Add release v2.0.3

Merge pull request #3096 from weaveworks/wip-3095
fix: Missing nil checks
2017-08-23 11:08:24 +00:00 · 2017-08-23 11:28:16 +01:00 · 2017-08-23 11:27:43 +01:00 · 2017-08-23 09:42:51 +00:00 · 2017-08-23 09:40:44 +01:00 · 2017-08-23 01:21:15 +01:00
267 changed files with 7001 additions and 3647 deletions
@@ -0,0 +1,65 @@
+<!--
+Hi, thank you for opening an issue!
+Before hitting the button...
+
+** Is this a REQUEST FOR HELP? **
+If so, please have a look at:
+- our FAQ: https://www.weave.works/docs/net/latest/faq/
+- our troubleshooting page: https://www.weave.works/docs/net/latest/troubleshooting/
+- our help page, to choose the best channel (Slack, etc.) to reach out: https://www.weave.works/help/
+
+** Is this a FEATURE REQUEST? **
+If so, please search existing feature requests, and if you find a similar one, up-vote it and/or add your comments to it instead.
+If you did not find a similar one, please describe in details:
+- why: your use-case, specific constraints you may have, etc.
+- what: the feature/behaviour/change you would like to see in Weave Net
+Do not hesitate, when appropriate, to share the exact commands or API you would like, and/or to share a diagram (e.g.: asciiflow.com): "a picture is worth a thousand words".
+
+** Is this a BUG REPORT? **
+Please fill in as much of the template below as you can.
+
+Thank you!
+-->
+
+## What you expected to happen?
+
+## What happened?
+<!-- Error message, actual behaviour, etc. -->
+
+## How to reproduce it?
+<!-- Specific steps, as minimally and precisely as possible. -->
+
+## Anything else we need to know?
+<!-- Cloud provider? Hardware? How did you configure your cluster? Kubernetes YAML, KOPS, etc. -->
+
+## Versions:
+<!-- Please paste in the output of these commands; 'kubectl' only if using Kubernetes -->
+```
+$ weave version
+$ docker version
+$ uname -a
+$ kubectl version
+```
+
+## Logs:
+```
+$ docker logs weave
+```
+or, if using Kubernetes:
+```
+$ kubectl logs -n kube-system <weave-net-pod> weave
+```
+<!-- (If output is long, please consider a Gist.) -->
+<!-- Anything interesting or unusual output by the below, potentially relevant, commands?
+$ journalctl -u docker.service --no-pager
+$ journalctl -u kubelet --no-pager
+$ kubectl get events
+-->
+
+## Network:
+<!-- If your problem has anything to do with one network endpoint not being able to contact another, please run the following commands -->
+```
+$ ip route
+$ ip -4 -o addr
+$ sudo iptables-save
+```
@@ -37,7 +37,6 @@ coverage.html
 prog/weaver/weaver
 prog/weavedns/weavedns
 prog/weavehosts/weavehosts
-prog/weaveproxy/weaveproxy
 prog/sigproxy/sigproxy
 prog/weavewait/weavewait
 prog/weavewait/weavewait_noop
@@ -53,14 +52,13 @@ testing/runner/runner
 releases
 .*.uptodate
 weave*.tar.gz
-prog/weaveexec/weave
+prog/weaver/weave
 prog/weaveexec/weavehosts
-prog/weaveexec/weaveproxy
 prog/weaveexec/weavewait
 prog/weaveexec/weavewait_noop
 prog/weaveexec/weavewait_nomcast
 prog/weaveexec/sigproxy
-prog/weaveexec/weaveutil
+prog/weaver/weaveutil
 prog/weaveexec/docker*
 Vagrantfile.local
 test/tls/tls
@@ -68,3 +66,9 @@ test/tls/*.pem
 test/coverage
 test/coverage.*
 *qemu-*-static
+terraform.tfstate
+terraform.tfstate.backup
+prog/net-plugin/rootfs/
+
+# Website
+site-build
@@ -3,7 +3,7 @@
 	url = https://github.com/weaveworks/build-tools
 [submodule "vendor/github.com/vishvananda/netlink"]
 	path = vendor/github.com/vishvananda/netlink
-	url = https://github.com/weaveworks/netlink.git
+	url = https://github.com/vishvananda/netlink.git
 [submodule "vendor/github.com/gorilla/mux"]
 	path = vendor/github.com/gorilla/mux
 	url = https://github.com/gorilla/mux.git
@@ -61,9 +61,6 @@
 [submodule "vendor/github.com/hashicorp/go-cleanhttp"]
 	path = vendor/github.com/hashicorp/go-cleanhttp
 	url = http://github.com/hashicorp/go-cleanhttp
-[submodule "vendor/github.com/appc/cni"]
-	path = vendor/github.com/appc/cni
-	url = https://github.com/appc/cni
 [submodule "vendor/github.com/coreos/go-iptables"]
 	path = vendor/github.com/coreos/go-iptables
 	url = https://github.com/coreos/go-iptables
@@ -124,3 +121,15 @@
 [submodule "vendor/github.com/weaveworks/common"]
 	path = vendor/github.com/weaveworks/common
 	url = https://github.com/weaveworks/common
+[submodule "vendor/github.com/containernetworking/cni"]
+	path = vendor/github.com/containernetworking/cni
+	url = https://github.com/containernetworking/cni
+[submodule "vendor/google.golang.org/grpc"]
+	path = vendor/google.golang.org/grpc
+	url = https://github.com/grpc/grpc-go
+[submodule "vendor/github.com/docker/go-units"]
+	path = vendor/github.com/docker/go-units
+	url = https://github.com/docker/go-units
+[submodule "vendor/golang.org/x/net"]
+	path = vendor/golang.org/x/net
+	url = https://github.com/golang/net
@@ -1,8 +1,27 @@
 # IMPORTANT: Please only use GLOBs to ignore files and directories.

-# Do not lint any bash script in Weave Net, in order to 
+# Do not lint the below bash scripts in Weave Net, in order to 
 # avoid breaking the build on make lint:
-*.sh
-bin/*
+bin/circle-deploy-issues
+bin/circle-deploy-master
+bin/circle-teardown-pre
+bin/circle-test-teardown
+bin/circle-test-unit
+bin/install-wordepress
+bin/multiweave
+bin/publish-site
+bin/release
+build/build.sh
+prog/weave-kube/launch.sh
 prog/weaveexec/symlink
+test/*_test.sh
+test/600_proxy_docker_py.sh
+test/assert.sh
+test/config.sh
+test/gce.sh
+test/gen_coverage_reports.sh
+test/run_all.sh
+test/sanity_check.sh
+test/setup.sh
+vendor/*.sh
 weave
@@ -0,0 +1 @@
+2.3.0
@@ -1,3 +1,298 @@
+## Release 2.0.3
+
+Bug fixes
+
+* Weave-npc would crash on a policy with no 'from' part - regression introduced in 2.0.2 #3095,#3096,#3097
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/61?closed=1).
+
+
+## Release 2.0.2
+
+Bug fixes and minor improvements
+
+* Fix race condition in weave-npc which would intermittently block all traffic for a namespace  #3057,#3059
+* Ensure Fast Datapath works on machines that need to mount the kernel module dynamically #3080
+* Regression: weave-npc would block everything if `kubelet --hostname-override` was used #3049,#3051
+* Fix netfilter rules to block containers from accessing the Weave Net control endpoint #3093
+* If DNS server is off then disable proxy DNS registration, to avoid spurious errors #3054,#3088
+* Add comments to each iptables rule and ipset, to help when troubleshooting #3064
+* Remove code that checked for an outdated fallback address for Kubernetes api-server #3071
+* Add a label to the weavedb image so it can be filtered out by tools #3066
+* Fix various build and continuous-integration failures #3061
+* Print 'help' text faster in the weave script #3056
+* Add an option to create continuous integration hosts in different ways  #3060
+* Remove remnants of the pre-2.0 proxy and plugin from build and test #3035,#3036
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/60?closed=1).
+
+
+## Release 2.0.1
+
+Bug fixes and minor improvements
+
+* Fall back to slower data path (`sleeve`), rather than crashing, when the machine lacks VXLAN support (required for “fast data path”, `fastdp`)  #3043
+* Fix bug in processing of arguments when Docker has TLS enabled, rather than crashing with invalid peers list, e.g. `lookup --tlsverify: no such host` #3039
+* Add `kube-system` namespace back to `weave-kube`'s YAMLs, preventing omissions leading to errors like `error contacting APIServer: the server does not allow access to the requested resource` #3033,#3042
+* Fix release script to prevent ARM64 binaries to end up in AMD64 `net-plugin`, leading to `Error response from daemon: dial unix /run/docker/plugins/<id>/weave.sock: connect: no such file or directory` when installing `net-plugin` #3045
+* `weave reset` and `weave rmpeer` now only contact Weave Cloud when Weave Net is configured with a Weave Cloud token, preventing unnecessary requests and potentially confusing `401 Unauthorized` errors in Weave Net’s logs #3044
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/58?closed=1).
+
+
+## Release 2.0.0
+
+New Features
+
+Peer Discovery via Weave Cloud
+
+You can now get all your Weave Net peers to find each other via the
+Weave Cloud service, instead of maintaining a list of peers at
+startup. #2799,#2827
+
+See the [docs
+page](https://github.com/weaveworks/weave/blob/master/site/using-weave/weave-cloud.md)
+for more details
+
+New Docker Plugin
+
+Docker has a [new plugin
+system](https://docs.docker.com/engine/extend/) which improves the
+installation UX and solves some issues around startup.  This means
+Weave Net 2.0 can now run with Docker in "swarm mode" and supports the
+`docker service` command. #2396,#2397,#2651,#2727,#2805,#2816,#2905,
+#2906,#2929,#2932,#2945,#2950,#2956,#2963,#2964,#2966,#3019
+
+The previous Docker Plugin is still available and can be installed as before.
+
+All of Weave Net now runs in one container
+
+Previously we had three separate containers for routing, Docker API
+proxy and Docker plugin. Running everything in one simplifies start-up
+and removes the need to detect various error
+conditions. #1642,#2897,#2936,#2945,#2946,#2951,#2960
+
+The individual commands ‘weave launch-router’, ‘weave launch-plugin’,
+etc., have been removed. You can turn off the plugin and proxy with
+new command-line options. In keeping with Semantic Versioning, we have
+changed the major version number for this release.
+
+Other new features
+
+* Kubernetes configuration now comes from our “Launch Generator” that
+  allows different options to be selected via
+  URL. #2754,#2903,#3000,#3001
+* `weave-kube` now stores data about IP allocation in `/var/lib/weave`
+  on the host instead of in a Kubernetes volume.  This means that the
+  data will persist across pod deletion and re-creation, e.g. during
+  an upgrade of Weave Net, which makes restarts more
+  reliable. #2610,#2967
+* `weave-kube` turned on rolling updates, so careful manual handling
+  of updates is no longer required. #3024
+
+Bug fixes
+
+* Kubernetes Network Policies which allowed a specific set of pods to
+  connect would block all pods on other hosts. Revert the change in
+  v1.9.6 which ignored pods on other hosts #3025,#3028
+
+Features removed
+
+* `weave run` has been removed.  This was the original method provided
+  to start containers with Weave Net, but it always required care over
+  timing of start-up, and we now provide three alternative, better,
+  ways. You can replicate the effect by calling `docker run` then
+  `weave attach`.  Similarly `weave start` and `weave restart` were
+  removed. #2353,#2885
+* Everything deprecated more than one release ago has been removed, so
+  if you use it now you get an error rather than a warning. This
+  includes the ‘create-bridge’ command and older command-line
+  arguments, e.g. `--iprange` was replaced by `--ipalloc-range`
+  #2901,#2909,#2913,#2942,#2989,#2991
+
+Functions moved from shell-script to Go code.
+
+This enables more precise error-checking and runs a bit faster. It has
+also enabled us to shrink the size of images downloaded: `weave-kube`
+is 101MB compared to 163MB previously #2953,#2954,#2974
+
+Specific items that moved from shell-script to Go:
+* Setting up the `weave` bridge #1958,#2975,#2977,#2978
+* Container attachment #2947
+* Creation of the ’weave’ default plugin network #2920
+
+Minor improvements
+
+* You can now restart the Weave Net router without requiring the proxy to be enabled #2112
+* Plugin (legacy version) now respects `--ipalloc-default-subnet` option #2919
+* The `weave` script now detects and issues an error message if
+  `weave-kube` is running and you attempt to launch again from the script. #2709/#2966
+* It is now possible to choose the the MAC address of the `weave`
+  bridge using `--name`, in case your hosts have identical unique
+  IDs. #2900
+* Relaxed Kubernetes tolerations for Weave Net's daemonset in order to
+  match any node (previously, only taints directed at master). #3018
+* Kubernetes' `seLinuxOptions` configuration is now empty by default,
+  to reduce spurious failures on hosts not using seLinux. #3001
+* Improved reliability of namespace changes via `nsenter`. #2992
+* `weave ps` now fetches the list container IDs internally, rather
+  than calling out to `docker ps` #2814,#2898
+* at startup, actively remove dead containers’ Weave Net IP addresses from IPAM #3013
+* at startup, only check live containers to see if they have an
+  existing Weave Net IP address #2815,#2829
+* Weave Net CNI plugin now logs but does not raise an error if
+  anything goes wrong during network interface delete, to be more
+  compatible with Kubernetes 1.6. #2928
+* Stop running a shell in “privileged” mode when it’s only writing a file #2838
+* New internal REST endpoint to return all IP address mappings. #1350
+* Changed the wording where we do not log the password #2833
+* Fixed typo in plugin error messages #2894
+
+Build and test
+
+* Weave Net is now built with Go version 1.8, which has better code
+  generation and garbage collection #2914
+* During smoke-tests, use a webserver instead of just `ping` so we get
+  a more realistic test that the Weave network is working #2918
+* When installing dependencies for the build container, use a
+  keyserver port that's better for firewalls #2812
+* Kubernetes test script now scales up to more hosts, and works with
+  Kubernetes 1.6 #2837,#2853,#2923
+* Other minor build improvements and refactoring #2760,#2910
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/49?closed=1).
+
+
+## Release 1.9.8
+
+Bug fixes and minor improvements
+
+* Fix weave-npc blocking NodePort and any other non-local access #3011,#3014
+* Fix bug where IPAM would duplicate a fixed IP address assigned via Docker plugin #3003,#3010
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/56?closed=1).
+
+
+## Release 1.9.7
+
+This is identical to 1.9.6 with one additional bug-fix:
+
+* weave-npc would block everything if `kubelet --hostname-override` was used #2995,#2996
+
+## Release 1.9.6
+
+Bug fixes and minor improvements
+
+* Ensure that Kubernetes pods can contact a service implemented within
+  the same pod, by turning on "hairpin mode". This is required because
+  of a quiet change between Kubernetes 1.5 and 1.6. #2993
+* Network Policy Controller (`weave-npc`) now checks local addresses
+  only, so it doesn't interfere with cross-cluster traffic. It should
+  be more efficient too #2622,#2973,#2979
+* Stop reporting back to Kubernetes any issues encountered when
+  deleting a pod's network interface. This is required because
+  of a quiet change between Kubernetes 1.5 and 1.6. #2921,#2928
+* Fixed an issue whereby `weave-npc` couldn't start because one
+  `ipset` was referring to another one and could not be destroyed #2915,#2949
+* Improved the code which checks whether the kernel supports `ipset` #2934,#2935
+* `weave-npc` now creates ipsets with only valid xml characters in the
+  name #2958,#2959
+
+Build and Testing
+
+* In build container use cross-compilers from debian package
+  repository, so they match other components #2940
+* Pin the version of the linting tool `shfmt` so the set of things it
+  checks is stable #2987
+* Fix lint error in script that runs smoke-tests #2962
+* Moved website publishing from Wordpress to Netlify #2986
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/55?closed=1).
+
+## Release 1.9.5
+
+Bug fixes and minor improvements
+
+* Improve log messages generated if "hairpin" conditions are detected,
+  to make clear which kind is likely to cause problems #2808/#2926
+* Filter out IPv6 peer addresses from Kubernetes; Weave Net currently
+  only supports IPv4 #2904/#2912
+* Fix rare crash during initialization of weave-kube #2893/#2892
+* Include overlay and encryption modes in checkpoint reports, in case
+  this is relevant to a version upgrade #2771/#2907
+
+Build and Testing
+
+* Ensure CI build can run gcloud tools  #2887
+* Prevent kubeadm from upgrading Kubernetes if we are trying to test an older version #2886
+* Upgrade build scripts to support Kubernetes 1.6 #2880
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/54?closed=1).
+
+## Release 1.9.4
+
+Bug fixes and minor improvements
+
+* Support Kubernetes 1.6 by creating a new DaemonSet #2777,#2801
+* Support Kubernetes 1.6 by allowing CNI callers to send a
+  network-delete request for a container that is not running or has
+  never been attached to the network #2850
+* Leave non-weave ipsets alone in Network Policy Controller (e.g. when
+  running Weave Net alonside keepalived-vip) #2751,#2846
+* Fix various small issues revealed by 'staticcheck' tool #2843,#2857
+* Avoid leaving 'defunct' processes when weave-kube container restarts #2836,#2845
+* When using the CNI plugin with a non-standard network configuration
+  file, the weave bridge could get the same IP as a container, if
+  'weave expose' hadn't run at that point #2839,#2856
+
+Build and Testing
+
+* Check that no defunct processes remain after each test #2852
+* Update build and test scripts to work with Kubernetes 1.6 beta #2851
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/53?closed=1).
+
+## Release 1.9.3
+
+Bug fixes and minor improvements
+
+* Fixed a race condition in Fast Datapath encrypted connections which could lead Weave Net to crash: #2824, #2825.
+
+## Release 1.9.2
+
+Bug fixes and minor improvements
+
+* Fix a weave-kube bug when `br_netfilter` or `xt_set` module is compiled into
+  kernel #2820/#2821
+* Detect the absence of the required `xt_set` kernel module #2821
+
+## Release 1.9.1
+
+Bug fixes and minor improvements
+
+* Fix a race condition when the Weave Net container is restarted
+  which could allow a new container to be allocated the same IP
+  address as an existing one #2784,#2787
+* Handle the message type received when a pod has been deleted during
+  Kubernetes api-server fail-over #2772,#2773
+* Make weave-kube work with `dockerd --iptables=false` #2726
+* Ensure we have the right kernel modules loaded for Network Policy in weave-kube #2819
+* Reference-count addresses in Network Policy Controller, to avoid
+  errors when updates come in an unexpected order #2792,#2795
+* Allow the soft connection limit to be raised in weave-kube, so
+  larger clusters can be created #2781
+* WeaveDNS was incorrectly case-sensitive for reverse DNS lookups #2817,#2818
+
+Build and Testing
+
+* Scripts to create VMs to run automated tests were rewritten to use
+  Terraform and Ansible, to make it much easier to test with different
+  versions of components such as Docker and Kubernetes #2647,#2694,#2775,#2796
+* Upgrade to latest Weaveworks common build-tools #2780
+* Improve encryption tests #2793
+* Update vishvananda/netlink library to bring in changes we had previously forked #2790
+* Slight change to the build container to avoid permission errors and slow builds #2761,#2802
+
 ## Release 1.9.0

 Highlights:
@@ -0,0 +1,3 @@
+DOCKER_VERSION=17.06
+KUBERNETES_VERSION=1.6.2
+KUBERNETES_CNI_VERSION=0.5.1
@@ -1,5 +1,5 @@
 .DEFAULT: all
-.PHONY: all exes testrunner update tests lint publish-one-arch $(PUBLISH) clean clean-bin prerequisites build run-smoketests
+.PHONY: all exes testrunner update tests lint publish-one-arch $(PUBLISH) clean clean-bin clean-work-dir prerequisites build run-smoketests

 # If you can use docker without being root, you can do "make SUDO="
 SUDO=$(shell docker info >/dev/null 2>&1 || echo "sudo -E")
@@ -82,10 +82,11 @@ endif
 DOCKERHUB_USER?=weaveworks
 # The default version that's chosen when pushing the images. Can/should be overridden
 WEAVE_VERSION?=git-$(shell git rev-parse --short=12 HEAD)
+# Docker Store does not allow the "latest" tag.
+NET_PLUGIN_LATEST=latest_release

 # Paths to all relevant binaries that should be compiled
 WEAVER_EXE=prog/weaver/weaver
-WEAVEPROXY_EXE=prog/weaveproxy/weaveproxy
 SIGPROXY_EXE=prog/sigproxy/sigproxy
 KUBEPEERS_EXE=prog/kube-peers/kube-peers
 WEAVENPC_EXE=prog/weave-npc/weave-npc
@@ -93,39 +94,44 @@ WEAVEWAIT_EXE=prog/weavewait/weavewait
 WEAVEWAIT_NOOP_EXE=prog/weavewait/weavewait_noop
 WEAVEWAIT_NOMCAST_EXE=prog/weavewait/weavewait_nomcast
 WEAVEUTIL_EXE=prog/weaveutil/weaveutil
-PLUGIN_EXE=prog/plugin/plugin
 RUNNER_EXE=tools/runner/runner
 MANIFEST_TOOL_DIR=vendor/github.com/estesp/manifest-tool
 MANIFEST_TOOL_EXE=$(MANIFEST_TOOL_DIR)/manifest-tool
 TEST_TLS_EXE=test/tls/tls
+NETWORKTESTER_EXE=test/images/network-tester/webserver

 # All binaries together in a list
-EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(KUBEPEERS_EXE) $(WEAVENPC_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVEUTIL_EXE) $(PLUGIN_EXE) $(RUNNER_EXE) $(TEST_TLS_EXE) $(MANIFEST_TOOL_EXE)
+EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(KUBEPEERS_EXE) $(WEAVENPC_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVEUTIL_EXE) $(RUNNER_EXE) $(TEST_TLS_EXE) $(MANIFEST_TOOL_EXE) $(NETWORKTESTER_EXE)

 # These stamp files are used to mark the current state of the build; whether an image has been built or not
 BUILD_UPTODATE=.build.uptodate
 WEAVER_UPTODATE=.weaver$(ARCH_EXT).uptodate
 WEAVEEXEC_UPTODATE=.weaveexec$(ARCH_EXT).uptodate
-PLUGIN_UPTODATE=.plugin$(ARCH_EXT).uptodate
+PLUGIN_UPTODATE=.net-plugin$(ARCH_EXT).uptodate
 WEAVEKUBE_UPTODATE=.weavekube$(ARCH_EXT).uptodate
 WEAVENPC_UPTODATE=.weavenpc$(ARCH_EXT).uptodate
 WEAVEDB_UPTODATE=.weavedb.uptodate
+NETWORKTESTER_UPTODATE=.networktester$(ARCH_EXT).uptodate

-IMAGES_UPTODATE=$(WEAVER_UPTODATE) $(WEAVEEXEC_UPTODATE) $(PLUGIN_UPTODATE) $(WEAVEKUBE_UPTODATE) $(WEAVENPC_UPTODATE)
+IMAGES_UPTODATE=$(WEAVER_UPTODATE) $(WEAVEEXEC_UPTODATE) $(WEAVEKUBE_UPTODATE) $(WEAVENPC_UPTODATE) $(NETWORKTESTER_UPTODATE)

 # The names of the images. Note that the images for other architectures than amd64 have a suffix in the image name.
 WEAVER_IMAGE=$(DOCKERHUB_USER)/weave$(ARCH_EXT)
 WEAVEEXEC_IMAGE=$(DOCKERHUB_USER)/weaveexec$(ARCH_EXT)
-PLUGIN_IMAGE=$(DOCKERHUB_USER)/plugin$(ARCH_EXT)
 WEAVEKUBE_IMAGE=$(DOCKERHUB_USER)/weave-kube$(ARCH_EXT)
 WEAVENPC_IMAGE=$(DOCKERHUB_USER)/weave-npc$(ARCH_EXT)
 BUILD_IMAGE=weaveworks/weavebuild
 WEAVEDB_IMAGE=$(DOCKERHUB_USER)/weavedb
+PLUGIN_IMAGE=$(DOCKERHUB_USER)/net-plugin
+NETWORKTESTER_IMAGE=$(DOCKERHUB_USER)/network-tester

-IMAGES=$(WEAVER_IMAGE) $(WEAVEEXEC_IMAGE) $(PLUGIN_IMAGE) $(WEAVEKUBE_IMAGE) $(WEAVENPC_IMAGE) $(WEAVEDB_IMAGE)
+IMAGES=$(WEAVER_IMAGE) $(WEAVEEXEC_IMAGE) $(WEAVEKUBE_IMAGE) $(WEAVENPC_IMAGE) $(WEAVEDB_IMAGE) $(NETWORKTESTER_IMAGE)

-PUBLISH=publish_weave publish_weaveexec publish_plugin publish_weave-kube publish_weave-npc
-PUSH_ML=push_ml_weave push_ml_weaveexec push_ml_plugin push_ml_weave-kube push_ml_weave-npc
+PLUGIN_WORK_DIR="prog/net-plugin/rootfs"
+PLUGIN_BUILD_IMG="plugin-builder"
+
+PUBLISH=publish_weave publish_weaveexec publish_weave-kube publish_weave-npc
+PUSH_ML=push_ml_weave push_ml_weaveexec push_ml_weave-kube push_ml_weave-npc

 WEAVE_EXPORT=weave$(ARCH_EXT).tar.gz

@@ -150,20 +156,21 @@ PACKAGE_BASE=$(shell go list -e ./)
 all: $(WEAVE_EXPORT)
 testrunner: $(RUNNER_EXE) $(TEST_TLS_EXE)

-$(WEAVER_EXE) $(WEAVEPROXY_EXE) $(WEAVEUTIL_EXE): common/*.go common/*/*.go net/*.go net/*/*.go
+$(WEAVER_EXE) $(WEAVEUTIL_EXE): common/*.go common/*/*.go net/*.go net/*/*.go
 $(WEAVER_EXE): router/*.go ipam/*.go ipam/*/*.go db/*.go nameserver/*.go prog/weaver/*.go
-$(WEAVEPROXY_EXE): proxy/*.go prog/weaveproxy/*.go
+$(WEAVER_EXE): api/*.go plugin/*.go plugin/*/*
+$(WEAVER_EXE):  proxy/*.go
 $(WEAVEUTIL_EXE): prog/weaveutil/*.go net/*.go plugin/net/*.go plugin/ipam/*.go db/*.go
 $(SIGPROXY_EXE): prog/sigproxy/*.go
 $(KUBEPEERS_EXE): prog/kube-peers/*.go
 $(WEAVENPC_EXE): prog/weave-npc/*.go npc/*.go npc/*/*.go
-$(PLUGIN_EXE): prog/plugin/*.go plugin/*/*.go api/*.go common/*.go common/docker/*.go net/*.go
 $(TEST_TLS_EXE): test/tls/*.go
 $(RUNNER_EXE): tools/runner/*.go
 $(MANIFEST_TOOL_EXE): $(MANIFEST_TOOL_DIR)/*.go
 $(WEAVEWAIT_NOOP_EXE): prog/weavewait/*.go
 $(WEAVEWAIT_EXE): prog/weavewait/*.go net/*.go
 $(WEAVEWAIT_NOMCAST_EXE): prog/weavewait/*.go net/*.go
+$(NETWORKTESTER_EXE): test/images/network-tester/*.go
 tests: tools/.git
 lint: tools/.git

@@ -173,18 +180,21 @@ ifeq ($(BUILD_IN_CONTAINER),true)
 # It bind-mounts the source into the container and passes all important variables
 exes $(EXES) tests lint: $(BUILD_UPTODATE)
 	git submodule update --init
+# Containernetworking has another copy of vishvananda/netlink which leads to duplicate definitions
+	-@rm -r vendor/github.com/containernetworking/cni/vendor
 	@mkdir -p $(shell pwd)/.pkg
 	$(SUDO) docker run $(RM) $(RUN_FLAGS) \
 	    -v $(shell pwd):/go/src/github.com/weaveworks/weave \
 		-v $(shell pwd)/.pkg:/go/pkg \
 		-e GOARCH=$(ARCH) -e CGO_ENABLED=1 -e GOOS=linux -e CIRCLECI -e CIRCLE_BUILD_NUM -e CIRCLE_NODE_TOTAL -e CIRCLE_NODE_INDEX -e COVERDIR -e SLOW -e DEBUG \
 		$(BUILD_IMAGE) COVERAGE=$(COVERAGE) WEAVE_VERSION=$(WEAVE_VERSION) CC=$(CC) QEMUARCH=$(QEMUARCH) CGO_LDFLAGS=$(CGO_LDFLAGS) $@
+	touch $@

 else

 exes: $(EXES)

-$(WEAVER_EXE) $(WEAVEPROXY_EXE) $(PLUGIN_EXE):
+$(WEAVER_EXE):
 ifeq ($(COVERAGE),true)
 	$(eval COVERAGE_MODULES := $(shell (go list ./$(@D); go list -f '{{join .Deps "\n"}}' ./$(@D) | grep "^$(PACKAGE_BASE)/") | grep -v "^$(PACKAGE_BASE)/vendor/" | paste -s -d,))
 	go test -c -o ./$@ $(BUILD_FLAGS) -v -covermode=atomic -coverpkg $(COVERAGE_MODULES) ./$(@D)/
@@ -193,7 +203,7 @@ else
 endif
 	$(NETGO_CHECK)

-$(WEAVEUTIL_EXE) $(KUBEPEERS_EXE) $(WEAVENPC_EXE):
+$(WEAVEUTIL_EXE) $(KUBEPEERS_EXE) $(WEAVENPC_EXE) $(NETWORKTESTER_EXE):
 	go build $(BUILD_FLAGS) -o $@ ./$(@D)
 	$(NETGO_CHECK)

@@ -214,7 +224,7 @@ tests:
 	./tools/test -no-go-get -netgo -timeout 8m

 lint:
-	./tools/lint -nocomment -notestpackage .
+	./tools/lint -nocomment -notestpackage

 endif

@@ -244,25 +254,37 @@ else
 endif

 # The targets below builds the weave images
-$(WEAVER_UPTODATE): prog/weaver/Dockerfile.$(DOCKERHUB_USER) $(WEAVER_EXE) $(WEAVEEXEC_UPTODATE)
+$(WEAVER_UPTODATE): prog/weaver/Dockerfile.$(DOCKERHUB_USER) $(WEAVER_EXE) weave $(WEAVEUTIL_EXE)
+	cp $(WEAVEUTIL_EXE) prog/weaver/weaveutil
+	cp weave prog/weaver/weave
 	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker build -f prog/weaver/Dockerfile.$(DOCKERHUB_USER) -t $(WEAVER_IMAGE) prog/weaver
 	touch $@

-$(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile.$(DOCKERHUB_USER) prog/weaveexec/symlink $(DOCKER_DISTRIB) weave $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVEUTIL_EXE)
-	cp weave prog/weaveexec/weave
+$(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile.$(DOCKERHUB_USER) prog/weaveexec/symlink $(DOCKER_DISTRIB) $(SIGPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVER_UPTODATE)
 	cp $(SIGPROXY_EXE) prog/weaveexec/sigproxy
-	cp $(WEAVEPROXY_EXE) prog/weaveexec/weaveproxy
 	cp $(WEAVEWAIT_EXE) prog/weaveexec/weavewait
 	cp $(WEAVEWAIT_NOOP_EXE) prog/weaveexec/weavewait_noop
 	cp $(WEAVEWAIT_NOMCAST_EXE) prog/weaveexec/weavewait_nomcast
-	cp $(WEAVEUTIL_EXE) prog/weaveexec/weaveutil
 	tar -xf $(DOCKER_DISTRIB) usr/local/bin/docker -O > prog/weaveexec/docker
 	chmod +x prog/weaveexec/docker
 	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker build -f prog/weaveexec/Dockerfile.$(DOCKERHUB_USER) -t $(WEAVEEXEC_IMAGE) prog/weaveexec
 	touch $@

