	tcpClient *dns.Client
-	udpClient *dns.Client
+func NewUpstream(resolvConf, filterAddress string) Upstream {
+	return &upstream{
+		resolvConf:    resolvConf,
+		filterAddress: filterAddress,
+		cachedConfig:  &dns.ClientConfig{}}
+}
+
+type upstream struct {
+	sync.Mutex
+
+	resolvConf    string
+	filterAddress string
+	cachedConfig  *dns.ClientConfig
+	lastStat      time.Time
+	lastModified  time.Time
+}
+
+func (u *upstream) Config() *dns.ClientConfig {
+	u.Lock()
+	defer u.Unlock()
+
+	// If we checked less than five seconds ago return what we already have
+	now := time.Now()
+	if now.Sub(u.lastStat) < 5*time.Second {
+		return u.cachedConfig
+	}
+	u.lastStat = now
+
+	// Reread file if it has changed
+	if fi, err := os.Stat(u.resolvConf); err == nil && fi.ModTime() != u.lastModified {
+		if config, err := dns.ClientConfigFromFile(u.resolvConf); err == nil {
+			config.Servers = filter(config.Servers, u.filterAddress)
+			u.lastModified = fi.ModTime()
+			u.cachedConfig = config
+		}
+	}
+
+	return u.cachedConfig
 }

 func filter(ss []string, s string) []string {
@@ -49,24 +82,30 @@ func filter(ss []string, s string) []string {
 	return ss
 }

-func NewDNSServer(ns *Nameserver, domain, address, effectiveAddress string, ttl uint32, clientTimeout time.Duration) (*DNSServer, error) {
+type DNSServer struct {
+	ns      *Nameserver
+	domain  string
+	ttl     uint32
+	address string
+
+	servers   []*dns.Server
+	upstream  Upstream
+	tcpClient *dns.Client
+	udpClient *dns.Client
+}
+
+func NewDNSServer(ns *Nameserver, domain, address string, upstream Upstream, ttl uint32, clientTimeout time.Duration) (*DNSServer, error) {
 	s := &DNSServer{
 		ns:        ns,
 		domain:    dns.Fqdn(domain),
 		ttl:       ttl,
 		address:   address,
+		upstream:  upstream,
 		tcpClient: &dns.Client{Net: "tcp", ReadTimeout: clientTimeout},
 		udpClient: &dns.Client{Net: "udp", ReadTimeout: clientTimeout, UDPSize: udpBuffSize},
 	}
-	var err error
-	if s.upstream, err = dns.ClientConfigFromFile(etcResolvConf); err != nil {
-		return nil, err
-	}
-	if s.upstream != nil {
-		s.upstream.Servers = filter(s.upstream.Servers, effectiveAddress)
-	}

-	err = s.listen(address)
+	err := s.listen(address)
 	return s, err
 }

@@ -134,7 +173,7 @@ func (d *DNSServer) createMux(client *dns.Client, defaultMaxResponseSize int) *d

 func (h *handler) handleLocal(w dns.ResponseWriter, req *dns.Msg) {
 	h.ns.debugf("local request: %+v", *req)
-	if len(req.Question) != 1 || req.Question[0].Qtype != dns.TypeA {
+	if len(req.Question) != 1 {
 		h.nameError(w, req)
 		return
 	}
@@ -149,6 +188,12 @@ func (h *handler) handleLocal(w dns.ResponseWriter, req *dns.Msg) {
 		h.nameError(w, req)
 		return
 	}
+	// Per RFC4074, if we have an A but another type was requested,
+	// return 'no error' with empty answer section
+	if req.Question[0].Qtype != dns.TypeA {
+		h.respond(w, h.makeResponse(req, nil))
+		return
+	}

 	header := dns.RR_Header{
 		Name:   req.Question[0].Name,
@@ -204,7 +249,7 @@ func (h *handler) handleRecursive(w dns.ResponseWriter, req *dns.Msg) {
 	h.ns.debugf("recursive request: %+v", *req)

 	// Resolve unqualified names locally
-	if len(req.Question) == 1 && req.Question[0].Qtype == dns.TypeA {
+	if len(req.Question) == 1 {
 		hostname := dns.Fqdn(req.Question[0].Name)
 		if strings.Count(hostname, ".") == 1 {
 			h.handleLocal(w, req)
@@ -212,10 +257,11 @@ func (h *handler) handleRecursive(w dns.ResponseWriter, req *dns.Msg) {
 		}
 	}

-	for _, server := range h.upstream.Servers {
+	upstreamConfig := h.upstream.Config()
+	for _, server := range upstreamConfig.Servers {
 		reqCopy := req.Copy()
 		reqCopy.Id = dns.Id()
-		response, _, err := h.client.Exchange(reqCopy, fmt.Sprintf("%s:%s", server, h.upstream.Port))
+		response, _, err := h.client.Exchange(reqCopy, fmt.Sprintf("%s:%s", server, upstreamConfig.Port))
 		if (err != nil && err != dns.ErrTruncated) || response == nil {
 			h.ns.debugf("error trying %s: %v", server, err)
 			continue
@@ -11,21 +11,26 @@ import (
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/require"

-	"github.com/weaveworks/weave/mesh"
+	"github.com/weaveworks/mesh"
 	"github.com/weaveworks/weave/net/address"
 )

+type mockUpstream struct {
+	config *dns.ClientConfig
+}
+
+func (mu *mockUpstream) Config() *dns.ClientConfig {
+	return mu.config
+}
+
 func startServer(t *testing.T, upstream *dns.ClientConfig) (*DNSServer, *Nameserver, int, int) {
 	peername, err := mesh.PeerNameFromString("00:00:00:02:00:00")
 	require.Nil(t, err)
 	nameserver := New(peername, "", func(mesh.PeerName) bool { return true })
-	dnsserver, err := NewDNSServer(nameserver, "weave.local.", "0.0.0.0:0", "", 30, 5*time.Second)
+	dnsserver, err := NewDNSServer(nameserver, "weave.local.", "0.0.0.0:0", &mockUpstream{upstream}, 30, 5*time.Second)
 	require.Nil(t, err)
 	udpPort := dnsserver.servers[0].PacketConn.LocalAddr().(*net.UDPAddr).Port
 	tcpPort := dnsserver.servers[1].Listener.Addr().(*net.TCPAddr).Port
-	if upstream != nil {
-		dnsserver.upstream = upstream
-	}
 	go dnsserver.ActivateAndServe()
 	return dnsserver, nameserver, udpPort, tcpPort
 }
@@ -8,7 +8,8 @@ import (
 	"strings"
 	"time"

-	"github.com/weaveworks/weave/mesh"
+	"github.com/weaveworks/mesh"
+
 	"github.com/weaveworks/weave/net/address"
 )

@@ -93,6 +94,9 @@ func (e1 *Entry) merge(e2 *Entry) bool {
 		e1.Version = e2.Version
 		e1.Tombstone = e2.Tombstone
 		return true
+	} else if e2.Version == e1.Version && e2.Tombstone > e1.Tombstone {
+		e1.Tombstone = e2.Tombstone
+		return true
 	}
 	return false
 }
@@ -105,6 +109,15 @@ func (e1 *Entry) addLowercase() {
 	e1.lHostname = strings.ToLower(e1.Hostname)
 }

+func (e1 *Entry) tombstone() bool {
+	if e1.Tombstone > 0 {
+		return false
+	}
+	e1.Tombstone = now()
+	e1.Version++
+	return true
+}
+
 func check(es SortableEntries) error {
 	if !sort.IsSorted(es) {
 		return fmt.Errorf("Not sorted!")
@@ -181,9 +194,7 @@ func (es *Entries) tombstone(ourname mesh.PeerName, f func(*Entry) bool) Entries

 	tombstoned := Entries{}
 	for i, e := range *es {
-		if f(&e) && e.Origin == ourname {
-			e.Version++
-			e.Tombstone = now()
+		if f(&e) && e.Origin == ourname && e.tombstone() {
 			(*es)[i] = e
 			tombstoned = append(tombstoned, e)
 		}
@@ -191,6 +202,7 @@ func (es *Entries) tombstone(ourname mesh.PeerName, f func(*Entry) bool) Entries
 	return tombstoned
 }

+// note f() may only modify entries such that they remain in order defined by less()
 func (es *Entries) filter(f func(*Entry) bool) {
 	defer es.checkAndPanic().checkAndPanic()

@@ -205,6 +217,16 @@ func (es *Entries) filter(f func(*Entry) bool) {
 	*es = (*es)[:i]
 }

+func (es Entries) findEqual(e *Entry) (*Entry, bool) {
+	i := sort.Search(len(es), func(i int) bool {
+		return !es[i].insensitiveLess(e)
+	})
+	if i < len(es) && es[i].equal(*e) {
+		return &es[i], true
+	}
+	return nil, false
+}
+
 func (es Entries) lookup(hostname string) Entries {
 	es.checkAndPanic()

@@ -4,8 +4,8 @@ import (
 	"testing"

 	"github.com/stretchr/testify/require"
+	"github.com/weaveworks/mesh"

-	"github.com/weaveworks/weave/mesh"
 	"github.com/weaveworks/weave/net/address"
 )

@@ -86,6 +86,21 @@ func TestTombstone(t *testing.T) {
 		Entry{Hostname: "B", Version: 1, Tombstone: 1234},
 	})
 	require.Equal(t, expected, es)
+
+	// Now try a merge including two entries which differ only in tombstone
+	e2 := make(Entries, len(es))
+	copy(e2, es)
+	e2[1].Tombstone = 5555
+
+	diff := es.merge(e2)
+
+	expected2 := l(Entries{
+		Entry{Hostname: "A"},
+		Entry{Hostname: "B", Version: 1, Tombstone: 5555},
+	})
+	require.Equal(t, expected2, es)
+	expectedDiff := l(Entries{Entry{Hostname: "B", Version: 1, Tombstone: 5555}})
+	require.Equal(t, expectedDiff, diff)
 }

 func TestDelete(t *testing.T) {
@@ -40,16 +40,11 @@ func (n *Nameserver) HandleHTTP(router *mux.Router, dockerCli *docker.Client) {
 			return
 		}

-		if err := n.AddEntry(hostname, container, n.ourName, ip); err != nil {
-			n.badRequest(w, fmt.Errorf("Unable to add entry: %v", err))
-			return
-		}
+		n.AddEntry(hostname, container, n.ourName, ip)

 		if r.FormValue("check-alive") == "true" && dockerCli != nil && dockerCli.IsContainerNotRunning(container) {
 			n.infof("container '%s' is not running: removing", container)
-			if err := n.Delete(hostname, container, ipStr, ip); err != nil {
-				n.infof("failed to remove: %v", err)
-			}
+			n.Delete(hostname, container, ipStr, ip)
 		}

 		w.WriteHeader(204)
@@ -79,10 +74,7 @@ func (n *Nameserver) HandleHTTP(router *mux.Router, dockerCli *docker.Client) {
 			ipStr = "*"
 		}

-		if err := n.Delete(hostname, container, ipStr, ip); err != nil {
-			n.badRequest(w, fmt.Errorf("Unable to delete entries: %v", err))
-			return
-		}
+		n.Delete(hostname, container, ipStr, ip)
 		w.WriteHeader(204)
 	}
 	router.Methods("DELETE").Path("/name/{container}/{ip}").HandlerFunc(deleteHandler)
@@ -6,9 +6,9 @@ import (
 	"time"