-$(PLUGIN_UPTODATE): prog/plugin/Dockerfile.$(DOCKERHUB_USER) $(PLUGIN_EXE) $(WEAVER_UPTODATE)
-	$(SUDO) docker build -f prog/plugin/Dockerfile.$(DOCKERHUB_USER) -t $(PLUGIN_IMAGE) prog/plugin
+# Builds Docker plugin.
+$(PLUGIN_UPTODATE): prog/net-plugin/launch.sh prog/net-plugin/config.json $(WEAVER_UPTODATE)
+	-$(SUDO) docker rm -f $(PLUGIN_BUILD_IMG) 2>/dev/null
+	$(SUDO) docker create --name=$(PLUGIN_BUILD_IMG) $(WEAVER_IMAGE) true
+	rm -rf $(PLUGIN_WORK_DIR)
+	mkdir $(PLUGIN_WORK_DIR)
+	$(SUDO) docker export $(PLUGIN_BUILD_IMG) | tar -x -C $(PLUGIN_WORK_DIR)
+	$(SUDO) docker rm -f $(PLUGIN_BUILD_IMG)
+	cp prog/net-plugin/launch.sh $(PLUGIN_WORK_DIR)/home/weave/launch.sh
+	-$(SUDO) docker plugin disable $(PLUGIN_IMAGE):$(WEAVE_VERSION) 2>/dev/null
+	-$(SUDO) docker plugin rm $(PLUGIN_IMAGE):$(WEAVE_VERSION) 2>/dev/null
+	$(SUDO) docker plugin create $(PLUGIN_IMAGE):$(WEAVE_VERSION) prog/net-plugin
+	-$(SUDO) docker plugin disable $(PLUGIN_IMAGE):$(NET_PLUGIN_LATEST) 2>/dev/null
+	-$(SUDO) docker plugin rm $(PLUGIN_IMAGE):$(NET_PLUGIN_LATEST) 2>/dev/null
+	$(SUDO) docker plugin create $(PLUGIN_IMAGE):$(NET_PLUGIN_LATEST) prog/net-plugin
 	touch $@

 $(WEAVEKUBE_UPTODATE): prog/weave-kube/Dockerfile.$(DOCKERHUB_USER) prog/weave-kube/launch.sh $(KUBEPEERS_EXE) $(WEAVER_UPTODATE)
@@ -278,6 +300,10 @@ $(WEAVEDB_UPTODATE): prog/weavedb/Dockerfile
 	$(SUDO) docker build -t $(WEAVEDB_IMAGE) prog/weavedb
 	touch $@

+$(NETWORKTESTER_UPTODATE): test/images/network-tester/Dockerfile $(NETWORKTESTER_EXE)
+	$(SUDO) docker build -t $(NETWORKTESTER_IMAGE) test/images/network-tester
+	touch $@
+
 $(WEAVE_EXPORT): $(IMAGES_UPTODATE) $(WEAVEDB_UPTODATE)
 	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker save $(addsuffix :latest,$(IMAGES)) | gzip > $@

@@ -290,6 +316,14 @@ tools/.git $(MANIFEST_TOOL_DIR)/.git:

 # CODE FOR PUBLISHING THE IMAGES

+# Push plugin
+plugin_publish: $(PLUGIN_UPTODATE)
+	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker plugin push $(PLUGIN_IMAGE):$(WEAVE_VERSION)
+# "$(NET_PLUGIN_LATEST)" means "stable release" here, so only push that if explicitly told to
+ifeq ($(UPDATE_LATEST),true)
+	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker plugin push $(PLUGIN_IMAGE):$(NET_PLUGIN_LATEST)
+endif
+
 # This target first runs "make publish" for each architecture
 # Then it pushes the manifest lists
 publish: $(addprefix sub-publish-,$(ALL_ARCHITECTURES)) $(WEAVEDB_UPTODATE)
@@ -342,13 +376,16 @@ ifneq ($(UPDATE_LATEST),false)
 	$(MANIFEST_TOOL_EXE) push from-args --platforms $(ML_PLATFORMS) --template $(DOCKERHUB_USER)/$*-ARCH:latest --target $(DOCKERHUB_USER)/$*:latest
 endif

+clean-work-dir:
+	rm -rf $(PLUGIN_WORK_DIR)
+
 clean-bin:
 	-$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker rmi $(IMAGES)
 	find prog -type f -name "Dockerfile.*" -not -name "Dockerfile.template" -print | xargs rm -f
 	find prog -type f -name "*qemu-*" -print | xargs rm -f
 	rm -rf $(EXES) $(IMAGES_UPTODATE) $(WEAVEDB_UPTODATE) weave*.tar.gz $(DOCKER_DISTRIB) prog/weaveexec/docker .pkg

-clean: clean-bin
+clean: clean-bin clean-work-dir
 	-$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker rmi $(BUILD_IMAGE)
 	rm -rf test/tls/*.pem test/coverage.* test/coverage $(BUILD_UPTODATE) $(MANIFEST_TOOL_EXE)

@@ -359,3 +396,31 @@ build:

 run-smoketests: all testrunner
 	cd test && ./setup.sh && ./run_all.sh
+
+integration-tests: all testrunner
+# Usage:
+#   $ make \
+#     NAME="<prefix used to name VMs and other resources>" \
+#     PROVIDER="<provider among {vagrant|gcp|aws|do}>" \
+#     NUM_HOSTS="<# test machines>" \
+#     PLAYBOOK="<filename>" \
+#     RUNNER_ARGS="<...>" \
+#     TESTS="<...>" \  # Can be set to only run one or a few tests instead of the full test suite.
+#     DOCKER_VERSION=<...> \
+#     KUBERNETES_VERSION=<...> \
+#     KUBERNETES_CNI_VERSION=<...> \
+#     <...> # See also run-integration-test.sh for all variables and individual functions.
+#     integration-tests
+#
+	RUNNER_ARGS="-parallel" ./test/run-integration-tests.sh
+
+# This target is only intended for use in Netlify CI environment for generating preview pages on feature branches and pull requests.
+# We need to obtain website repository (checked out under `site-build`) and place `site` directory into the context (`site-build/_weave_net_docs`).
+# We then run make in `site-build` and Netlify will publish the output (`site-build/_site`).
+netlify-site-preview:
+	@mkdir -p site-build
+	@curl --user $(WEBSITE_GITHUB_USER) --silent 'https://codeload.github.com/weaveworks/website-next/tar.gz/$(WEBSITE_BRANCH)' \
+	  | tar --extract --gunzip --directory site-build --strip 1
+	@cp -r site site-build/_weave_net_docs
+	@$(MAKE) -C site-build netlify_ensure_install
+	@$(MAKE) -C site-build BUILD_ENV=netlify
@@ -3,7 +3,6 @@
 [![Integration Tests](https://circleci.com/gh/weaveworks/weave/tree/master.svg?style=shield)](https://circleci.com/gh/weaveworks/weave)
 [![Coverage Status](https://coveralls.io/repos/weaveworks/weave/badge.svg)](https://coveralls.io/r/weaveworks/weave)
 [![Go Report Card](https://goreportcard.com/badge/github.com/weaveworks/weave)](https://goreportcard.com/report/github.com/weaveworks/weave)
-[![Slack Status](https://slack.weave.works/badge.svg)](https://slack.weave.works)
 [![Docker Pulls](https://img.shields.io/docker/pulls/weaveworks/weave.svg?maxAge=604800)](https://hub.docker.com/r/weaveworks/weave/)

 # About Weaveworks
@@ -11,11 +10,13 @@
 [Weaveworks](https://www.weave.works) is the company that delivers the most productive way for developers to connect, observe and control
 Docker containers.

-This repository contains [Weave Net](https://www.weave.works/products/weave-net/), the first product developed by Weaveworks, and with over 8 million downloads to date, it enables you to get started with Docker clusters and portable apps in a fraction of the time compared with other solutions.
+This repository contains [Weave Net](https://www.weave.works/products/weave-net/), the first product developed by Weaveworks, and with over 8 million downloads to date, enables you to get started with Docker clusters and portable apps in a fraction of the time compared with other solutions.

-Weaveworks' product [Weave Cloud](https://www.weave.works/solution/cloud/) takes the heavy lifting out of building, integrating and operating open source components, so you don’t have to manage databases, storage and availability.
+## Weave Cloud: 

-Weave Cloud is built using these Open Source projects: [Weave Scope](https://www.weave.works/products/weave-scope/), a powerful container monitoring tool that automatically maps Docker containers and their interactions, [Weave Cortex](https://github.com/weaveworks/cortex), a horizontally-scalable version of Prometheus, and [Weave Flux](https://www.weave.works/products/weave-flux/), a continuous deployment tool that works with Kubernetes.
+[Weave Cloud](https://www.weave.works/product/cloud/) is software-as-a-service that simplifies deployment, monitoring and management for containers and microservices. It extends and complements popular orchestrators, and enables developers and DevOps to realize faster deployments, insightful monitoring, visualization and networking.
+
+Weave Cloud is built using these Open Source projects: [Weave Scope](https://www.weave.works/products/weave-scope/), a powerful container visualization tool that automatically maps Docker containers and their interactions, [Weave Cortex](https://github.com/weaveworks/cortex), a horizontally-scalable version of Prometheus, and [Weave Flux](https://www.weave.works/products/weave-flux/), a continuous deployment tool that works with Kubernetes.

 # Weave Net

@@ -23,5 +24,20 @@ Weave Net creates a virtual network that connects Docker containers across multi

 Services provided by application containers on the Weave network can be exposed to the outside world, regardless of where they are running. Similarly, existing internal systems can be opened to accept connections from application containers irrespective of their location.

-* [Install Weave Net](https://www.weave.works/docs/net/latest/installing-weave/)
-* [Find out more about Weave Net](https://www.weave.works/products/weave-net/)
+## <a name="help"></a>Getting help
+
+If you have any questions about, feedback for or a problem with Weave Net:
+
+- Read [the Weave Net docs](https://www.weave.works/docs/net/latest/overview).
+- Invite yourself to the <a href="https://weaveworks.github.io/community-slack/" target="_blank"> #weave-community </a> slack channel.
+- Ask a question on the <a href="https://weave-community.slack.com/messages/general/"> #weave-community</a> slack channel.
+- Join the <a href="https://www.meetup.com/pro/Weave/"> Weave User Group </a> and get invited to online talks, hands-on training and meetups in your area.
+- Send an email to <a href="mailto:weave-users@weave.works">weave-users@weave.works</a>
+- <a href="https://github.com/weaveworks/weave/issues/new">File an issue.</a>
+
+Your feedback is always welcome!
+
+## Further Information
+
+* [Installing Weave Net](https://www.weave.works/docs/net/latest/install/installing-weave)
+* [Weave Net Product Overview](https://www.weave.works/products/weave-net)
@@ -1,45 +1,36 @@
-VAGRANTFILE_API_VERSION = "2"
-
-require './vagrant-common.rb'
+require File.expand_path(File.join(File.dirname(__FILE__), 'vagrant-common.rb'))

 vm_ip = "172.16.0.3" # arbitrary private IP

-pkgs = %w(
-  docker-engine=1.10.2-0~wily
-  aufs-tools
-  build-essential
-  ethtool
-  iputils-arping
-  libpcap-dev
-  git
-  mercurial
-  bc
-  jq
-)
-
 Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|

-  config.vm.box = "ubuntu/wily64"
+  config.vm.box = VAGRANT_IMAGE

  config.vm.network "private_network", ip: vm_ip
  config.vm.provider :virtualbox do |vb|
    vb.memory = 2048
-    vb.customize ["modifyvm", :id, "--natdnshostresolver1", "off"]
-    vb.customize ["modifyvm", :id, "--natdnsproxy1", "off"]
+    configure_nat_dns(vb)
  end

+  # Disable default Vagrant shared folder, which we don't need:
  config.vm.synced_folder ".", "/vagrant", disabled: true
+  # Keep Weave Net sources' in sync:
  config.vm.synced_folder ".", "/home/vagrant/src/github.com/weaveworks/weave"
+  # Create a convenience symlink to $HOME/src/github.com/weaveworks/weave
+  config.vm.provision :shell, :inline => 'ln -sf ~vagrant/src/github.com/weaveworks/weave ~vagrant/'

  # Set SSH keys up to be able to run smoke tests straightaway:
  config.vm.provision "file", source: "~/.vagrant.d/insecure_private_key", destination: "/home/vagrant/src/github.com/weaveworks/weave/test/insecure_private_key"
-
-  install_build_deps config.vm, pkgs
-  install_go_toochain config.vm
-  tweak_user_env config.vm
-  tweak_docker_daemon config.vm
+  # Grant permissions on sources:
+  config.vm.provision :shell, :inline => 'sudo chown -R vagrant:vagrant ~vagrant/src', :privileged => false
  cleanup config.vm

+  config.vm.provision 'ansible' do |ansible|
+    ansible.playbook = 'tools/config_management/setup_weave-net_dev.yml'
+    ansible.extra_vars = {
+      go_version: GO_VERSION
+    }.merge(ansibleize(get_dependencies_version_from_file_and_env()))
+  end
 end

 begin
@@ -3,6 +3,7 @@ package api
 import (
 	"fmt"
 	"net"
+	"net/url"
 )

 // Special token used in place of a container identifier when:
@@ -14,21 +15,29 @@ import (
 // which should be kept in mind if the entry needs to be removed at any point.
 const NoContainerID string = "_"

-func (client *Client) ipamOp(ID string, op string) (*net.IPNet, error) {
-	ip, err := client.httpVerb(op, fmt.Sprintf("/ip/%s", ID), nil)
+func (client *Client) ipamOp(ID string, op string, values url.Values) (*net.IPNet, error) {
+	ip, err := client.httpVerb(op, fmt.Sprintf("/ip/%s", ID), values)
 	if err != nil {
 		return nil, err
 	}
 	return parseIP(ip)
 }

-// returns an IP for the ID given, allocating a fresh one if necessary
-func (client *Client) AllocateIP(ID string) (*net.IPNet, error) {
-	return client.ipamOp(ID, "POST")
+func ipamValues(checkAlive bool) url.Values {
+	values := make(url.Values)
+	if checkAlive {
+		values.Set("check-alive", "true")
+	}
+	return values
 }

-func (client *Client) AllocateIPInSubnet(ID string, subnet *net.IPNet) (*net.IPNet, error) {
-	ip, err := client.httpVerb("POST", fmt.Sprintf("/ip/%s/%s", ID, subnet), nil)
+// returns an IP for the ID given, allocating a fresh one if necessary
+func (client *Client) AllocateIP(ID string, checkAlive bool) (*net.IPNet, error) {
+	return client.ipamOp(ID, "POST", ipamValues(checkAlive))
+}
+
+func (client *Client) AllocateIPInSubnet(ID string, subnet *net.IPNet, checkAlive bool) (*net.IPNet, error) {
+	ip, err := client.httpVerb("POST", fmt.Sprintf("/ip/%s/%s", ID, subnet), ipamValues(checkAlive))
 	if err != nil {
 		return nil, err
 	}
@@ -38,12 +47,12 @@ func (client *Client) AllocateIPInSubnet(ID string, subnet *net.IPNet) (*net.IPN
 // returns an IP for the ID given, or nil if one has not been
 // allocated
 func (client *Client) LookupIP(ID string) (*net.IPNet, error) {
-	return client.ipamOp(ID, "GET")
+	return client.ipamOp(ID, "GET", nil)
 }

 // Claim a specific IP on behalf of the ID
-func (client *Client) ClaimIP(ID string, cidr *net.IPNet) error {
-	_, err := client.httpVerb("PUT", fmt.Sprintf("/ip/%s/%s", ID, cidr), nil)
+func (client *Client) ClaimIP(ID string, cidr *net.IPNet, checkAlive bool) error {
+	_, err := client.httpVerb("PUT", fmt.Sprintf("/ip/%s/%s", ID, cidr), ipamValues(checkAlive))
 	return err
 }

@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"net/url"
 	"strings"
+	"time"
 )

 const (
@@ -76,6 +77,22 @@ func (client *Client) Connect(remote string) error {
 	return err
 }

+// IsReady returns true if the API server is up and running
+// (note it returns StatusServiceUnavailable until all parts are ready,
+// but callers of this function are expected to be ok with a partial service)
+func (client *Client) IsReady() bool {
+	resp, err := http.Get(client.baseURL + "/status")
+	return err == nil &&
+		(resp.StatusCode == http.StatusOK || resp.StatusCode == http.StatusServiceUnavailable)
+}
+
+// WaitAPIServer waits until the API server is ready to serve.
+func (client *Client) WaitAPIServer(n int) {
+	for i := 0; i < n && !client.IsReady(); i++ {
+		time.Sleep(2 * time.Second)
+	}
+}
+
 type Logger interface {
 	Infof(string, ...interface{})
 	Debugf(string, ...interface{})
@@ -2,45 +2,16 @@

 set -e

-echo "TEST_AND_PUBLISH=1" > "$STATE"
-
-# Avoid doing a full build if we can.  Note if the PR doesn't exist
-# when the build is kicked off, we can't run this check so we do a
-# full build.  Subsequent pushes to the same branch will have the desired behaviour
-if [ -n "$CI_PULL_REQUEST" -a "$CI_PULL_REQUEST" = "$CI_PULL_REQUESTS" ] ; then
-    if PR=$(echo "$CI_PULL_REQUEST" | grep -oP '(?<=^https://github.com/weaveworks/weave/pull/)[0-9]+$') ; then
-        echo "GH_PR=$PR" >> "$STATE"
-        if FILES=$(curl -s https://api.github.com/repos/weaveworks/weave/pulls/$PR/files | jq -r '.[]|.filename') ; then
-            echo "PR touches [$FILES]"
-            if ! echo "$FILES" | grep -v ^site/ ; then
-                echo "PR contains site changes only - skipping tests"
-                echo "TEST_AND_PUBLISH=" >> "$STATE"
-            else
-                echo "PR contains non-site changes - running tests"
-            fi
-        else
-            echo "Unable to get files for PR $PR" >&2
-        fi
-    else
-        echo "Unable to extract PR number from $CI_PULL_REQUEST" >&2
-    fi
-fi
-
 source "$STATE"

-mkdir -p $(dirname $SRCDIR) && cp -r $(pwd)/ $SRCDIR
-
-if [ -n "$TEST_AND_PUBLISH" ] ; then
-    [ -z "$SECRET_PASSWORD" ] || bin/setup-circleci-secrets "$SECRET_PASSWORD"
-    cd $SRCDIR; git submodule update --init
-    if [ "$CIRCLE_NODE_INDEX" = "0" -a -n "$SECRET_PASSWORD" ] ; then
-        cd $SRCDIR/test; ./gce.sh make_template
-    fi
-    cd $SRCDIR/build
+if [ -n "$TEST_AND_PUBLISH" ]; then
+    cd "$SRCDIR"
+    git submodule update --init
+    cd "$SRCDIR/build"
    ../tools/rebuild-image weaveworks/weavebuild . Dockerfile build.sh
-    touch $SRCDIR/.build.uptodate
+    touch "$SRCDIR/.build.uptodate"
    sudo chown -R ubuntu /usr/local/go
-    cd $SRCDIR
+    cd "$SRCDIR"
    make testrunner
    make COVERAGE=true RM= exes all
 fi
@@ -0,0 +1,36 @@
+#!/bin/bash
+
+set -e
+
+echo "TEST_AND_PUBLISH=1" >"$STATE"
+
+# Avoid doing a full build if we can.  Note if the PR doesn't exist
+# when the build is kicked off, we can't run this check so we do a
+# full build.  Subsequent pushes to the same branch will have the desired behaviour
+if [ -n "$CI_PULL_REQUEST" -a "$CI_PULL_REQUEST" = "$CI_PULL_REQUESTS" ]; then
+    if PR=$(echo "$CI_PULL_REQUEST" | grep -oP '(?<=^https://github.com/weaveworks/weave/pull/)[0-9]+$'); then
+        echo "GH_PR=$PR" >>"$STATE"
+        if FILES=$(curl -s "https://api.github.com/repos/weaveworks/weave/pulls/$PR/files" | jq -r '.[]|.filename'); then
+            echo "PR touches [$FILES]"
+            if ! echo "$FILES" | grep -v ^site/; then
+                echo "PR contains site changes only - skipping tests"
+                echo "TEST_AND_PUBLISH=" >>"$STATE"
+            else
+                echo "PR contains non-site changes - running tests"
+            fi
+        else
+            echo "Unable to get files for PR $PR" >&2
+        fi
+    else
+        echo "Unable to extract PR number from $CI_PULL_REQUEST" >&2
+    fi
+fi
+
+source "$STATE"
+
+mkdir -p "$(dirname "$SRCDIR")" && cp -r "$(pwd)/" "$SRCDIR"
+
+if [ -n "$TEST_AND_PUBLISH" ]; then
+    cd "$SRCDIR"
+    git submodule update --init
+fi
@@ -1,43 +0,0 @@
-#!/bin/bash
-
-set -e
-set -o pipefail
-
-source "$STATE"
-
-site_changes() {
-    curl -s https://api.github.com/repos/weaveworks/weave/pulls/$1/files |
-        jq -r '.[]|.status + " " + .filename' |
-        grep -oP '^(added|modified|removed) site/.*(?=\.md$)'
-}
-
-format_comment() {
-    if [ ! -d .git ] || ! BRANCH=$(git symbolic-ref --short HEAD) || [ -z "$BRANCH" ] ; then
-        echo "Could not determine branch" >&2
-        return 1
-    fi
-
-    echo "#### Documentation changes:"
-    while read ACTION PAGE; do
-        echo "$ACTION [${PAGE#site/}]($WP_DEV_URL/docs/net/${BRANCH#issues/}/${PAGE#site/}/)"
-    done | sort
-}
-
-post_comment() {
-    jq -s -R '. | tostring | { body: . }' |
-        curl -s -d @- \
-            -H "Authorization: Bearer $WP_GH_COMMENT_TOKEN" \
-            -H 'Content-Type: application/json' \
-            https://api.github.com/repos/weaveworks/weave/issues/$GH_PR/comments > /dev/null
-}
-
-cd $SRCDIR
-bin/install-wordepress v1.0.0
-bin/publish-site "$WP_DEV_URL" "$WP_DEV_USER" "$WP_DEV_PASSWORD"
-
-if [ -n "$WP_GH_COMMENT_TOKEN" -a -n "$GH_PR" ] ; then
-    echo ">>> Adding doc changelog to GitHub PR $GH_PR"
-    if CHANGES=$(site_changes $GH_PR) && [ -n "$CHANGES" ] ; then
-        echo "$CHANGES" | format_comment | post_comment
-    fi
-fi
@@ -11,7 +11,3 @@ if [ -n "$TEST_AND_PUBLISH" ] ; then
    # CircleCI doesn't let us install the qemu module to do ARM docker builds
    make publish ALL_ARCHITECTURES=amd64 UPDATE_LATEST=latest-only
 fi
-
-cd $SRCDIR
-bin/install-wordepress v1.0.0
-bin/publish-site "$WP_DEV_URL" "$WP_DEV_USER" "$WP_DEV_PASSWORD"
@@ -1,7 +0,0 @@
-#!/bin/bash
-
-set -e
-
-cd $SRCDIR
-bin/install-wordepress v1.0.0
-bin/publish-site "$WP_LIVE_URL" "$WP_LIVE_USER" "$WP_LIVE_PASSWORD"
@@ -2,9 +2,29 @@

 set -e

-source "$STATE"
+# Signal failures in lock file, in order to fail fast:
+function signal_failure() {
+    echo "KO" >"$TEST_VMS_READY_LOCK_FILE"
+    exit 1
+}
+trap signal_failure ERR

-if [ -n "$TEST_AND_PUBLISH" ] ; then
-    cd $SRCDIR/test
-    [ -z "$SECRET_PASSWORD" ] || (./gce.sh setup && eval $(./gce.sh hosts) && ./setup.sh)
+source "$STATE"
+source "$(dirname "$0")/wait_for.sh"
+
+if [ -n "$TEST_AND_PUBLISH" ]; then
+    [ -n "$SECRET_KEY" ] || {
+        echo "Cannot run smoke tests: no secret key"
+        exit 1
+    }
+
+    # Provisioning from image typically take 90 seconds, 
+    # but if we are creating a GCP image, it can take more than 10 minutes:
+    wait_for 900 "$TEST_VMS_PROV_AND_CONF_LOCK_FILE"
+
+    # Upload built binaries to testing VMs:
+    cd "$SRCDIR/test" # Ensures we generate Terraform state files in the right folder, for later use by integration tests.
+    ./run-integration-tests.sh setup >>"$TEST_VMS_SETUP_OUTPUT_FILE" 2>&1
+    echo "OK" >"$TEST_VMS_READY_LOCK_FILE"
+    echo "Test VMs now ready. $(date)." >>"$TEST_VMS_SETUP_OUTPUT_FILE"
 fi
@@ -3,12 +3,21 @@
 set -e

 source "$STATE"
+source "$(dirname "$0")/wait_for.sh"

-if [ -n "$TEST_AND_PUBLISH" ] ; then
-    [ -n "$SECRET_PASSWORD" ] || { echo "Cannot run smoke tests: no secret key"; exit 1; }
-    cd $SRCDIR/test
-    eval $(./gce.sh hosts)
+if [ -n "$TEST_AND_PUBLISH" ]; then
+    [ -n "$SECRET_KEY" ] || {
+        echo "Cannot run smoke tests: no secret key"
+        exit 1
+    }
+
+    # Provisioning from image typically take 90 seconds, 
+    # but if we are creating a GCP image, it can take more than 10 minutes:
+    wait_for 900 "$TEST_VMS_READY_LOCK_FILE"
+
+    # Run integration tests:
    export COVERAGE=true
    export WEAVE_NET_SANITY_CHECKS_FILES="$CIRCLE_ARTIFACTS/weave_net_sanity_check_*.log"
-    ./run_all.sh
+    cd "$SRCDIR/test" # Ensures we generate code coverage files in the right folder, and use the Terraform state of previously provisionned VMs.
+    ./run-integration-tests.sh test
 fi
@@ -6,6 +6,5 @@ source "$STATE"

 if [ -n "$TEST_AND_PUBLISH" ] ; then
    cd $SRCDIR/test
-    [ -z "$SECRET_PASSWORD" ] || ./gce.sh destroy
    test "$CIRCLE_NODE_INDEX" != "0" || (cd $SRCDIR/test; ./gen_coverage_reports.sh)
 fi
@@ -1,12 +0,0 @@
-#!/bin/bash
-
-if [ $# -ne 1 ] ; then
-    echo USAGE: install-wordepress [COMMIT-ISH] >&2
-    exit 1
-fi
-
-go get github.com/weaveworks/wordepress
-cd /home/ubuntu/src/github.com/weaveworks/wordepress
-git checkout $1
-cd cmd/wordepress
-go get
@@ -41,7 +41,7 @@ case "$1" in
        for i in $(seq $START $FINISH); do
            IP=$SUBNET.$i
            sudo ip addr add $IP/24 dev multiweave
-            weave $i launch-router --datapath '' --iface '' --no-dns --host $IP \
+            weave $i launch --datapath '' --iface '' --no-dns --host $IP \
                --name $(random_mac) --nickname weave$i "$@"
        done
        echo $(date -R) connecting
@@ -57,7 +57,7 @@ case "$1" in
        for i in $(seq $FINISH -1 $START); do
            IP=$SUBNET.$i
            echo Stopping weave$i
-            weave $i stop-router
+            weave $i stop
            sudo ip addr del $IP/24 dev multiweave || true
        done
        [ -z "$(ip -4 -o addr show multiweave)" ] && sudo ip link del multiweave
@@ -0,0 +1,41 @@
+#!/bin/bash
+
+set -e
+
+# Signal failures in lock file, in order to fail fast:
+function signal_failure() {
+    echo "KO" >"$TEST_VMS_PROV_AND_CONF_LOCK_FILE"
+    exit 1
+}
+trap signal_failure ERR
+
+source "$STATE"
+
+function install_terraform() {
+    curl -fsS https://releases.hashicorp.com/terraform/0.8.5/terraform_0.8.5_linux_amd64.zip | gunzip >terraform && chmod +x terraform && sudo mv terraform /usr/bin
+}
+
+function install_ansible() {
+    sudo apt-get update || true
+    sudo apt-get install -qq -y python-pip python-dev libffi-dev libssl-dev && pip install --user -U cffi && pip install --user ansible
+    export PATH="$PATH:$HOME/.local/bin"
+}
+
+if [ -n "$TEST_AND_PUBLISH" ]; then
+    [ -n "$SECRET_KEY" ] || {
+        echo "Cannot run smoke tests: no secret key"
+        exit 1
+    }
+
+    install_terraform >>"$TEST_VMS_SETUP_OUTPUT_FILE" 2>&1
+    install_ansible >>"$TEST_VMS_SETUP_OUTPUT_FILE" 2>&1
+
+    # Only attempt to create GCP image in first container, wait for it to be created otherwise:
+    [ "$CIRCLE_NODE_INDEX" != "0" ] && export CREATE_IMAGE=0
+
+    # Provision and configure testing VMs:
+    cd "$SRCDIR/test" # Ensures we generate Terraform state files in the right folder, for later use by integration tests.
+    ./run-integration-tests.sh configure >>"$TEST_VMS_SETUP_OUTPUT_FILE" 2>&1
+    echo "OK" >"$TEST_VMS_PROV_AND_CONF_LOCK_FILE"
+    echo "Test VMs now provisioned and configured. $(date)." >>"$TEST_VMS_SETUP_OUTPUT_FILE"
+fi
@@ -1,46 +0,0 @@
-#!/bin/bash
-
-set -e
-set -o pipefail
-
-PRODUCT=net
-
-fatal() {
-    echo "$@" >&2
-    exit 1
-}
-
-if [ ! -d .git ] ; then
-    fatal "Current directory is not a git clone"
-fi
-
-if ! BRANCH=$(git symbolic-ref --short HEAD) || [ -z "$BRANCH" ] ; then
-    fatal "Could not determine branch"
-fi
-
-case "$BRANCH" in
-    issues/*)
-        VERSION="${BRANCH#issues/}"
-        TAGS="$VERSION"
-        ;;
-    *)
-        if echo "$BRANCH" | grep -qE '^[0-9]+\.[0-9]+' ; then
-            DESCRIBE=$(git describe --match 'v*')
-            if ! VERSION=$(echo "$DESCRIBE" | grep -oP '(?<=^v)[0-9]+\.[0-9]+\.[0-9]+') ; then
-                fatal "Could not infer latest $BRANCH version from $DESCRIBE"
-            fi
-            TAGS="latest"
-        else
-            VERSION="$BRANCH"
-            TAGS="$VERSION"
-        fi
-        ;;
-esac
-
-for TAG in $TAGS ; do
-    echo ">>> Publishing $PRODUCT $VERSION to $1/docs/$PRODUCT/$TAG"
-    wordepress \
-        --url "$1" --user "$2" --password "$3" \
-        --product "$PRODUCT" --version "$VERSION" --tag "$TAG" \
-        publish site
-done
@@ -89,6 +89,8 @@ build() {
    ## Inject the version numbers and build the distributables
    ## (library versions?)
    sed -i "/SCRIPT_VERSION=/ c\SCRIPT_VERSION=\"$VERSION\"" ./weave
+    sed -i -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset.yaml
+    sed -i -e "s/:latest/:$VERSION/" -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset-k8s-1.6.yaml
    make SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER

    if make tests; then
@@ -157,17 +159,9 @@ draft() {
        --name "weave" \
        --file "./weave"

-    github-release release $RELEASE_ARGS \
-        --user $GITHUB_USER \
-        --repo weave-kube \
-        --tag $LATEST_TAG \
-        --name "$RELEASE_NAME $VERSION" \
-        --description "$RELEASE_DESCRIPTION"
-
-    sed -i -e s/:latest/:$VERSION/ -e "/imagePullPolicy: Always/d" ./prog/weave-kube/weave-daemonset.yaml
    github-release upload \
        --user $GITHUB_USER \
-        --repo weave-kube \
+        --repo weave \
        --tag $LATEST_TAG \
        --name "weave-daemonset.yaml" \
        --file "./prog/weave-kube/weave-daemonset.yaml"
@@ -176,8 +170,8 @@ draft() {
        --user $GITHUB_USER \
        --repo weave \
        --tag $LATEST_TAG \
-        --name "weave-daemonset.yaml" \
-        --file "./prog/weave-kube/weave-daemonset.yaml"
+        --name "weave-daemonset-k8s-1.6.yaml" \
+        --file "./prog/weave-kube/weave-daemonset-k8s-1.6.yaml"

    echo "** Draft $TYPE $RELEASE_NAME $VERSION created at"
    echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/$LATEST_TAG"
@@ -193,6 +187,10 @@ publish() {
    fi

    if [ "$RELEASE_TYPE" = 'PRERELEASE' ] ; then
+        echo "== Building and pushing plugin"
+        make UPDATE_LATEST=$IS_MAINLINE SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER plugin_publish
+        echo "** Plugin built and pushed"
+
        echo "== Tagging and pushing images on docker hub as user $DOCKERHUB_USER"
        make UPDATE_LATEST=$IS_MAINLINE SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER publish
        echo "** Docker images tagged and pushed"
@@ -225,6 +223,10 @@ publish() {
        fi
        echo '** Sanity checks OK for publishing tag' $LATEST_TAG as $DOCKERHUB_USER/weave:$VERSION

+        echo "== Building and pushing plugin"
+        make UPDATE_LATEST=$IS_MAINLINE SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER plugin_publish
+        echo "** Plugin built and pushed"
+
        echo "== Tagging and pushing images on docker hub as user $DOCKERHUB_USER"
        make PUBLISH_WEAVEDB=$IS_MAINLINE UPDATE_LATEST=$IS_MAINLINE SUDO=$SUDO WEAVE_VERSION=$VERSION DOCKERHUB_USER=$DOCKERHUB_USER publish
        echo "** Docker images tagged and pushed"
@@ -258,29 +260,9 @@ publish() {
            --name "weave" \
            --file "./weave"

-        github-release publish \
-            --user $GITHUB_USER \
-            --repo weave-kube \
-            --tag $LATEST_TAG
-
-        if github-release info --user $GITHUB_USER --repo weave-kube \
-            --tag latest_release >/dev/null 2>&1; then
-            github-release delete \
-                --user $GITHUB_USER \
-                --repo weave-kube \
-                --tag latest_release
-        fi
-
-        github-release release \
-            --user $GITHUB_USER \
-            --repo weave-kube \
-            --tag latest_release \
-            --name "$RELEASE_NAME latest ($VERSION)" \
-            --description "[Release Notes](https://github.com/$GITHUB_USER/weave/releases/$LATEST_TAG)"
-
        github-release upload \
            --user $GITHUB_USER \
-            --repo weave-kube \
+            --repo weave \
            --tag latest_release \
            --name "weave-daemonset.yaml" \
            --file "./prog/weave-kube/weave-daemonset.yaml"
@@ -289,8 +271,8 @@ publish() {
            --user $GITHUB_USER \
            --repo weave \
            --tag latest_release \
-            --name "weave-daemonset.yaml" \
-            --file "./prog/weave-kube/weave-daemonset.yaml"
+            --name "weave-daemonset-k8s-1.6.yaml" \
+            --file "./prog/weave-kube/weave-daemonset-k8s-1.6.yaml"

        echo "** Release $RELEASE_NAME $VERSION published at"
        echo -e "\thttps://github.com/$GITHUB_USER/weave/releases/$LATEST_TAG"
@@ -1,115 +0,0 @@
-#!/bin/bash
-
-set -eu
-
-# openssl enc -in do-setup-circleci-secrets.orig -out setup-circleci-secrets.orig -e -aes256 -pass stdin
-# openssl base64 < setup-circleci-secrets.orig
-
-openssl base64 -d << EOF \
-  | openssl enc \
-    -out bin/do-setup-circleci-secrets \
-		-d -aes256 -pass pass:$1
-U2FsdGVkX1/3QHnDgpZn0srp+GiEQBTlag0CBdsw6Bp6iaIKy6Jy8gFshrsmvl3+
-c+7hn1nqsBVpzVH0S5QA3Ex5nx9rl7/dcGoogsySFcwMmBFcauT0UTMK1bvX0Hqx
-QrshYSndUkww72KA7EsSnjR1BBJWm3AhCDOTIcnO6nQhig1Fc+SBEj5FGS5xTQ5Z
-/8hDsKf54Ms49vOO6QeE5w5ndZ+k7IvVJfq9Evhb7htD20RntDhR86foAwMnLV7R
-Wh9qAqI3gnRq0GmbeRKaHmB7pcLq9f0OdScqM/Tn1D+q0556fqJjBziXpZiGbxVs
-DxEp8zDJ8yNDAi0Wb2NXjoA79SXJ8Q7iTieaST4y2OmXQpY+Vw8RVDXxi6ERyVnH
-41OeMzyLm0qvCoMl32pe1sSG5DRCUiAm7wOtDTVvNDRqmGJYUgwwexyayecJI1wQ
-LlhYLJavUvw3UGDZOld8BaMQhfOKBVCdFrjmA4HuVxmOf3029qkgzOCSZiQVNqs+
-fvM6J05zBuk+GPy8YInvRkzfxum/x00vmUyGjMs/lHDFfrmYDFK3ux41EoVqvWLG
-S5uYxdZJFdR3Xsrs+sMr51XNBQGMmz6KoEEzFYyHs5fZgtdpRdPAuQS1m6FqgZyi
-wSz6+EKsALtmGorEp+CF8JN5YzKJCrKzNkg0fILBqsqmJZGP64lmX69950lRLNGM
-/l3KVR2zH31b4AnnzTcvldVSCKDXjaMw3JA2Ce/MK6XhOWOcpEv4oDt/62lbhUKP
-QUQTPbfpQRvVfBcoIrfAm3ghi/CZc2TDVEuD7DhasLTZD3r7LoK261BWC9O5Wubi
-vlXuFIF+uyrpTDf6EJKE/+XywtArppffMP6RkHu1Iqnd8JtsqPaIZsmMmZbjgb6j
-BX4ZLb5U9R7jYoSgIke4+u6geFcrMQ+Lny4r7MxXaS0Y1UJ6Jo1bwpYw1TBIobZc
-eQ30+xhbSeRC9vEw1NXI6qM2Ai2gIHtAZvEiBkBBXTG5Ld7N/mBAmDIJEzVRxh6F
-jRkB3dzESF6eeTBm61OQepwV3aW6lslMaf26drPGv2W2q+K/WOpQOejfggtHUgVs
-9SWqtn7hHYSpIASe1Ihi14HAWv3kPhQien0zY1DLKJWf4ilbRaICn1QSJjNuKwtl
-A2ZwEw7FFddFcsF4okHPkxEoCre3shq0DEw9UA1gnwEaEF1Q+i9cvLtQg56zK3+R
-MfTzFUv2K1z3j1s5tC6Z6LzL8j682EFOll7MkihqiIWh+po1zcNs6Ln0SkjB3v9T
-OFRYVJis9GqXYO9PUW1mI69udR4nXbKlBl5tWNyAxn9hufJHLSAmbGMwActKLRM5
-kROapKrN1Ra/sHUmhoSSDUK9AXeYKkqPXVMbhly9xC1Kya4hFaFokjRQIMLPmXdQ
-lP46RL3HOq0v1BkXg05poSwDm+BtitZkcIhOzcmeucUqn1whsz39y3VoOhJqQu2j
-0dUcj19Fue1CDZfwzACb9mLZr643h0yCIHQaVT7is/yiN2vEt0S0zynvOA1D+Xgy
-4bFdjqed9DgBShLwF/lh4/hur5iZPpVr9A8rt3Vq0k5A1tdjsZpXP3qv5jLc7lJv
-cAQxdVLEuv8WPwwTV/EQsoH7lpoEdjktw/gu0v5PkUgR/WBxEqJq4liTekViQ+8X
-BAmdm/FGWeIxSSEm0a8I+muiBpIuKjuQoJit1f0k+lLUohoVDqpDDfeYHh1TxXHE
-xSKAKNmFSc2XOr5Zg2mOInxeH7WoxH6iylXKADBgEgAQ4C55DoAPRjFNtGGz2iJl
-WkzhQOfgsDss1VxpPZ4SWDQO+xxuuEnYcCYdJ6Tyi5hAwZ0+RZmXx0g9BCK+5qzc
-Ffei066kCItBcayekwCs0i86r8JvDtsMUUkzEKDQTSWHpP8ypIZoz3P+Skdqcs6p
-IcZHy2fODIsClctRAsHOjZ9BnWSY2rqf1lysqvRfOkNTViTOUVx2hf+LuL+8rT6g
-K4GvS39Q+c9FYSMjCNxv1m37NfHJv2W7AlqVV95gMBEFB97M3388T7PfvmSLsyPv
-qAKDE7genTOycQvEX9oeEACxPo08ai2Mgs/YXCig0g0btZoScoKPelQKtD0HLpZ+
-j7ruaKFy4/vySDMostB3AKSkCE/SkGu/W9oI37n1guSYC/9yJjtTcwZULXAClfwt
-LyHvLAw4+7BdGJqDe9Tf8z4zqVLax+BcBHkW7pbP+pvxC6fhIA4PO8k5HwwAVlRw
-68lG6e3z9+Vst4zrFLewHJvkDRSOTSecs9h9SPOjReTK0ovlDzMHVakfUvqpk9mv
-nCj8SWaMPF70z138AuRuKN7X4exNXPBFnOcseKp/NpT1DyvgoHm/oIO65mq9vvo+
-42uSbyyegYiTdVK4SaXBc2hixkhaTteqdEy6GxfWqKCvHtYuRD2LyUSjZn/0Y6CG
-3wZapylKL1sxfH+b1gogv2wAA8KtZAfiTlMISuymwQr5RbOFma7UVMVecCa7XrNG
-fZwO8R+6++ru0efDzeC/gtLOItjn+yVfsbk2gfu0FikHIV1sogOjnsv3dl6IpH/s
-w6WbuK/yZhyrrmhIIueHF30ES512Peogf/Gxp8U/ZAmqBa7p4qsv93XWDR52IPYz
-yU1MtboLD02J39daBNrYZuO4Yfo/xAvU7Ijg2KIR9HS0bSWNuSFAZaZXlJ2bSag3
-8l0dZMx2fZa0FALxWvY2+nd1tWcH+Wo99RSxX+4TH3guCpe1x/58yKOKL4d1xRpu
-02nGaqerV9bHU6WjCUYTrrZurTp6yqivpSFCALDMhAU5Ihd/Qjz69zg4uZ7iqbNd
-WqIYJ3SAOei2tSfoOJbdh8mohotnMFFbupck3Fv+lXAXYDp0V/sSuK32MSeJxan1
-q3t0eenAh6zoBP0Tj53N8B9YmrgZ1i1AljQqYsAdb8N5Z3vecuzQa946U8H4axEc
-BL5fgmqSfsbj1EjJVUrw3cE9hgqeqAYBBvZsyW5zSAsLq/RJKYtBxDGADqr0TOOu
-TjVqfPObb1u9EAQj15ALBhhPORa2gBAK5gnhJWW5deNgA0UOYoWARFYfATuQvr1T
-9xTVbqzZ0VJR4n7X5JyxJo2tZ44QYVzA0fqX0lt+uRkarrkbZMgplKp4MJTFCp2N
-tLciWS0YSHPbKTm7svw5mROazUvEoj1N3SYrJT+Ai9UgSL1cA4FmQ5Jsi+GOeQbH
-7E4pzjeST4b1aATY9ZZSy4TzK+UNYBcCVqY1dN5Xnk0e5yPMnrkkcYI41s/6oOaW
-lQkp/yrHkvpzQWZa7vF2yWg54j3eX8YWx/TsLvmuJmSQqiIHfu9TXcAIPDispCpF
-gp4ZbYPZ8RDQLw3ROc+bZ9E0J8e+FHwgXEELsMLW9n4d3PTj9pLFej1vmBKa03o3
-g+JViNxb1gUPNmC6ADk4o7TQzBrjV2pmmuCza16kOmq6oAbJPOeCLtVWA5HJTX8d
-AuOzBLO37tWP457dNqoNDaCMik3LCy8cslZjAz02D6VG/QGOAXP9x8bJ3zg9N7vW
-EOn1BMtIeMI4yIxpC6HgotNWDNbUBWremAFWYQRgYQqo9L1SdW4hz6X8FqdlBFvK
-ml7sdUwjEy2tNW+aiZI4cgAlI/VvMWYr5kPfhvaUu1wGYeS1TD1B+DPcjcXpOGWo
-vB1f/uvGc61zZWD0ph9f3S9OnvEko5qV3VhxOnxYUZTrqlM7LVgy/sHrSaPdR7Eo
-nb4QGdi5wEGMxVgQlDGwOmEmS5nCaA0RcfHbkQV4SebRleocLB9qcSwj5JzPICAB
-sn1qeSv45LnGdTzUnCQErw1EzgrK1FXOknujjZ3GX5dM7a6Gag0E6cAxoQeC8Mh0
-aUWolyBo9aSXltn7Vnywoe4X3v96eVH6tUQtN3wt51LBlfSDTWOQDeXLFyW57oYL
-/ErbmJLaSHpANBcC9InI+rxNYePTTba7K8rdPDppmMEmdOXjaL+5aPay2Bay9K8T
-FUyZdoyrbzxFZYT9/YyVJV/ukVcT9ru3HpzLTg9Vgc/CyRfIvCZY/Gzh+pPUbRsR
-pHYDT09BFS+mjszTkcdbceweYXJvknXpajMiISrPUUkb9rwCTmLS4QR4y7I9zAgJ
-9U72mCZB9yhhzS17kyKAANihXvOFrMXCO7QTWZbtSkobMBS2SybDxYP3rM5b6824
-HQaY4MZW5qCndydfz4fa908XbPTDka9Nu3CZfI3fhGiiGDFWViotGEYE4i9BuGZJ
-vmtzII7zeIoHwM4t5fb5mYDd9H+Rkct1yATGEIFEx7cu1fj4Ht2177EzhdkF3Q6I
-Fccn43yGDW06nFvEjnjb+Lz4EvtGp6dDefUhNBohdzd4Rm2o+etKobm0lZ1xOX74
-2gOGBLfXS6PF+msNkWP76mqKE6hG0+R1iPrN06Arti+ZRBhNGJDp1pnOERl7IyB0
-hiLUqae7xVSMVRDeq4O04EUpMXh5ixs3RJXjthYILt7vX+6qskJC3rMuyThrsvMi
-Kk0wErDpzR5U7KFnM2fk4jY5by/0b/jHZ/PWFGnaFrXNOiwK/mV1RIJtg5FCrvMv
-xJN5Qo7o2ZYzUL+IBf5mP5O49FCnz3e++9r4ySY/K57ybhQft1l+cQPWS7xuvVAg
-wZGM9DPl9AhBus0I3V3XzfkcWWHkMynMRcfTnkBHrmKjMopIOggsq05JPalM9b0V
-NfwZngVvTFbQejbGjgQQQ+G7spav/icCIA8Iu8JPHaKZt2IX77L1xMcQOouqMrx8
-JCXnJ7zsuU+8W3GQGm70H2kcen4bf4beA8TSkFmbVsaqDNtGaG+ZopWO8ctZX3CP
-jFgIYgEGi137IWvs1KD5QNFHZI6l0JMzglmvcfnViRPDHLi+EQXAoL/98j/YzA9t
-a9L4xMO0oucovKkqYOS2cdFaQKVIUM9L5ibcbW7Tol4ugMo5ibIsTgjZoyFohG6t
-acg+h2wTTyxtrIapvOOBeAo9V/iQowTAPQf38LKQZ5tApksiCG1qvJerKALTMp1J
-yUHjTCPCPsaiXVVO0mfa9OPtzVvi/icLmlz7umk82mew13djedgMS3/ghq5aEHbg
-e7rtI5snFlm/GQnV6IaCDytb+jYxqQ0DZ9Mb0CHcMpnLyiBO6nzHfadpZYlrxrpx
-dPx9MVqfLavj1UVjKuVj4Mgec9J38IBBRGMJZ4MGhde2hrw/s2jVzG1BzaIzcvFa
-bWiJOkKKRC4BY9DBDYfae5c/obwzkxLmvkbWAVzoFXc+46K1IK6bbC2a4EerOAxc
-C7B3X8BucD8OtiPORwXgjctd9AJ7cXq0EEVGoZZ8jkILnklsK6RXsxrT4gSOGFpx
-cBU7TF4kHpH+o4KGQmjlFA2VYP1tXirjEep57LOHfL+zy+HiSXdsbexf6odkqLYA
-1RR0TzSkmqJYvP0GfHPMvp2xredx1kP934fhTIUcWvErrG3NPd/Dod4BzQye1nNK
-8Y8aFYF6fACcD4SFZ11ecK9DJmB+WXGlsxtO3w1LeEysny2lVkkH6HuMRIzPyXAM
-/sEpwh3hwPJosAh6vGM6JxuL7CXP8hC1oUvK91VR0hxeDcO/LgdcHtDnlNMqt1wC
-jvYt9Hg+3aY5GehBnQPRppnIMaGhiBrRC6HjBg8Umt6UTUr5PXNY2aia5wRcx4M6
-Tj0O0dAt8WWZ9ySgzOoq4SRoaAp6m4E7CpRNMgXH031OWEeHqtt8rsYqAcvcQLuW
-vIwts5hiXZOfgXyR6SBY3ANE1SjDY46na2G4oiG8FI7eAqYgehjHrXqCnGrzjefE
-V1eVcIr7DBYuM8wq7C9x+qdMir6RNV4MrVD+7rO/drivnd3MaqDHlG0LfMZo6GIK
-QZGIy0z1W5lOXm9x3RAz7/Ea11ynkZyPDDxBE5NRcV6JfukdjDrvsaQA/Qk2Wo7h
-PdUZjv17H4syMdap6tUDTc8Cohut6n1UxnDnhaAYEDGR3TgPqI5vEaJ+yoaM9itv
-b2I/K+0uK6GfWwca7PeTtYn92/5etO4czG99xEBFzw7tiEmBTA8KfseZIUe/i3fr
-9LO+rKEGalFB4mVTYyCKPYYx4hOIvjdCox/jEBTFyYUEhgGnZvArgw9XabvII7eM
-c1FmwnN2CM/MHUzM0Kw7cS/oaoRFcG/PqioO/krL2Bd+xThwSH4Zn+Y1UVO7aXNy
-90MOehHSc2nhN984Y2re3ffVsjPhC3KdWxr8jbho/Az65rUkYg64roiO2ZqdqRvf
-aYtX9fCe8N8SzgLTlWZt+l8sjY8HP2k9NoajphV1nG4iC/pX0ZJiVQ+VBRNaGhSl
-6IhM9gM1ZsI86cULJpOTAhNu1fZBv+Mq8IXYD8SqlNVwVtjvshtlzBN4InSGEKiO
-HM7coo7aDuu+Go5AEiIVMbR09jAa0VINsCVScfSbTFhlGRTrZr2DSO/s8WxbV+Mb
-EQAfZmyrLF71Z3MfIukg+ps5iuqFhZ+gJSXXSFwumpg=
-EOF
-
-exec sh bin/do-setup-circleci-secrets
@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# shellcheck disable=SC2155
+wait_for() {
+    local timeout=$1
+    local lock_file=$2
+    for i in $(seq 1 "$timeout"); do
+        if [ -f "$lock_file" ]; then
+            local status="$(cat "$lock_file")"
+            if [ "$status" == "OK" ]; then
+                echo "[$i seconds]: $lock_file found and status: $status." && return
+            else
+                echo "[$i seconds]: $lock_file found and status: $status." && return 1
+            fi
+        fi
+        if ! ((i % 10)); then echo "[$i seconds]: Waiting for $lock_file to be created..."; fi
+        sleep 1
+    done
+    echo "Timed out waiting for test VMs to be ready. See details in: $TEST_VMS_SETUP_OUTPUT_FILE" >&2
+    return 1
+}
@@ -1,9 +1,9 @@
-FROM golang:1.7.4
+FROM golang:1.8.1

 # Support Raspberry Pi 2 and newer
 ENV GOARM 7

-# The names of the architectures that we're fetching cross-compilers for from the Ubuntu packages
+# The names of the architectures that we're fetching cross-compilers for from the Debian packages
 ENV DEB_CROSSPLATFORMS \
 	armhf \
 	arm64
@@ -18,15 +18,14 @@ ENV GCC_CROSSCOMPILERS \
 	arm-linux-gnueabihf \
 	aarch64-linux-gnu

-# Temporarily add the Ubuntu repositories, because we're going to install gcc cross-compilers from there
+# Temporarily add the Debian repositories, because we're going to install gcc cross-compilers from there
 # Install the build-essential and crossbuild-essential-ARCH packages
-RUN echo "deb http://archive.ubuntu.com/ubuntu xenial main universe" > /etc/apt/sources.list.d/cgocrosscompiling.list \
-  && apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 40976EAF437D05B5 3B4FE6ACC0B21F32 \
+RUN echo "deb http://emdebian.org/tools/debian/ jessie main" > /etc/apt/sources.list.d/cgocrosscompiling.list \
+  && curl http://emdebian.org/tools/debian/emdebian-toolchain-archive.key | apt-key add - \
+  && for platform in ${DEB_CROSSPLATFORMS}; do dpkg --add-architecture $platform; done \
  && apt-get update \
  && apt-get install -y build-essential \
  && for platform in ${DEB_CROSSPLATFORMS}; do apt-get install -y crossbuild-essential-${platform}; done \
-  && rm /etc/apt/sources.list.d/cgocrosscompiling.list \
-  && apt-get update \
  && apt-get clean && rm -rf /var/lib/apt/lists/*

 # Install some required packages
@@ -41,10 +40,16 @@ RUN apt-get update \
 		flex \
 		bison

+RUN curl -fsSLo shfmt https://github.com/mvdan/sh/releases/download/v1.3.0/shfmt_v1.3.0_linux_amd64 && \
+	echo "b1925c2c405458811f0c227266402cf1868b4de529f114722c2e3a5af4ac7bb2  shfmt" | sha256sum -c && \
+	chmod +x shfmt && \
+	mv shfmt /usr/bin
+
 # Install common Go tools
 RUN go get \
 	github.com/golang/lint/golint \
 	github.com/fzipp/gocyclo \
+	github.com/fatih/hclfmt \
 	github.com/client9/misspell/cmd/misspell

 # First clean, because we're gonna rebuild the std both with -race enabled and disabled
@@ -60,6 +65,9 @@ RUN for platform in ${GO_CROSSPLATFORMS}; do \
 		GOOS=${platform%/*} GOARCH=${platform##*/} \
 			go install -tags netgo std; done

+# Allow full write access to the Go folders for anyone
+RUN chmod -R a+w /usr/local/go
+
 # The libpcap version from Debian packages is 1.6.2, matching that version here although newer versions of libpcap have been released
 # We have to cross-compile the libpcap library for the new architectures, that's what we're doing here
 ENV LIBPCAP_CROSS_VERSION=1.6.2
@@ -25,7 +25,4 @@ echo "weave:x:$uid:$gid::$WEAVE_SRC:/bin/sh" >>/etc/passwd
 echo "weave:*:::::::" >>/etc/shadow
 echo "weave	ALL=(ALL)	NOPASSWD: ALL" >>/etc/sudoers

-# Allow full write access to the Go folders for the user Weave
-chown -R $uid:$gid /usr/local/go
-
 su weave -c "PATH=$PATH make -C $WEAVE_SRC BUILD_IN_CONTAINER=false $*"
@@ -11,20 +11,34 @@ machine:
  environment:
    GOPATH: /home/ubuntu:$GOPATH
    SRCDIR: /home/ubuntu/src/github.com/weaveworks/weave
-    PATH: $PATH:$HOME/.local/bin
+    PATH: $PATH:$HOME/.local/bin:/opt/google-cloud-sdk/bin
    CLOUDSDK_CORE_DISABLE_PROMPTS: 1
    STATE: /home/ubuntu/state.env
+    # Base name of VMs for integration tests:
+    NAME: test-$CIRCLE_BUILD_NUM-$CIRCLE_NODE_INDEX
+    TEST_VMS_SETUP_OUTPUT_FILE: $CIRCLE_ARTIFACTS/test_vms_setup_output.txt
+    TEST_VMS_PROV_AND_CONF_LOCK_FILE: $CIRCLE_ARTIFACTS/test_vms_provisioned_and_configured.txt
+    TEST_VMS_READY_LOCK_FILE: $CIRCLE_ARTIFACTS/test_vms_ready.txt
+    # Google Cloud Platorm images for integration tests:
+    USE_IMAGE: 1
+    DISK_NAME_PREFIX: test-$CIRCLE_BUILD_NUM-0

 dependencies:
  cache_directories:
    - "~/docker"
  post:
+    - bin/circle-dependencies-post-sources
+    # Provision & configure testing VMs:
+    - "while [ ! -d $SRCDIR ]; do sleep 1; done; $SRCDIR/bin/provision_test_vms.sh":
+        parallel: true
+        background: true
    - bin/circle-dependencies-post

 test:
  pre:
    - "$SRCDIR/bin/circle-test-pre":
        parallel: true
+        background: true
  override:
    - "$SRCDIR/bin/circle-test-unit":
        parallel: true
@@ -37,22 +51,16 @@ test:

 teardown:
  pre:
+    # Destroy testing VMs:
+    - "cd $SRCDIR/test && ./run-integration-tests.sh destroy":
+        parallel: true
+        background: true
    - "$SRCDIR/bin/circle-teardown-pre":
        parallel: true

 deployment:
-  release:
-    branch: /[0-9]+\.[0-9]+/
-    owner: weaveworks
-    commands:
-      - "$SRCDIR/bin/circle-deploy-release"
  master:
    branch: master
    owner: weaveworks
    commands:
      - "$SRCDIR/bin/circle-deploy-master"
-  issues:
-    branch: /.*/
-    owner: weaveworks
-    commands:
-      - "$SRCDIR/bin/circle-deploy-issues"
@@ -0,0 +1,7 @@
+## Community Code of Conduct
+
+Weaveworks follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).
+
+Instances of abusive, harassing, or otherwise unacceptable behavior
+may be reported by contacting a Weaveworks project maintainer, or
+Alexis Richardson alexis@weave.works.
@@ -165,13 +165,25 @@ func (pending pendingStarts) finish(id string) {
 	}
 }

+// AllContainerIDs returns all the IDs of Docker containers,
+// whether they are running or not.
 func (c *Client) AllContainerIDs() ([]string, error) {
-	all, err := c.ListContainers(docker.ListContainersOptions{All: true})
+	return c.containerIDs(true)
+}
+
+// RunningContainerIDs returns all the IDs of the running
+// Docker containers.
+func (c *Client) RunningContainerIDs() ([]string, error) {
+	return c.containerIDs(false)
+}
+
+func (c *Client) containerIDs(all bool) ([]string, error) {
+	containers, err := c.ListContainers(docker.ListContainersOptions{All: all})
 	if err != nil {
 		return nil, err
 	}
 	var ids []string
-	for _, c := range all {
+	for _, c := range containers {
 		ids = append(ids, c.ID)
 	}
 	return ids, nil
@@ -213,6 +225,30 @@ func (c *Client) GetContainerIP(nameOrID string) (string, error) {
 	return info.NetworkSettings.IPAddress, nil
 }

+func (c *Client) EnsureNetwork(networkName, driver, subnet string, options map[string]interface{}) error {
+	_, err := c.CreateNetwork(
+		docker.CreateNetworkOptions{
+			Name:           networkName,
+			CheckDuplicate: true,
+			Driver:         driver,
+			IPAM: docker.IPAMOptions{
+				Driver: driver,
+				Config: []docker.IPAMConfig{{Subnet: subnet}},
+			},
+			Options: options,
+		})
+	if err != docker.ErrNetworkAlreadyExists && err != nil {
+		// Despite appearances to the contrary, CreateNetwork does
+		// sometimes(always?) *not* return ErrNetworkAlreadyExists
+		// when the network already exists. Hence we need to check for
+		// this explicitly.
+		if _, err2 := c.NetworkInfo(networkName); err2 != nil {
+			return fmt.Errorf("unable to create network: %s", err)
+		}
+	}
+	return nil
+}
+
 // logging

 func (c *Client) errorf(fmt string, args ...interface{}) {
@@ -0,0 +1,25 @@
+package common
+
+import (
+	"sync"
+	"sync/atomic"
+)
+
+type WaitGroup struct {
+	wg    sync.WaitGroup
+	count int32
+}
+
+// Increase the count of things waiting and return a closure which calls Done
+func (w *WaitGroup) Add() func() {
+	atomic.AddInt32(&w.count, 1)
+	w.wg.Add(1)
+	return func() {
+		w.wg.Done()
+		atomic.AddInt32(&w.count, -1)
+	}
+}
+
+func (w *WaitGroup) IsDone() bool {
+	return atomic.LoadInt32(&w.count) == 0
+}
@@ -26,10 +26,15 @@ var (

 const (
 	NameIdent = "peername"
-	FileName  = "data.db"
+	fileName  = "data.db"
 )

-func NewBoltDB(dbPathname string) (*BoltDB, error) {
+func Pathname(dbPrefix string) string {
+	return dbPrefix + fileName
+}
+
+func NewBoltDB(dbPrefix string) (*BoltDB, error) {
+	dbPathname := Pathname(dbPrefix)
 	db, err := bolt.Open(dbPathname, 0660, nil)
 	if err != nil {
 		return nil, fmt.Errorf("[boltDB] Unable to open %s: %s", dbPathname, err)
@@ -38,8 +43,9 @@ func NewBoltDB(dbPathname string) (*BoltDB, error) {
 	return &BoltDB{db: db}, err
 }