 	"github.com/miekg/dns"
+	"github.com/weaveworks/mesh"

-	. "github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/mesh"
+	"github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/net/address"
 )

@@ -73,22 +73,22 @@ func (n *Nameserver) Stop() {
 	n.quit <- struct{}{}
 }

-func (n *Nameserver) broadcastEntries(es ...Entry) error {
+func (n *Nameserver) broadcastEntries(es ...Entry) {
 	if n.gossip == nil || len(es) == 0 {
-		return nil
+		return
 	}
-	return n.gossip.GossipBroadcast(&GossipData{
+	n.gossip.GossipBroadcast(&GossipData{
 		Entries:   Entries(es),
 		Timestamp: now(),
 	})
 }

-func (n *Nameserver) AddEntry(hostname, containerid string, origin mesh.PeerName, addr address.Address) error {
-	n.infof("adding entry %s -> %s", hostname, addr.String())
+func (n *Nameserver) AddEntry(hostname, containerid string, origin mesh.PeerName, addr address.Address) {
 	n.Lock()
+	n.infof("adding entry for %s: %s -> %s", containerid, hostname, addr.String())
 	entry := n.entries.add(hostname, containerid, origin, addr)
 	n.Unlock()
-	return n.broadcastEntries(entry)
+	n.broadcastEntries(entry)
 }

 func (n *Nameserver) Lookup(hostname string) []address.Address {
@@ -121,7 +121,8 @@ func (n *Nameserver) ReverseLookup(ip address.Address) (string, error) {
 	return match.Hostname, nil
 }

-func (n *Nameserver) ContainerStarted(ident string) {}
+func (n *Nameserver) ContainerStarted(ident string)   {}
+func (n *Nameserver) ContainerDestroyed(ident string) {}

 func (n *Nameserver) ContainerDied(ident string) {
 	n.Lock()
@@ -133,9 +134,7 @@ func (n *Nameserver) ContainerDied(ident string) {
 		return false
 	})
 	n.Unlock()
-	if err := n.broadcastEntries(entries...); err != nil {
-		n.errorf("failed to broadcast container %s death: %v", ident, err)
-	}
+	n.broadcastEntries(entries...)
 }

 func (n *Nameserver) PeerGone(peer mesh.PeerName) {
@@ -147,7 +146,7 @@ func (n *Nameserver) PeerGone(peer mesh.PeerName) {
 	})
 }

-func (n *Nameserver) Delete(hostname, containerid, ipStr string, ip address.Address) error {
+func (n *Nameserver) Delete(hostname, containerid, ipStr string, ip address.Address) {
 	n.Lock()
 	n.infof("tombstoning hostname=%s, container=%s, ip=%s", hostname, containerid, ipStr)
 	entries := n.entries.tombstone(n.ourName, func(e *Entry) bool {
@@ -167,7 +166,7 @@ func (n *Nameserver) Delete(hostname, containerid, ipStr string, ip address.Addr
 		return true
 	})
 	n.Unlock()
-	return n.broadcastEntries(entries...)
+	n.broadcastEntries(entries...)
 }

 func (n *Nameserver) deleteTombstones() {
@@ -203,14 +202,43 @@ func (n *Nameserver) receiveGossip(msg []byte) (mesh.GossipData, mesh.GossipData
 		return nil, nil, fmt.Errorf("clock skew of %d detected", delta)
 	}

-	n.Lock()
-	defer n.Unlock()
-
+	// Filter to remove entries from unknown peers, done before we take
+	// the nameserver lock, so we don't have to worry what isKnownPeer locks.
 	gossip.Entries.filter(func(e *Entry) bool {
 		return n.isKnownPeer(e.Origin)
 	})

+	var overriddenEntries []Entry
+	n.Lock()
+
+	// Check entries claiming to originate from us against our current data
+	gossip.Entries.filter(func(e *Entry) bool {
+		if e.Origin == n.ourName {
+			if ourEntry, ok := n.entries.findEqual(e); ok {
+				if ourEntry.Version < e.Version ||
+					(ourEntry.Version == e.Version && ourEntry.Tombstone != e.Tombstone) {
+					// Take our version of the data, but make the version higher than the incoming
+					nextVersion := e.Version + 1
+					*e = *ourEntry
+					e.Version = nextVersion
+					overriddenEntries = append(overriddenEntries, *e)
+				}
+			} else { // We have no entry matching the one that came in with us as Origin
+				if e.tombstone() {
+					overriddenEntries = append(overriddenEntries, *e)
+				}
+			}
+		}
+		return true
+	})
+
 	newEntries := n.entries.merge(gossip.Entries)
+	n.Unlock() // unlock before attempting to broadcast
+
+	// Note that all overriddenEntries have been merged into our entries, either
+	// because we forced the version higher or because they were missing before.
+	n.broadcastEntries(overriddenEntries...)
+
 	if len(newEntries) > 0 {
 		return &GossipData{Entries: newEntries, Timestamp: now()}, &gossip, nil
 	}
@@ -231,12 +259,17 @@ func (n *Nameserver) OnGossipBroadcast(_ mesh.PeerName, msg []byte) (mesh.Gossip
 	return entries, err
 }

+// Logging
+
 func (n *Nameserver) infof(fmt string, args ...interface{}) {
-	Log.Infof("[nameserver %s] "+fmt, append([]interface{}{n.ourName}, args...)...)
+	n.logf(common.Log.Infof, fmt, args...)
 }
 func (n *Nameserver) debugf(fmt string, args ...interface{}) {
-	Log.Debugf("[nameserver %s] "+fmt, append([]interface{}{n.ourName}, args...)...)
+	n.logf(common.Log.Debugf, fmt, args...)
 }
 func (n *Nameserver) errorf(fmt string, args ...interface{}) {
-	Log.Errorf("[nameserver %s] "+fmt, append([]interface{}{n.ourName}, args...)...)
+	n.logf(common.Log.Errorf, fmt, args...)
+}
+func (n *Nameserver) logf(f func(string, ...interface{}), fmt string, args ...interface{}) {
+	f("[nameserver %s] "+fmt, append([]interface{}{n.ourName}, args...)...)
 }
@@ -10,8 +10,8 @@ import (
 	"time"

 	"github.com/stretchr/testify/require"
+	"github.com/weaveworks/mesh"

-	"github.com/weaveworks/weave/mesh"
 	"github.com/weaveworks/weave/net/address"
 	"github.com/weaveworks/weave/testing/gossip"
 )
@@ -117,7 +117,7 @@ func TestNameservers(t *testing.T) {
 		mapping := mapping{hostname, []pair{{nameserver.ourName, addr}}}
 		mappings = append(mappings, mapping)

-		require.Nil(t, nameserver.AddEntry(hostname, "", nameserver.ourName, addr))
+		nameserver.AddEntry(hostname, "", nameserver.ourName, addr)
 		check(nameserver, mapping)
 	}

@@ -132,7 +132,7 @@ func TestNameservers(t *testing.T) {
 		mapping.addrs = append(mapping.addrs, pair{nameserver.ourName, addr})
 		mappings[i] = mapping

-		require.Nil(t, nameserver.AddEntry(mapping.hostname, "", nameserver.ourName, addr))
+		nameserver.AddEntry(mapping.hostname, "", nameserver.ourName, addr)
 		check(nameserver, mapping)
 	}

@@ -157,7 +157,7 @@ func TestNameservers(t *testing.T) {
 		mappings[i] = mapping
 		nameserver := nameserversByName[pair.origin]

-		require.Nil(t, nameserver.Delete(mapping.hostname, "*", pair.addr.String(), pair.addr))
+		nameserver.Delete(mapping.hostname, "*", pair.addr.String(), pair.addr)
 		check(nameserver, mapping)
 	}

@@ -223,15 +223,13 @@ func TestContainerAndPeerDeath(t *testing.T) {
 	require.Nil(t, err)
 	nameserver := makeNameserver(peername)

-	err = nameserver.AddEntry("hostname", "containerid", peername, address.Address(0))
-	require.Nil(t, err)
+	nameserver.AddEntry("hostname", "containerid", peername, address.Address(0))
 	require.Equal(t, []address.Address{0}, nameserver.Lookup("hostname"))

 	nameserver.ContainerDied("containerid")
 	require.Equal(t, []address.Address{}, nameserver.Lookup("hostname"))

-	err = nameserver.AddEntry("hostname", "containerid", peername, address.Address(0))
-	require.Nil(t, err)
+	nameserver.AddEntry("hostname", "containerid", peername, address.Address(0))
 	require.Equal(t, []address.Address{0}, nameserver.Lookup("hostname"))

 	nameserver.PeerGone(peername)
@@ -247,15 +245,13 @@ func TestTombstoneDeletion(t *testing.T) {
 	require.Nil(t, err)
 	nameserver := makeNameserver(peername)

-	err = nameserver.AddEntry("hostname", "containerid", peername, address.Address(0))
-	require.Nil(t, err)
+	nameserver.AddEntry("hostname", "containerid", peername, address.Address(0))
 	require.Equal(t, []address.Address{0}, nameserver.Lookup("hostname"))

 	nameserver.deleteTombstones()
 	require.Equal(t, []address.Address{0}, nameserver.Lookup("hostname"))

-	err = nameserver.Delete("hostname", "containerid", "", address.Address(0))
-	require.Nil(t, err)
+	nameserver.Delete("hostname", "containerid", "", address.Address(0))
 	require.Equal(t, []address.Address{}, nameserver.Lookup("hostname"))
 	require.Equal(t, l(Entries{Entry{
 		ContainerID: "containerid",
@@ -38,7 +38,7 @@ func NewStatus(ns *Nameserver, dnsServer *DNSServer) *Status {

 	return &Status{
 		dnsServer.domain,
-		dnsServer.upstream.Servers,
+		dnsServer.upstream.Config().Servers,
 		dnsServer.address,
 		dnsServer.ttl,
 		entryStatusSlice}
@@ -10,6 +10,7 @@ import (
 // Using 32-bit integer to represent IPv4 address
 type Address uint32
 type Offset uint32
+type Count uint32

 type Range struct {
 	Start, End Address // [Start, End); Start <= End
@@ -18,7 +19,7 @@ type Range struct {
 func NewRange(start Address, size Offset) Range {
 	return Range{Start: start, End: Add(start, size)}
 }
-func (r Range) Size() Offset               { return Subtract(r.End, r.Start) }
+func (r Range) Size() Count                { return Length(r.End, r.Start) }
 func (r Range) String() string             { return fmt.Sprintf("%s-%s", r.Start, r.End-1) }
 func (r Range) Overlaps(or Range) bool     { return !(r.Start >= or.End || r.End <= or.Start) }
 func (r Range) Contains(addr Address) bool { return addr >= r.Start && addr < r.End }
@@ -31,14 +32,81 @@ func (r Range) AsCIDRString() string {
 		}
 		prefixLen--
 	}
-	return CIDR{Start: r.Start, PrefixLen: prefixLen}.String()
+	return CIDR{Addr: r.Start, PrefixLen: prefixLen}.String()
+}
+
+// return the highest bit set in v
+// algorithm from http://graphics.stanford.edu/~seander/bithacks.html#RoundUpPowerOf2
+func msb(v Count) Count {
+	v |= v >> 1
+	v |= v >> 2
+	v |= v >> 4
+	v |= v >> 8
+	v |= v >> 16
+	// Cast to 64-bit to avoid overflow when original v >= 0x80000000
+	return Count((uint64(v) + 1) / 2)
+}
+
+func (r Range) BiggestCIDRRange() Range {
+	sizeMsb := Offset(msb(r.Size()))
+	maskedSize := Offset(r.Size()) & (sizeMsb - 1)
+	maskedStart := Offset(r.Start) & (sizeMsb - 1)
+	if maskedStart == 0 {
+		return NewRange(r.Start, sizeMsb)
+	}
+	if sizeMsb-maskedStart <= maskedSize {
+		return NewRange(Add(r.Start, sizeMsb-maskedStart), sizeMsb)
+	}
+	size := sizeMsb / 2
+	if size >= maskedStart {
+		return NewRange(Add(r.Start, size-maskedStart), size)
+	}
+	return NewRange(Add(r.Start, sizeMsb-maskedStart), size)
+}
+
+func MakeCIDR(subnet CIDR, addr Address) CIDR {
+	return CIDR{Addr: addr, PrefixLen: subnet.PrefixLen}
 }

 type CIDR struct {
-	Start     Address
+	Addr      Address
 	PrefixLen int
 }

+// CIDRs returns a list of CIDR-aligned ranges which cover this range.
+func (r Range) CIDRs() []CIDR {
+	const (
+		fullMask         = ^Address(0)
+		cidrMaxPrefixLen = 32
+	)
+	var cidrs []CIDR
+
+	for start, end := r.Start, r.End-1; end >= start; {
+		mask, prefixLen := fullMask, cidrMaxPrefixLen
+		// Find the smallest mask which would cover some part of [start;end].
+		// Once we found such, apply it by OR'ing
+		for mask > 0 {
+			tmpMask := mask << 1
+			// Check whether mask neither too short nor too long
+			if (start&tmpMask) != start || (start|^tmpMask) > end {
+				break
+			}
+			mask = tmpMask
+			prefixLen--
+		}
+		cidrs = append(cidrs, CIDR{start, prefixLen})
+		// Apply mask
+		start |= ^mask
+		// Check for overflow
+		if start+1 < start {
+			break
+		}
+		start++
+	}
+
+	return cidrs
+}
+
 func ParseIP(s string) (Address, error) {
 	if ip := net.ParseIP(s); ip != nil {
 		return FromIP4(ip), nil
@@ -46,29 +114,50 @@ func ParseIP(s string) (Address, error) {
 	return 0, &net.ParseError{Type: "IP Address", Text: s}
 }

-func ParseCIDR(s string) (Address, CIDR, error) {
+func ParseCIDR(s string) (CIDR, error) {
 	if ip, ipnet, err := net.ParseCIDR(s); err != nil {
-		return 0, CIDR{}, err
+		return CIDR{}, err
 	} else if ipnet.IP.To4() == nil {
-		return 0, CIDR{}, &net.ParseError{Type: "Non-IPv4 address not supported", Text: s}
+		return CIDR{}, &net.ParseError{Type: "Non-IPv4 address not supported", Text: s}
 	} else {
 		prefixLen, _ := ipnet.Mask.Size()
-		return FromIP4(ip), CIDR{Start: FromIP4(ipnet.IP), PrefixLen: prefixLen}, nil
+		return CIDR{Addr: FromIP4(ip), PrefixLen: prefixLen}, nil
 	}
 }

+func NewCIDRs(ranges []Range) (cidrs []CIDR) {
+	for _, r := range ranges {
+		cidrs = append(cidrs, r.CIDRs()...)
+	}
+	return cidrs
+}
+
+func (cidr CIDR) Start() Address {
+	return cidr.Addr
+}
+
+// cidr = [Start; End)
+func (cidr CIDR) End() Address {
+	return cidr.Range().End
+}
+
+func (cidr CIDR) IsSubnet() bool {
+	mask := cidr.Size() - 1
+	return Offset(cidr.Addr)&mask == 0
+}
+
 func (cidr CIDR) Size() Offset { return 1 << uint(32-cidr.PrefixLen) }

 func (cidr CIDR) Range() Range {
-	return NewRange(cidr.Start, cidr.Size())
+	return NewRange(cidr.Addr, cidr.Size())
 }
 func (cidr CIDR) HostRange() Range {
 	// Respect RFC1122 exclusions of first and last addresses
-	return NewRange(cidr.Start+1, cidr.Size()-2)
+	return NewRange(cidr.Addr+1, cidr.Size()-2)
 }

 func (cidr CIDR) String() string {
-	return fmt.Sprintf("%s/%d", cidr.Start.String(), cidr.PrefixLen)
+	return fmt.Sprintf("%s/%d", cidr.Addr.String(), cidr.PrefixLen)
 }

 // FromIP4 converts an ipv4 address to our integer address type
@@ -107,7 +196,12 @@ func Subtract(a, b Address) Offset {
 	return Offset(a - b)
 }

-func Min(a, b Offset) Offset {
+func Length(a, b Address) Count {
+	common.Assert(a >= b)
+	return Count(a - b)
+}
+
+func Min(a, b Count) Count {
 	if a > b {
 		return b
 	}
@@ -0,0 +1,69 @@
+package address
+
+import (
+	"testing"
+	"testing/quick"
+
+	"github.com/stretchr/testify/require"
+)
+
+func isPower2(x Count) bool {
+	if x == 0 {
+		return false
+	}
+	for ; x > 1; x /= 2 {
+		if x&1 != 0 {
+			return false
+		}
+	}
+	return true
+}
+
+func TestBiggestPow2AlignedRange(t *testing.T) {
+	require.Equal(t, NewRange(0, 1), NewRange(0, 1).BiggestCIDRRange())
+	require.Equal(t, NewRange(1, 1), NewRange(1, 2).BiggestCIDRRange())
+	require.Equal(t, NewRange(2, 2), NewRange(1, 3).BiggestCIDRRange())
+	require.Equal(t, NewRange(0, 0x40000000), NewRange(0, 0x7fffffff).BiggestCIDRRange())
+	require.Equal(t, NewRange(0xfffffffe, 1), NewRange(0xfffffffe, 1).BiggestCIDRRange())
+	prop := func(start Address, size Offset) bool {
+		if size > Offset(0xffffffff)-Offset(start) { // out of range
+			return true
+		}
+		r := NewRange(start, size)
+		result := r.BiggestCIDRRange()
+		return r.Contains(result.Start) &&
+			r.Contains(result.End-1) &&
+			isPower2(result.Size()) &&
+			result.Size() > r.Size()/4 &&
+			Count(result.Start)%result.Size() == 0
+	}
+	require.NoError(t, quick.Check(prop, &quick.Config{MaxCount: 1000000}))
+}
+
+func ip(s string) Address {
+	addr, _ := ParseIP(s)
+	return addr
+}
+
+func cidr(s string) CIDR {
+	c, err := ParseCIDR(s)
+	if err != nil {
+		panic(err)
+	}
+	return c
+}
+
+func TestCIDRs(t *testing.T) {
+	start := ip("10.0.0.1")
+	end := ip("10.0.0.9")
+	r := NewRange(start, Subtract(end, start))
+	require.Equal(t,
+		[]CIDR{cidr("10.0.0.1/32"), cidr("10.0.0.2/31"), cidr("10.0.0.4/30"), cidr("10.0.0.8/32")},
+		r.CIDRs())
+}
+
+func TestCIDRStartAndEnd(t *testing.T) {
+	cidr, _ := ParseCIDR("10.0.0.0/24")
+	require.Equal(t, ip("10.0.0.0"), cidr.Start(), "")
+	require.Equal(t, ip("10.0.1.0"), cidr.End(), "")
+}
@@ -0,0 +1,43 @@
+package net
+
+import "fmt"
+import "io"
+import "os"
+
+// Configure the ARP cache parameters for the given interface.  This
+// makes containers react more quickly to a change in the MAC address
+// associated with an IP address.
+func ConfigureARPCache(name string) error {
+	if err := sysctl(fmt.Sprintf("net/ipv4/neigh/%s/base_reachable_time", name), "5"); err != nil {
+		return err
+	}
+	if err := sysctl(fmt.Sprintf("net/ipv4/neigh/%s/delay_first_probe_time", name), "2"); err != nil {
+		return err
+	}
+	if err := sysctl(fmt.Sprintf("net/ipv4/neigh/%s/ucast_solicit", name), "1"); err != nil {
+		return err
+	}
+	return nil
+}
+
+func sysctl(variable, value string) error {
+	f, err := os.OpenFile(fmt.Sprintf("/proc/sys/%s", variable), os.O_WRONLY, 0)
+	if err != nil {
+		return err
+	}
+
+	n, err := io.WriteString(f, value)
+	if err != nil {
+		return err
+	}
+	if n < len(value) {
+		return io.ErrShortWrite
+	}
+
+	err = f.Close()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
@@ -0,0 +1,53 @@
+package net
+
+import (
+	"github.com/vishvananda/netlink"
+)
+
+type BridgeType int
+
+const (
+	WeaveBridgeName = "weave"
+	DatapathName    = "datapath"
+
+	None BridgeType = iota
+	Bridge
+	Fastdp
+	BridgedFastdp
+	Inconsistent
+)
+
+func DetectBridgeType(weaveBridgeName, datapathName string) BridgeType {
+	bridge, _ := netlink.LinkByName(weaveBridgeName)
+	datapath, _ := netlink.LinkByName(datapathName)
+
+	switch {
+	case bridge == nil && datapath == nil:
+		return None
+	case isBridge(bridge) && datapath == nil:
+		return Bridge
+	case isDatapath(bridge) && datapath == nil:
+		return Fastdp
+	case isDatapath(datapath) && isBridge(bridge):
+		return BridgedFastdp
+	default:
+		return Inconsistent
+	}
+}
+
+func isBridge(link netlink.Link) bool {
+	_, isBridge := link.(*netlink.Bridge)
+	return isBridge
+}
+
+func isDatapath(link netlink.Link) bool {
+	switch link.(type) {
+	case *netlink.GenericLink:
+		return link.Type() == "openvswitch"
+	case *netlink.Device:
+		// Assume it's our openvswitch device, and the kernel has not been updated to report the kind.
+		return true
+	default:
+		return false
+	}
+}
@@ -0,0 +1,52 @@
+package net
+
+import "fmt"
+import "syscall"
+import "unsafe"
+
+const (
+	SIOCETHTOOL     = 0x8946     // linux/sockios.h
+	ETHTOOL_STXCSUM = 0x00000017 // linux/ethtool.h
+	IFNAMSIZ        = 16         // linux/if.h
+)
+
+// linux/if.h 'struct ifreq'
+type IFReqData struct {
+	Name [IFNAMSIZ]byte
+	Data uintptr
+}
+
+// linux/ethtool.h 'struct ethtool_value'
+type EthtoolValue struct {
+	Cmd  uint32
+	Data uint32
+}
+
+// Disable TX checksum offload on specified interface
+func EthtoolTXOff(name string) error {
+	if len(name)+1 > IFNAMSIZ {
+		return fmt.Errorf("name too long")
+	}
+
+	value := EthtoolValue{ETHTOOL_STXCSUM, 0}
+	request := IFReqData{Data: uintptr(unsafe.Pointer(&value))}
+
+	copy(request.Name[:], name)
+
+	socket, err := syscall.Socket(syscall.AF_INET, syscall.SOCK_DGRAM, 0)
+	if err != nil {
+		return err
+	}
+	defer syscall.Close(socket)
+
+	_, _, errno := syscall.RawSyscall(syscall.SYS_IOCTL,
+		uintptr(socket),
+		uintptr(SIOCETHTOOL),
+		uintptr(unsafe.Pointer(&request)))
+
+	if errno != 0 {
+		return errno
+	}
+
+	return nil
+}
@@ -19,9 +19,10 @@ func EnsureInterface(ifaceName string) (*net.Interface, error) {