-func NewBoltDBReadOnly(dbPathname string) (*BoltDB, error) {
+func NewBoltDBReadOnly(dbPrefix string) (*BoltDB, error) {
 	options := bolt.Options{Timeout: time.Millisecond * 50, ReadOnly: true}
+	dbPathname := Pathname(dbPrefix)
 	db, err := bolt.Open(dbPathname, 0660, &options)
 	if err != nil {
 		return nil, fmt.Errorf("[boltDB] Unable to open %s: %s", dbPathname, err)
@@ -0,0 +1,81 @@
+# Weave Net Benchmarks
+
+## 2017-02-16: Fast Datapath Encryption
+
+Results: https://www.weave.works/weave-net-performance-fast-datapath/
+
+* Two `c3.8xlarge` instances running Ubuntu 16.04 LTS (`ami-d8f4deab`) in
+`eu-west-1` region of AWS.
+* 10 Gigabit [Enhanced Networking](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/enhanced-networking.html).
+* `iperf 3.0.11`.
+
+### fastdp
+
+* Encrypted:
+
+```
+host1$ WEAVE_MTU=8916 weave launch --password=foobar
+host1$ docker $(weave config) run --rm -ti --name server networkstatic/iperf3 -s
+
+host2$ WEAVE_MTU=8916 weave launch --password=foobar host1
+host2$ docker $(weave config) run --rm -ti networkstatic/iperf3 -c server
+```
+
+* Non-encrypted:
+
+```
+host1$ WEAVE_MTU=8950 weave launch
+host1$ docker $(weave config) run --rm -ti --name server networkstatic/iperf3 -s
+
+host2$ WEAVE_MTU=8950 weave launch --password=foobar host1
+host2$ docker $(weave config) run --rm -ti networkstatic/iperf3 -c server
+```
+
+### sleeve
+
+* Encrypted:
+
+```
+host1$ WEAVE_NO_FASTDP=1 weave launch --password=foobar
+host1$ docker $(weave config) run --rm -ti --name server networkstatic/iperf3 -s
+
+host2$ WEAVE_NO_FASTDP=1 weave launch --password=foobar host1
+host2$ docker $(weave config) run --rm -ti networkstatic/iperf3 -c server
+```
+
+* Non-encrypted:
+
+```
+host1$ WEAVE_NO_FASTDP=1 weave launch
+host1$ docker $(weave config) run --rm -ti --name server networkstatic/iperf3 -s
+
+host2$ WEAVE_NO_FASTDP=1 weave launch --password=foobar host1
+host2$ docker $(weave config) run --rm -ti networkstatic/iperf3 -c server
+```
+
+### host
+
+* Non-encrypted:
+
+```
+host1$ iperf -s
+host2$ iperf -c host1
+```
+
+* Encrypted:
+
+```
+host1$ export KEY1="0x466454f2b1a770f8f872f9afbc35ebeac57e00fc11ac86ed1f82716f010b20f0cf532274"
+host1$ export KEY2="0x3531151241a770f8f872f9afbc35ebeac57e00fc11ac86ed1f82716f010b20f0cf532274"
+host1# ip xfrm state add src ${IP1} dst ${IP2} proto esp spi 0x4c856ffc replay-window 256 flag esn reqid 0 mode transport aead 'rfc4106(gcm(aes))' ${KEY1} 128
+host1# ip xfrm state add src ${IP2} dst ${IP1} proto esp spi 0x9b0830bc replay-window 256 flag esn reqid 0 mode transport aead 'rfc4106(gcm(aes))' ${KEY2} 128
+host1# ip xfrm policy add src ${IP1}/32 dst ${IP2}/32 dir out tmpl src ${IP1} dst ${IP2} proto esp spi 0x4c856ffc reqid 0 mode transport
+host1$ iperf -s
+
+host2$ export KEY1="0x466454f2b1a770f8f872f9afbc35ebeac57e00fc11ac86ed1f82716f010b20f0cf532274"
+host2$ export KEY2="0x3531151241a770f8f872f9afbc35ebeac57e00fc11ac86ed1f82716f010b20f0cf532274"
+host2# ip xfrm state add src ${IP2} dst ${IP1} proto esp spi 0x9b0830bc reqid 0 replay-window 256 flag esn mode transport aead 'rfc4106(gcm(aes))' ${KEY2} 128
+host2# ip xfrm state add src ${IP1} dst ${IP2} proto esp spi 0x4c856ffc reqid 0 replay-window 256 flag esn mode transport aead 'rfc4106(gcm(aes))' ${KEY1} 128
+host2# ip xfrm policy add src ${IP2}/32 dst ${IP1}/32 dir out tmpl src ${IP1} dst ${IP2} proto esp spi 0x9b0830bc reqid 0 mode transport
+host2$ iperf -c host1
+```
@@ -0,0 +1,70 @@
+# Entrypoints
+
+This document describes the various ways that weave as a binary gets launched, and where and how it processes options.
+
+The goal is to enable maintainers to modify functionality without having to reverse engineer the code to find all of the places you can start a weave binary and what it depends upon.
+
+## Components
+### weaver
+
+`weaver` is the primary binary: it sets up the weave bridge to which containers are attached, manages IP address allocation, serves DNS requests and does many more things.
+
+Since version 2.0, `weaver` also bundles the Docker Plugin (legacy version) and Docker API Proxy which used to be shipped as separate containers.
+
+### weaveutil
+weaveutil is a binary which provides a number of functions for managing an existing weave network. It gets information about the network, attaches and detaches containers, etc.
+
+For the majority of interactions with an existing weave network, you will launch `weaveutil` in some manner or another.
+
+Almost all options can be passed as `--option` to `weaveutil`. These options are created in `prog/weaveutil/main.go` with a table mapping each command to a dedicated golang function.
+
+In addition to operating in normal mode, `weaveutil` has several additional operating modes. Before processing any commands, `weaveutil` checks the filename with which it was called.
+
+* If it was `weave-ipam` it delegates responsibility to the `cniIPAM()` function in `prog/weaveutil/cni.go`, which, in turn, calls the standard CNI plugin function `cni.PluginMain()`, passing it weave's IPAM implementation from `plugin/ipam`.
+* If it was `weave-net` it delegates responsibility to the `cniNet()` function in `prog/weaveutil/cni.go`, which, in turn, calls the standard CNI plugin function `cni.PluginMain()`, passing it weave's net plugin implementation from `plugin/net`.
+
+Finally, `weaveutil` is called by `weaver` when it needs to operate in a different network namespace.
+Go programs cannot safely switch namespaces; see this [issue](http://github.com/vishvananda/netns/issues/17).
+The call chain is `weaver`->`nsenter`->`weaveutil`.
+
+### weave
+Wrapping `weaver` and `weaveutil` is `weave`, a `sh` script that provides help information and calls `weaveutil` as relevant.
+
+### weave-kube
+weave-kube is an image with the weave binaries and a wrapper script installed. It is responsible for:
+
+1. Setting up the weave network
+2. Connecting to peers
+3. Copy the weave CNI-compatible binary plugin `weaveutil` to `/opt/cni/bin/weave-net` and weave config in `/etc/cni/net.d/10-weave.conf`
+4. Running the weave network policy controller (weave-npc) to implement kubernetes' `NetworkPolicy`
+
+Once installation is complete, each network-relevant change in a container leads `kubelet` to:
+
+1. Set certain environment variables to configure the CNI plugin, mostly related to the container ID
+2. Launch `/opt/cni/bin/weave-net`
+3. Pass the CNI config - the contents of `/etc/cni/net.d/10-weave.conf` to `weave-net`
+
+Thus, when each container is changed, and `kubelet` calls weave as a CNI plugin, it really just is launching `weaveutil` as `weave-net`.
+
+The installation and setup of all of the above - and therefore the entrypoint to the weave-kube image - is the script `prog/weave-kube/launch.sh`. `launch.sh` does the following:
+
+1. Read configuration variables from the environment. When the documentation for `weave-kube` describes configuring the weave network by changing the environment variables in the daemonset in the `.yml` file, `launch.sh` reads these environment variables.
+2. Set up the config file at `/etc/cni/net.d/10-weave.conf`
+3. Run the `weave` initialization script
+4. Run `weaver` with the correct configuration passed as command-line options
+
+
+## Adding Options
+To add new options to how weave should run with each invocation, you would do the following:
+
+1. determine to which `weave` command you want to add the option(s). `weave` normally is launched as `weave <command> <options> ...`.
+2. Add the option to `weave` script help for each `weave` command you wish to make it available. As of this writing, all of the commands and their options are listed in the function `usage_no_exist()`.
+3. Add the option to `weave` script option processing for the `weave` command, under the `case $COMMAND in` in the main `weave` script.
+4. In the function for the `weave` command, determine if the command should be passed on to `weaveutil` or `weaver`. Pass the option on to `weaveutil` or `weaver`, as appropriate, in the format `--option`, in the function for the `weave` command.
+5. Add a command-line option `--option` to `weaveutil` or `weaver` as appropriate.
+6. If the option can be configured for CNI:
+    * have `prog/weave-kube/launch.sh` read it as an environment variable and set inside
+    * set a default for the environment variable in `prog/weave-kube/weave-daemonset-k8s-1.6.yaml` and `weave-daemonset.yaml`
+    * if it should be set via `weaver` globally on its one-time initialization invocation, pass it on in `launch.sh`
+    * if it needs to be set via `weaveutil` on each invocation of `weave-net`, have `launch.sh` save it as an option in the CNI config file `/etc/cni/net.d/10-weave.conf` and then have the CNI code in `plugin/net/cni.go` in `weaveutil` read it and use where appropriate
+7. Document it!
@@ -4,14 +4,15 @@ This document describes implementation details of the fast datapath encryption.

 At the high level, we use the ESP protocol ([RFC 2406][esp]) in the Transport
 mode. Each packet is encrypted with AES in GCM mode ([RFC 4106][aesgcm]), with
-32byte key and 4byte salt. This combo provides the following security
+32 byte key and 4 byte salt. This combo provides the following security
 properties:

 * Data confidentiality.
 * Data origin authentication.
 * Integrity.
-* Anti-replay service.
-* Limited traffic flow confidentiality.
+* Anti-replay.
+* Limited traffic flow confidentiality as fast datapath VXLAN packets are fully
+  encrypted.

 ## Notation

@@ -52,9 +52,9 @@ overlay, which has a more sophisticated dynamic mechanism for coping
 with low path MTUs.

 To avoid triggering this fallback in typical deployments, the datapath
-interface is statically configured with an MTU of 1410 bytes allowing
+interface is statically configured with an MTU of 1376 bytes allowing
 it to work with most underlay network provider MTUs, including GCE at
-1460 bytes (the fifty byte difference accommodates the vxlan overhead).
+1460 bytes (the eighty four byte difference accommodates the encrypted vxlan overhead).
 This value can be overridden by setting `WEAVE_MTU` at launch if
 necessary.

@@ -65,14 +65,30 @@ peer for space:
  - it will continue to ask for space until it receives some, or its
    copy of the ring tells it all peers are full in that subnet.

+### Data persistence
+
+Key IPAM data is saved to disk, in a [BoltDB](https://github.com/boltdb/bolt)
+file, stored within a [data volume container](https://docs.docker.com/engine/userguide/containers/dockervolumes/#creating-and-mounting-a-data-volume-container)
+named `weavedb`.
+
+This file is used to persist data for various Weave Net components; for IPAM it contains:
+
+* the division of the IP allocation range amongst peers, and
+* allocation of addresses to containers on the local peer,
+
+so that it is immediately available when the peer restarts.
+
 ### Claiming an address

-If a Weave process is restarted, in most cases it will hear from
-another peer which ranges it used to own, but it needs to know which
-individual IP addresses are assigned to containers in order to avoid
-giving the same address out in subsequent allocation requests. The
-weave script invokes the `claim` command in `populate_ipam` to do
-this.
+If a Weave process is restarted,
+
+- if `weavedb` is present, then it loads persisted IPAM data from there, as
+described, in the previous section;
+- else, it learns from other peers which ranges it used to own.
+
+Weave Net then consults the allocator to know which individual IP addresses
+are assigned to containers, and therefore avoid giving the same address out in
+subsequent allocation requests.

 When the Allocator is told to claim an address, there are four
 possibilities:
@@ -4,8 +4,7 @@
 * Up-to-date versions of `git`, `go` etc
 * Install GitHub release tool `go get github.com/weaveworks/github-release`
 * Create a [github token for
-  github-release](https://help.github.com/articles/creating-an-access-token-for-command-line-use/);
-set and export `$GITHUB_TOKEN` with this value
+  github-release](https://help.github.com/articles/creating-an-access-token-for-command-line-use/); select the `repo` OAuth scope; set and export `$GITHUB_TOKEN` with this value

 ## Release Types

@@ -138,6 +137,8 @@ Finally, for **Mainline** releases only:
  published to https://www.weave.works
 * Add the new version of `weave-net` to the checkpoint system at
  https://checkpoint-api.weave.works/admin
+* File a PR to update the version of the daemonset at
+  https://github.com/kubernetes/kops/tree/master/upup/models/cloudup/resources/addons/networking.weave

 ## Troubleshooting

@@ -19,6 +19,9 @@ NetworkPolicy object updates from the k8s API server:
  network policy, containing the IP addresses of all pods in the
  namespace whose labels match that selector

+IPsets are implemented by the kernel module `xt_set`, without which
+weave-npc will not work.
+
 ipset names are generated deterministically from a string
 representation of the corresponding label selector. Because ipset
 names are limited to 31 characters in length, this is done by taking a
@@ -74,8 +77,10 @@ iptables -A WEAVE-NPC -m state --state NEW -j WEAVE-NPC-INGRESS

 To direct traffic into the policy engine:

+```
 iptables -A FORWARD -o weave -m physdev ! --physdev-out vethwe-bridge -j WEAVE-NPC
 iptables -A FORWARD -o weave -m physdev ! --physdev-out vethwe-bridge -j DROP
+```

 Note this only affects traffic which egresses the bridge on a physical
 port which is not the Weave Net router - in other words, it is
@@ -94,6 +99,9 @@ The following traffic is NOT affected:
  (e.g. kubelet health checks)
 * Traffic routed from an application container to the internet

+The above mechanism relies on the kernel module `br_netfilter` being
+loaded and enabled via `/proc/sys/net/bridge/bridge-nf-call-iptables`.
+
 See these resources for helpful context:

 * http://ebtables.netfilter.org/br_fw_ia/br_fw_ia.html
@@ -14,9 +14,9 @@ type allocateResult struct {

 type allocate struct {
 	resultChan       chan<- allocateResult
-	ident            string
+	ident            string       // a container ID, something like "weave:expose", or api.NoContainerID
 	r                address.CIDR // Subnet we are trying to allocate within
-	isContainer      bool
+	isContainer      bool         // true if ident is a container ID
 	hasBeenCancelled func() bool
 }

@@ -76,6 +76,13 @@ type Allocator struct {
 	now               func() time.Time
 }

+// PreClaims are IP addresses discovered before we could initialize IPAM
+type PreClaim struct {
+	Ident       string // a container ID, something like "weave:expose", or api.NoContainerID
+	IsContainer bool   // true if Ident is a container ID
+	Cidr        address.CIDR
+}
+
 type Config struct {
 	OurName     mesh.PeerName
 	OurUID      mesh.PeerUID
@@ -83,6 +90,7 @@ type Config struct {
 	Seed        []mesh.PeerName
 	Universe    address.CIDR
 	IsObserver  bool
+	PreClaims   []PreClaim
 	Quorum      func() uint
 	Db          db.DB
 	IsKnownPeer func(name mesh.PeerName) bool
@@ -123,6 +131,12 @@ func NewAllocator(config Config) *Allocator {
 		dead:        make(map[string]time.Time),
 		now:         time.Now,
 	}
+
+	alloc.pendingClaims = make([]operation, len(config.PreClaims))
+	for i, c := range config.PreClaims {
+		alloc.pendingClaims[i] = &claim{ident: c.Ident, cidr: c.Cidr}
+	}
+
 	return alloc
 }

@@ -156,6 +170,9 @@ func (alloc *Allocator) Start() {
 	default:
 		alloc.infof("Initialising as observer - awaiting IPAM data from another peer")
 	}
+	if loadedPersistedData { // do any pre-claims right away
+		alloc.tryOps(&alloc.pendingClaims)
+	}
 	actionChan := make(chan func(), mesh.ChannelSize)
 	stopChan := make(chan struct{})
 	alloc.actionChan = actionChan
@@ -193,9 +210,9 @@ func (alloc *Allocator) doOperation(op operation, ops *[]operation) {
 //  already succeeded.  If it is on the queue, we call
 //  cancel on it, allowing callers waiting for the resultChans
 //  to unblock.
-func (alloc *Allocator) cancelOp(op operation, ops *[]operation) {
+func (alloc *Allocator) cancelOp(opToCancel operation, ops *[]operation) {
 	for i, op := range *ops {
-		if op == op {
+		if op == opToCancel {
 			*ops = append((*ops)[:i], (*ops)[i+1:]...)
 			op.Cancel()
 			break
@@ -248,6 +265,10 @@ func (alloc *Allocator) tryPendingOps() {
 	alloc.tryOps(&alloc.pendingAllocates)
 }

+func (alloc *Allocator) havePendingOps() bool {
+	return len(alloc.pendingPrimes)+len(alloc.pendingClaims)+len(alloc.pendingAllocates) > 0
+}
+
 func (alloc *Allocator) spaceRequestDenied(sender mesh.PeerName, r address.Range) {
 	for i := 0; i < len(alloc.pendingClaims); {
 		claim := alloc.pendingClaims[i].(*claim)
@@ -679,8 +700,12 @@ func (alloc *Allocator) actorLoop(actionChan <-chan func(), stopChan <-chan stru
 			// Retry things in case messages got lost between here and recipients
 			if alloc.awaitingConsensus {
 				alloc.propose()
-			} else {
-				alloc.tryPendingOps()
+			} else if alloc.havePendingOps() {
+				if alloc.ring.Empty() {
+					alloc.establishRing()
+				} else {
+					alloc.tryPendingOps()
+				}
 			}
 			alloc.removeDeadContainers()
 		}
@@ -9,6 +9,7 @@ import (

 	"github.com/stretchr/testify/require"

+	"github.com/weaveworks/weave/api"
 	"github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/net/address"
 	"github.com/weaveworks/weave/testing/gossip"
@@ -30,6 +31,10 @@ func (alloc *Allocator) SimplyClaim(ident string, cidr address.CIDR) error {
 	return alloc.Claim(ident, cidr, true, true, returnFalse)
 }

+func (alloc *Allocator) AnonymousClaim(cidr address.CIDR) error {
+	return alloc.Claim(api.NoContainerID, cidr, false, true, returnFalse)
+}
+
 func TestAllocFree(t *testing.T) {
 	const (
 		container1 = "abcdef"
@@ -168,11 +173,15 @@ func TestAllocatorClaim(t *testing.T) {
 		container1 = "abcdef"
 		container3 = "b01df00d"
 		universe   = "10.0.3.0/24"
-		testAddr1  = "10.0.3.2/24"
+		testAddr1  = "10.0.3.5/24"
 		testAddr2  = "10.0.4.2/24"
+		testAddr4  = "10.0.2.3/23"
+		subnet4    = "10.0.2.0/23"
+		testPre    = "10.0.3.1/24"
 	)

-	allocs, router, subnet := makeNetworkOfAllocators(2, universe)
+	preAddr, _ := address.ParseCIDR(testPre)
+	allocs, router, subnet := makeNetworkOfAllocators(2, universe, []PreClaim{{container1, true, preAddr}})
 	defer stopNetworkOfAllocators(allocs, router)
 	alloc := allocs[1]
 	addr1, _ := address.ParseCIDR(testAddr1)
@@ -184,6 +193,9 @@ func TestAllocatorClaim(t *testing.T) {
 	alloc.Prime()
 	// Do an allocate on the other peer, which we will try to claim later
 	addrx, err := allocs[0].Allocate(container1, subnet, true, returnFalse)
+	require.NoError(t, err)
+	// Should not get the address we pre-claimed
+	require.NotEqual(t, addrx, preAddr)
 	router.Flush()

 	// Now try the claim again
@@ -198,13 +210,30 @@ func TestAllocatorClaim(t *testing.T) {
 	// claim for a different container should fail
 	err = alloc.SimplyClaim(container1, addr1)
 	require.Error(t, err)
+	// claim for an anonymous container, will assume it's the same one
+	err = alloc.AnonymousClaim(addr1)
+	require.NoError(t, err)
 	// claiming the address allocated on the other peer should fail
 	err = alloc.SimplyClaim(container1, address.MakeCIDR(subnet, addrx))
 	require.Error(t, err, "claiming address allocated on other peer should fail")
+	// claiming the pre-claimed address should fail on both peers
+	err = alloc.SimplyClaim(container3, preAddr)
+	require.Error(t, err, "claiming address allocated on other peer should fail")
+	err = allocs[0].SimplyClaim(container3, preAddr)
+	require.Error(t, err, "claiming address allocated on other peer should fail")
 	// Check an address outside of our universe
 	addr2, _ := address.ParseCIDR(testAddr2)
 	err = alloc.SimplyClaim(container1, addr2)
 	require.NoError(t, err)
+	err = alloc.SimplyClaim(container3, addr2)
+	require.Error(t, err)
+	// Anonymous claim outside of our universe
+	addr4, _ := address.ParseCIDR(testAddr4)
+	subnet4cidr, _ := address.ParseCIDR(subnet4)
+	require.NoError(t, alloc.AnonymousClaim(addr4))
+	addr5, err := alloc.Allocate(api.NoContainerID, subnet4cidr, false, returnFalse)
+	require.NoError(t, err)
+	require.NotEqual(t, addr4.Start(), addr5)
 }

 func (alloc *Allocator) pause() func() {
@@ -12,10 +12,10 @@ import (

 type claim struct {
 	resultChan       chan<- error
-	ident            string
-	cidr             address.CIDR
-	isContainer      bool
-	noErrorOnUnknown bool
+	ident            string       // a container ID, something like "weave:expose", or api.NoContainerID
+	cidr             address.CIDR // single address being claimed
+	isContainer      bool         // true if ident is a container ID
+	noErrorOnUnknown bool         // if false, error or block if we don't know; if true return ok but keep trying
 	hasBeenCancelled func() bool
 }

@@ -35,15 +35,34 @@ func (c *claim) sendResult(result error) {

 // Try returns true for success (or failure), false if we need to try again later
 func (c *claim) Try(alloc *Allocator) bool {
-	if c.hasBeenCancelled() {
+	if c.hasBeenCancelled != nil && c.hasBeenCancelled() {
 		c.Cancel()
 		return true
 	}

+	addOwned := func() {
+		if c.ident == api.NoContainerID {
+			alloc.addOwned(c.cidr.Addr.String(), c.cidr, c.isContainer)
+		} else {
+			alloc.addOwned(c.ident, c.cidr, c.isContainer)
+		}
+	}
+
 	if !alloc.ring.Contains(c.cidr.Addr) {
-		// Address not within our universe; assume user knows what they are doing
 		alloc.infof("Address %s claimed by %s - not in our range", c.cidr, c.ident)
-		alloc.addOwned(c.ident, c.cidr, c.isContainer)
+		previousOwner := alloc.findOwner(c.cidr.Addr)
+		switch {
+		case previousOwner == "":
+			addOwned()
+		case previousOwner == c.ident: // already owned by this ID
+		case c.ident == api.NoContainerID: // already owned by anonymous container
+			// do nothing (no automatic fall-through in Go)
+		case !alloc.dead[previousOwner].IsZero(): // already owned by dead container
+			alloc.removeOwned(previousOwner, c.cidr.Addr)
+			addOwned()
+		default:
+			c.sendResult(fmt.Errorf("address %s already in use by %s", c.cidr, previousOwner))
+		}
 		c.sendResult(nil)
 		return true
 	}
@@ -85,11 +104,7 @@ func (c *claim) Try(alloc *Allocator) bool {
 		// Unused address, we try to claim it:
 		if err := alloc.space.Claim(c.cidr.Addr); err == nil {
 			alloc.debugln("Claimed", c.cidr, "for", c.ident)
-			if c.ident == api.NoContainerID {
-				alloc.addOwned(c.cidr.Addr.String(), c.cidr, c.isContainer)
-			} else {
-				alloc.addOwned(c.ident, c.cidr, c.isContainer)
-			}
+			addOwned()
 			c.sendResult(nil)
 		} else {
 			c.sendResult(err)
@@ -1,6 +1,7 @@
 package ipam

 import (
+	"encoding/json"
 	"fmt"
 	"net/http"

@@ -127,6 +128,39 @@ func (alloc *Allocator) HandleHTTP(router *mux.Router, defaultSubnet address.CID
 		writeAddresses(w, addrs)
 	})

+	router.Methods("GET").Path("/ip").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		type mapping struct {
+			ContainerID string   `json:"containerid"`
+			Addrs       []string `json:"addrs"`
+		}
+
+		type mappings struct {
+			Owned []mapping `json:"owned"`
+		}
+
+		resultChan := make(chan mappings)
+		alloc.actionChan <- func() {
+			ms := mappings{}
+			for containerid, d := range alloc.owned {
+				m := mapping{
+					ContainerID: containerid,
+					Addrs:       []string{},
+				}
+				for _, addr := range d.Cidrs {
+					m.Addrs = append(m.Addrs, addr.String())
+				}
+				ms.Owned = append(ms.Owned, m)
+			}
+			resultChan <- ms
+		}
+		ms := <-resultChan
+
+		w.Header().Set("Content-Type", "application/json")
+		if err := json.NewEncoder(w).Encode(ms); err != nil {
+			common.Log.Warningln("[allocator]:", err.Error())
+		}
+	})
+
 	router.Methods("POST").Path("/ip/{id}/{ip}/{prefixlen}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		vars := mux.Vars(r)
 		if subnet, ok := parseCIDR(w, vars["ip"]+"/"+vars["prefixlen"], true); ok {
@@ -164,17 +198,6 @@ func (alloc *Allocator) HandleHTTP(router *mux.Router, defaultSubnet address.CID
 		w.WriteHeader(204)
 	})

-	router.Methods("DELETE").Path("/peer").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		alloc.Shutdown()
-		w.WriteHeader(204)
-	})
-
-	router.Methods("DELETE").Path("/peer/{id}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		ident := mux.Vars(r)["id"]
-		transferred := alloc.AdminTakeoverRanges(ident)
-		fmt.Fprintf(w, "%d IPs taken over from %s\n", transferred, ident)
-	})
-
 	router.Methods("GET").Path("/ipinfo/tracker").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		fmt.Fprintf(w, tracker)
 	})
@@ -52,12 +52,12 @@ func TestLowlevel(t *testing.T) {

 	s := New()
 	require.Equal(t, address.Count(0), s.NumFreeAddresses())
-	ok, got := s.Allocate(address.NewRange(0, 1000))
+	ok, _ := s.Allocate(address.NewRange(0, 1000))
 	require.False(t, ok, "allocate in empty space should fail")

 	s.Add(100, 100)
 	require.Equal(t, address.Count(100), s.NumFreeAddresses())
-	ok, got = s.Allocate(address.NewRange(0, 1000))
+	ok, got := s.Allocate(address.NewRange(0, 1000))
 	require.True(t, ok && got == 100, "allocate")
 	require.Equal(t, address.Count(99), s.NumFreeAddresses())
 	require.NoError(t, s.Claim(150))
@@ -68,6 +68,7 @@ func TestLowlevel(t *testing.T) {
 	wt.AssertErrorInterface(t, (*error)(nil), s.Free(100), "double free")

 	r, ok := s.Donate(address.NewRange(0, 1000))
+	require.True(t, ok, "donate")
 	require.Equal(t, address.NewRange(0xa0, 0x20), r, "donate")

 	// test Donate when addresses are scarce
@@ -78,6 +79,7 @@ func TestLowlevel(t *testing.T) {
 	require.NoError(t, s.Claim(0))
 	require.NoError(t, s.Claim(2))
 	r, ok = s.Donate(address.NewRange(0, 1000))
+	require.True(t, ok, "donate")
 	require.Equal(t, address.NewRange(1, 1), r, "donate")
 	r, ok = s.Donate(address.NewRange(0, 1000))
 	require.True(t, !ok, "donate should fail")
@@ -128,7 +128,7 @@ type mockDB struct{}
 func (d *mockDB) Load(_ string, _ interface{}) (bool, error) { return false, nil }
 func (d *mockDB) Save(_ string, _ interface{}) error         { return nil }

-func makeAllocator(name string, cidrStr string, quorum uint) (*Allocator, address.CIDR) {
+func makeAllocator(name string, cidrStr string, quorum uint, preClaims ...PreClaim) (*Allocator, address.CIDR) {
 	peername, err := mesh.PeerNameFromString(name)
 	if err != nil {
 		panic(err)
@@ -145,6 +145,7 @@ func makeAllocator(name string, cidrStr string, quorum uint) (*Allocator, addres
 		OurNickname: "nick-" + name,
 		Universe:    cidr,
 		IsObserver:  quorum == 0,
+		PreClaims:   preClaims,
 		Quorum:      func() uint { return quorum },
 		Db:          new(mockDB),
 		IsKnownPeer: func(mesh.PeerName) bool { return true },
@@ -213,15 +214,19 @@ func AssertNothingSentErr(t *testing.T, ch <-chan error) {
 	}
 }

-func makeNetworkOfAllocators(size int, cidr string) ([]*Allocator, *gossip.TestRouter, address.CIDR) {
+func makeNetworkOfAllocators(size int, cidr string, preClaims ...[]PreClaim) ([]*Allocator, *gossip.TestRouter, address.CIDR) {
 	gossipRouter := gossip.NewTestRouter(0.0)
 	allocs := make([]*Allocator, size)
 	var subnet address.CIDR

 	for i := 0; i < size; i++ {
 		var alloc *Allocator
+		preClaim := []PreClaim{}
+		if i < len(preClaims) {
+			preClaim = preClaims[i]
+		}
 		alloc, subnet = makeAllocator(fmt.Sprintf("%02d:00:00:02:00:00", i),
-			cidr, uint(size/2+1))
+			cidr, uint(size/2+1), preClaim...)
 		alloc.SetInterfaces(gossipRouter.Connect(alloc.ourName, alloc))
 		alloc.Start()
 		allocs[i] = alloc
@@ -30,7 +30,6 @@ import (
 	"github.com/vishvananda/netlink"

 	"github.com/weaveworks/weave/common"
-	wnet "github.com/weaveworks/weave/net"
 	"github.com/weaveworks/weave/net/address"
 )

@@ -42,7 +41,7 @@ type AWSVPCTracker struct {
 }

 // NewAWSVPCTracker creates and initialises AWS VPC based tracker.
-func NewAWSVPCTracker() (*AWSVPCTracker, error) {
+func NewAWSVPCTracker(bridgeName string) (*AWSVPCTracker, error) {
 	var (
 		err     error
 		session = session.New()
@@ -69,9 +68,9 @@ func NewAWSVPCTracker() (*AWSVPCTracker, error) {
 	t.routeTableID = *routeTableID

 	// Detect Weave bridge link index
-	link, err := netlink.LinkByName(wnet.WeaveBridgeName)
+	link, err := netlink.LinkByName(bridgeName)
 	if err != nil {
-		return nil, fmt.Errorf("cannot find \"%s\" interface: %s", wnet.WeaveBridgeName, err)
+		return nil, fmt.Errorf("cannot find \"%s\" interface: %s", bridgeName, err)
 	}
 	t.linkIndex = link.Attrs().Index

@@ -222,7 +222,7 @@ func (h *handler) handleReverse(w dns.ResponseWriter, req *dns.Msg) {
 		return
 	}

-	ipStr := strings.TrimSuffix(req.Question[0].Name, "."+reverseDNSdomain)
+	ipStr := strings.TrimSuffix(strings.ToLower(req.Question[0].Name), "."+reverseDNSdomain)
 	ip, err := address.ParseIP(ipStr)
 	if err != nil {
 		h.nameError(w, req)
@@ -27,7 +27,7 @@ func (n *Nameserver) HandleHTTP(router *mux.Router, dockerCli *docker.Client) {
 			vars      = mux.Vars(r)
 			container = vars["container"]
 			ipStr     = vars["ip"]
-			hostname  = dns.Fqdn(r.FormValue("fqdn"))
+			fqdn      = r.FormValue("fqdn")
 			ip, err   = address.ParseIP(ipStr)
 		)
 		if err != nil {
@@ -35,16 +35,11 @@ func (n *Nameserver) HandleHTTP(router *mux.Router, dockerCli *docker.Client) {
 			return
 		}

-		if !dns.IsSubDomain(n.domain, hostname) {
-			n.infof("Ignoring registration %s %s %s (not a subdomain of %s)", hostname, ipStr, container, n.domain)
-			return
-		}
-
-		n.AddEntry(hostname, container, n.ourName, ip)
+		n.AddEntryFQDN(fqdn, container, n.ourName, ip)

 		if r.FormValue("check-alive") == "true" && dockerCli != nil && dockerCli.IsContainerNotRunning(container) {
 			n.infof("container '%s' is not running: removing", container)
-			n.Delete(hostname, container, ipStr, ip)
+			n.Delete(dns.Fqdn(fqdn), container, ipStr, ip)
 		}

 		w.WriteHeader(204)
@@ -91,6 +91,15 @@ func (n *Nameserver) AddEntry(hostname, containerid string, origin mesh.PeerName
 	n.broadcastEntries(entry)
 }