 func ensureInterface(ifaceName string) (*net.Interface, error) {
 	ch := make(chan netlink.LinkUpdate)
-	done := make(chan struct{})
-	defer close(done)
-	if err := netlink.LinkSubscribe(ch, done); err != nil {
+	// NB: We do not supply (and eventually close) a 'done' channel
+	// here since that can cause incorrect file descriptor
+	// re-usage. See https://github.com/weaveworks/weave/issues/2120
+	if err := netlink.LinkSubscribe(ch, nil); err != nil {
 		return nil, err
 	}
 	// check for currently-existing interface after subscribing, to avoid race
@@ -46,9 +47,7 @@ func EnsureInterfaceAndMcastRoute(ifaceName string) (*net.Interface, error) {
 		return nil, err
 	}
 	ch := make(chan netlink.RouteUpdate)
-	done := make(chan struct{})
-	defer close(done)
-	if err := netlink.RouteSubscribe(ch, done); err != nil {
+	if err := netlink.RouteSubscribe(ch, nil); err != nil {
 		return nil, err
 	}
 	dest := net.IPv4(224, 0, 0, 0)
@@ -0,0 +1,18 @@
+package net
+
+import (
+	"fmt"
+	"net"
+	"os"
+)
+
+func ListenUnixSocket(pathname string) (net.Listener, error) {
+	if err := os.Remove(pathname); err != nil && !os.IsNotExist(err) {
+		return nil, fmt.Errorf("Error removing existing unix socket: %s", err)
+	}
+	listener, err := net.Listen("unix", pathname)
+	if err != nil {
+		return nil, fmt.Errorf("ListenUnixSocket failed: %s", err)
+	}
+	return listener, nil
+}
@@ -0,0 +1,37 @@
+package net
+
+import (
+	"runtime"
+
+	"github.com/vishvananda/netlink"
+	"github.com/vishvananda/netns"
+)
+
+func WithNetNS(ns netns.NsHandle, work func() error) error {
+	runtime.LockOSThread()
+	defer runtime.UnlockOSThread()
+
+	oldNs, err := netns.Get()
+	if err == nil {
+		defer oldNs.Close()
+
+		err = netns.Set(ns)
+		if err == nil {
+			defer netns.Set(oldNs)
+
+			err = work()
+		}
+	}
+
+	return err
+}
+
+func WithNetNSLink(ns netns.NsHandle, ifName string, work func(link netlink.Link) error) error {
+	return WithNetNS(ns, func() error {
+		link, err := netlink.LinkByName(ifName)
+		if err != nil {
+			return err
+		}
+		return work(link)
+	})
+}
@@ -3,6 +3,7 @@ package net
 import (
 	"fmt"
 	"net"
+	"os"

 	"github.com/vishvananda/netlink"
 )
@@ -55,3 +56,16 @@ func forEachRoute(ignoreIfaceNames map[string]struct{}, check func(r netlink.Rou
 	}
 	return nil
 }
+
+func AddRoute(link netlink.Link, scope netlink.Scope, dst *net.IPNet, gw net.IP) error {
+	err := netlink.RouteAdd(&netlink.Route{
+		LinkIndex: link.Attrs().Index,
+		Scope:     scope,
+		Dst:       dst,
+		Gw:        gw,
+	})
+	if os.IsExist(err) { // squash duplicate route errors
+		err = nil
+	}
+	return err
+}
@@ -0,0 +1,204 @@
+package net
+
+import (
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/j-keck/arping"
+	"github.com/vishvananda/netlink"
+	"github.com/vishvananda/netns"
+
+	"github.com/weaveworks/weave/common/odp"
+)
+
+// create and attach a veth to the Weave bridge
+func CreateAndAttachVeth(name, peerName, bridgeName string, mtu int, keepTXOn bool, init func(peer netlink.Link) error) (*netlink.Veth, error) {
+	bridge, err := netlink.LinkByName(bridgeName)
+	if err != nil {
+		return nil, fmt.Errorf(`bridge "%s" not present; did you launch weave?`, bridgeName)
+	}
+
+	if mtu == 0 {
+		mtu = bridge.Attrs().MTU
+	}
+	veth := &netlink.Veth{
+		LinkAttrs: netlink.LinkAttrs{
+			Name: name,
+			MTU:  mtu},
+		PeerName: peerName,
+	}
+	if err := netlink.LinkAdd(veth); err != nil {
+		return nil, fmt.Errorf(`could not create veth pair %s-%s: %s`, name, peerName, err)
+	}
+
+	cleanup := func(format string, a ...interface{}) (*netlink.Veth, error) {
+		netlink.LinkDel(veth)
+		return nil, fmt.Errorf(format, a...)
+	}
+
+	switch bridgeType := DetectBridgeType(bridgeName, DatapathName); bridgeType {
+	case Bridge, BridgedFastdp:
+		if err := netlink.LinkSetMasterByIndex(veth, bridge.Attrs().Index); err != nil {
+			return cleanup(`unable to set master of %s: %s`, name, err)
+		}
+		if bridgeType == Bridge && !keepTXOn {
+			if err := EthtoolTXOff(peerName); err != nil {
+				return cleanup(`unable to set tx off on %q: %s`, peerName, err)
+			}
+		}
+	case Fastdp:
+		if err := odp.AddDatapathInterface(bridgeName, name); err != nil {
+			return cleanup(`failed to attach %s to device "%s": %s`, name, bridgeName, err)
+		}
+	default:
+		return cleanup(`invalid bridge configuration`)
+	}
+
+	if init != nil {
+		peer, err := netlink.LinkByName(peerName)
+		if err != nil {
+			return cleanup("unable to find peer veth %s: %s", peerName, err)
+		}
+		if err := init(peer); err != nil {
+			return cleanup("initializing veth: %s", err)
+		}
+	}
+
+	if err := netlink.LinkSetUp(veth); err != nil {
+		return cleanup("unable to bring veth up: %s", err)
+	}
+
+	return veth, nil
+}
+
+func AddAddresses(link netlink.Link, cidrs []*net.IPNet) (newAddrs []*net.IPNet, err error) {
+	existingAddrs, err := netlink.AddrList(link, netlink.FAMILY_V4)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get IP address for %q: %v", link.Attrs().Name, err)
+	}
+	for _, ipnet := range cidrs {
+		if contains(existingAddrs, ipnet) {
+			continue
+		}
+		if err := netlink.AddrAdd(link, &netlink.Addr{IPNet: ipnet}); err != nil {
+			return nil, fmt.Errorf("failed to add IP address to %q: %v", link.Attrs().Name, err)
+		}
+		newAddrs = append(newAddrs, ipnet)
+	}
+	return newAddrs, nil
+}
+
+func contains(addrs []netlink.Addr, addr *net.IPNet) bool {
+	for _, x := range addrs {
+		if addr.IP.Equal(x.IPNet.IP) {
+			return true
+		}
+	}
+	return false
+}
+
+const (
+	VethName   = "ethwe"        // name inside container namespace
+	vethPrefix = "v" + VethName // starts with "veth" to suppress UI notifications
+)
+
+func interfaceExistsInNamespace(ns netns.NsHandle, ifName string) bool {
+	err := WithNetNS(ns, func() error {
+		_, err := netlink.LinkByName(ifName)
+		return err
+	})
+	return err == nil
+}
+
+func AttachContainer(ns netns.NsHandle, id, ifName, bridgeName string, mtu int, withMulticastRoute bool, cidrs []*net.IPNet, keepTXOn bool) error {
+	if !interfaceExistsInNamespace(ns, ifName) {
+		maxIDLen := IFNAMSIZ - 1 - len(vethPrefix+"pl")
+		if len(id) > maxIDLen {
+			id = id[:maxIDLen] // trim passed ID if too long
+		}
+		name, peerName := vethPrefix+"pl"+id, vethPrefix+"pg"+id
+		_, err := CreateAndAttachVeth(name, peerName, bridgeName, mtu, keepTXOn, func(veth netlink.Link) error {
+			if err := netlink.LinkSetNsFd(veth, int(ns)); err != nil {
+				return fmt.Errorf("failed to move veth to container netns: %s", err)
+			}
+			if err := WithNetNS(ns, func() error {
+				if err := netlink.LinkSetName(veth, ifName); err != nil {
+					return err
+				}
+				if err := ConfigureARPCache(ifName); err != nil {
+					return err
+				}
+				return nil
+			}); err != nil {
+				return fmt.Errorf("error setting up interface: %s", err)
+			}
+			return nil
+		})
+		if err != nil {
+			return err
+		}
+	}
+
+	if err := WithNetNSLink(ns, ifName, func(veth netlink.Link) error {
+		newAddresses, err := AddAddresses(veth, cidrs)
+		if err != nil {
+			return err
+		}
+		if err := netlink.LinkSetUp(veth); err != nil {
+			return err
+		}
+		for _, ipnet := range newAddresses {
+			// If we don't wait for a bit here, we see the arp fail to reach the bridge.
+			time.Sleep(1 * time.Millisecond)
+			arping.GratuitousArpOverIfaceByName(ipnet.IP, ifName)
+		}
+		if withMulticastRoute {
+			/* Route multicast packets across the weave network.
+			This must come last in 'attach'. If you change this, change weavewait to match.
+
+			TODO: Add the MTU lock to prevent PMTU discovery for multicast
+			destinations. Without that, the kernel sets the DF flag on
+			multicast packets. Since RFC1122 prohibits sending of ICMP
+			errors for packets with multicast destinations, that causes
+			packets larger than the PMTU to be dropped silently.  */
+
+			_, multicast, _ := net.ParseCIDR("224.0.0.0/4")
+			if err := AddRoute(veth, netlink.SCOPE_LINK, multicast, nil); err != nil {
+				return err
+			}
+		}
+		return nil
+	}); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func DetachContainer(ns netns.NsHandle, id, ifName string, cidrs []*net.IPNet) error {
+	return WithNetNSLink(ns, ifName, func(veth netlink.Link) error {
+		existingAddrs, err := netlink.AddrList(veth, netlink.FAMILY_V4)
+		if err != nil {
+			return fmt.Errorf("failed to get IP address for %q: %v", veth.Attrs().Name, err)
+		}
+		for _, ipnet := range cidrs {
+			if !contains(existingAddrs, ipnet) {
+				continue
+			}
+			if err := netlink.AddrDel(veth, &netlink.Addr{IPNet: ipnet}); err != nil {
+				return fmt.Errorf("failed to remove IP address from %q: %v", veth.Attrs().Name, err)
+			}
+		}
+		addrs, err := netlink.AddrList(veth, netlink.FAMILY_V4)
+		if err != nil {
+			return fmt.Errorf("failed to get IP address for %q: %v", veth.Attrs().Name, err)
+		}
+		if len(addrs) == 0 { // all addresses gone: remove the interface
+			if err := netlink.LinkDel(veth); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}
@@ -1,9 +1,14 @@
-# Weave network driver extension for Docker
+# Weave network driver extension for Docker and Kubernetes

-A [plugin](http://docs.docker.com/engine/extend/plugin_api/) to
-integrate [weave Net](http://weave.works/net/) with Docker.
+This directory implements both a 
+[Docker plugin](http://docs.docker.com/engine/extend/plugin_api/) to
+integrate [Weave Net](http://weave.works/net/) with Docker, and a 
+[Container Network Interface (CNI) plugin](https://github.com/appc/cni#cni---the-container-network-interface),
+to integrate Weave Net with [Kubernetes](http://kubernetes.io/).