+func (n *Nameserver) AddEntryFQDN(fqdn, containerid string, origin mesh.PeerName, addr address.Address) {
+	hostname := dns.Fqdn(fqdn)
+	if !dns.IsSubDomain(n.domain, hostname) {
+		n.infof("Ignoring registration %s %s %s (not a subdomain of %s)", hostname, addr.String(), containerid, n.domain)
+		return
+	}
+	n.AddEntry(hostname, containerid, origin, addr)
+}
+
 func (n *Nameserver) Lookup(hostname string) []address.Address {
 	n.RLock()
 	defer n.RUnlock()
@@ -160,6 +160,11 @@ func (cidr CIDR) String() string {
 	return fmt.Sprintf("%s/%d", cidr.Addr.String(), cidr.PrefixLen)
 }

+func (cidr CIDR) IPNet() (r *net.IPNet) {
+	mask := net.CIDRMask(cidr.PrefixLen, 8*net.IPv4len)
+	return &net.IPNet{IP: cidr.Addr.IP4(), Mask: mask}
+}
+
 // FromIP4 converts an ipv4 address to our integer address type
 func FromIP4(ip4 net.IP) (r Address) {
 	for _, b := range ip4.To4() {
@@ -1,6 +1,7 @@
 package address

 import (
+	"net"
 	"testing"
 	"testing/quick"

@@ -67,3 +68,15 @@ func TestCIDRStartAndEnd(t *testing.T) {
 	require.Equal(t, ip("10.0.0.0"), cidr.Start(), "")
 	require.Equal(t, ip("10.0.1.0"), cidr.End(), "")
 }
+
+func TestConversions(t *testing.T) {
+	addrStr := "10.2.3.0"
+	cidrStr := addrStr + "/24"
+	addr := ip(addrStr)
+	require.Equal(t, addr.String(), addrStr)
+	require.Equal(t, addr.IP4(), net.ParseIP(addrStr).To4())
+	cidr, _ := ParseCIDR(cidrStr)
+	require.Equal(t, cidr.String(), cidrStr)
+	_, ipnet, _ := net.ParseCIDR(cidrStr)
+	require.Equal(t, cidr.IPNet(), ipnet)
+}
@@ -1,27 +1,30 @@
 package net

-import "fmt"
-import "io"
-import "os"
+import (
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+)

 // Configure the ARP cache parameters for the given interface.  This
 // makes containers react more quickly to a change in the MAC address
 // associated with an IP address.
-func ConfigureARPCache(name string) error {
-	if err := sysctl(fmt.Sprintf("net/ipv4/neigh/%s/base_reachable_time", name), "5"); err != nil {
+func ConfigureARPCache(procPath, name string) error {
+	if err := sysctl(procPath, fmt.Sprintf("net/ipv4/neigh/%s/base_reachable_time", name), "5"); err != nil {
 		return err
 	}
-	if err := sysctl(fmt.Sprintf("net/ipv4/neigh/%s/delay_first_probe_time", name), "2"); err != nil {
+	if err := sysctl(procPath, fmt.Sprintf("net/ipv4/neigh/%s/delay_first_probe_time", name), "2"); err != nil {
 		return err
 	}
-	if err := sysctl(fmt.Sprintf("net/ipv4/neigh/%s/ucast_solicit", name), "1"); err != nil {
+	if err := sysctl(procPath, fmt.Sprintf("net/ipv4/neigh/%s/ucast_solicit", name), "1"); err != nil {
 		return err
 	}
 	return nil
 }

-func sysctl(variable, value string) error {
-	f, err := os.OpenFile(fmt.Sprintf("/proc/sys/%s", variable), os.O_WRONLY, 0)
+func sysctl(procPath, variable, value string) error {
+	f, err := os.OpenFile(filepath.Join(procPath, "/sys/", variable), os.O_WRONLY, 0)
 	if err != nil {
 		return err
 	}
@@ -2,43 +2,137 @@ package net

 import (
 	"fmt"
+	"io/ioutil"
 	"net"
+	"path/filepath"

 	"github.com/Sirupsen/logrus"
+	"github.com/coreos/go-iptables/iptables"
+	"github.com/j-keck/arping"
+	"github.com/pkg/errors"
 	"github.com/vishvananda/netlink"
+
+	"github.com/weaveworks/weave/common/odp"
 )

-type BridgeType int
+/* This code implements three possible configurations to connect
+   containers to the Weave Net overlay:
+
+1. Bridge
+                 +-------+
+(container-veth)-+ weave +-(vethwe-bridge)--(vethwe-pcap)
+                 +-------+
+
+"weave" is a Linux bridge. "vethwe-pcap" (end of veth pair) is used
+to capture and inject packets, by router/pcap.go.
+
+2. BridgedFastdp
+
+                 +-------+                                    /----------\
+(container-veth)-+ weave +-(vethwe-bridge)--(vethwe-datapath)-+ datapath +
+                 +-------+                                    \----------/
+
+"weave" is a Linux bridge and "datapath" is an Open vSwitch datapath;
+they are connected via a veth pair. Packet capture and injection use
+the "datapath" device, via "router/fastdp.go:fastDatapathBridge"
+
+3. Fastdp
+
+                 /-------\
+(container-veth)-+ weave +
+                 \-------/
+
+"weave" is an Open vSwitch datapath, and capture/injection are as in
+BridgedFastdp. Not used by default due to missing conntrack support in
+datapath of old kernel versions (https://github.com/weaveworks/weave/issues/1577).
+*/

 const (
 	WeaveBridgeName = "weave"
 	DatapathName    = "datapath"
-
-	None BridgeType = iota
-	Bridge
-	Fastdp
-	BridgedFastdp
-	Inconsistent
+	DatapathIfName  = "vethwe-datapath"
+	BridgeIfName    = "vethwe-bridge"
+	PcapIfName      = "vethwe-pcap"
 )

-func DetectBridgeType(weaveBridgeName, datapathName string) BridgeType {
+type Bridge interface {
+	init(config *BridgeConfig) error // create and initialise bridge device(s)
+	attach(veth *netlink.Veth) error // attach veth to bridge
+	IsFastdp() bool                  // does this bridge use fastdp?
+	String() string                  // human-readable type string
+}
+
+// Used to indicate a fallback to the Bridge type
+var errBridgeNotSupported = errors.New("bridge not supported")
+
+type bridgeImpl struct{ bridge netlink.Link }
+type fastdpImpl struct{ datapathName string }
+type bridgedFastdpImpl struct {
+	bridgeImpl
+	fastdpImpl
+}
+
+// Returns a string that is consistent with the weave script
+func (bridgeImpl) String() string        { return "bridge" }
+func (fastdpImpl) String() string        { return "fastdp" }
+func (bridgedFastdpImpl) String() string { return "bridged_fastdp" }
+
+// Used to decide whether to manage ODP tunnels
+func (bridgeImpl) IsFastdp() bool        { return false }
+func (fastdpImpl) IsFastdp() bool        { return true }
+func (bridgedFastdpImpl) IsFastdp() bool { return true }
+
+func ExistingBridgeType(weaveBridgeName, datapathName string) (Bridge, error) {
 	bridge, _ := netlink.LinkByName(weaveBridgeName)
 	datapath, _ := netlink.LinkByName(datapathName)

 	switch {
 	case bridge == nil && datapath == nil:
-		return None
+		return nil, nil
 	case isBridge(bridge) && datapath == nil:
-		return Bridge
+		return bridgeImpl{bridge: bridge}, nil
 	case isDatapath(bridge) && datapath == nil:
-		return Fastdp
+		return fastdpImpl{datapathName: datapathName}, nil
 	case isDatapath(datapath) && isBridge(bridge):
-		return BridgedFastdp
+		return bridgedFastdpImpl{bridgeImpl{bridge: bridge}, fastdpImpl{datapathName: datapathName}}, nil
 	default:
-		return Inconsistent
+		return nil, errors.New("Inconsistent bridge state detected. Please do 'weave reset' and try again")
 	}
 }

+func EnforceAddrAssignType(bridgeName string) (setAddr bool, err error) {
+	sysctlFilename := filepath.Join("/sys/class/net/", bridgeName, "/addr_assign_type")
+	addrAssignType, err := ioutil.ReadFile(sysctlFilename)
+	if err != nil {
+		return false, errors.Wrapf(err, "reading %q", sysctlFilename)
+	}
+
+	// From include/uapi/linux/netdevice.h
+	// #define NET_ADDR_PERM       0   /* address is permanent (default) */
+	// #define NET_ADDR_RANDOM     1   /* address is generated randomly */
+	// #define NET_ADDR_STOLEN     2   /* address is stolen from other device */
+	// #define NET_ADDR_SET        3   /* address is set using dev_set_mac_address() */
+	// Note the file typically has a newline at the end, so we just look at the first char
+	if addrAssignType[0] != '3' {
+		link, err := netlink.LinkByName(bridgeName)
+		if err != nil {
+			return false, errors.Wrapf(err, "EnforceAddrAssignType finding bridge %s", bridgeName)
+		}
+
+		mac, err := RandomMAC()
+		if err != nil {
+			return false, errors.Wrap(err, "creating random MAC")
+		}
+
+		if err := netlink.LinkSetHardwareAddr(link, mac); err != nil {
+			return false, errors.Wrapf(err, "setting bridge %s address to %v", bridgeName, mac)
+		}
+		return true, nil
+	}
+
+	return false, nil
+}
+
 func isBridge(link netlink.Link) bool {
 	_, isBridge := link.(*netlink.Bridge)
 	return isBridge
@@ -108,3 +202,320 @@ func FindBridgeIP(bridgeName string, subnet *net.IPNet) (net.IP, error) {
 	// No subnet, or none in the required subnet; just return the first one
 	return netdev.CIDRs[0].IP, nil
 }
+
+type BridgeConfig struct {
+	DockerBridgeName string
+	WeaveBridgeName  string
+	DatapathName     string
+	NoFastdp         bool
+	NoBridgedFastdp  bool
+	AWSVPC           bool
+	NPC              bool
+	MTU              int
+	Mac              string
+	Port             int
+}
+
+func (config *BridgeConfig) configuredBridgeType() Bridge {
+	switch {
+	case config.NoFastdp:
+		return bridgeImpl{}
+	case config.NoBridgedFastdp:
+		return fastdpImpl{datapathName: config.WeaveBridgeName}
+	default:
+		return bridgedFastdpImpl{fastdpImpl: fastdpImpl{datapathName: config.DatapathName}}
+	}
+}
+
+func EnsureBridge(procPath string, config *BridgeConfig, log *logrus.Logger) (Bridge, error) {
+	bridgeType, err := ExistingBridgeType(config.WeaveBridgeName, config.DatapathName)
+	if bridgeType != nil || err != nil {
+		return bridgeType, err
+	}
+
+	bridgeType = config.configuredBridgeType()
+	for {
+		if err := bridgeType.init(config); err != nil {
+			if errors.Cause(err) == errBridgeNotSupported {
+				log.Warnf("Skipping bridge creation of %q due to: %s", bridgeType, err)
+				bridgeType = bridgeImpl{}
+				continue
+			}
+			return nil, err
+		}
+		break
+	}
+
+	if err := configureIPTables(config); err != nil {
+		return bridgeType, errors.Wrap(err, "configuring iptables")
+	}
+
+	if config.AWSVPC {
+		// Set proxy_arp on the bridge, so that it could accept packets destined
+		// to containers within the same subnet but running on remote hosts.
+		// Without it, exact routes on each container are required.
+		if err := sysctl(procPath, "net/ipv4/conf/"+config.WeaveBridgeName+"/proxy_arp", "1"); err != nil {
+			return bridgeType, errors.Wrap(err, "setting proxy_arp")
+		}
+		// Avoid delaying the first ARP request. Also, setting it to 0 avoids
+		// placing the request into a bounded queue as it can be seen:
+		// https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/net/ipv4/arp.c?id=refs/tags/v4.6.1#n819
+		if err := sysctl(procPath, "net/ipv4/neigh/"+config.WeaveBridgeName+"/proxy_delay", "0"); err != nil {
+			return bridgeType, errors.Wrap(err, "setting proxy_arp")
+		}
+	}
+
+	if err := linkSetUpByName(config.WeaveBridgeName); err != nil {
+		return bridgeType, err
+	}
+
+	if err := ConfigureARPCache(procPath, config.WeaveBridgeName); err != nil {
+		return bridgeType, errors.Wrapf(err, "configuring ARP cache on bridge %q", config.WeaveBridgeName)
+	}
+
+	return bridgeType, nil
+}
+
+func (b bridgeImpl) initPrep(config *BridgeConfig) error {
+	mac, err := net.ParseMAC(config.Mac)
+	if err != nil {
+		return errors.Wrapf(err, "parsing bridge MAC %q", config.Mac)
+	}
+
+	linkAttrs := netlink.NewLinkAttrs()
+	linkAttrs.Name = config.WeaveBridgeName
+	linkAttrs.HardwareAddr = mac
+	if config.MTU == 0 {
+		config.MTU = 65535
+	}
+	b.bridge = &netlink.Bridge{LinkAttrs: linkAttrs}
+	if err = netlink.LinkAdd(b.bridge); err != nil {
+		return errors.Wrapf(err, "creating bridge %q", config.WeaveBridgeName)
+	}
+	if err := netlink.LinkSetHardwareAddr(b.bridge, mac); err != nil {
+		return errors.Wrapf(err, "setting bridge %q mac %v", config.WeaveBridgeName, mac)
+	}
+	// Attempting to set the bridge MTU to a high value directly
+	// fails. Bridges take the lowest MTU of their interfaces. So
+	// instead we create a temporary interface with the desired MTU,
+	// attach that to the bridge, and then remove it again.
+	dummy := &netlink.Dummy{LinkAttrs: netlink.NewLinkAttrs()}
+	dummy.LinkAttrs.Name = "vethwedu"
+	if err = netlink.LinkAdd(dummy); err != nil {
+		return errors.Wrap(err, "creating dummy interface")
+	}
+	if err := netlink.LinkSetMTU(dummy, config.MTU); err != nil {
+		return errors.Wrapf(err, "setting dummy interface mtu to %d", config.MTU)
+	}
+	if err := netlink.LinkSetMasterByIndex(dummy, b.bridge.Attrs().Index); err != nil {
+		return errors.Wrap(err, "setting dummy interface master")
+	}
+	if err := netlink.LinkDel(dummy); err != nil {
+		return errors.Wrap(err, "deleting dummy interface")
+	}
+
+	return nil
+}
+
+func (b bridgeImpl) init(config *BridgeConfig) error {
+	if err := b.initPrep(config); err != nil {
+		return err
+	}
+	if _, err := CreateAndAttachVeth(BridgeIfName, PcapIfName, config.WeaveBridgeName, config.MTU, true, func(veth netlink.Link) error {
+		return netlink.LinkSetUp(veth)
+	}); err != nil {
+		return errors.Wrap(err, "creating pcap veth pair")
+	}
+	if err := EthtoolTXOff(config.WeaveBridgeName); err != nil {
+		return errors.Wrap(err, "setting tx off")
+	}
+
+	return nil
+}
+
+func (f fastdpImpl) init(config *BridgeConfig) error {
+	odpSupported, err := odp.CreateDatapath(f.datapathName)
+	if !odpSupported {
+		msg := ""
+		if err != nil {
+			msg = err.Error()
+		}
+		return errors.Wrap(errBridgeNotSupported, msg)
+	}
+	if err != nil {
+		return errors.Wrapf(err, "creating datapath %q", f.datapathName)
+	}
+	datapath, err := netlink.LinkByName(f.datapathName)
+	if err != nil {
+		return errors.Wrapf(err, "finding datapath %q", f.datapathName)
+	}
+	if config.MTU == 0 {
+		/* GCE has the lowest underlay network MTU we're likely to encounter on
+		   a local network, at 1460 bytes.  To get the overlay MTU from that we
+		   subtract 20 bytes for the outer IPv4 header, 8 bytes for the outer
+		   UDP header, 8 bytes for the vxlan header, and 14 bytes for the inner
+		   ethernet header.  In addition, we subtract 34 bytes for the ESP overhead
+		   which is needed for the vxlan encryption. */
+		config.MTU = 1376
+	}
+	if err := netlink.LinkSetMTU(datapath, config.MTU); err != nil {
+		return errors.Wrapf(err, "setting datapath %q mtu %d", f.datapathName, config.MTU)
+	}
+	return nil
+}
+
+func (bf bridgedFastdpImpl) init(config *BridgeConfig) error {
+	if err := bf.fastdpImpl.init(config); err != nil {
+		return err
+	}
+	if err := bf.bridgeImpl.initPrep(config); err != nil {
+		return err
+	}
+	if _, err := CreateAndAttachVeth(BridgeIfName, DatapathIfName, config.WeaveBridgeName, config.MTU, true, func(veth netlink.Link) error {
+		if err := netlink.LinkSetUp(veth); err != nil {
+			return errors.Wrapf(err, "setting link up on %q", veth.Attrs().Name)
+		}
+		if err := odp.AddDatapathInterface(bf.datapathName, veth.Attrs().Name); err != nil {
+			return errors.Wrapf(err, "adding interface %q to datapath %q", veth.Attrs().Name, bf.datapathName)
+		}
+		return nil
+	}); err != nil {
+		return errors.Wrap(err, "creating bridged fastdp veth pair")
+	}
+
+	if err := linkSetUpByName(bf.datapathName); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (b bridgeImpl) attach(veth *netlink.Veth) error {
+	return netlink.LinkSetMasterByIndex(veth, b.bridge.Attrs().Index)
+}
+
+func (bf bridgedFastdpImpl) attach(veth *netlink.Veth) error {
+	return bf.bridgeImpl.attach(veth)
+}
+
+func (f fastdpImpl) attach(veth *netlink.Veth) error {
+	return odp.AddDatapathInterface(f.datapathName, veth.Attrs().Name)
+}
+
+func configureIPTables(config *BridgeConfig) error {
+	ipt, err := iptables.New()
+	if err != nil {
+		return errors.Wrap(err, "creating iptables object")
+	}
+	if config.DockerBridgeName != "" {
+		if config.WeaveBridgeName != config.DockerBridgeName {
+			err := ipt.Insert("filter", "FORWARD", 1, "-i", config.DockerBridgeName, "-o", config.WeaveBridgeName, "-j", "DROP")
+			if err != nil {
+				return err
+			}
+		}
+
+		dockerBridgeIP, err := FindBridgeIP(config.DockerBridgeName, nil)
+		if err != nil {
+			return err
+		}
+
+		// forbid traffic to the Weave port from other containers
+		if err = ipt.AppendUnique("filter", "INPUT", "-i", config.DockerBridgeName, "-p", "tcp", "--dst", dockerBridgeIP.String(), "--dport", fmt.Sprint(config.Port), "-j", "DROP"); err != nil {
+			return err
+		}
+		if err = ipt.AppendUnique("filter", "INPUT", "-i", config.DockerBridgeName, "-p", "udp", "--dst", dockerBridgeIP.String(), "--dport", fmt.Sprint(config.Port), "-j", "DROP"); err != nil {
+			return err
+		}
+		if err = ipt.AppendUnique("filter", "INPUT", "-i", config.DockerBridgeName, "-p", "udp", "--dst", dockerBridgeIP.String(), "--dport", fmt.Sprint(config.Port+1), "-j", "DROP"); err != nil {
+			return err
+		}
+
+		// let DNS traffic to weaveDNS, since otherwise it might get blocked by the likes of UFW
+		if err = ipt.AppendUnique("filter", "INPUT", "-i", config.DockerBridgeName, "-p", "udp", "--dport", "53", "-j", "ACCEPT"); err != nil {
+			return err
+		}
+		if err = ipt.AppendUnique("filter", "INPUT", "-i", config.DockerBridgeName, "-p", "tcp", "--dport", "53", "-j", "ACCEPT"); err != nil {
+			return err
+		}
+	}
+
+	if config.NPC {
+		// Steer traffic via the NPC
+		_ = ipt.NewChain("filter", "WEAVE-NPC") // ignore error because it might already exist
+		// If WEAVE-NPC chain doesn't exist then next line will fail
+		if err = ipt.AppendUnique("filter", "FORWARD", "-o", config.WeaveBridgeName, "-j", "WEAVE-NPC"); err != nil {
+			return err
+		}
+		if err = ipt.AppendUnique("filter", "FORWARD", "-o", config.WeaveBridgeName, "-m", "state", "--state", "NEW", "-j", "NFLOG", "--nflog-group", "86"); err != nil {
+			return err
+		}
+		if err = ipt.AppendUnique("filter", "FORWARD", "-o", config.WeaveBridgeName, "-j", "DROP"); err != nil {
+			return err
+		}
+	} else {
+		// Work around the situation where there are no rules allowing traffic
+		// across our bridge. E.g. ufw
+		if err = ipt.AppendUnique("filter", "FORWARD", "-i", config.WeaveBridgeName, "-o", config.WeaveBridgeName, "-j", "ACCEPT"); err != nil {
+			return err
+		}
+	}
+	// Forward from weave to the rest of the world
+	if err = ipt.AppendUnique("filter", "FORWARD", "-i", config.WeaveBridgeName, "!", "-o", config.WeaveBridgeName, "-j", "ACCEPT"); err != nil {
+		return err
+	}
+	// and allow replies back
+	if err = ipt.AppendUnique("filter", "FORWARD", "-o", config.WeaveBridgeName, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT"); err != nil {
+		return err
+	}
+
+	// create a chain for masquerading
+	if err = ipt.ClearChain("nat", "WEAVE"); err != nil {
+		return errors.Wrap(err, "clearing WEAVE chain")
+	}
+	if err = ipt.AppendUnique("nat", "POSTROUTING", "-j", "WEAVE"); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func linkSetUpByName(linkName string) error {
+	link, err := netlink.LinkByName(linkName)
+	if err != nil {
+		return errors.Wrapf(err, "setting link up on %q", linkName)
+	}
+	return netlink.LinkSetUp(link)
+}
+
+func AddBridgeAddr(bridgeName string, addr *net.IPNet, removeDefaultRoute bool) error {
+	link, err := netlink.LinkByName(bridgeName)
+	if err != nil {
+		return errors.Wrapf(err, "AddBridgeAddr finding bridge %q", bridgeName)
+	}
+	newAddresses, err := AddAddresses(link, []*net.IPNet{addr})
+	if err != nil {
+		return errors.Wrapf(err, "adding address %v to %q", addr, bridgeName)
+	}
+	for _, ipnet := range newAddresses {
+		arping.GratuitousArpOverIfaceByName(ipnet.IP, bridgeName)
+	}
+	if removeDefaultRoute {
+		routeFilter := &netlink.Route{
+			LinkIndex: link.Attrs().Index,
+			Dst:       &net.IPNet{IP: addr.IP.Mask(addr.Mask), Mask: addr.Mask},
+			Protocol:  2, // RTPROT_KERNEL
+		}
+		filterMask := netlink.RT_FILTER_OIF | netlink.RT_FILTER_DST | netlink.RT_FILTER_PROTOCOL
+		routes, err := netlink.RouteListFiltered(netlink.FAMILY_V4, routeFilter, filterMask)
+		if err != nil {
+			return errors.Wrapf(err, "failed to get route list for bridge %q", bridgeName)
+		}
+		for _, r := range routes {
+			if err = netlink.RouteDel(&r); err != nil {
+				return errors.Wrapf(err, "failed to delete default route %+v", r)
+			}
+		}
+	}
+	return nil
+}
@@ -82,3 +82,25 @@ func findInterface(ifaceName string) (iface *net.Interface, err error) {
 	}
 	return
 }
+
+func LocalAddresses() ([]*net.IPNet, error) {
+	links, err := netlink.LinkList()
+	if err != nil {
+		return nil, err
+	}
+
+	retval := []*net.IPNet{}
+	for _, link := range links {
+		if _, isBridge := link.(*netlink.Bridge); isBridge || (link.Attrs().Flags&net.FlagLoopback) != 0 {
+			continue
+		}
+		addrs, err := netlink.AddrList(link, netlink.FAMILY_V4)
+		if err != nil {
+			return nil, err
+		}
+		for _, addr := range addrs {
+			retval = append(retval, addr.IPNet)
+		}
+	}
+	return retval, nil
+}
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"os/exec"
+	"path/filepath"
 	"runtime"

 	"github.com/vishvananda/netlink"
@@ -80,5 +81,9 @@ func WithNetNSByPid(pid int, cmd string, args ...string) ([]byte, error) {
 }

 func NSPathByPid(pid int) string {
-	return fmt.Sprintf("/proc/%d/ns/net", pid)
+	return NSPathByPidWithRoot("/", pid)
+}
+
+func NSPathByPidWithRoot(root string, pid int) string {
+	return filepath.Join(root, fmt.Sprintf("/proc/%d/ns/net", pid))
 }
@@ -36,8 +36,8 @@ func getSystemUUID(hostRoot string) ([]byte, error) {
 	return append(machineid, uuid...), nil
 }

-func getPersistedPeerName(pathName string) (mesh.PeerName, error) {
-	d, err := db.NewBoltDBReadOnly(pathName)
+func getPersistedPeerName(dbPrefix string) (mesh.PeerName, error) {
+	d, err := db.NewBoltDBReadOnly(dbPrefix)
 	if err != nil {
 		return mesh.UnknownPeerName, err
 	}
@@ -56,9 +56,8 @@ func getPersistedPeerName(pathName string) (mesh.PeerName, error) {
 func GetSystemPeerName(dbPrefix, hostRoot string) (string, error) {
 	// Check if we have a persisted name that matches the old-style ID for this host
 	if oldUUID, err := getOldStyleSystemUUID(); err == nil {
-		pathName := dbPrefix + db.FileName
-		if _, err := os.Stat(pathName); err == nil {
-			persistedPeerName, err := getPersistedPeerName(pathName)
+		if _, err := os.Stat(db.Pathname(dbPrefix)); err == nil {
+			persistedPeerName, err := getPersistedPeerName(dbPrefix)
 			if err != nil && !os.IsNotExist(err) {
 				return "", err
 			}
@@ -11,8 +11,6 @@ import (
 	"github.com/j-keck/arping"
 	"github.com/vishvananda/netlink"
 	"github.com/vishvananda/netns"
-
-	"github.com/weaveworks/weave/common/odp"
 )

 // create and attach a veth to the Weave bridge
@@ -40,22 +38,17 @@ func CreateAndAttachVeth(name, peerName, bridgeName string, mtu int, keepTXOn bo
 		return nil, fmt.Errorf(format, a...)
 	}

-	switch bridgeType := DetectBridgeType(bridgeName, DatapathName); bridgeType {
-	case Bridge, BridgedFastdp:
-		if err := netlink.LinkSetMasterByIndex(veth, bridge.Attrs().Index); err != nil {
-			return cleanup(`unable to set master of %s: %s`, name, err)
+	bridgeType, err := ExistingBridgeType(bridgeName, DatapathName)
+	if err != nil {
+		return cleanup("detect bridge type: %s", err)
+	}
+	if err := bridgeType.attach(veth); err != nil {
+		return cleanup("attaching veth %q to %q: %s", name, bridgeName, err)
+	}
+	if !bridgeType.IsFastdp() && !keepTXOn {
+		if err := EthtoolTXOff(veth.PeerName); err != nil {
+			return cleanup(`unable to set tx off on %q: %s`, peerName, err)
 		}
-		if bridgeType == Bridge && !keepTXOn {
-			if err := EthtoolTXOff(peerName); err != nil {
-				return cleanup(`unable to set tx off on %q: %s`, peerName, err)
-			}
-		}
-	case Fastdp:
-		if err := odp.AddDatapathInterface(bridgeName, name); err != nil {
-			return cleanup(`failed to attach %s to device "%s": %s`, name, bridgeName, err)
-		}
-	default:
-		return cleanup(`invalid bridge configuration`)
 	}

 	if init != nil {
@@ -111,27 +104,20 @@ func interfaceExistsInNamespace(netNSPath string, ifName string) bool {
 	return err == nil
 }

-// NB: This function can be used only by a process that terminates immediately
-//     after calling the function as it changes netns via WithNetNSLinkUnsafe.
-func AttachContainer(netNSPath, id, ifName, bridgeName string, mtu int, withMulticastRoute bool, cidrs []*net.IPNet, keepTXOn bool) error {
+func AttachContainer(netNSPath, id, ifName, bridgeName string, mtu int, withMulticastRoute bool, cidrs []*net.IPNet, keepTXOn bool, hairpinMode bool) error {
 	ns, err := netns.GetFromPath(netNSPath)
 	if err != nil {
 		return err
 	}
 	defer ns.Close()

-	ipt, err := iptables.New()
-	if err != nil {
-		return err
-	}
-
 	if !interfaceExistsInNamespace(netNSPath, ifName) {
 		maxIDLen := IFNAMSIZ - 1 - len(vethPrefix+"pl")
 		if len(id) > maxIDLen {
 			id = id[:maxIDLen] // trim passed ID if too long
 		}
 		name, peerName := vethPrefix+"pl"+id, vethPrefix+"pg"+id
-		_, err := CreateAndAttachVeth(name, peerName, bridgeName, mtu, keepTXOn, func(veth netlink.Link) error {
+		veth, err := CreateAndAttachVeth(name, peerName, bridgeName, mtu, keepTXOn, func(veth netlink.Link) error {
 			if err := netlink.LinkSetNsFd(veth, int(ns)); err != nil {
 				return fmt.Errorf("failed to move veth to container netns: %s", err)
 			}
@@ -143,53 +129,96 @@ func AttachContainer(netNSPath, id, ifName, bridgeName string, mtu int, withMult
 		if err != nil {
 			return err
 		}
+		if err = netlink.LinkSetHairpin(veth, hairpinMode); err != nil {
+			return fmt.Errorf("unable to set hairpin mode to %t for bridge side of veth %s: %s", hairpinMode, name, err)
+		}
+
 	}

-	if err := WithNetNSLinkUnsafe(ns, ifName, func(veth netlink.Link) error {
-		newAddresses, err := AddAddresses(veth, cidrs)
+	args := []string{ifName, fmt.Sprintf("%t", withMulticastRoute)}
+	for _, cidr := range cidrs {
+		args = append(args, cidr.String())
+	}
+	if _, err := WithNetNS(netNSPath, "setup-iface-addrs", args...); err != nil {
+		return fmt.Errorf("error setting up interface addresses: %s", err)
+	}
+	return nil
+}
+
+// SetupIfaceAddrs is the implementation of the 'setup-iface-addrs' call above,
+// running in another process in the container's netns
+func SetupIfaceAddrs(veth netlink.Link, withMulticastRoute bool, cidrs []*net.IPNet) error {
+	newAddresses, err := AddAddresses(veth, cidrs)
+	if err != nil {
+		return err
+	}
+
+	ifName := veth.Attrs().Name
+	ipt, err := iptables.New()
+	if err != nil {
+		return err
+	}
+
+	// Add multicast ACCEPT rules for new subnets
+	for _, ipnet := range newAddresses {
+		acceptRule := []string{"-i", ifName, "-s", subnet(ipnet), "-d", "224.0.0.0/4", "-j", "ACCEPT"}
+		exists, err := ipt.Exists("filter", "INPUT", acceptRule...)
 		if err != nil {
 			return err
 		}
-
-		// Add multicast ACCEPT rules for new subnets
-		for _, ipnet := range newAddresses {
-			acceptRule := []string{"-i", ifName, "-s", subnet(ipnet), "-d", "224.0.0.0/4", "-j", "ACCEPT"}
-			exists, err := ipt.Exists("filter", "INPUT", acceptRule...)
-			if err != nil {
+		if !exists {
+			if err := ipt.Insert("filter", "INPUT", 1, acceptRule...); err != nil {
 				return err
 			}
-			if !exists {
-				if err := ipt.Insert("filter", "INPUT", 1, acceptRule...); err != nil {
-					return err
-				}
-			}
 		}
+	}