-The plugin runs automatically when you `weave launch`, provided your
+The Docker plugin runs automatically when you `weave launch`, provided your
 Docker daemon is version 1.9 or newer.

-More detail [here](http://docs.weave.works/weave/latest_release/plugin.html).
+More detail on the Docker plugin [here](https://www.weave.works/docs/net/latest/plugin/).
+
+More detail on the CNI plugin [here](https://www.weave.works/docs/net/latest/cni-plugin/).
@@ -0,0 +1,80 @@
+package ipamplugin
+
+import (
+	"encoding/json"
+	"fmt"
+	"net"
+
+	"github.com/appc/cni/pkg/skel"
+	"github.com/appc/cni/pkg/types"
+)
+
+func (i *Ipam) CmdAdd(args *skel.CmdArgs) error {
+	result, err := i.Allocate(args)
+	if err != nil {
+		return err
+	}
+	return result.Print()
+}
+
+func (i *Ipam) Allocate(args *skel.CmdArgs) (*types.Result, error) {
+	// extract the things we care about
+	conf, err := loadIPAMConf(args.StdinData)
+	if err != nil {
+		return nil, err
+	}
+	if conf == nil {
+		conf = &ipamConf{}
+	}
+	containerID := args.ContainerID
+	if containerID == "" {
+		return nil, fmt.Errorf("Weave CNI Allocate: blank container name")
+	}
+	var ipnet *net.IPNet
+
+	if conf.Subnet == "" {
+		ipnet, err = i.weave.AllocateIP(containerID)
+	} else {
+		var subnet *net.IPNet
+		subnet, err = types.ParseCIDR(conf.Subnet)
+		if err != nil {
+			return nil, fmt.Errorf("subnet given in config, but not parseable: %s", err)
+		}
+		ipnet, err = i.weave.AllocateIPInSubnet(containerID, subnet)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+	result := &types.Result{
+		IP4: &types.IPConfig{
+			IP:      *ipnet,
+			Gateway: conf.Gateway,
+			Routes:  conf.Routes,
+		},
+	}
+	return result, nil
+}
+
+func (i *Ipam) CmdDel(args *skel.CmdArgs) error {
+	return i.Release(args)
+}
+
+func (i *Ipam) Release(args *skel.CmdArgs) error {
+	return i.weave.ReleaseIPsFor(args.ContainerID)
+}
+
+type ipamConf struct {
+	Subnet  string        `json:"subnet,omitempty"`
+	Gateway net.IP        `json:"gateway,omitempty"`
+	Routes  []types.Route `json:"routes"`
+}
+
+type netConf struct {
+	IPAM *ipamConf `json:"ipam"`
+}
+
+func loadIPAMConf(stdinData []byte) (*ipamConf, error) {
+	var conf netConf
+	return conf.IPAM, json.Unmarshal(stdinData, &conf)
+}
@@ -3,67 +3,129 @@ package ipamplugin
 import (
 	"fmt"
 	"net"
+	"strings"

-	"github.com/docker/libnetwork/ipamapi"
+	"github.com/docker/libnetwork/discoverapi"
 	"github.com/docker/libnetwork/netlabel"
-	godocker "github.com/fsouza/go-dockerclient"
 	"github.com/weaveworks/weave/api"
-	. "github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/common/docker"
+	"github.com/weaveworks/weave/common"
 )

-const (
-	WeaveContainer = "weave"
-)
-
-type ipam struct {
-	client *docker.Client
-	weave  *api.Client
+type Ipam struct {
+	weave *api.Client
 }

-func NewIpam(client *docker.Client, version string) (ipamapi.Ipam, error) {
-	resolver := func() (string, error) {
-		addr, err := client.GetContainerIP(WeaveContainer)
-		if _, ok := err.(*godocker.NoSuchContainer); ok {
-			return "", fmt.Errorf("%s container is not present. Have you launched it?", WeaveContainer)
-		}
-		return addr, err
-	}
-	return &ipam{client: client, weave: api.NewClientWithResolver(resolver)}, nil
+func NewIpam(weave *api.Client) *Ipam {
+	return &Ipam{weave: weave}
 }

-func (i *ipam) GetDefaultAddressSpaces() (string, string, error) {
-	Log.Debugln("GetDefaultAddressSpaces")
+func (i *Ipam) GetDefaultAddressSpaces() (string, string, error) {
+	i.logReq("GetDefaultAddressSpaces")
 	return "weavelocal", "weaveglobal", nil
 }

-func (i *ipam) RequestPool(addressSpace, pool, subPool string, options map[string]string, v6 bool) (string, *net.IPNet, map[string]string, error) {
-	Log.Debugln("RequestPool", addressSpace, pool, subPool, options)
-	cidr, err := i.weave.DefaultSubnet()
-	Log.Debugln("RequestPool returning ", cidr, err)
-	if err != nil {
-		return "", nil, nil, err
+func (i *Ipam) RequestPool(addressSpace, pool, subPool string, options map[string]string, v6 bool) (poolname string, subnet *net.IPNet, data map[string]string, err error) {
+	i.logReq("RequestPool", addressSpace, pool, subPool, options)
+	defer func() { i.logRes("RequestPool", err, poolname, subnet, data) }()
+	if pool == "" {
+		subnet, err = i.weave.DefaultSubnet()
+	} else {
+		_, subnet, err = net.ParseCIDR(pool)
 	}
+	if err != nil {
+		return
+	}
+	iprange := subnet
+	if subPool != "" {
+		if _, iprange, err = net.ParseCIDR(subPool); err != nil {
+			return
+		}
+	}
+	// Cunningly-constructed pool "name" which gives us what we need later
+	poolname = strings.Join([]string{"weave", subnet.String(), iprange.String()}, "-")
 	// Pass back a fake "gateway address"; we don't actually use it,
 	// so just give the network address.
-	data := map[string]string{netlabel.Gateway: cidr.String()}
-	return "weavepool", cidr, data, err
+	data = map[string]string{netlabel.Gateway: subnet.String()}
+	return
 }

-func (i *ipam) ReleasePool(poolID string) error {
-	Log.Debugln("ReleasePool", poolID)
+func (i *Ipam) ReleasePool(poolID string) error {
+	i.logReq("ReleasePool", poolID)
 	return nil
 }

-func (i *ipam) RequestAddress(poolID string, address net.IP, options map[string]string) (*net.IPNet, map[string]string, error) {
-	Log.Debugln("RequestAddress", poolID, address, options)
-	// Pass magic string to weave IPAM, which then stores the address under its own string
-	ip, err := i.weave.AllocateIP("_")
-	Log.Debugln("allocateIP returned", ip, err)
-	return ip, nil, err
+func splitPoolID(poolID string) (subnet, iprange *net.IPNet, err error) {
+	parts := strings.Split(poolID, "-")
+	if len(parts) != 3 || parts[0] != "weave" {
+		err = fmt.Errorf("Unrecognized pool ID: %s", poolID)
+		return
+	}
+	if _, subnet, err = net.ParseCIDR(parts[1]); err != nil {
+		return
+	}
+	if _, iprange, err = net.ParseCIDR(parts[2]); err != nil {
+		return
+	}
+	return
 }

-func (i *ipam) ReleaseAddress(poolID string, address net.IP) error {
-	Log.Debugln("ReleaseAddress", poolID, address)
-	return i.weave.ReleaseIP(address.String())
+func (i *Ipam) RequestAddress(poolID string, address net.IP, options map[string]string) (ip *net.IPNet, _ map[string]string, err error) {
+	i.logReq("RequestAddress", poolID, address, options)
+	defer func() { i.logRes("RequestAddress", err, ip) }()
+	// If we pass magic string "_" to weave IPAM it stores the address under its own string
+	if poolID == "weavepool" { // old-style
+		ip, err = i.weave.AllocateIP("_")
+		return
+	}
+	subnet, iprange, err := splitPoolID(poolID)
+	if err != nil {
+		return
+	}
+	if address != nil { // try to claim specific address requested
+		ip = &net.IPNet{IP: address, Mask: subnet.Mask}
+		if err = i.weave.ClaimIP("_", ip); err != nil {
+			return
+		}
+	} else {
+		// We are lying slightly to IPAM here: the range is not a subnet
+		if ip, err = i.weave.AllocateIPInSubnet("_", iprange); err != nil {
+			return
+		}
+		ip.Mask = subnet.Mask // fix up the subnet we lied about
+	}
+	return
+}
+
+func (i *Ipam) ReleaseAddress(poolID string, address net.IP) error {
+	i.logReq("ReleaseAddress", poolID, address)
+	if subnet, _, err := splitPoolID(poolID); err != nil {
+		return err
+	} else if address.Equal(subnet.IP) { // is it the gateway address we faked earlier?
+		return nil
+	}
+	return i.weave.ReleaseIPsFor(address.String())
+}
+
+// Functions required by ipamapi "contract" but not actually used.
+
+func (i *Ipam) DiscoverNew(discoverapi.DiscoveryType, interface{}) error {
+	return nil
+}
+
+func (i *Ipam) DiscoverDelete(discoverapi.DiscoveryType, interface{}) error {
+	return nil
+}
+
+// logging
+
+func (i *Ipam) logReq(fun string, args ...interface{}) {
+	common.Log.Infoln(append([]interface{}{fmt.Sprintf("[ipam] %s", fun)}, args...)...)
+}
+
+func (i *Ipam) logRes(fun string, err error, args ...interface{}) {
+	if err == nil {
+		common.Log.Debugln(append([]interface{}{fmt.Sprintf("[ipam] %s result", fun)}, args...)...)
+		return
+	}
+	common.Log.Errorf("[ipam] %s: %s", fun, err)
 }
@@ -0,0 +1,193 @@
+package plugin
+
+import (
+	"crypto/rand"
+	"encoding/json"
+	"fmt"
+	"net"
+
+	"github.com/appc/cni/pkg/ipam"
+	"github.com/appc/cni/pkg/skel"
+	"github.com/appc/cni/pkg/types"
+	"github.com/vishvananda/netlink"
+	"github.com/vishvananda/netns"
+	weaveapi "github.com/weaveworks/weave/api"
+	"github.com/weaveworks/weave/common"
+	weavenet "github.com/weaveworks/weave/net"
+	ipamplugin "github.com/weaveworks/weave/plugin/ipam"
+)
+
+var (
+	zeroNetwork = net.IPNet{IP: net.IPv4zero, Mask: net.IPv4Mask(0, 0, 0, 0)}
+	mask32      = net.IPv4Mask(0xff, 0xff, 0xff, 0xff)
+)
+
+type CNIPlugin struct {
+	weave *weaveapi.Client
+}
+
+func NewCNIPlugin(weave *weaveapi.Client) *CNIPlugin {
+	return &CNIPlugin{weave: weave}
+}
+
+func loadNetConf(bytes []byte) (*NetConf, error) {
+	n := &NetConf{
+		BrName: weavenet.WeaveBridgeName,
+	}
+	if err := json.Unmarshal(bytes, n); err != nil {
+		return nil, fmt.Errorf("failed to load netconf: %v", err)
+	}
+	return n, nil
+}
+
+func (c *CNIPlugin) CmdAdd(args *skel.CmdArgs) error {
+	conf, err := loadNetConf(args.StdinData)
+	if err != nil {
+		return err
+	}
+
+	if conf.IsGW {
+		return fmt.Errorf("Gateway functionality not supported")
+	}
+	if conf.IPMasq {
+		return fmt.Errorf("IP Masquerading functionality not supported")
+	}
+
+	var result *types.Result
+	// Default IPAM is Weave's own
+	if conf.IPAM.Type == "" {
+		result, err = ipamplugin.NewIpam(c.weave).Allocate(args)
+	} else {
+		result, err = ipam.ExecAdd(conf.IPAM.Type, args.StdinData)
+	}
+	if err != nil {
+		return fmt.Errorf("unable to allocate IP address: %s", err)
+	}
+	if result.IP4 == nil {
+		return fmt.Errorf("IPAM plugin failed to allocate IP address")
+	}
+
+	// If config says nothing about routes or gateway, default one will be via the bridge
+	if result.IP4.Routes == nil && result.IP4.Gateway == nil {
+		bridgeIP, err := findBridgeIP(conf.BrName, result.IP4.IP)
+		if err != nil {
+			return err
+		}
+		result.IP4.Gateway = bridgeIP
+	}
+
+	ns, err := netns.GetFromPath(args.Netns)
+	if err != nil {
+		return err
+	}
+	defer ns.Close()
+
+	id := args.ContainerID
+	if len(id) < 5 {
+		data := make([]byte, 5)
+		_, err := rand.Reader.Read(data)
+		if err != nil {
+			return err
+		}
+		id = fmt.Sprintf("%x", data)
+	}
+
+	if err := weavenet.AttachContainer(ns, id, args.IfName, conf.BrName, conf.MTU, false, []*net.IPNet{&result.IP4.IP}, false); err != nil {
+		return err
+	}
+	if err := weavenet.WithNetNSLink(ns, args.IfName, func(link netlink.Link) error {
+		return setupRoutes(link, args.IfName, result.IP4.IP, result.IP4.Gateway, result.IP4.Routes)
+	}); err != nil {
+		return fmt.Errorf("error setting up routes: %s", err)
+	}
+
+	result.DNS = conf.DNS
+	return result.Print()
+}
+
+func setupRoutes(link netlink.Link, name string, ipnet net.IPNet, gw net.IP, routes []types.Route) error {
+	var err error
+	if routes == nil { // If config says nothing about routes, add a default one
+		if !ipnet.Contains(gw) {
+			// The bridge IP is not on the same subnet; add a specific route to it
+			gw32 := &net.IPNet{IP: gw, Mask: mask32}
+			if err = weavenet.AddRoute(link, netlink.SCOPE_LINK, gw32, nil); err != nil {
+				return err
+			}
+		}
+		routes = []types.Route{{Dst: zeroNetwork}}
+	}
+	for _, r := range routes {
+		if r.GW != nil {
+			err = weavenet.AddRoute(link, netlink.SCOPE_UNIVERSE, &r.Dst, r.GW)
+		} else {
+			err = weavenet.AddRoute(link, netlink.SCOPE_UNIVERSE, &r.Dst, gw)
+		}
+		if err != nil {
+			return fmt.Errorf("failed to add route '%v via %v dev %v': %v", r.Dst, gw, name, err)
+		}
+	}
+	return nil
+}
+
+func findBridgeIP(bridgeName string, subnet net.IPNet) (net.IP, error) {
+	netdevs, err := common.GetBridgeNetDev(bridgeName)
+	if err != nil {
+		return nil, fmt.Errorf("Failed to get netdev for %q bridge: %s", bridgeName, err)
+	}
+	if len(netdevs) == 0 {
+		return nil, fmt.Errorf("Could not find %q bridge", bridgeName)
+	}
+	if len(netdevs[0].CIDRs) == 0 {
+		return nil, fmt.Errorf("Bridge %q has no IP addresses", bridgeName)
+	}
+	for _, cidr := range netdevs[0].CIDRs {
+		if subnet.Contains(cidr.IP) {
+			return cidr.IP, nil
+		}
+	}
+	// None in the required subnet; just return the first one
+	return netdevs[0].CIDRs[0].IP, nil
+}
+
+func (c *CNIPlugin) CmdDel(args *skel.CmdArgs) error {
+	conf, err := loadNetConf(args.StdinData)
+	if err != nil {
+		return err
+	}
+
+	ns, err := netns.GetFromPath(args.Netns)
+	if err != nil {
+		return err
+	}
+	defer ns.Close()
+	err = weavenet.WithNetNS(ns, func() error {
+		link, err := netlink.LinkByName(args.IfName)
+		if err != nil {
+			return err
+		}
+		return netlink.LinkDel(link)
+	})
+	if err != nil {
+		return fmt.Errorf("error removing interface: %s", err)
+	}
+
+	// Default IPAM is Weave's own
+	if conf.IPAM.Type == "" {
+		err = ipamplugin.NewIpam(c.weave).Release(args)
+	} else {
+		err = ipam.ExecDel(conf.IPAM.Type, args.StdinData)
+	}
+	if err != nil {
+		return fmt.Errorf("unable to release IP address: %s", err)
+	}
+	return nil
+}
+
+type NetConf struct {
+	types.NetConf
+	BrName string `json:"bridge"`
+	IsGW   bool   `json:"isGateway"`
+	IPMasq bool   `json:"ipMasq"`
+	MTU    int    `json:"mtu"`
+}
@@ -2,205 +2,237 @@ package plugin

 import (
 	"fmt"
+	"strconv"
 	"sync"

 	"github.com/docker/libnetwork/drivers/remote/api"
+	"github.com/docker/libnetwork/netlabel"
 	"github.com/docker/libnetwork/types"

-	. "github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/common/docker"
-	"github.com/weaveworks/weave/common/odp"
-	"github.com/weaveworks/weave/plugin/skel"
-
 	"github.com/vishvananda/netlink"
+	weaveapi "github.com/weaveworks/weave/api"
+	"github.com/weaveworks/weave/common"
+	"github.com/weaveworks/weave/common/docker"
+	weavenet "github.com/weaveworks/weave/net"
+	"github.com/weaveworks/weave/plugin/skel"
 )

 const (
-	WeaveContainer = "weave"
-	WeaveBridge    = "weave"
+	MulticastOption = "works.weave.multicast"
 )

-type driver struct {
-	version          string
-	nameserver       string
-	scope            string
-	noMulticastRoute bool
-	sync.RWMutex
-	endpoints map[string]struct{}
+type network struct {
+	isOurs            bool
+	hasMulticastRoute bool
 }

-func New(client *docker.Client, version string, nameserver string, scope string, noMulticastRoute bool) (skel.Driver, error) {
+type driver struct {
+	name   string
+	scope  string
+	docker *docker.Client
+	sync.RWMutex
+	networks map[string]network
+}
+
+func New(client *docker.Client, weave *weaveapi.Client, name, scope string) (skel.Driver, error) {
 	driver := &driver{
-		nameserver:       nameserver,
-		noMulticastRoute: noMulticastRoute,
-		version:          version,
-		scope:            scope,
-		endpoints:        make(map[string]struct{}),
+		name:     name,
+		scope:    scope,
+		docker:   client,
+		networks: make(map[string]network),
 	}

-	_, err := NewWatcher(client, driver)
+	_, err := NewWatcher(client, weave, driver)
 	if err != nil {
 		return nil, err
 	}
 	return driver, nil
 }

-func errorf(format string, a ...interface{}) error {
-	Log.Errorf(format, a...)
-	return fmt.Errorf(format, a...)
-}
-
 // === protocol handlers

 func (driver *driver) GetCapabilities() (*api.GetCapabilityResponse, error) {
+	driver.logReq("GetCapabilities", nil, "")
 	var caps = &api.GetCapabilityResponse{
 		Scope: driver.scope,
 	}
-	Log.Debugf("Get capabilities: responded with %+v", caps)
+	driver.logRes("GetCapabilities", caps)
 	return caps, nil
 }

 func (driver *driver) CreateNetwork(create *api.CreateNetworkRequest) error {
-	Log.Debugf("Create network request %+v", create)
-	Log.Infof("Create network %s", create.NetworkID)
+	driver.logReq("CreateNetwork", create, create.NetworkID)
+	_, err := driver.setupNetworkInfo(create.NetworkID, true, stringOptions(create))
+	return err
+}
+
+// Deal with excessively-generic way the options get decoded from JSON
+func stringOptions(create *api.CreateNetworkRequest) map[string]string {
+	if create.Options != nil {
+		if data, found := create.Options[netlabel.GenericData]; found {
+			if options, ok := data.(map[string]interface{}); ok {
+				out := make(map[string]string, len(options))
+				for key, value := range options {
+					if str, ok := value.(string); ok {
+						out[key] = str
+					}
+				}
+				return out
+			}
+		}
+	}
 	return nil
 }

-func (driver *driver) DeleteNetwork(delete *api.DeleteNetworkRequest) error {
-	Log.Debugf("Delete network request: %+v", delete)
-	Log.Infof("Destroy network %s", delete.NetworkID)
+func (driver *driver) DeleteNetwork(delreq *api.DeleteNetworkRequest) error {
+	driver.logReq("DeleteNetwork", delreq, delreq.NetworkID)
+	driver.Lock()
+	delete(driver.networks, delreq.NetworkID)
+	driver.Unlock()
 	return nil
 }

 func (driver *driver) CreateEndpoint(create *api.CreateEndpointRequest) (*api.CreateEndpointResponse, error) {
-	Log.Debugf("Create endpoint request %+v", create)
-	endID := create.EndpointID
+	driver.logReq("CreateEndpoint", create, create.EndpointID)

 	if create.Interface == nil {
-		return nil, fmt.Errorf("Not supported: creating an interface from within CreateEndpoint")
+		return nil, driver.error("CreateEndpoint", "Not supported: creating an interface from within CreateEndpoint")
 	}
-	driver.Lock()
-	driver.endpoints[endID] = struct{}{}
-	driver.Unlock()
 	resp := &api.CreateEndpointResponse{}