-		if err := netlink.LinkSetUp(veth); err != nil {
+	if err := netlink.LinkSetUp(veth); err != nil {
+		return err
+	}
+	for _, ipnet := range newAddresses {
+		// If we don't wait for a bit here, we see the arp fail to reach the bridge.
+		time.Sleep(1 * time.Millisecond)
+		arping.GratuitousArpOverIfaceByName(ipnet.IP, ifName)
+	}
+	if withMulticastRoute {
+		/* Route multicast packets across the weave network.
+		This must come last in 'attach'. If you change this, change weavewait to match.
+
+		TODO: Add the MTU lock to prevent PMTU discovery for multicast
+		destinations. Without that, the kernel sets the DF flag on
+		multicast packets. Since RFC1122 prohibits sending of ICMP
+		errors for packets with multicast destinations, that causes
+		packets larger than the PMTU to be dropped silently.  */
+
+		_, multicast, _ := net.ParseCIDR("224.0.0.0/4")
+		if err := AddRoute(veth, netlink.SCOPE_LINK, multicast, nil); err != nil {
 			return err
 		}
-		for _, ipnet := range newAddresses {
-			// If we don't wait for a bit here, we see the arp fail to reach the bridge.
-			time.Sleep(1 * time.Millisecond)
-			arping.GratuitousArpOverIfaceByName(ipnet.IP, ifName)
-		}
-		if withMulticastRoute {
-			/* Route multicast packets across the weave network.
-			This must come last in 'attach'. If you change this, change weavewait to match.
+	}
+	return nil
+}

-			TODO: Add the MTU lock to prevent PMTU discovery for multicast
-			destinations. Without that, the kernel sets the DF flag on
-			multicast packets. Since RFC1122 prohibits sending of ICMP
-			errors for packets with multicast destinations, that causes
-			packets larger than the PMTU to be dropped silently.  */
+// SetupIface is the implementation of the 'setup-iface' call above,
+// running in another process in the container's netns
+func SetupIface(ifaceName, newIfName string) error {
+	ipt, err := iptables.New()
+	if err != nil {
+		return err
+	}

-			_, multicast, _ := net.ParseCIDR("224.0.0.0/4")
-			if err := AddRoute(veth, netlink.SCOPE_LINK, multicast, nil); err != nil {
-				return err
-			}
-		}
-		return nil
-	}); err != nil {
+	link, err := netlink.LinkByName(ifaceName)
+	if err != nil {
+		return err
+	}
+	if err := netlink.LinkSetName(link, newIfName); err != nil {
+		return err
+	}
+	// This is only called by AttachContainer which is only called in host pid namespace
+	if err := ConfigureARPCache("/proc", newIfName); err != nil {
+		return err
+	}
+	if err := ipt.Append("filter", "INPUT", "-i", newIfName, "-d", "224.0.0.0/4", "-j", "DROP"); err != nil {
 		return err
 	}

@@ -6,4 +6,8 @@ const (
 	MainChain    = "WEAVE-NPC"
 	DefaultChain = "WEAVE-NPC-DEFAULT"
 	IngressChain = "WEAVE-NPC-INGRESS"
+
+	IpsetNamePrefix = "weave-"
+
+	LocalIpset = IpsetNamePrefix + "local-pods"
 )
@@ -3,13 +3,13 @@ package npc
 import (
 	"sync"

-	"github.com/coreos/go-iptables/iptables"
 	"github.com/pkg/errors"
 	coreapi "k8s.io/client-go/pkg/api/v1"
 	extnapi "k8s.io/client-go/pkg/apis/extensions/v1beta1"

 	"github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/npc/ipset"
+	"github.com/weaveworks/weave/npc/iptables"
 )

 type NetworkPolicyController interface {
@@ -29,18 +29,21 @@ type NetworkPolicyController interface {
 type controller struct {
 	sync.Mutex

-	ipt *iptables.IPTables
+	nodeName string // my node name
+
+	ipt iptables.Interface
 	ips ipset.Interface

 	nss         map[string]*ns // ns name -> ns struct
 	nsSelectors *selectorSet   // selector string -> nsSelector
 }

-func New(ipt *iptables.IPTables, ips ipset.Interface) NetworkPolicyController {
+func New(nodeName string, ipt iptables.Interface, ips ipset.Interface) NetworkPolicyController {
 	c := &controller{
-		ipt: ipt,
-		ips: ips,
-		nss: make(map[string]*ns)}
+		nodeName: nodeName,
+		ipt:      ipt,
+		ips:      ips,
+		nss:      make(map[string]*ns)}

 	c.nsSelectors = newSelectorSet(ips, c.onNewNsSelector)

@@ -51,7 +54,7 @@ func (npc *controller) onNewNsSelector(selector *selector) error {
 	for _, ns := range npc.nss {
 		if ns.namespace != nil {
 			if selector.matches(ns.namespace.ObjectMeta.Labels) {
-				if err := ns.ips.AddEntry(selector.spec.ipsetName, string(ns.allPods.ipsetName)); err != nil {
+				if err := selector.addEntry(string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
 					return err
 				}
 			}
@@ -63,7 +66,7 @@ func (npc *controller) onNewNsSelector(selector *selector) error {
 func (npc *controller) withNS(name string, f func(ns *ns) error) error {
 	ns, found := npc.nss[name]
 	if !found {
-		newNs, err := newNS(name, npc.ipt, npc.ips, npc.nsSelectors)
+		newNs, err := newNS(name, npc.nodeName, npc.ipt, npc.ips, npc.nsSelectors)
 		if err != nil {
 			return err
 		}
@@ -0,0 +1,182 @@
+package npc
+
+import (
+	"log"
+	"testing"
+
+	"github.com/pkg/errors"
+	"github.com/stretchr/testify/require"
+	"github.com/weaveworks/weave/npc/ipset"
+	unversionedapi "k8s.io/client-go/pkg/api/unversioned"
+	coreapi "k8s.io/client-go/pkg/api/v1"
+	extnapi "k8s.io/client-go/pkg/apis/extensions/v1beta1"
+	"k8s.io/client-go/pkg/util/intstr"
+)
+
+type mockSet struct {
+	name    ipset.Name
+	setType ipset.Type
+	subSets map[string]bool
+}
+
+type mockIPSet struct {
+	sets map[string]mockSet
+}
+
+func newMockIPSet() mockIPSet {
+	i := mockIPSet{
+		sets: make(map[string]mockSet),
+	}
+
+	return i
+}
+
+func (i *mockIPSet) Create(ipsetName ipset.Name, ipsetType ipset.Type) error {
+	if _, ok := i.sets[string(ipsetName)]; ok {
+		return errors.Errorf("ipset %s already exists", ipsetName)
+	}
+	i.sets[string(ipsetName)] = mockSet{name: ipsetName, setType: ipsetType, subSets: make(map[string]bool)}
+	return nil
+}
+
+func (i *mockIPSet) AddEntry(ipsetName ipset.Name, entry string, comment string) error {
+	log.Printf("adding entry %s to %s", entry, ipsetName)
+	if _, ok := i.sets[entry]; !ok {
+		return errors.Errorf("ipset %s does not exist", entry)
+	}
+	if _, ok := i.sets[string(ipsetName)].subSets[entry]; ok {
+		return errors.Errorf("ipset %s is already a member of %s", entry, ipsetName)
+	}
+	i.sets[string(ipsetName)].subSets[entry] = true
+
+	return nil
+}
+
+func (i *mockIPSet) DelEntry(ipsetName ipset.Name, entry string) error {
+	log.Printf("deleting entry %s from %s", entry, ipsetName)
+	if _, ok := i.sets[string(ipsetName)]; !ok {
+		return errors.Errorf("ipset %s does not exist", ipsetName)
+	}
+	if _, ok := i.sets[string(ipsetName)].subSets[entry]; !ok {
+		return errors.Errorf("ipset %s is not a member of %s", entry, ipsetName)
+	}
+	delete(i.sets[string(ipsetName)].subSets, entry)
+
+	return nil
+}
+
+func (i *mockIPSet) Flush(ipsetName ipset.Name) error {
+	return errors.New("Not Implemented")
+}
+
+func (i *mockIPSet) FlushAll() error {
+	return errors.New("Not Implemented")
+}
+
+func (i *mockIPSet) Destroy(ipsetName ipset.Name) error {
+	if _, ok := i.sets[string(ipsetName)]; !ok {
+		return errors.Errorf("ipset %s does not exist", ipsetName)
+	}
+	delete(i.sets, string(ipsetName))
+	return nil
+}
+
+func (i *mockIPSet) DestroyAll() error {
+	return errors.New("Not Implemented")
+}
+
+func (i *mockIPSet) List(prefix string) ([]ipset.Name, error) {
+	return []ipset.Name{}, errors.New("Not Implemented")
+}
+
+type mockIPTables struct {
+}
+
+func (ipt *mockIPTables) Append(table, chain string, rulespec ...string) error {
+	return nil
+}
+
+func (ipt *mockIPTables) Delete(table, chain string, rulespec ...string) error {
+	return nil
+}
+
+func (ipt *mockIPTables) Insert(table, chain string, pos int, rulespec ...string) error {
+	return nil
+}
+
+func TestRegressionPolicyNamespaceOrdering3059(t *testing.T) {
+	// Test for race condition between namespace and networkpolicy events
+	// https://github.com/weaveworks/weave/issues/3059
+
+	sourceNamespace := &coreapi.Namespace{
+		ObjectMeta: coreapi.ObjectMeta{
+			Name: "source",
+			Labels: map[string]string{
+				"app": "source",
+			},
+		},
+	}
+
+	destinationNamespace := &coreapi.Namespace{
+		ObjectMeta: coreapi.ObjectMeta{
+			Name: "destination",
+		},
+	}
+
+	port := intstr.FromInt(12345)
+
+	networkPolicy := &extnapi.NetworkPolicy{
+		ObjectMeta: coreapi.ObjectMeta{
+			Name:      "network-policy",
+			Namespace: "destination",
+		},
+		Spec: extnapi.NetworkPolicySpec{
+			Ingress: []extnapi.NetworkPolicyIngressRule{
+				{
+					From: []extnapi.NetworkPolicyPeer{
+						{
+							NamespaceSelector: &unversionedapi.LabelSelector{
+								MatchLabels: map[string]string{
+									"app": "source",
+								},
+							},
+						},
+					},
+					Ports: []extnapi.NetworkPolicyPort{
+						{
+							Port: &port,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	// Namespaces first
+	m := newMockIPSet()
+	controller := New("foo", &mockIPTables{}, &m)
+
+	const (
+		selectorIPSetName = "weave-I239Zp%sCvoVt*D6u=A!2]YEk"
+		sourceIPSetName   = "weave-HboJG1fGgG]/SR%k9H#hv5e96"
+	)
+
+	controller.AddNamespace(sourceNamespace)
+	controller.AddNamespace(destinationNamespace)
+
+	controller.AddNetworkPolicy(networkPolicy)
+
+	require.Equal(t, true, m.sets[selectorIPSetName].subSets[sourceIPSetName])
+
+	// NetworkPolicy first
+	m = newMockIPSet()
+	controller = New("foo", &mockIPTables{}, &m)
+
+	controller.AddNetworkPolicy(networkPolicy)
+
+	controller.AddNamespace(sourceNamespace)
+	controller.AddNamespace(destinationNamespace)
+
+	require.Equal(t, true, m.sets[selectorIPSetName].subSets[sourceIPSetName])
+
+}
@@ -1,7 +1,9 @@
 package ipset

 import (
+	"log"
 	"os/exec"
+	"strings"

 	"github.com/pkg/errors"
 )
@@ -17,53 +19,122 @@ const (

 type Interface interface {
 	Create(ipsetName Name, ipsetType Type) error
-	AddEntry(ipsetName Name, entry string) error
+	AddEntry(ipsetName Name, entry string, comment string) error
 	DelEntry(ipsetName Name, entry string) error
 	Flush(ipsetName Name) error
 	Destroy(ipsetName Name) error

+	List(prefix string) ([]Name, error)
+
 	FlushAll() error
 	DestroyAll() error
 }

 type ipset struct {
+	refCount
+	*log.Logger
 }

-func New() Interface {
-	return &ipset{}
+func New(logger *log.Logger) Interface {
+	return &ipset{refCount: newRefCount(), Logger: logger}
 }

 func (i *ipset) Create(ipsetName Name, ipsetType Type) error {
-	return doExec("create", string(ipsetName), string(ipsetType))
+	return doExec("create", string(ipsetName), string(ipsetType), "comment")
 }

-func (i *ipset) AddEntry(ipsetName Name, entry string) error {
-	return doExec("add", string(ipsetName), entry)
+func (i *ipset) AddEntry(ipsetName Name, entry string, comment string) error {
+	i.Logger.Printf("adding entry %s to %s", entry, ipsetName)
+	if i.inc(ipsetName, entry) > 1 { // already in the set
+		return nil
+	}
+	return doExec("add", string(ipsetName), entry, "comment", comment)
 }

 func (i *ipset) DelEntry(ipsetName Name, entry string) error {
+	i.Logger.Printf("deleting entry %s from %s", entry, ipsetName)
+	if i.dec(ipsetName, entry) > 0 { // still needed
+		return nil
+	}
 	return doExec("del", string(ipsetName), entry)
 }

 func (i *ipset) Flush(ipsetName Name) error {
+	i.removeSet(ipsetName)
 	return doExec("flush", string(ipsetName))
 }

 func (i *ipset) FlushAll() error {
+	i.refCount = newRefCount()
 	return doExec("flush")
 }

 func (i *ipset) Destroy(ipsetName Name) error {
+	i.removeSet(ipsetName)
 	return doExec("destroy", string(ipsetName))
 }

 func (i *ipset) DestroyAll() error {
+	i.refCount = newRefCount()
 	return doExec("destroy")
 }

+// Fetch a list of all existing sets with a given prefix
+func (i *ipset) List(prefix string) ([]Name, error) {
+	output, err := exec.Command("ipset", "list", "-name", "-output", "plain").Output()
+	if err != nil {
+		return nil, err
+	}
+
+	var selected []Name
+	sets := strings.Split(string(output), "\n")
+	for _, v := range sets {
+		if strings.HasPrefix(v, prefix) {
+			selected = append(selected, Name(v))
+		}
+	}
+
+	return selected, err
+}
+
 func doExec(args ...string) error {
 	if output, err := exec.Command("ipset", args...).CombinedOutput(); err != nil {
 		return errors.Wrapf(err, "ipset %v failed: %s", args, output)
 	}
 	return nil
 }
+
+// Reference-counting
+type key struct {
+	ipsetName Name
+	entry     string
+}
+
+// note no locking is required as all operations are serialised in the controller
+type refCount struct {
+	ref map[key]int
+}
+
+func newRefCount() refCount {
+	return refCount{ref: make(map[key]int)}
+}
+
+func (rc *refCount) inc(ipsetName Name, entry string) int {
+	k := key{ipsetName, entry}
+	rc.ref[k]++
+	return rc.ref[k]
+}
+
+func (rc *refCount) dec(ipsetName Name, entry string) int {
+	k := key{ipsetName, entry}
+	rc.ref[k]--
+	return rc.ref[k]
+}
+
+func (rc *refCount) removeSet(ipsetName Name) {
+	for k := range rc.ref {
+		if k.ipsetName == ipsetName {
+			delete(rc.ref, k)
+		}
+	}
+}
@@ -0,0 +1,7 @@
+package iptables
+
+type Interface interface {
+	Append(table, chain string, rulespec ...string) error
+	Delete(table, chain string, rulespec ...string) error
+	Insert(table, chain string, pos int, rulespec ...string) error
+}
@@ -2,8 +2,8 @@ package npc

 import (
 	"encoding/json"
+	"fmt"

-	"github.com/coreos/go-iptables/iptables"
 	"k8s.io/client-go/pkg/api/unversioned"
 	coreapi "k8s.io/client-go/pkg/api/v1"
 	extnapi "k8s.io/client-go/pkg/apis/extensions/v1beta1"
@@ -12,13 +12,15 @@ import (

 	"github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/npc/ipset"
+	"github.com/weaveworks/weave/npc/iptables"
 )

 type ns struct {
-	ipt *iptables.IPTables // interface to iptables
+	ipt iptables.Interface // interface to iptables
 	ips ipset.Interface    // interface to ipset

 	name      string                               // k8s Namespace name
+	nodeName  string                               // my node name
 	namespace *coreapi.Namespace                   // k8s Namespace object
 	pods      map[types.UID]*coreapi.Pod           // k8s Pod objects by UID
 	policies  map[types.UID]*extnapi.NetworkPolicy // k8s NetworkPolicy objects by UID
@@ -31,7 +33,7 @@ type ns struct {
 	rules        *ruleSet
 }

-func newNS(name string, ipt *iptables.IPTables, ips ipset.Interface, nsSelectors *selectorSet) (*ns, error) {
+func newNS(name, nodeName string, ipt iptables.Interface, ips ipset.Interface, nsSelectors *selectorSet) (*ns, error) {
 	allPods, err := newSelectorSpec(&unversioned.LabelSelector{}, name, ipset.HashIP)
 	if err != nil {
 		return nil, err
@@ -41,6 +43,7 @@ func newNS(name string, ipt *iptables.IPTables, ips ipset.Interface, nsSelectors
 		ipt:         ipt,
 		ips:         ips,
 		name:        name,
+		nodeName:    nodeName,
 		pods:        make(map[types.UID]*coreapi.Pod),
 		policies:    make(map[types.UID]*extnapi.NetworkPolicy),
 		uid:         uuid.NewUUID(),
@@ -72,7 +75,7 @@ func (ns *ns) onNewPodSelector(selector *selector) error {
 	for _, pod := range ns.pods {
 		if hasIP(pod) {
 			if selector.matches(pod.ObjectMeta.Labels) {
-				if err := selector.addEntry(pod.Status.PodIP); err != nil {
+				if err := selector.addEntry(pod.Status.PodIP, podComment(pod)); err != nil {
 					return err
 				}
 			}
@@ -81,6 +84,13 @@ func (ns *ns) onNewPodSelector(selector *selector) error {
 	return nil
 }

+func (ns *ns) checkLocalPod(obj *coreapi.Pod) bool {
+	if obj.Spec.NodeName != ns.nodeName {
+		return false
+	}
+	return true
+}
+
 func (ns *ns) addPod(obj *coreapi.Pod) error {
 	ns.pods[obj.ObjectMeta.UID] = obj

@@ -88,7 +98,10 @@ func (ns *ns) addPod(obj *coreapi.Pod) error {
 		return nil
 	}

-	return ns.podSelectors.addToMatching(obj.ObjectMeta.Labels, obj.Status.PodIP)
+	if ns.checkLocalPod(obj) {
+		ns.ips.AddEntry(LocalIpset, obj.Status.PodIP, podComment(obj))
+	}
+	return ns.podSelectors.addToMatching(obj.ObjectMeta.Labels, obj.Status.PodIP, podComment(obj))
 }

 func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
@@ -100,11 +113,17 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
 	}

 	if hasIP(oldObj) && !hasIP(newObj) {
+		if ns.checkLocalPod(oldObj) {
+			ns.ips.DelEntry(LocalIpset, oldObj.Status.PodIP)
+		}
 		return ns.podSelectors.delFromMatching(oldObj.ObjectMeta.Labels, oldObj.Status.PodIP)
 	}

 	if !hasIP(oldObj) && hasIP(newObj) {
-		return ns.podSelectors.addToMatching(newObj.ObjectMeta.Labels, newObj.Status.PodIP)
+		if ns.checkLocalPod(newObj) {
+			ns.ips.AddEntry(LocalIpset, newObj.Status.PodIP, podComment(newObj))
+		}
+		return ns.podSelectors.addToMatching(newObj.ObjectMeta.Labels, newObj.Status.PodIP, podComment(newObj))
 	}

 	if !equals(oldObj.ObjectMeta.Labels, newObj.ObjectMeta.Labels) ||
@@ -122,7 +141,7 @@ func (ns *ns) updatePod(oldObj, newObj *coreapi.Pod) error {
 				}
 			}
 			if newMatch {
-				if err := ps.addEntry(newObj.Status.PodIP); err != nil {
+				if err := ps.addEntry(newObj.Status.PodIP, podComment(newObj)); err != nil {
 					return err
 				}
 			}
@@ -139,6 +158,9 @@ func (ns *ns) deletePod(obj *coreapi.Pod) error {
 		return nil
 	}

+	if ns.checkLocalPod(obj) {
+		ns.ips.DelEntry(LocalIpset, obj.Status.PodIP)
+	}
 	return ns.podSelectors.delFromMatching(obj.ObjectMeta.Labels, obj.Status.PodIP)
 }

@@ -225,16 +247,18 @@ func (ns *ns) deleteNetworkPolicy(obj *extnapi.NetworkPolicy) error {
 	return nil
 }

-func bypassRule(nsIpsetName ipset.Name) []string {
-	return []string{"-m", "set", "--match-set", string(nsIpsetName), "dst", "-j", "ACCEPT"}
+func bypassRule(nsIpsetName ipset.Name, namespace string) []string {
+	return []string{"-m", "set", "--match-set", string(nsIpsetName), "dst", "-j", "ACCEPT", "-m", "comment", "--comment", "DefaultAllow isolation for namespace: " + namespace}
 }

 func (ns *ns) ensureBypassRule(nsIpsetName ipset.Name) error {
-	return ns.ipt.Append(TableFilter, DefaultChain, bypassRule(ns.allPods.ipsetName)...)
+	common.Log.Debugf("ensuring rule for DefaultAllow in namespace: %s, set %s", ns.name, nsIpsetName)
+	return ns.ipt.Append(TableFilter, DefaultChain, bypassRule(ns.allPods.ipsetName, ns.name)...)
 }

 func (ns *ns) deleteBypassRule(nsIpsetName ipset.Name) error {
-	return ns.ipt.Delete(TableFilter, DefaultChain, bypassRule(ns.allPods.ipsetName)...)
+	common.Log.Debugf("removing default rule in namespace: %s, set %s", ns.name, nsIpsetName)
+	return ns.ipt.Delete(TableFilter, DefaultChain, bypassRule(ns.allPods.ipsetName, ns.name)...)
 }

 func (ns *ns) addNamespace(obj *coreapi.Namespace) error {
@@ -242,11 +266,13 @@ func (ns *ns) addNamespace(obj *coreapi.Namespace) error {

 	// Insert a rule to bypass policies if namespace is DefaultAllow
 	if !isDefaultDeny(obj) {
-		return ns.ensureBypassRule(ns.allPods.ipsetName)
+		if err := ns.ensureBypassRule(ns.allPods.ipsetName); err != nil {
+			return err
+		}
 	}

 	// Add namespace ipset to matching namespace selectors
-	return ns.nsSelectors.addToMatching(obj.ObjectMeta.Labels, string(ns.allPods.ipsetName))
+	return ns.nsSelectors.addToMatching(obj.ObjectMeta.Labels, string(ns.allPods.ipsetName), namespaceComment(ns))
 }

 func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error {
@@ -257,11 +283,16 @@ func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error {
 	newDefaultDeny := isDefaultDeny(newObj)

 	if oldDefaultDeny != newDefaultDeny {
+		common.Log.Infof("namespace DefaultDeny changed from %t to %t", oldDefaultDeny, newDefaultDeny)
 		if oldDefaultDeny {
-			return ns.ensureBypassRule(ns.allPods.ipsetName)
+			if err := ns.ensureBypassRule(ns.allPods.ipsetName); err != nil {
+				return err
+			}
 		}
 		if newDefaultDeny {
-			return ns.deleteBypassRule(ns.allPods.ipsetName)
+			if err := ns.deleteBypassRule(ns.allPods.ipsetName); err != nil {
+				return err
+			}
 		}
 	}

@@ -279,7 +310,7 @@ func (ns *ns) updateNamespace(oldObj, newObj *coreapi.Namespace) error {
 				}
 			}
 			if newMatch {
-				if err := selector.addEntry(string(ns.allPods.ipsetName)); err != nil {
+				if err := selector.addEntry(string(ns.allPods.ipsetName), namespaceComment(ns)); err != nil {
 					return err
 				}
 			}
@@ -294,7 +325,9 @@ func (ns *ns) deleteNamespace(obj *coreapi.Namespace) error {

 	// Remove bypass rule
 	if !isDefaultDeny(obj) {
-		return ns.deleteBypassRule(ns.allPods.ipsetName)
+		if err := ns.deleteBypassRule(ns.allPods.ipsetName); err != nil {
+			return err
+		}
 	}

 	// Remove namespace ipset from any matching namespace selectors
@@ -336,3 +369,11 @@ func isDefaultDeny(namespace *coreapi.Namespace) bool {
 		nnp.Ingress.Isolation != nil &&
 		*(nnp.Ingress.Isolation) == DefaultDeny
 }
+
+func namespaceComment(namespace *ns) string {
+	return "namespace: " + namespace.name
+}
+
+func podComment(pod *coreapi.Pod) string {
+	return fmt.Sprintf("namespace: %s, pod: %s", pod.ObjectMeta.Namespace, pod.ObjectMeta.Name)
+}
@@ -1,12 +1,13 @@
 package npc

 import (
+	"fmt"
 	"strings"

-	"github.com/coreos/go-iptables/iptables"
 	"k8s.io/client-go/pkg/types"

 	"github.com/weaveworks/weave/common"
+	"github.com/weaveworks/weave/npc/iptables"
 )

 type ruleSpec struct {
@@ -19,27 +20,36 @@ func newRuleSpec(proto *string, srcHost *selectorSpec, dstHost *selectorSpec, ds
 	if proto != nil {
 		args = append(args, "-p", *proto)
 	}
+	srcComment := "anywhere"
 	if srcHost != nil {
 		args = append(args, "-m", "set", "--match-set", string(srcHost.ipsetName), "src")
+		if srcHost.nsName != "" {
+			srcComment = fmt.Sprintf("pods: namespace: %s, selector: %s", srcHost.nsName, srcHost.key)
+		} else {
+			srcComment = fmt.Sprintf("namespaces: selector: %s", srcHost.key)
+		}
 	}
+	dstComment := "anywhere"
 	if dstHost != nil {
 		args = append(args, "-m", "set", "--match-set", string(dstHost.ipsetName), "dst")
+		dstComment = fmt.Sprintf("pods: namespace: %s, selector: %s", dstHost.nsName, dstHost.key)
 	}
 	if dstPort != nil {
 		args = append(args, "--dport", *dstPort)
 	}
 	args = append(args, "-j", "ACCEPT")
+	args = append(args, "-m", "comment", "--comment", fmt.Sprintf("%s -> %s", srcComment, dstComment))
 	key := strings.Join(args, " ")

 	return &ruleSpec{key, args}
 }

 type ruleSet struct {
-	ipt   *iptables.IPTables
+	ipt   iptables.Interface
 	users map[string]map[types.UID]struct{}
 }

-func newRuleSet(ipt *iptables.IPTables) *ruleSet {
+func newRuleSet(ipt iptables.Interface) *ruleSet {
 	return &ruleSet{ipt, make(map[string]map[types.UID]struct{})}
 }

@@ -0,0 +1,16 @@
+package npc
+
+import (
+	"github.com/stretchr/testify/require"
+	"testing"
+)
+
+func TestRegressionHandleNil3095(t *testing.T) {
+	// Test for handling nil values
+	// https://github.com/weaveworks/weave/issues/3095
+
+	rs := newRuleSpec(nil, nil, nil, nil)
+
+	require.NotEqual(t, rs.key, "")
+
+}
@@ -15,6 +15,7 @@ type selectorSpec struct {

 	ipsetType ipset.Type // type of ipset to provision
 	ipsetName ipset.Name // generated ipset name
+	nsName    string     // Namespace name
 }

 func newSelectorSpec(json *unversioned.LabelSelector, nsName string, ipsetType ipset.Type) (*selectorSpec, error) {
@@ -29,8 +30,9 @@ func newSelectorSpec(json *unversioned.LabelSelector, nsName string, ipsetType i
 		// We prefix the selector string with the namespace name when generating
 		// the shortname because you can specify the same selector in multiple
 		// namespaces - we need those to map to distinct ipsets
-		ipsetName: ipset.Name("weave-" + shortName(nsName+":"+key)),
-		ipsetType: ipsetType}, nil
+		ipsetName: ipset.Name(IpsetNamePrefix + shortName(nsName+":"+key)),
+		ipsetType: ipsetType,
+		nsName:    nsName}, nil
 }

 type selector struct {
@@ -42,13 +44,11 @@ func (s *selector) matches(labelMap map[string]string) bool {
 	return s.spec.selector.Matches(labels.Set(labelMap))
 }

-func (s *selector) addEntry(entry string) error {
-	common.Log.Infof("adding entry %s to %s", entry, s.spec.ipsetName)
-	return s.ips.AddEntry(s.spec.ipsetName, entry)
+func (s *selector) addEntry(entry string, comment string) error {
+	return s.ips.AddEntry(s.spec.ipsetName, entry, comment)
 }

 func (s *selector) delEntry(entry string) error {
-	common.Log.Infof("deleting entry %s from %s", entry, s.spec.ipsetName)
 	return s.ips.DelEntry(s.spec.ipsetName, entry)
 }

@@ -69,10 +69,10 @@ func newSelectorSet(ips ipset.Interface, onNewSelector selectorFn) *selectorSet
 		entries:       make(map[string]*selector)}
 }

-func (ss *selectorSet) addToMatching(labelMap map[string]string, entry string) error {
+func (ss *selectorSet) addToMatching(labelMap map[string]string, entry string, comment string) error {
 	for _, s := range ss.entries {
 		if s.matches(labelMap) {
-			if err := s.addEntry(entry); err != nil {
+			if err := s.addEntry(entry, comment); err != nil {
 				return err
 			}
 		}
@@ -7,12 +7,13 @@ import (

 const (
 	// This array:
-	// * Must include only printable UTF8 characters that are represented with a single byte
+	// * Must include only printable UTF8 characters that are represented with a single byte (http://www.utf8-chartable.de/)
 	// * Must be at least of length 85 (`len("weave-") + l(2^160)/l(85)` equals 31, the maximum ipset name length)
 	// * Must not include commas as those are treated specially by `ipset add` when adding a named set to a list:set
 	// * Should not include space for readability
+	// * Should not include invalid chars for XML `<>&"'`
 	// * Should not include single quote or backslash to be nice to shell users
-	ShortNameSymbols = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789(){}[]<>_$%^&*|/?.;:@#~"
+	ShortNameSymbols = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789(){}[]+=_$%^!*|/?.;:@#~"
 )

 // sha1 hash an arbitrary string and represent it using the full range of
@@ -5,19 +5,24 @@ import (
 	"fmt"
 	"net"

-	"github.com/appc/cni/pkg/skel"
-	"github.com/appc/cni/pkg/types"
+	"github.com/containernetworking/cni/pkg/skel"
+	"github.com/containernetworking/cni/pkg/types"
+	"github.com/containernetworking/cni/pkg/types/current"
 )

 func (i *Ipam) CmdAdd(args *skel.CmdArgs) error {
+	var conf types.NetConf
+	if err := json.Unmarshal(args.StdinData, &conf); err != nil {
+		return fmt.Errorf("failed to load netconf: %v", err)
+	}
 	result, err := i.Allocate(args)
 	if err != nil {
 		return err
 	}
-	return result.Print()
+	return types.PrintResult(result, conf.CNIVersion)
 }