-	Log.Infof("Create endpoint %s %+v", endID, resp)
+	driver.logRes("CreateEndpoint", resp)
 	return resp, nil
 }

 func (driver *driver) DeleteEndpoint(deleteReq *api.DeleteEndpointRequest) error {
-	Log.Debugf("Delete endpoint request: %+v", deleteReq)
-	Log.Infof("Delete endpoint %s", deleteReq.EndpointID)
-	driver.Lock()
-	delete(driver.endpoints, deleteReq.EndpointID)
-	driver.Unlock()
+	driver.logReq("DeleteEndpoint", deleteReq, deleteReq.EndpointID)
 	return nil
 }

-func (driver *driver) HasEndpoint(endpointID string) bool {
-	driver.Lock()
-	_, found := driver.endpoints[endpointID]
-	driver.Unlock()
-	return found
-}
-
 func (driver *driver) EndpointInfo(req *api.EndpointInfoRequest) (*api.EndpointInfoResponse, error) {
-	Log.Debugf("Endpoint info request: %+v", req)
-	Log.Infof("Endpoint info %s", req.EndpointID)
+	driver.logReq("EndpointInfo", req, req.EndpointID)
 	return &api.EndpointInfoResponse{Value: map[string]interface{}{}}, nil
 }

 func (driver *driver) JoinEndpoint(j *api.JoinRequest) (*api.JoinResponse, error) {
-	endID := j.EndpointID
+	driver.logReq("JoinEndpoint", j, fmt.Sprintf("%s:%s to %s", j.NetworkID, j.EndpointID, j.SandboxKey))

-	maybeBridge, err := netlink.LinkByName(WeaveBridge)
+	network, err := driver.findNetworkInfo(j.NetworkID)
 	if err != nil {
-		return nil, errorf(`bridge "%s" not present; did you launch weave?`, WeaveBridge)
+		return nil, driver.error("JoinEndpoint", "unable to find network info: %s", err)
 	}

-	// create and attach local name to the bridge
-	local := vethPair(endID[:5])
-	local.Attrs().MTU = maybeBridge.Attrs().MTU
-	if err := netlink.LinkAdd(local); err != nil {
-		return nil, errorf("could not create veth pair: %s", err)
-	}
-
-	switch maybeBridge.(type) {
-	case *netlink.Bridge:
-		if err := netlink.LinkSetMasterByIndex(local, maybeBridge.Attrs().Index); err != nil {
-			return nil, errorf(`unable to set master: %s`, err)
-		}
-	case *netlink.GenericLink:
-		if maybeBridge.Type() != "openvswitch" {
-			Log.Errorf("device %s is %+v", WeaveBridge, maybeBridge)
-			return nil, errorf(`device "%s" is of type "%s"`, WeaveBridge, maybeBridge.Type())
-		}
-		odp.AddDatapathInterface(WeaveBridge, local.Name)
-	case *netlink.Device:
-		Log.Warnf("kernel does not report what kind of device %s is, just %+v", WeaveBridge, maybeBridge)
-		// Assume it's our openvswitch device, and the kernel has not been updated to report the kind.
-		odp.AddDatapathInterface(WeaveBridge, local.Name)
-	default:
-		Log.Errorf("device %s is %+v", WeaveBridge, maybeBridge)
-		return nil, errorf(`device "%s" not a bridge`, WeaveBridge)
-	}
-	if err := netlink.LinkSetUp(local); err != nil {
-		return nil, errorf(`unable to bring veth up: %s`, err)
-	}
-
-	ifname := &api.InterfaceName{
-		SrcName:   local.PeerName,
-		DstPrefix: "ethwe",
+	name, peerName := vethPair(j.EndpointID)
+	if _, err := weavenet.CreateAndAttachVeth(name, peerName, weavenet.WeaveBridgeName, 0, false, nil); err != nil {
+		return nil, driver.error("JoinEndpoint", "%s", err)
 	}

 	response := &api.JoinResponse{
-		InterfaceName: ifname,
+		InterfaceName: &api.InterfaceName{
+			SrcName:   peerName,
+			DstPrefix: weavenet.VethName,
+		},
 	}
-	if driver.nameserver != "" {
-		routeToDNS := api.StaticRoute{
-			Destination: driver.nameserver + "/32",
-			RouteType:   types.CONNECTED,
-			NextHop:     "",
-		}
-		response.StaticRoutes = []api.StaticRoute{routeToDNS}
-	}
-	if !driver.noMulticastRoute {
+	if network.hasMulticastRoute {
 		multicastRoute := api.StaticRoute{
 			Destination: "224.0.0.0/4",
 			RouteType:   types.CONNECTED,
 		}
 		response.StaticRoutes = append(response.StaticRoutes, multicastRoute)
 	}
-	Log.Infof("Join endpoint %s:%s to %s", j.NetworkID, j.EndpointID, j.SandboxKey)
+	driver.logRes("JoinEndpoint", response)
 	return response, nil
 }

+func (driver *driver) findNetworkInfo(id string) (network, error) {
+	driver.Lock()
+	network, found := driver.networks[id]
+	driver.Unlock()
+	if found {
+		return network, nil
+	}
+	info, err := driver.docker.NetworkInfo(id)
+	if err != nil {
+		return network, err
+	}
+	return driver.setupNetworkInfo(id, info.Driver == driver.name, info.Options)
+}
+
+func (driver *driver) setupNetworkInfo(id string, isOurs bool, options map[string]string) (network, error) {
+	network := network{isOurs: isOurs}
+	if isOurs {
+		for key, value := range options {
+			switch key {
+			case MulticastOption:
+				if value == "" { // interpret "--opt works.weave.multicast" as "turn it on"
+					network.hasMulticastRoute = true
+				} else {
+					var err error
+					if network.hasMulticastRoute, err = strconv.ParseBool(value); err != nil {
+						return network, fmt.Errorf("unrecognized value %q for option %s", value, key)
+					}
+
+				}
+			default:
+				driver.warn("setupNetworkInfo", "unrecognized option: %s", key)
+			}
+		}
+	}
+	driver.Lock()
+	driver.networks[id] = network
+	driver.Unlock()
+	return network, nil
+}
+
 func (driver *driver) LeaveEndpoint(leave *api.LeaveRequest) error {
-	Log.Debugf("Leave request: %+v", leave)
+	driver.logReq("LeaveEndpoint", leave, fmt.Sprintf("%s:%s", leave.NetworkID, leave.EndpointID))

-	local := vethPair(leave.EndpointID[:5])
-	if err := netlink.LinkDel(local); err != nil {
-		Log.Warningf("unable to delete veth on leave: %s", err)
+	name, _ := vethPair(leave.EndpointID)
+	veth := &netlink.Veth{LinkAttrs: netlink.LinkAttrs{Name: name}}
+	if err := netlink.LinkDel(veth); err != nil {
+		driver.warn("LeaveEndpoint", "unable to delete veth: %s", err)
 	}
-	Log.Infof("Leave %s:%s", leave.NetworkID, leave.EndpointID)
 	return nil
 }

 func (driver *driver) DiscoverNew(disco *api.DiscoveryNotification) error {
-	Log.Debugf("Dicovery new notification: %+v", disco)
+	driver.logReq("DiscoverNew", disco, "")
 	return nil
 }

 func (driver *driver) DiscoverDelete(disco *api.DiscoveryNotification) error {
-	Log.Debugf("Dicovery delete notification: %+v", disco)
+	driver.logReq("DiscoverDelete", disco, "")
 	return nil
 }

-// ===
+func vethPair(id string) (string, string) {
+	return "vethwl" + id[:5], "vethwg" + id[:5]
+}

-func vethPair(suffix string) *netlink.Veth {
-	return &netlink.Veth{
-		LinkAttrs: netlink.LinkAttrs{Name: "vethwl" + suffix},
-		PeerName:  "vethwg" + suffix,
-	}
+// logging
+
+func (driver *driver) logReq(fun string, req interface{}, short string) {
+	driver.log(common.Log.Debugf, " %+v", fun, req)
+	common.Log.Infof("[net] %s %s", fun, short)
+}
+
+func (driver *driver) logRes(fun string, res interface{}) {
+	driver.log(common.Log.Debugf, " %+v", fun, res)
+}
+
+func (driver *driver) warn(fun string, format string, a ...interface{}) {
+	driver.log(common.Log.Warnf, ": "+format, fun, a...)
+}
+
+func (driver *driver) debug(fun string, format string, a ...interface{}) {
+	driver.log(common.Log.Debugf, ": "+format, fun, a...)
+}
+
+func (driver *driver) error(fun string, format string, a ...interface{}) error {
+	driver.log(common.Log.Errorf, ": "+format, fun, a...)
+	return fmt.Errorf(format, a...)
+}
+
+func (driver *driver) log(f func(string, ...interface{}), format string, fun string, a ...interface{}) {
+	f("[net] %s"+format, append([]interface{}{fun}, a...)...)
 }
@@ -4,8 +4,9 @@ import (
 	"fmt"

 	weaveapi "github.com/weaveworks/weave/api"
-	. "github.com/weaveworks/weave/common"
+	"github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/common/docker"
+	weavenet "github.com/weaveworks/weave/net"
 )

 const (
@@ -21,31 +22,32 @@ type watcher struct {
 type Watcher interface {
 }

-func NewWatcher(client *docker.Client, driver *driver) (Watcher, error) {
-	resolver := func() (string, error) { return client.GetContainerIP(WeaveContainer) }
-	w := &watcher{client: client, driver: driver,
-		weave: weaveapi.NewClientWithResolver(resolver)}
-	err := client.AddObserver(w)
-	if err != nil {
-		return nil, err
-	}
-
-	return w, nil
+func NewWatcher(client *docker.Client, weave *weaveapi.Client, driver *driver) (Watcher, error) {
+	w := &watcher{client: client, weave: weave, driver: driver}
+	return w, client.AddObserver(w)
 }