-func (i *Ipam) Allocate(args *skel.CmdArgs) (*types.Result, error) {
+func (i *Ipam) Allocate(args *skel.CmdArgs) (types.Result, error) {
 	// extract the things we care about
 	conf, err := loadIPAMConf(args.StdinData)
 	if err != nil {
@@ -33,25 +38,26 @@ func (i *Ipam) Allocate(args *skel.CmdArgs) (*types.Result, error) {
 	var ipnet *net.IPNet

 	if conf.Subnet == "" {
-		ipnet, err = i.weave.AllocateIP(containerID)
+		ipnet, err = i.weave.AllocateIP(containerID, false)
 	} else {
 		var subnet *net.IPNet
 		subnet, err = types.ParseCIDR(conf.Subnet)
 		if err != nil {
 			return nil, fmt.Errorf("subnet given in config, but not parseable: %s", err)
 		}
-		ipnet, err = i.weave.AllocateIPInSubnet(containerID, subnet)
+		ipnet, err = i.weave.AllocateIPInSubnet(containerID, subnet, false)
 	}

 	if err != nil {
 		return nil, err
 	}
-	result := &types.Result{
-		IP4: &types.IPConfig{
-			IP:      *ipnet,
+	result := &current.Result{
+		IPs: []*current.IPConfig{{
+			Version: "4",
+			Address: *ipnet,
 			Gateway: conf.Gateway,
-			Routes:  conf.Routes,
-		},
+		}},
+		Routes: conf.Routes,
 	}
 	return result, nil
 }
@@ -65,9 +71,9 @@ func (i *Ipam) Release(args *skel.CmdArgs) error {
 }

 type ipamConf struct {
-	Subnet  string        `json:"subnet,omitempty"`
-	Gateway net.IP        `json:"gateway,omitempty"`
-	Routes  []types.Route `json:"routes"`
+	Subnet  string         `json:"subnet,omitempty"`
+	Gateway net.IP         `json:"gateway,omitempty"`
+	Routes  []*types.Route `json:"routes"`
 }

 type netConf struct {
@@ -19,6 +19,11 @@ func NewIpam(weave *api.Client) *Ipam {
 	return &Ipam{weave: weave}
 }

+func (i *Ipam) GetCapabilities() (RequiresMACAddress bool, RequiresRequestReplay bool, err error) {
+	i.logReq("GetCapabilities")
+	return false, false, nil
+}
+
 func (i *Ipam) GetDefaultAddressSpaces() (string, string, error) {
 	i.logReq("GetDefaultAddressSpaces")
 	return "weavelocal", "weaveglobal", nil
@@ -73,7 +78,7 @@ func (i *Ipam) RequestAddress(poolID string, address net.IP, options map[string]
 	i.logReq("RequestAddress", poolID, address, options)
 	defer func() { i.logRes("RequestAddress", err, ip) }()
 	if poolID == "weavepool" { // old-style
-		ip, err = i.weave.AllocateIP(api.NoContainerID)
+		ip, err = i.weave.AllocateIP(api.NoContainerID, false)
 		return
 	}
 	subnet, iprange, err := splitPoolID(poolID)
@@ -82,12 +87,12 @@ func (i *Ipam) RequestAddress(poolID string, address net.IP, options map[string]
 	}
 	if address != nil { // try to claim specific address requested
 		ip = &net.IPNet{IP: address, Mask: subnet.Mask}
-		if err = i.weave.ClaimIP(api.NoContainerID, ip); err != nil {
+		if err = i.weave.ClaimIP(api.NoContainerID, ip, false); err != nil {
 			return
 		}
 	} else {
 		// We are lying slightly to IPAM here: the range is not a subnet
-		if ip, err = i.weave.AllocateIPInSubnet(api.NoContainerID, iprange); err != nil {
+		if ip, err = i.weave.AllocateIPInSubnet(api.NoContainerID, iprange, false); err != nil {
 			return
 		}
 		ip.Mask = subnet.Mask // fix up the subnet we lied about
@@ -5,11 +5,13 @@ import (
 	"encoding/json"
 	"fmt"
 	"net"
+	"os"
 	"syscall"

-	"github.com/appc/cni/pkg/ipam"
-	"github.com/appc/cni/pkg/skel"
-	"github.com/appc/cni/pkg/types"
+	"github.com/containernetworking/cni/pkg/ipam"
+	"github.com/containernetworking/cni/pkg/skel"
+	"github.com/containernetworking/cni/pkg/types"
+	"github.com/containernetworking/cni/pkg/types/current"
 	"github.com/vishvananda/netlink"
 	"github.com/vishvananda/netns"
 	weaveapi "github.com/weaveworks/weave/api"
@@ -32,7 +34,8 @@ func NewCNIPlugin(weave *weaveapi.Client) *CNIPlugin {

 func loadNetConf(bytes []byte) (*NetConf, error) {
 	n := &NetConf{
-		BrName: weavenet.WeaveBridgeName,
+		BrName:      weavenet.WeaveBridgeName,
+		HairpinMode: true,
 	}
 	if err := json.Unmarshal(bytes, n); err != nil {
 		return nil, fmt.Errorf("failed to load netconf: %v", err)
@@ -40,17 +43,26 @@ func loadNetConf(bytes []byte) (*NetConf, error) {
 	return n, nil
 }

-func (c *CNIPlugin) getIP(ipamType string, args *skel.CmdArgs) (result *types.Result, err error) {
+func (c *CNIPlugin) getIP(ipamType string, args *skel.CmdArgs) (newResult *current.Result, err error) {
+	var result types.Result
 	// Default IPAM is Weave's own
 	if ipamType == "" {
 		result, err = ipamplugin.NewIpam(c.weave).Allocate(args)
 	} else {
 		result, err = ipam.ExecAdd(ipamType, args.StdinData)
 	}
-	if err == nil && result.IP4 == nil {
+	if err != nil {
+		return nil, err
+	}
+	if result == nil {
+		return nil, fmt.Errorf("Received no usable result from IPAM plugin")
+	}
+	newResult, err = current.NewResultFromResult(result)
+	// Check if ipam returned no results without error
+	if err == nil && len(newResult.IPs) == 0 {
 		return nil, fmt.Errorf("IPAM plugin failed to allocate IP address")
 	}
-	return result, err
+	return newResult, err
 }

 func (c *CNIPlugin) CmdAdd(args *skel.CmdArgs) error {
@@ -70,28 +82,35 @@ func (c *CNIPlugin) CmdAdd(args *skel.CmdArgs) error {
 	if err != nil {
 		return fmt.Errorf("unable to allocate IP address: %s", err)
 	}
+	// Only expecting one address
+	ip := result.IPs[0]

 	// If config says nothing about routes or gateway, default one will be via the bridge
-	if result.IP4.Routes == nil && result.IP4.Gateway == nil {
-		bridgeIP, err := weavenet.FindBridgeIP(conf.BrName, &result.IP4.IP)
+	if len(result.Routes) == 0 && ip.Gateway == nil {
+		bridgeIP, err := weavenet.FindBridgeIP(conf.BrName, &ip.Address)
 		if err == weavenet.ErrBridgeNoIP {
 			bridgeArgs := *args
 			bridgeArgs.ContainerID = "weave:expose"
+			// It would be better if libcni let us send just the desired parameters,
+			// but there is a bug: https://github.com/containernetworking/cni/issues/410
+			// so just blank out the one we want to change
+			os.Setenv("CNI_CONTAINERID", bridgeArgs.ContainerID)
 			bridgeIPResult, err := c.getIP(conf.IPAM.Type, &bridgeArgs)
 			if err != nil {
 				return fmt.Errorf("unable to allocate IP address for bridge: %s", err)
 			}
-			if err := assignBridgeIP(conf.BrName, bridgeIPResult.IP4.IP); err != nil {
+			bridgeCIDR := bridgeIPResult.IPs[0].Address
+			if err := assignBridgeIP(conf.BrName, bridgeCIDR); err != nil {
 				return fmt.Errorf("unable to assign IP address to bridge: %s", err)
 			}
-			if err := weavenet.ExposeNAT(bridgeIPResult.IP4.IP); err != nil {
+			if err := weavenet.ExposeNAT(bridgeCIDR); err != nil {
 				return fmt.Errorf("unable to create NAT rules: %s", err)
 			}
-			bridgeIP = bridgeIPResult.IP4.IP.IP
+			bridgeIP = bridgeCIDR.IP
 		} else if err != nil {
 			return err
 		}
-		result.IP4.Gateway = bridgeIP
+		result.IPs[0].Gateway = bridgeIP
 	}

 	ns, err := netns.GetFromPath(args.Netns)
@@ -110,20 +129,20 @@ func (c *CNIPlugin) CmdAdd(args *skel.CmdArgs) error {
 		id = fmt.Sprintf("%x", data)
 	}

-	if err := weavenet.AttachContainer(args.Netns, id, args.IfName, conf.BrName, conf.MTU, false, []*net.IPNet{&result.IP4.IP}, false); err != nil {
+	if err := weavenet.AttachContainer(args.Netns, id, args.IfName, conf.BrName, conf.MTU, false, []*net.IPNet{&ip.Address}, false, conf.HairpinMode); err != nil {
 		return err
 	}
 	if err := weavenet.WithNetNSLinkUnsafe(ns, args.IfName, func(link netlink.Link) error {
-		return setupRoutes(link, args.IfName, result.IP4.IP, result.IP4.Gateway, result.IP4.Routes)
+		return setupRoutes(link, args.IfName, ip.Address, ip.Gateway, result.Routes)
 	}); err != nil {
 		return fmt.Errorf("error setting up routes: %s", err)
 	}

 	result.DNS = conf.DNS
-	return result.Print()
+	return types.PrintResult(result, conf.CNIVersion)
 }

-func setupRoutes(link netlink.Link, name string, ipnet net.IPNet, gw net.IP, routes []types.Route) error {
+func setupRoutes(link netlink.Link, name string, ipnet net.IPNet, gw net.IP, routes []*types.Route) error {
 	var err error
 	if routes == nil { // If config says nothing about routes, add a default one
 		if !ipnet.Contains(gw) {
@@ -133,7 +152,7 @@ func setupRoutes(link netlink.Link, name string, ipnet net.IPNet, gw net.IP, rou
 				return err
 			}
 		}
-		routes = []types.Route{{Dst: zeroNetwork}}
+		routes = []*types.Route{{Dst: zeroNetwork}}
 	}
 	for _, r := range routes {
 		if r.GW != nil {
@@ -164,14 +183,22 @@ func assignBridgeIP(bridgeName string, ipnet net.IPNet) error {
 	return nil
 }

+// As of CNI 0.5 spec:
+//   "Plugins should generally complete a DEL action without error even if some resources are missing"
+// this method should therefore return nil in most, if not all, cases.
 func (c *CNIPlugin) CmdDel(args *skel.CmdArgs) error {
 	conf, err := loadNetConf(args.StdinData)
 	if err != nil {
-		return err
+		logOnStderr(err)
+		return nil
 	}

-	if _, err = weavenet.WithNetNS(args.Netns, "del-iface", args.IfName); err != nil {
-		return fmt.Errorf("error removing interface %q: %s", args.IfName, err)
+	// As of CNI 0.3 spec, runtimes can send blank if they just want the address deallocated
+	if args.Netns != "" {
+		if _, err = weavenet.WithNetNS(args.Netns, "del-iface", args.IfName); err != nil {
+			// We log the error and carry on instead of returning nil, as there may still be resources to free in IPAM.
+			logOnStderr(fmt.Errorf("error removing interface %q: %s", args.IfName, err))
+		}
 	}

 	// Default IPAM is Weave's own
@@ -180,16 +207,21 @@ func (c *CNIPlugin) CmdDel(args *skel.CmdArgs) error {
 	} else {
 		err = ipam.ExecDel(conf.IPAM.Type, args.StdinData)
 	}
-	if err != nil {
-		return fmt.Errorf("unable to release IP address: %s", err)
-	}
+	logOnStderr(fmt.Errorf("unable to release IP address: %s", err))
 	return nil
 }

+// Standard error is inherited from the caller (e.g. Kubelet, when running Weave Net's CNI plugin
+// under Kubernetes) hence provided errors should eventually appear in the caller's log files.
+func logOnStderr(err error) {
+	fmt.Fprintln(os.Stderr, "weave-cni:", err)
+}
+
 type NetConf struct {
 	types.NetConf
-	BrName string `json:"bridge"`
-	IsGW   bool   `json:"isGateway"`
-	IPMasq bool   `json:"ipMasq"`
-	MTU    int    `json:"mtu"`
+	BrName      string `json:"bridge"`
+	IsGW        bool   `json:"isGateway"`
+	IPMasq      bool   `json:"ipMasq"`
+	MTU         int    `json:"mtu"`
+	HairpinMode bool   `json:"hairpinMode"`
 }
@@ -28,25 +28,40 @@ type network struct {
 }

 type driver struct {
-	name   string
-	scope  string
-	docker *docker.Client
 	sync.RWMutex
-	networks map[string]network
+	name  string
+	scope string
+	// Docker API is not available for plugin-v2
+	docker     *docker.Client
+	dns        bool
+	isPluginV2 bool
+	// Enable multicast regardless whether multicast opt is passed to Docker;
+	// used only by plugin-v2
+	forceMulticast bool
+	networks       map[string]network
 }

-func New(client *docker.Client, weave *weaveapi.Client, name, scope string) (skel.Driver, error) {
+func New(client *docker.Client, weave *weaveapi.Client, name, scope string, dns, isPluginV2, forceMulticast bool) (skel.Driver, error) {
 	driver := &driver{
-		name:     name,
-		scope:    scope,
-		docker:   client,
-		networks: make(map[string]network),
+		name:       name,
+		scope:      scope,
+		docker:     client,
+		dns:        dns,
+		isPluginV2: isPluginV2,
+		// make sure that it's used only by plugin-v2
+		forceMulticast: isPluginV2 && forceMulticast,
+		networks:       make(map[string]network),
 	}

-	_, err := NewWatcher(client, weave, driver)
-	if err != nil {
-		return nil, err
+	// Do not start watcher in the case of plugin v2, which prevents us from
+	// configuring arp settings of containers.
+	if client != nil {
+		_, err := NewWatcher(client, weave, driver)
+		if err != nil {
+			return nil, err
+		}
 	}
+
 	return driver, nil
 }

@@ -61,12 +76,27 @@ func (driver *driver) GetCapabilities() (*api.GetCapabilityResponse, error) {
 	return caps, nil
 }

+// In Swarm mode, CreateNetwork is called on each Swarm node when a new service
+// is created.
 func (driver *driver) CreateNetwork(create *api.CreateNetworkRequest) error {
 	driver.logReq("CreateNetwork", create, create.NetworkID)
 	_, err := driver.setupNetworkInfo(create.NetworkID, true, stringOptions(create))
 	return err
 }

+// NetworkAllocate is called on a Swarm node (master) which creates the network.
+// The returned options are passed to CreateNetwork.
+func (driver *driver) NetworkAllocate(alloc *api.AllocateNetworkRequest) (*api.AllocateNetworkResponse, error) {
+	driver.logReq("NetworkAllocate", alloc, alloc.NetworkID)
+	return &api.AllocateNetworkResponse{Options: alloc.Options}, nil
+}
+
+// NetworkFree is called on a Swarm master node which created the network.
+func (driver *driver) NetworkFree(free *api.FreeNetworkRequest) (*api.FreeNetworkResponse, error) {
+	driver.logReq("NetworkFree", free, free.NetworkID)
+	return nil, nil
+}
+
 // Deal with excessively-generic way the options get decoded from JSON
 func stringOptions(create *api.CreateNetworkRequest) map[string]string {
 	if create.Options != nil {
@@ -85,6 +115,7 @@ func stringOptions(create *api.CreateNetworkRequest) map[string]string {
 	return nil
 }

+// In Swarm mode, DeleteNetwork is called after a service has been removed.
 func (driver *driver) DeleteNetwork(delreq *api.DeleteNetworkRequest) error {
 	driver.logReq("DeleteNetwork", delreq, delreq.NetworkID)
 	driver.Lock()
@@ -163,12 +194,29 @@ func (driver *driver) JoinEndpoint(j *api.JoinRequest) (*api.JoinResponse, error
 }

 func (driver *driver) findNetworkInfo(id string) (network, error) {
+	var network network
+
+	// plugin-v2 does not have access to docker.sock, so we cannot call Docker
+	// API for the network info.
+	if driver.isPluginV2 {
+		// safe to set, as isOurs used only by the watcher which is disabled for plugin-v2
+		network.isOurs = true
+		network.hasMulticastRoute = driver.forceMulticast
+
+		return network, nil
+	}
+
 	driver.Lock()
 	network, found := driver.networks[id]
 	driver.Unlock()
 	if found {
 		return network, nil
 	}
+
+	if driver.docker == nil {
+		return network, fmt.Errorf("Docker client disabled; unable to get network info")
+	}
+
 	info, err := driver.docker.NetworkInfo(id)
 	if err != nil {
 		return network, err
@@ -41,11 +41,19 @@ func (w *watcher) ContainerStarted(id string) {
 			continue
 		}
 		if network.isOurs {
-			fqdn := fmt.Sprintf("%s.%s", info.Config.Hostname, info.Config.Domainname)
-			if err := w.weave.RegisterWithDNS(id, fqdn, net.IPAddress); err != nil {
-				w.driver.warn("ContainerStarted", "unable to register %s with weaveDNS: %s", id, err)
+			if w.driver.dns {
+				fqdn := fmt.Sprintf("%s.%s", info.Config.Hostname, info.Config.Domainname)
+				if err := w.weave.RegisterWithDNS(id, fqdn, net.IPAddress); err != nil {
+					w.driver.warn("ContainerStarted", "unable to register %s with weaveDNS: %s", id, err)
+				}
 			}
-			if _, err := weavenet.WithNetNSByPid(info.State.Pid, "configure-arp", weavenet.VethName); err != nil {
+			rootDir := "/"
+			if w.driver.isPluginV2 {
+				// We bind mount host's /proc to /host/proc for plugin-v2
+				rootDir = "/host"
+			}
+			netNSPath := weavenet.NSPathByPidWithRoot(rootDir, info.State.Pid)
+			if _, err := weavenet.WithNetNS(netNSPath, "configure-arp", weavenet.VethName, rootDir); err != nil {
 				w.driver.warn("ContainerStarted", "unable to configure interfaces: %s", err)
 			}
 		}
@@ -0,0 +1,124 @@
+package plugin
+
+import (
+	"net"
+	"os"
+	"path"
+	"strings"
+
+	"github.com/docker/libnetwork/ipamapi"
+	weaveapi "github.com/weaveworks/weave/api"
+	"github.com/weaveworks/weave/common"
+	"github.com/weaveworks/weave/common/docker"
+	weavenet "github.com/weaveworks/weave/net"
+	ipamplugin "github.com/weaveworks/weave/plugin/ipam"
+	netplugin "github.com/weaveworks/weave/plugin/net"
+	"github.com/weaveworks/weave/plugin/skel"
+)
+
+const (
+	pluginV2Name    = "net-plugin"
+	defaultNetwork  = "weave"
+	MulticastOption = netplugin.MulticastOption
+)
+
+var Log = common.Log
+
+type Config struct {
+	Socket            string
+	MeshSocket        string
+	Enable            bool
+	EnableV2          bool
+	EnableV2Multicast bool
+	DNS               bool
+	DefaultSubnet     string
+}
+
+type Plugin struct {
+	Config
+}
+
+func NewPlugin(config Config) *Plugin {
+	if !config.Enable && !config.EnableV2 {
+		return nil
+	}
+	plugin := &Plugin{Config: config}
+	return plugin
+}
+
+func (plugin *Plugin) Start(weaveAPIAddr string, dockerClient *docker.Client, ready func()) {
+	weave := weaveapi.NewClient(weaveAPIAddr, Log)
+
+	Log.Info("Waiting for Weave API Server...")
+	weave.WaitAPIServer(30)
+	Log.Info("Finished waiting for Weave API Server")
+
+	if err := plugin.run(dockerClient, weave, ready); err != nil {
+		Log.Fatal(err)
+	}
+}
+
+func (plugin *Plugin) run(dockerClient *docker.Client, weave *weaveapi.Client, ready func()) error {
+	endChan := make(chan error, 1)
+
+	if plugin.Socket != "" {
+		globalListener, err := listenAndServe(dockerClient, weave, plugin.Socket, endChan, "global", false, plugin.DNS, plugin.EnableV2, plugin.EnableV2Multicast)
+		if err != nil {
+			return err
+		}
+		defer os.Remove(plugin.Socket)
+		defer globalListener.Close()
+	}
+	if plugin.MeshSocket != "" {
+		meshListener, err := listenAndServe(dockerClient, weave, plugin.MeshSocket, endChan, "local", true, plugin.DNS, plugin.EnableV2, plugin.EnableV2Multicast)
+		if err != nil {
+			return err
+		}
+		defer os.Remove(plugin.MeshSocket)
+		defer meshListener.Close()
+		if !plugin.EnableV2 {
+			Log.Printf("Creating default %q network", defaultNetwork)
+			options := map[string]interface{}{MulticastOption: "true"}
+			dockerClient.EnsureNetwork(defaultNetwork, pluginNameFromAddress(plugin.MeshSocket), plugin.DefaultSubnet, options)
+		}
+	}
+	ready()
+
+	return <-endChan
+}
+
+func listenAndServe(dockerClient *docker.Client, weave *weaveapi.Client, address string, endChan chan<- error, scope string, withIpam, dns bool, isPluginV2, forceMulticast bool) (net.Listener, error) {
+	var name string
+	if isPluginV2 {
+		name = pluginV2Name
+	} else {
+		name = pluginNameFromAddress(address)
+	}
+
+	d, err := netplugin.New(dockerClient, weave, name, scope, dns, isPluginV2, forceMulticast)
+	if err != nil {
+		return nil, err
+	}
+
+	var i ipamapi.Ipam
+	if withIpam {
+		i = ipamplugin.NewIpam(weave)
+	}
+
+	listener, err := weavenet.ListenUnixSocket(address)
+	if err != nil {
+		return nil, err
+	}
+	Log.Printf("Listening on %s for %s scope", address, scope)
+
+	go func() {
+		endChan <- skel.Listen(listener, d, i)
+	}()
+
+	return listener, nil
+}
+
+// Take a socket address like "/run/docker/plugins/weavemesh.sock" and extract the plugin name "weavemesh"
+func pluginNameFromAddress(address string) string {
+	return strings.TrimSuffix(path.Base(address), ".sock")
+}
@@ -26,11 +26,17 @@ type Driver interface {
 	DeleteEndpoint(delete *api.DeleteEndpointRequest) error
 	EndpointInfo(req *api.EndpointInfoRequest) (*api.EndpointInfoResponse, error)
 	JoinEndpoint(j *api.JoinRequest) (response *api.JoinResponse, error error)
+	NetworkAllocate(*api.AllocateNetworkRequest) (*api.AllocateNetworkResponse, error)
+	NetworkFree(*api.FreeNetworkRequest) (*api.FreeNetworkResponse, error)
 	LeaveEndpoint(leave *api.LeaveRequest) error
 	DiscoverNew(discover *api.DiscoveryNotification) error
 	DiscoverDelete(delete *api.DiscoveryNotification) error
 }

+type IpamCapability interface {
+	GetCapabilities() (RequiresMACAddress bool, RequiresRequestReplay bool, err error)
+}
+
 type listener struct {
 	d Driver
 	i ipamapi.Ipam
@@ -58,9 +64,12 @@ func Listen(socket net.Listener, driver Driver, ipamDriver ipamapi.Ipam) error {
 		handleMethod(networkReceiver, "EndpointOperInfo", listener.infoEndpoint)
 		handleMethod(networkReceiver, "Join", listener.joinEndpoint)
 		handleMethod(networkReceiver, "Leave", listener.leaveEndpoint)
+		handleMethod(networkReceiver, "AllocateNetwork", listener.networkAllocate)
+		handleMethod(networkReceiver, "FreeNetwork", listener.networkFree)
 	}

 	if ipamDriver != nil {
+		handleMethod(ipamReceiver, "GetCapabilities", listener.getIpamCapabilities)
 		handleMethod(ipamReceiver, "GetDefaultAddressSpaces", listener.getDefaultAddressSpaces)
 		handleMethod(ipamReceiver, "RequestPool", listener.requestPool)
 		handleMethod(ipamReceiver, "ReleasePool", listener.releasePool)
@@ -137,7 +146,7 @@ func (listener *listener) createEndpoint(w http.ResponseWriter, r *http.Request)
 func (listener *listener) deleteEndpoint(w http.ResponseWriter, r *http.Request) {
 	var delete api.DeleteEndpointRequest
 	if err := json.NewDecoder(r.Body).Decode(&delete); err != nil {
-		sendError(w, "Could not decode JSON encode payload", http.StatusBadRequest)
+		sendError(w, "Could not decode JSON encoded payload", http.StatusBadRequest)
 		return
 	}
 	emptyOrErrorResponse(w, listener.d.DeleteEndpoint(&delete))
@@ -146,7 +155,7 @@ func (listener *listener) deleteEndpoint(w http.ResponseWriter, r *http.Request)
 func (listener *listener) infoEndpoint(w http.ResponseWriter, r *http.Request) {
 	var req api.EndpointInfoRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		sendError(w, "Could not decode JSON encode payload", http.StatusBadRequest)
+		sendError(w, "Could not decode JSON encoded payload", http.StatusBadRequest)
 		return
 	}
 	info, err := listener.d.EndpointInfo(&req)
@@ -156,17 +165,37 @@ func (listener *listener) infoEndpoint(w http.ResponseWriter, r *http.Request) {
 func (listener *listener) joinEndpoint(w http.ResponseWriter, r *http.Request) {
 	var join api.JoinRequest
 	if err := json.NewDecoder(r.Body).Decode(&join); err != nil {
-		sendError(w, "Could not decode JSON encode payload", http.StatusBadRequest)
+		sendError(w, "Could not decode JSON encoded payload", http.StatusBadRequest)
 		return
 	}
 	res, err := listener.d.JoinEndpoint(&join)
 	objectOrErrorResponse(w, res, err)
 }

+func (listener *listener) networkAllocate(w http.ResponseWriter, r *http.Request) {
+	var alloc api.AllocateNetworkRequest
+	if err := json.NewDecoder(r.Body).Decode(&alloc); err != nil {
+		sendError(w, "Could not decode JSON encode payload", http.StatusBadRequest)
+		return
+	}
+	res, err := listener.d.NetworkAllocate(&alloc)
+	objectOrErrorResponse(w, res, err)
+}
+
+func (listener *listener) networkFree(w http.ResponseWriter, r *http.Request) {
+	var free api.FreeNetworkRequest
+	if err := json.NewDecoder(r.Body).Decode(&free); err != nil {
+		sendError(w, "Could not decode JSON encode payload", http.StatusBadRequest)
+		return
+	}
+	res, err := listener.d.NetworkFree(&free)
+	objectOrErrorResponse(w, res, err)
+}
+
 func (listener *listener) leaveEndpoint(w http.ResponseWriter, r *http.Request) {
 	var l api.LeaveRequest
 	if err := json.NewDecoder(r.Body).Decode(&l); err != nil {
-		sendError(w, "Could not decode JSON encode payload", http.StatusBadRequest)
+		sendError(w, "Could not decode JSON encoded payload", http.StatusBadRequest)
 		return
 	}
 	emptyOrErrorResponse(w, listener.d.LeaveEndpoint(&l))
@@ -175,7 +204,7 @@ func (listener *listener) leaveEndpoint(w http.ResponseWriter, r *http.Request)
 func (listener *listener) discoverNew(w http.ResponseWriter, r *http.Request) {
 	var disco api.DiscoveryNotification
 	if err := json.NewDecoder(r.Body).Decode(&disco); err != nil {
-		sendError(w, "Could not decode JSON encode payload", http.StatusBadRequest)
+		sendError(w, "Could not decode JSON encoded payload", http.StatusBadRequest)
 		return
 	}
 	emptyOrErrorResponse(w, listener.d.DiscoverNew(&disco))
@@ -184,7 +213,7 @@ func (listener *listener) discoverNew(w http.ResponseWriter, r *http.Request) {
 func (listener *listener) discoverDelete(w http.ResponseWriter, r *http.Request) {
 	var disco api.DiscoveryNotification
 	if err := json.NewDecoder(r.Body).Decode(&disco); err != nil {
-		sendError(w, "Could not decode JSON encode payload", http.StatusBadRequest)
+		sendError(w, "Could not decode JSON encoded payload", http.StatusBadRequest)
 		return
 	}
 	emptyOrErrorResponse(w, listener.d.DiscoverDelete(&disco))
@@ -192,6 +221,20 @@ func (listener *listener) discoverDelete(w http.ResponseWriter, r *http.Request)

 // ===

+func (listener *listener) getIpamCapabilities(w http.ResponseWriter, r *http.Request) {
+	c, ok := listener.i.(IpamCapability)
+	if !ok {
+		http.NotFound(w, r)
+		return
+	}
+	requiresMACAddress, requiresRequestReplay, err := c.GetCapabilities()
+	response := &ipamapi.Capability{
+		RequiresMACAddress:    requiresMACAddress,
+		RequiresRequestReplay: requiresRequestReplay,
+	}
+	objectOrErrorResponse(w, response, err)
+}
+
 func (listener *listener) getDefaultAddressSpaces(w http.ResponseWriter, r *http.Request) {
 	local, global, err := listener.i.GetDefaultAddressSpaces()
 	response := &iapi.GetAddressSpacesResponse{
@@ -0,0 +1,19 @@
+package plugin
+
+type Status struct {
+	Config         Config
+	DriverName     string
+	MeshDriverName string `json:"MeshDriverName,omitempty"`
+}
+
+func (plugin *Plugin) NewStatus() *Status {
+	if plugin == nil {
+		return nil
+	}
+	status := &Status{
+		DriverName:     pluginNameFromAddress(plugin.Socket),
+		MeshDriverName: pluginNameFromAddress(plugin.MeshSocket),
+		Config:         plugin.Config,
+	}
+	return status
+}
@@ -3,6 +3,7 @@ package main
 import (
 	"fmt"
 	"log"
+	"net"