 func (w *watcher) ContainerStarted(id string) {
-	Log.Debugf("Container started %s", id)
+	w.driver.debug("ContainerStarted", "%s", id)
 	info, err := w.client.InspectContainer(id)
 	if err != nil {
-		Log.Warningf("error inspecting container: %s", err)
+		w.driver.warn("ContainerStarted", "error inspecting container %s: %s", id, err)
 		return
 	}
-	// check that it's on our network, via the endpointID
+	// check that it's on our network
 	for _, net := range info.NetworkSettings.Networks {
-		if w.driver.HasEndpoint(net.EndpointID) {
+		network, err := w.driver.findNetworkInfo(net.NetworkID)
+		if err != nil {
+			w.driver.warn("ContainerStarted", "unable to find network %s info: %s", net.NetworkID, err)
+			continue
+		}
+		if network.isOurs {
 			fqdn := fmt.Sprintf("%s.%s", info.Config.Hostname, info.Config.Domainname)
 			if err := w.weave.RegisterWithDNS(id, fqdn, net.IPAddress); err != nil {
-				Log.Warningf("unable to register with weaveDNS: %s", err)
+				w.driver.warn("ContainerStarted", "unable to register %s with weaveDNS: %s", id, err)
+			}
+			if err := common.ConfigureARPforVeths(info.State.Pid, weavenet.VethName); err != nil {
+				w.driver.warn("ContainerStarted", "unable to configure interfaces: %s", err)
 			}
 		}
 	}
@@ -55,3 +57,5 @@ func (w *watcher) ContainerDied(id string) {
 	// don't need to do this as WeaveDNS removes names on container died anyway
 	// (note by the time we get this event we can't see the EndpointID)
 }
+
+func (w *watcher) ContainerDestroyed(id string) {}
@@ -1,54 +0,0 @@
-/* netcheck: check whether a given network or address overlaps with any existing routes */
-package main
-
-import (
-	"fmt"
-	"net"
-	"os"
-
-	"github.com/docker/docker/pkg/mflag"
-	weavenet "github.com/weaveworks/weave/net"
-)
-
-func fatal(err error) {
-	fmt.Fprintln(os.Stderr, err)
-	os.Exit(1)
-}
-
-type stringList map[string]struct{}
-
-func (ss *stringList) Set(value string) error {
-	(*ss)[value] = struct{}{}
-	return nil
-}
-
-func (ss *stringList) String() string {
-	return fmt.Sprintf("%v", *ss)
-}
-
-func main() {
-	ignoreIfaceNames := make(stringList)
-
-	mflag.Var(&ignoreIfaceNames, []string{"-ignore-iface"}, "name of interface to ignore)")
-	mflag.Parse()
-
-	if len(mflag.Args()) < 1 {
-		fmt.Fprintln(os.Stderr, "usage: netcheck [--ignore-iface <iface-name>] network-cidr")
-		os.Exit(1)
-	}
-
-	cidrStr := mflag.Args()[0]
-	addr, ipnet, err := net.ParseCIDR(cidrStr)
-	if err != nil {
-		fatal(err)
-	}
-	if ipnet.IP.Equal(addr) {
-		err = weavenet.CheckNetworkFree(ipnet, ignoreIfaceNames)
-	} else {
-		err = weavenet.CheckAddressOverlap(addr, ignoreIfaceNames)
-	}
-	if err != nil {
-		fatal(err)
-	}
-	os.Exit(0)
-}
@@ -4,15 +4,19 @@ import (
 	"flag"
 	"fmt"
 	"net"
+	"net/http"
 	"os"
 	"os/signal"
+	"path"
 	"strings"
 	"syscall"

+	cni "github.com/appc/cni/pkg/skel"
 	"github.com/docker/libnetwork/ipamapi"
-	go_docker "github.com/fsouza/go-dockerclient"
-	. "github.com/weaveworks/weave/common"
+	weaveapi "github.com/weaveworks/weave/api"
+	"github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/common/docker"
+	weavenet "github.com/weaveworks/weave/net"
 	ipamplugin "github.com/weaveworks/weave/plugin/ipam"
 	netplugin "github.com/weaveworks/weave/plugin/net"
 	"github.com/weaveworks/weave/plugin/skel"
@@ -20,26 +24,26 @@ import (

 var version = "(unreleased version)"

+var Log = common.Log
+
 func main() {
 	var (
 		justVersion      bool
+		cniNet           bool
+		cniIpam          bool
 		address          string
-		nameserver       string
 		meshAddress      string
 		logLevel         string
-		meshNetworkName  string
 		noMulticastRoute bool
-		removeNetwork    bool
 	)

 	flag.BoolVar(&justVersion, "version", false, "print version and exit")
+	flag.BoolVar(&cniNet, "cni-net", false, "act as a CNI network plugin")
+	flag.BoolVar(&cniIpam, "cni-ipam", false, "act as a CNI IPAM plugin")
 	flag.StringVar(&logLevel, "log-level", "info", "logging level (debug, info, warning, error)")
 	flag.StringVar(&address, "socket", "/run/docker/plugins/weave.sock", "socket on which to listen")
-	flag.StringVar(&nameserver, "nameserver", "", "nameserver to provide to containers")
 	flag.StringVar(&meshAddress, "meshsocket", "/run/docker/plugins/weavemesh.sock", "socket on which to listen in mesh mode")
-	flag.StringVar(&meshNetworkName, "mesh-network-name", "weave", "network name to create in mesh mode")
-	flag.BoolVar(&noMulticastRoute, "no-multicast-route", false, "do not add a multicast route to network endpoints")
-	flag.BoolVar(&removeNetwork, "remove-network", false, "remove mesh network and exit")
+	flag.BoolVar(&noMulticastRoute, "no-multicast-route", false, "deprecated (this is now the default)")

 	flag.Parse()

@@ -48,7 +52,20 @@ func main() {
 		os.Exit(0)
 	}

-	SetLogLevel(logLevel)
+	common.SetLogLevel(logLevel)
+
+	weave := weaveapi.NewClient(os.Getenv("WEAVE_HTTP_ADDR"), Log)
+
+	switch {
+	case cniIpam || strings.HasSuffix(os.Args[0], "weave-ipam"):
+		i := ipamplugin.NewIpam(weave)
+		cni.PluginMain(i.CmdAdd, i.CmdDel)
+		os.Exit(0)
+	case cniNet || strings.HasSuffix(os.Args[0], "weave-net"):
+		n := netplugin.NewCNIPlugin(weave)
+		cni.PluginMain(n.CmdAdd, n.CmdDel)
+		os.Exit(0)
+	}

 	// API 1.21 is the first version that supports docker network commands
 	dockerClient, err := docker.NewVersionedClientFromEnv("1.21")
@@ -56,29 +73,22 @@ func main() {
 		Log.Fatalf("unable to connect to docker: %s", err)
 	}

-	if removeNetwork {
-		if _, err = dockerClient.Client.NetworkInfo(meshNetworkName); err == nil {
-			err = dockerClient.Client.RemoveNetwork(meshNetworkName)
-			if err != nil {
-				Log.Fatalf("unable to remove network: %s", err)
-			}
-		}
-		os.Exit(0)
-	}
-
 	Log.Println("Weave plugin", version, "Command line options:", os.Args[1:])
+	if noMulticastRoute {
+		Log.Warning("--no-multicast-route option has been removed; multicast is off by default")
+	}
 	Log.Info(dockerClient.Info())

-	err = run(dockerClient, address, meshAddress, meshNetworkName, nameserver, noMulticastRoute)
+	err = run(dockerClient, weave, address, meshAddress)
 	if err != nil {
 		Log.Fatal(err)
 	}
 }

-func run(dockerClient *docker.Client, address, meshAddress, meshNetworkName, nameserver string, noMulticastRoute bool) error {
+func run(dockerClient *docker.Client, weave *weaveapi.Client, address, meshAddress string) error {
 	endChan := make(chan error, 1)
 	if address != "" {
-		globalListener, err := listenAndServe(dockerClient, address, nameserver, noMulticastRoute, endChan, "global", false)
+		globalListener, err := listenAndServe(dockerClient, weave, address, endChan, "global", false)
 		if err != nil {
 			return err
 		}
@@ -86,7 +96,7 @@ func run(dockerClient *docker.Client, address, meshAddress, meshNetworkName, nam
 		defer globalListener.Close()
 	}
 	if meshAddress != "" {
-		meshListener, err := listenAndServe(dockerClient, meshAddress, nameserver, noMulticastRoute, endChan, "local", true)
+		meshListener, err := listenAndServe(dockerClient, weave, meshAddress, endChan, "local", true)
 		if err != nil {
 			return err
 		}
@@ -94,12 +104,11 @@ func run(dockerClient *docker.Client, address, meshAddress, meshNetworkName, nam
 		defer meshListener.Close()
 	}

-	if meshNetworkName != "" {
-		if err := createNetwork(dockerClient, meshNetworkName, meshAddress); err != nil {
-			return err
-		}
+	statusListener, err := weavenet.ListenUnixSocket("/home/weave/status.sock")
+	if err != nil {
+		return err
 	}
-
+	go serveStatus(statusListener)
 	sigChan := make(chan os.Signal, 1)
 	signal.Notify(sigChan, os.Interrupt, os.Kill, syscall.SIGTERM)

@@ -112,26 +121,19 @@ func run(dockerClient *docker.Client, address, meshAddress, meshNetworkName, nam
 	}
 }

-func listenAndServe(dockerClient *docker.Client, address, nameserver string, noMulticastRoute bool, endChan chan<- error, scope string, withIpam bool) (net.Listener, error) {
-	d, err := netplugin.New(dockerClient, version, nameserver, scope, noMulticastRoute)
+func listenAndServe(dockerClient *docker.Client, weave *weaveapi.Client, address string, endChan chan<- error, scope string, withIpam bool) (net.Listener, error) {
+	name := strings.TrimSuffix(path.Base(address), ".sock")
+	d, err := netplugin.New(dockerClient, weave, name, scope)
 	if err != nil {
 		return nil, err
 	}

 	var i ipamapi.Ipam
 	if withIpam {
-		if i, err = ipamplugin.NewIpam(dockerClient, version); err != nil {
-			return nil, err
-		}
+		i = ipamplugin.NewIpam(weave)
 	}

-	var listener net.Listener
-
-	// remove sockets from last invocation
-	if err := os.Remove(address); err != nil && !os.IsNotExist(err) {
-		return nil, err
-	}
-	listener, err = net.Listen("unix", address)
+	listener, err := weavenet.ListenUnixSocket(address)
 	if err != nil {
 		return nil, err
 	}
@@ -144,24 +146,11 @@ func listenAndServe(dockerClient *docker.Client, address, nameserver string, noM
 	return listener, nil
 }

-func createNetwork(dockerClient *docker.Client, networkName, address string) error {
-	if _, err := dockerClient.Client.NetworkInfo(networkName); err == nil {
-		Log.Printf("Docker network '%s' already exists", networkName)
-	} else if _, ok := err.(*go_docker.NoSuchNetwork); ok {
-		driverName := strings.TrimSuffix(address, ".sock")
-		if i := strings.LastIndex(driverName, "/"); i >= 0 {
-			driverName = driverName[i+1:]
-		}
-		options := go_docker.CreateNetworkOptions{
-			Name:           networkName,
-			CheckDuplicate: true,
-			Driver:         driverName,
-			IPAM:           go_docker.IPAMOptions{Driver: driverName},
-		}
-		_, err := dockerClient.Client.CreateNetwork(options)
-		if err != nil {
-			return fmt.Errorf("Error creating network: %s", err)
-		}
+func serveStatus(listener net.Listener) {
+	server := &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprintln(w, "ok")
+	})}
+	if err := server.Serve(listener); err != nil {
+		Log.Fatalf("ListenAndServeStatus failed: %s", err)
 	}
-	return nil
 }
@@ -0,0 +1,12 @@
+package main
+
+import (
+	"testing"
+
+	weavetest "github.com/weaveworks/weave/testing"
+)
+
+func TestMain(t *testing.T) {
+	weavetest.TrimTestArgs()
+	main()
+}
@@ -0,0 +1,6 @@
+# This is a nearly-empty image that we use to create a data-only container for persistence
+FROM scratch
+MAINTAINER Weaveworks Inc <help@weave.works>
+ENTRYPOINT ["data-only"]
+# Work round Docker refusing to save an empty image
+COPY Dockerfile /
@@ -17,7 +17,7 @@ RUN apk add --update \
  && rm -rf /var/cache/apk/*

 ADD ./weave ./sigproxy ./weaveproxy ./symlink /home/weave/
-ADD ./netcheck ./docker_tls_args /usr/bin/
+ADD ./weaveutil /usr/bin/
 ADD ./weavewait /w/w
 ADD ./weavewait_noop /w-noop/w
 ADD ./weavewait_nomcast /w-nomcast/w