 	"k8s.io/client-go/kubernetes"
 	api "k8s.io/client-go/pkg/api/v1"
@@ -19,26 +20,30 @@ func getKubePeers() ([]string, error) {
 		return nil, err
 	}
 	nodeList, err := c.Nodes().List(api.ListOptions{})
-	if err != nil {
-		// Fallback for cases (e.g. from kube-up.sh) where kube-proxy is not running on master
-		config.Host = "http://localhost:8080"
-		log.Print("error contacting APIServer: ", err, "; trying with fallback: ", config.Host)
-		c, err = kubernetes.NewForConfig(config)
-		if err != nil {
-			return nil, err
-		}
-		nodeList, err = c.Nodes().List(api.ListOptions{})
-	}
-
 	if err != nil {
 		return nil, err
 	}
 	addresses := make([]string, 0, len(nodeList.Items))
 	for _, peer := range nodeList.Items {
+		var internalIP, externalIP string
 		for _, addr := range peer.Status.Addresses {
-			if addr.Type == "InternalIP" {
-				addresses = append(addresses, addr.Address)
+			// Check it's a valid ipv4 address
+			ip := net.ParseIP(addr.Address)
+			if ip == nil || ip.To4() == nil {
+				continue
 			}
+			if addr.Type == "InternalIP" {
+				internalIP = ip.To4().String()
+			} else if addr.Type == "ExternalIP" {
+				externalIP = ip.To4().String()
+			}
+		}
+
+		// Fallback for cases where a Node has an ExternalIP but no InternalIP
+		if internalIP != "" {
+			addresses = append(addresses, internalIP)
+		} else if externalIP != "" {
+			addresses = append(addresses, externalIP)
 		}
 	}
 	return addresses, nil
@@ -0,0 +1,98 @@
+{
+  "description": "Weave Net plugin for Docker",
+  "documentation": "https://weave.works",
+  "entrypoint": [
+    "/home/weave/launch.sh"
+  ],
+  "interface": {
+    "socket": "weave.sock",
+    "types": [
+      "docker.networkdriver/1.0"
+    ]
+  },
+  "linux": {
+    "capabilities": [
+      "CAP_SYS_ADMIN",
+      "CAP_NET_ADMIN",
+      "CAP_SYS_MODULE"
+    ]
+  },
+  "mounts": [
+    {
+      "destination": "/host/proc/",
+      "type": "bind",
+      "source": "/proc/",
+      "options": ["rbind", "rw"]
+    },
+    {
+      "destination": "/var/run/docker.sock",
+      "source": "/var/run/docker.sock",
+      "type": "bind",
+      "options": ["rbind"]
+    },
+    {
+      "destination": "/host/var/lib/",
+      "source": "/var/lib/",
+      "type": "bind",
+      "options": ["rbind"]
+    },
+    {
+      "destination": "/host/etc/",
+      "source": "/etc/",
+      "type": "bind",
+      "options": ["rbind"]
+    },
+    {
+      "destination": "/lib/modules/",
+      "source": "/lib/modules/",
+      "type": "bind",
+      "options": ["rbind"]
+    }
+  ],
+  "env": [
+    {
+      "description": "Extra args to `weaver` and `plugin`",
+      "name": "EXTRA_ARGS",
+      "settable": [
+          "value"
+      ],
+      "value": ""
+    },
+    {
+      "description": "Encryption password",
+      "name": "WEAVE_PASSWORD",
+      "settable": [
+          "value"
+      ],
+      "value": ""
+    },
+    {
+      "description": "MTU",
+      "name": "WEAVE_MTU",
+      "settable": [
+          "value"
+      ],
+      "value": ""
+    },
+    {
+      "description": "Enable multicast for all Weave networks",
+      "name": "WEAVE_MULTICAST",
+      "settable": [
+          "value"
+      ],
+      "value": ""
+    },
+    {
+      "description": "The range of IP addresses used by Weave Net",
+      "name": "IPALLOC_RANGE",
+      "settable": [
+          "value"
+      ],
+      "value": ""
+    }
+  ],
+  "network": {
+    "type": "host"
+  },
+  "workdir": ""
+}
@@ -0,0 +1,53 @@
+#!/bin/sh
+
+set -e
+
+# Default if not supplied - same as weave net default
+IPALLOC_RANGE=${IPALLOC_RANGE:-10.32.0.0/12}
+HTTP_ADDR=${WEAVE_HTTP_ADDR:-127.0.0.1:6784}
+STATUS_ADDR=${WEAVE_STATUS_ADDR:-0.0.0.0:6782}
+HOST_ROOT=${HOST_ROOT:-/host}
+WEAVE_DIR="/host/var/lib/weave"
+
+mkdir $WEAVE_DIR || true
+
+echo "Starting launch.sh"
+
+# Check if the IP range overlaps anything existing on the host
+/usr/bin/weaveutil netcheck $IPALLOC_RANGE weave
+
+# We need to get a list of Swarm nodes which might run the net-plugin:
+# - In the case of missing restart.sentinel, we assume that net-plugin has started
+#   for the first time via the docker-plugin cmd. So it's safe to request docker.sock.
+# - If restart.sentinel present, let weaver restore from it as docker.sock is not
+#   available to any plugin in general (https://github.com/moby/moby/issues/32815).
+
+PEERS=
+if [ ! -f "/restart.sentinel" ]; then
+    PEERS=$(/usr/bin/weaveutil swarm-manager-peers)
+fi
+
+router_bridge_opts() {
+    echo --datapath=datapath
+    [ -z "$WEAVE_MTU" ] || echo --mtu "$WEAVE_MTU"
+    [ -z "$WEAVE_NO_FASTDP" ] || echo --no-fastdp
+}
+
+multicast_opt() {
+    [ -z "$WEAVE_MULTICAST" ] || echo "--plugin-v2-multicast"
+}
+
+exec /home/weave/weaver $EXTRA_ARGS --port=6783 $(router_bridge_opts) \
+    --host-root=/host \
+    --proc-path=/host/proc \
+    --http-addr=$HTTP_ADDR --status-addr=$STATUS_ADDR \
+    --no-dns \
+    --ipalloc-range=$IPALLOC_RANGE \
+    --nickname "$(hostname)" \
+    --log-level=debug \
+    --db-prefix="$WEAVE_DIR/weave" \
+    --plugin-v2 \
+    $(multicast_opt) \
+    --plugin-mesh-socket='' \
+    --docker-api='' \
+    $PEERS
@@ -1,3 +0,0 @@
-FROM DOCKERHUB_USER/weaveARCH_EXT
-ADD ./plugin /home/weave/
-ENTRYPOINT ["/home/weave/plugin"]
@@ -1,140 +0,0 @@
-package main
-
-import (
-	"flag"
-	"fmt"
-	"net"
-	"net/http"
-	"os"
-	"os/signal"
-	"path"
-	"strings"
-	"syscall"
-
-	"github.com/docker/libnetwork/ipamapi"
-	weaveapi "github.com/weaveworks/weave/api"
-	"github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/common/docker"
-	weavenet "github.com/weaveworks/weave/net"
-	ipamplugin "github.com/weaveworks/weave/plugin/ipam"
-	netplugin "github.com/weaveworks/weave/plugin/net"
-	"github.com/weaveworks/weave/plugin/skel"
-)
-
-var version = "unreleased"
-
-var Log = common.Log
-
-func main() {
-	var (
-		justVersion      bool
-		address          string
-		meshAddress      string
-		logLevel         string
-		noMulticastRoute bool
-	)
-
-	flag.BoolVar(&justVersion, "version", false, "print version and exit")
-	flag.StringVar(&logLevel, "log-level", "info", "logging level (debug, info, warning, error)")
-	flag.StringVar(&address, "socket", "/run/docker/plugins/weave.sock", "socket on which to listen")
-	flag.StringVar(&meshAddress, "meshsocket", "/run/docker/plugins/weavemesh.sock", "socket on which to listen in mesh mode")
-	flag.BoolVar(&noMulticastRoute, "no-multicast-route", false, "deprecated (this is now the default)")
-
-	flag.Parse()
-
-	if justVersion {
-		fmt.Printf("weave plugin %s\n", version)
-		os.Exit(0)
-	}
-
-	common.SetLogLevel(logLevel)
-
-	weave := weaveapi.NewClient(os.Getenv("WEAVE_HTTP_ADDR"), Log)
-
-	// API 1.21 is the first version that supports docker network commands
-	dockerClient, err := docker.NewVersionedClientFromEnv("1.21")
-	if err != nil {
-		Log.Fatalf("unable to connect to docker: %s", err)
-	}
-
-	Log.Println("Weave plugin", version, "Command line options:", os.Args[1:])
-	if noMulticastRoute {
-		Log.Warning("--no-multicast-route option has been removed; multicast is off by default")
-	}
-	Log.Info(dockerClient.Info())
-
-	err = run(dockerClient, weave, address, meshAddress)
-	if err != nil {
-		Log.Fatal(err)
-	}
-}
-
-func run(dockerClient *docker.Client, weave *weaveapi.Client, address, meshAddress string) error {
-	endChan := make(chan error, 1)
-	if address != "" {
-		globalListener, err := listenAndServe(dockerClient, weave, address, endChan, "global", false)
-		if err != nil {
-			return err
-		}
-		defer os.Remove(address)
-		defer globalListener.Close()
-	}
-	if meshAddress != "" {
-		meshListener, err := listenAndServe(dockerClient, weave, meshAddress, endChan, "local", true)
-		if err != nil {
-			return err
-		}
-		defer os.Remove(meshAddress)
-		defer meshListener.Close()
-	}
-
-	statusListener, err := weavenet.ListenUnixSocket("/home/weave/status.sock")
-	if err != nil {
-		return err
-	}
-	go serveStatus(statusListener)
-	sigChan := make(chan os.Signal, 1)
-	signal.Notify(sigChan, os.Interrupt, os.Kill, syscall.SIGTERM)
-
-	select {
-	case sig := <-sigChan:
-		Log.Debugf("Caught signal %s; shutting down", sig)
-		return nil
-	case err := <-endChan:
-		return err
-	}
-}
-
-func listenAndServe(dockerClient *docker.Client, weave *weaveapi.Client, address string, endChan chan<- error, scope string, withIpam bool) (net.Listener, error) {
-	name := strings.TrimSuffix(path.Base(address), ".sock")
-	d, err := netplugin.New(dockerClient, weave, name, scope)
-	if err != nil {
-		return nil, err
-	}
-
-	var i ipamapi.Ipam
-	if withIpam {
-		i = ipamplugin.NewIpam(weave)
-	}
-
-	listener, err := weavenet.ListenUnixSocket(address)
-	if err != nil {
-		return nil, err
-	}
-	Log.Printf("Listening on %s for %s scope", address, scope)
-
-	go func() {
-		endChan <- skel.Listen(listener, d, i)
-	}()
-
-	return listener, nil
-}
-
-func serveStatus(listener net.Listener) {
-	server := &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		fmt.Fprintln(w, "ok")
-	})}
-	if err := server.Serve(listener); err != nil {
-		Log.Fatalf("ListenAndServeStatus failed: %s", err)
-	}
-}
@@ -1,12 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	weavetest "github.com/weaveworks/weave/testing"
-)
-
-func TestMain(t *testing.T) {
-	weavetest.TrimTestArgs()
-	main()
-}
@@ -2,11 +2,34 @@

 set -e

+modprobe_safe() {
+    modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel" >&2
+}
+
+# Check whether xt_set actually exists
+xt_set_exists() {
+    # Clean everything up in advance, in case there's leftovers
+    iptables -F WEAVE-KUBE-TEST 2>/dev/null || true
+    iptables -X WEAVE-KUBE-TEST 2>/dev/null || true
+    ipset destroy weave-kube-test 2>/dev/null || true
+
+    ipset create weave-kube-test hash:ip
+    iptables -t filter -N WEAVE-KUBE-TEST
+    if ! iptables -A WEAVE-KUBE-TEST -m set --match-set weave-kube-test src -j DROP; then
+        NOT_EXIST=1
+    fi
+    iptables -F WEAVE-KUBE-TEST
+    iptables -X WEAVE-KUBE-TEST
+    ipset destroy weave-kube-test
+    [ -z "$NOT_EXIST" ] || (echo "\"xt_set\" does not exist" >&2 && return 1)
+}
+
 # Default if not supplied - same as weave net default
 IPALLOC_RANGE=${IPALLOC_RANGE:-10.32.0.0/12}
 HTTP_ADDR=${WEAVE_HTTP_ADDR:-127.0.0.1:6784}
 STATUS_ADDR=${WEAVE_STATUS_ADDR:-0.0.0.0:6782}
 HOST_ROOT=${HOST_ROOT:-/host}
+CONN_LIMIT=${CONN_LIMIT:-30}

 # Check if the IP range overlaps anything existing on the host
 /usr/bin/weaveutil netcheck $IPALLOC_RANGE weave
@@ -14,6 +37,13 @@ HOST_ROOT=${HOST_ROOT:-/host}
 # Default for network policy
 EXPECT_NPC=${EXPECT_NPC:-1}

+# Ensure we have the required modules for NPC
+if [ "${EXPECT_NPC}" != "0" ]; then
+    modprobe_safe br_netfilter
+    modprobe_safe xt_set
+    xt_set_exists
+fi
+
 # kube-proxy requires that bridged traffic passes through netfilter
 if ! BRIDGE_NF_ENABLED=$(cat /proc/sys/net/bridge/bridge-nf-call-iptables); then
    echo "Cannot detect bridge-nf support - network policy and iptables mode kubeproxy may not work reliably" >&2
@@ -23,15 +53,12 @@ else
    fi
 fi

-# Explicitly create the bridge so we can pass --expect-npc
+# Default is that npc will be running; allow caller to override
 WEAVE_NPC_OPTS="--expect-npc"
 if [ "${EXPECT_NPC}" = "0" ]; then
    WEAVE_NPC_OPTS=""
 fi

-export HOST_ROOT=/host
-/home/weave/weave --local create-bridge --force $WEAVE_NPC_OPTS
-
 # Kubernetes sets HOSTNAME to the host's hostname
 # when running a pod in host namespace.
 NICKNAME_ARG=""
@@ -39,17 +66,11 @@ if [ -n "$HOSTNAME" ] ; then
    NICKNAME_ARG="--nickname=$HOSTNAME"
 fi

-BRIDGE_OPTIONS="--datapath=datapath"
-if [ "$(/home/weave/weave --local bridge-type)" = "bridge" ] ; then
-    # TODO: Call into weave script to do this
-    if ! ip link show vethwe-pcap >/dev/null 2>&1 ; then
-        ip link add name vethwe-bridge type veth peer name vethwe-pcap
-        ip link set vethwe-bridge up
-        ip link set vethwe-pcap up
-        ip link set vethwe-bridge master weave
-    fi
-    BRIDGE_OPTIONS="--iface=vethwe-pcap"
-fi
+router_bridge_opts() {
+    echo --datapath=datapath
+    [ -z "$WEAVE_MTU" ] || echo --mtu "$WEAVE_MTU"
+    [ -z "$WEAVE_NO_FASTDP" ] || echo --no-fastdp
+}

 if [ -z "$KUBE_PEERS" ]; then
    if ! KUBE_PEERS=$(/home/weave/kube-peers) || [ -z "$KUBE_PEERS" ]; then
@@ -66,14 +87,6 @@ if [ -z "$IPALLOC_INIT" ]; then
    IPALLOC_INIT="consensus=$(peer_count $KUBE_PEERS)"
 fi

-reclaim_ips() {
-    ID=$1
-    shift
-    for CIDR in "$@" ; do
-        curl -s -S -X PUT "$HTTP_ADDR/ip/$ID/$CIDR" || true
-    done
-}
-
 post_start_actions() {
    # Wait for weave process to become responsive
    while true ; do
@@ -81,15 +94,6 @@ post_start_actions() {
        sleep 1
    done

-    # Tell the newly-started weave about existing weave bridge IPs
-    /usr/bin/weaveutil container-addrs weave weave:expose | while read ID IFACE MAC IPS; do
-        reclaim_ips "weave:expose" $IPS
-    done
-    # Tell weave about existing weave process IPs
-    /usr/bin/weaveutil process-addrs weave | while read ID IFACE MAC IPS; do
-        reclaim_ips "_" $IPS
-    done
-
    # Install CNI plugin binary to typical CNI bin location
    # with fall-back to CNI directory used by kube-up on GCI OS
    if ! mkdir -p $HOST_ROOT/opt/cni/bin ; then
@@ -101,6 +105,7 @@ post_start_actions() {
        fi
    fi
    mkdir -p $HOST_ROOT/etc/cni/net.d
+    export HOST_ROOT
    /home/weave/weave --local setup-cni

    # Expose the weave network so host processes can communicate with pods
@@ -109,9 +114,13 @@ post_start_actions() {

 post_start_actions &

-exec /home/weave/weaver $EXTRA_ARGS --port=6783 $BRIDGE_OPTIONS \
+/home/weave/weaver $EXTRA_ARGS --port=6783 $(router_bridge_opts) \
+     --host-root=$HOST_ROOT \
     --http-addr=$HTTP_ADDR --status-addr=$STATUS_ADDR --docker-api='' --no-dns \
+     --db-prefix="/weavedb/weave-net" \
     --ipalloc-range=$IPALLOC_RANGE $NICKNAME_ARG \
     --ipalloc-init $IPALLOC_INIT \
+     --conn-limit=$CONN_LIMIT \
+     $WEAVE_NPC_OPTS \
     "$@" \
     $KUBE_PEERS
@@ -0,0 +1,142 @@
+apiVersion: v1
+kind: List
+items:
+  - apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      name: weave-net
+      labels:
+        name: weave-net
+      namespace: kube-system
+  - apiVersion: rbac.authorization.k8s.io/v1beta1
+    kind: ClusterRole
+    metadata:
+      name: weave-net
+      labels:
+        name: weave-net
+    rules:
+      - apiGroups:
+          - ''
+        resources:
+          - pods
+          - namespaces
+          - nodes
+        verbs:
+          - get
+          - list
+          - watch
+      - apiGroups:
+          - extensions
+        resources:
+          - networkpolicies
+        verbs:
+          - get
+          - list
+          - watch
+  - apiVersion: rbac.authorization.k8s.io/v1beta1
+    kind: ClusterRoleBinding
+    metadata:
+      name: weave-net
+      labels:
+        name: weave-net
+    roleRef:
+      kind: ClusterRole
+      name: weave-net
+      apiGroup: rbac.authorization.k8s.io
+    subjects:
+      - kind: ServiceAccount
+        name: weave-net
+        namespace: kube-system
+  - apiVersion: extensions/v1beta1
+    kind: DaemonSet
+    metadata:
+      name: weave-net
+      labels:
+        name: weave-net
+      namespace: kube-system
+    spec:
+      template:
+        metadata:
+          labels:
+            name: weave-net
+        spec:
+          containers:
+            - name: weave
+              command:
+                - /home/weave/launch.sh
+              env:
+                - name: HOSTNAME
+                  valueFrom:
+                    fieldRef:
+                      apiVersion: v1
+                      fieldPath: spec.nodeName
+              image: 'weaveworks/weave-kube:latest'
+              imagePullPolicy: Always
+              livenessProbe:
+                httpGet:
+                  host: 127.0.0.1
+                  path: /status
+                  port: 6784
+                initialDelaySeconds: 30
+              resources:
+                requests:
+                  cpu: 10m
+              securityContext:
+                privileged: true
+              volumeMounts:
+                - name: weavedb
+                  mountPath: /weavedb
+                - name: cni-bin
+                  mountPath: /host/opt
+                - name: cni-bin2
+                  mountPath: /host/home
+                - name: cni-conf
+                  mountPath: /host/etc
+                - name: dbus
+                  mountPath: /host/var/lib/dbus
+                - name: lib-modules
+                  mountPath: /lib/modules
+            - name: weave-npc
+              env:
+                - name: HOSTNAME
+                  valueFrom:
+                    fieldRef:
+                      apiVersion: v1
+                      fieldPath: spec.nodeName
+              image: 'weaveworks/weave-npc:latest'
+              imagePullPolicy: Always
+              resources:
+                requests:
+                  cpu: 10m
+              securityContext:
+                privileged: true
+          hostNetwork: true
+          hostPID: true
+          restartPolicy: Always
+          securityContext:
+            seLinuxOptions: {}
+          serviceAccountName: weave-net
+          tolerations:
+            - effect: NoSchedule
+              operator: Exists
+          volumes:
+            - name: weavedb
+              hostPath:
+                path: /var/lib/weave
+            - name: cni-bin
+              hostPath:
+                path: /opt
+            - name: cni-bin2
+              hostPath:
+                path: /home
+            - name: cni-conf
+              hostPath:
+                path: /etc
+            - name: dbus
+              hostPath:
+                path: /var/lib/dbus
+            - name: lib-modules
+              hostPath:
+                path: /lib/modules
+      updateStrategy:
+        type: RollingUpdate
@@ -1,75 +1,101 @@
-apiVersion: extensions/v1beta1
-kind: DaemonSet
-metadata:
-  name: weave-net
-  namespace: kube-system
-spec:
-  template:
+apiVersion: v1
+kind: List
+items:
+  - apiVersion: v1
+    kind: ServiceAccount
    metadata:
+      name: weave-net
      labels:
        name: weave-net
-      annotations:
-        scheduler.alpha.kubernetes.io/tolerations: |
-          [
-            {
-              "key": "dedicated",
-              "operator": "Equal",
-              "value": "master",
-              "effect": "NoSchedule"
-            }
-          ]
+      namespace: kube-system
+  - apiVersion: extensions/v1beta1
+    kind: DaemonSet
+    metadata:
+      name: weave-net
+      labels:
+        name: weave-net
+      namespace: kube-system
    spec:
-      hostNetwork: true
-      hostPID: true
-      containers:
-        - name: weave
-          image: weaveworks/weave-kube:latest
-          imagePullPolicy: Always
-          command:
-            - /home/weave/launch.sh
-          livenessProbe:
-            initialDelaySeconds: 30
-            httpGet:
-              host: 127.0.0.1
-              path: /status
-              port: 6784
+      template:
+        metadata:
+          annotations:
+            scheduler.alpha.kubernetes.io/tolerations: >-
+              [{"key":"dedicated","operator":"Equal","value":"master","effect":"NoSchedule"}]
+          labels:
+            name: weave-net
+        spec:
+          containers:
+            - name: weave
+              command:
+                - /home/weave/launch.sh
+              env:
+                - name: HOSTNAME
+                  valueFrom:
+                    fieldRef:
+                      apiVersion: v1
+                      fieldPath: spec.nodeName
+              image: 'weaveworks/weave-kube:latest'
+              imagePullPolicy: Always
+              livenessProbe:
+                httpGet:
+                  host: 127.0.0.1
+                  path: /status
+                  port: 6784
+                initialDelaySeconds: 30
+              resources:
+                requests:
+                  cpu: 10m
+              securityContext:
+                privileged: true
+              volumeMounts:
+                - name: weavedb
+                  mountPath: /weavedb
+                - name: cni-bin
+                  mountPath: /host/opt
+                - name: cni-bin2
+                  mountPath: /host/home
+                - name: cni-conf
+                  mountPath: /host/etc
+                - name: dbus
+                  mountPath: /host/var/lib/dbus
+                - name: lib-modules
+                  mountPath: /lib/modules
+            - name: weave-npc
+              env:
+                - name: HOSTNAME
+                  valueFrom:
+                    fieldRef:
+                      apiVersion: v1
+                      fieldPath: spec.nodeName
+              image: 'weaveworks/weave-npc:latest'
+              imagePullPolicy: Always
+              resources:
+                requests:
+                  cpu: 10m
+              securityContext:
+                privileged: true
+          hostNetwork: true
+          hostPID: true
+          restartPolicy: Always
          securityContext:
-            privileged: true
-          volumeMounts:
+            seLinuxOptions: {}
+          serviceAccountName: weave-net
+          volumes:
            - name: weavedb
-              mountPath: /weavedb
+              hostPath:
+                path: /var/lib/weave
            - name: cni-bin
-              mountPath: /host/opt
+              hostPath:
+                path: /opt
            - name: cni-bin2
-              mountPath: /host/home
+              hostPath:
+                path: /home
            - name: cni-conf
-              mountPath: /host/etc
+              hostPath:
+                path: /etc
            - name: dbus
-              mountPath: /host/var/lib/dbus
-          resources:
-            requests:
-              cpu: 10m
-        - name: weave-npc
-          image: weaveworks/weave-npc:latest
-          imagePullPolicy: Always
-          resources:
-            requests:
-              cpu: 10m
-          securityContext:
-            privileged: true
-      restartPolicy: Always
-      volumes:
-        - name: weavedb
-          emptyDir: {}
-        - name: cni-bin
-          hostPath:
-            path: /opt
-        - name: cni-bin2
-          hostPath:
-            path: /home
-        - name: cni-conf
-          hostPath:
-            path: /etc
-        - name: dbus
-          hostPath:
-            path: /var/lib/dbus
+              hostPath:
+                path: /var/lib/dbus
+            - name: lib-modules
+              hostPath:
+                path: /lib/modules
@@ -28,6 +28,7 @@ var (
 	metricsAddr string
 	logLevel    string
 	allowMcast  bool
+	nodeName    string
 )

 func handleError(err error) { common.CheckFatal(err) }
@@ -53,6 +54,41 @@ func resetIPTables(ipt *iptables.IPTables) error {
 		return err
 	}

+	return nil
+}
+
+func resetIPSets(ips ipset.Interface) error {
+	// Remove ipsets prefixed `weave-` only
+
+	sets, err := ips.List(npc.IpsetNamePrefix)
+	if err != nil {
+		common.Log.Errorf("Failed to retrieve list of ipsets")
+		return err
+	}
+
+	common.Log.Debugf("Got list of ipsets: %v", sets)
+
+	// Must remove references to ipsets by other ipsets before they're destroyed
+	for _, s := range sets {
+		common.Log.Debugf("Flushing ipset '%s'", string(s))
+		if err := ips.Flush(s); err != nil {
+			common.Log.Errorf("Failed to flush ipset '%s'", string(s))
+			return err
+		}
+	}
+
+	for _, s := range sets {
+		common.Log.Debugf("Destroying ipset '%s'", string(s))
+		if err := ips.Destroy(s); err != nil {
+			common.Log.Errorf("Failed to destroy ipset '%s'", string(s))
+			return err
+		}
+	}
+
+	return nil
+}
+
+func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 	// Configure main chain static rules
 	if err := ipt.Append(npc.TableFilter, npc.MainChain,
 		"-m", "state", "--state", "RELATED,ESTABLISHED", "-j", "ACCEPT"); err != nil {
@@ -76,17 +112,12 @@ func resetIPTables(ipt *iptables.IPTables) error {
 		return err
 	}

-	return nil
-}
-
-func resetIPSets(ips ipset.Interface) error {
-	// TODO should restrict ipset operations to the `weave-` prefix:
-
-	if err := ips.FlushAll(); err != nil {
+	// If the destination address is not any of the local pods, let it through
+	if err := ips.Create(npc.LocalIpset, ipset.HashIP); err != nil {
 		return err
 	}
-
-	if err := ips.DestroyAll(); err != nil {
+	if err := ipt.Append(npc.TableFilter, npc.MainChain,
+		"-m", "set", "!", "--match-set", npc.LocalIpset, "dst", "-j", "ACCEPT"); err != nil {
 		return err
 	}

@@ -95,7 +126,14 @@ func resetIPSets(ips ipset.Interface) error {

 func root(cmd *cobra.Command, args []string) {
 	common.SetLogLevel(logLevel)
-	common.Log.Infof("Starting Weaveworks NPC %s", version)
+	if nodeName == "" {
+		// HOSTNAME is set by Kubernetes for pods in the host network namespace
+		nodeName = os.Getenv("HOSTNAME")
+	}
+	if nodeName == "" {
+		common.Log.Fatalf("Must set node name via --node-name or $HOSTNAME")
+	}
+	common.Log.Infof("Starting Weaveworks NPC %s; node name %q", version, nodeName)

 	if err := metrics.Start(metricsAddr); err != nil {
 		common.Log.Fatalf("Failed to start metrics: %v", err)
@@ -114,12 +152,13 @@ func root(cmd *cobra.Command, args []string) {
 	ipt, err := iptables.New()
 	handleError(err)

-	ips := ipset.New()
+	ips := ipset.New(common.LogLogger())

 	handleError(resetIPTables(ipt))
 	handleError(resetIPSets(ips))
+	handleError(createBaseRules(ipt, ips))

-	npc := npc.New(ipt, ips)
+	npc := npc.New(nodeName, ipt, ips)

 	nsController := makeController(client.Core().RESTClient(), "namespaces", &coreapi.Namespace{},
 		cache.ResourceEventHandlerFuncs{
@@ -127,7 +166,15 @@ func root(cmd *cobra.Command, args []string) {
 				handleError(npc.AddNamespace(obj.(*coreapi.Namespace)))
 			},
 			DeleteFunc: func(obj interface{}) {
-				handleError(npc.DeleteNamespace(obj.(*coreapi.Namespace)))
+				switch obj := obj.(type) {
+				case *coreapi.Namespace:
+					handleError(npc.DeleteNamespace(obj))
+				case cache.DeletedFinalStateUnknown:
+					// We know this object has gone away, but its final state is no longer
+					// available from the API server. Instead we use the last copy of it
+					// that we have, which is good enough for our cleanup.
+					handleError(npc.DeleteNamespace(obj.Obj.(*coreapi.Namespace)))
+				}
 			},
 			UpdateFunc: func(old, new interface{}) {
 				handleError(npc.UpdateNamespace(old.(*coreapi.Namespace), new.(*coreapi.Namespace)))
@@ -139,7 +186,15 @@ func root(cmd *cobra.Command, args []string) {
 				handleError(npc.AddPod(obj.(*coreapi.Pod)))
 			},
 			DeleteFunc: func(obj interface{}) {
-				handleError(npc.DeletePod(obj.(*coreapi.Pod)))
+				switch obj := obj.(type) {
+				case *coreapi.Pod:
+					handleError(npc.DeletePod(obj))
+				case cache.DeletedFinalStateUnknown:
+					// We know this object has gone away, but its final state is no longer
+					// available from the API server. Instead we use the last copy of it
+					// that we have, which is good enough for our cleanup.
+					handleError(npc.DeletePod(obj.Obj.(*coreapi.Pod)))
+				}
 			},
 			UpdateFunc: func(old, new interface{}) {
 				handleError(npc.UpdatePod(old.(*coreapi.Pod), new.(*coreapi.Pod)))
@@ -151,7 +206,15 @@ func root(cmd *cobra.Command, args []string) {
 				handleError(npc.AddNetworkPolicy(obj.(*extnapi.NetworkPolicy)))
 			},
 			DeleteFunc: func(obj interface{}) {
-				handleError(npc.DeleteNetworkPolicy(obj.(*extnapi.NetworkPolicy)))
+				switch obj := obj.(type) {
+				case *extnapi.NetworkPolicy:
+					handleError(npc.DeleteNetworkPolicy(obj))
+				case cache.DeletedFinalStateUnknown:
+					// We know this object has gone away, but its final state is no longer
+					// available from the API server. Instead we use the last copy of it
+					// that we have, which is good enough for our cleanup.
+					handleError(npc.DeleteNetworkPolicy(obj.Obj.(*extnapi.NetworkPolicy)))
+				}
 			},
 			UpdateFunc: func(old, new interface{}) {
 				handleError(npc.UpdateNetworkPolicy(old.(*extnapi.NetworkPolicy), new.(*extnapi.NetworkPolicy)))
@@ -175,6 +238,7 @@ func main() {
 	rootCmd.PersistentFlags().StringVar(&metricsAddr, "metrics-addr", ":6781", "metrics server bind address")
 	rootCmd.PersistentFlags().StringVar(&logLevel, "log-level", "debug", "logging level (debug, info, warning, error)")
 	rootCmd.PersistentFlags().BoolVar(&allowMcast, "allow-mcast", true, "allow all multicast traffic")
+	rootCmd.PersistentFlags().StringVar(&nodeName, "node-name", "", "only generate rules that apply to this node")

 	handleError(rootCmd.Execute())
 }
@@ -1,6 +1,7 @@
 # This is a nearly-empty image that we use to create a data-only container for persistence
 FROM scratch
 LABEL maintainer "Weaveworks Inc <help@weave.works>"
+LABEL works.weave.role=system
 ENTRYPOINT ["data-only"]
 # Work round Docker refusing to save an empty image
 COPY Dockerfile /
@@ -1,33 +1,10 @@
-FROM ALPINE_BASEIMAGE
+FROM DOCKERHUB_USER/weaveARCH_EXT

-# If we're building for another architecture than amd64, the CROSS_BUILD_ placeholder is removed so e.g. CROSS_BUILD_COPY turns into COPY
-# If we're building normally, for amd64, CROSS_BUILD lines are removed
-CROSS_BUILD_COPY qemu-QEMUARCH-static /usr/bin/
-
-LABEL maintainer "Weaveworks Inc <help@weave.works>"
-LABEL works.weave.role=system \
-      org.label-schema.name="Weave Net" \
-      org.label-schema.description="Weave Net creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery" \
-      org.label-schema.url="https://weave.works" \
-      org.label-schema.vcs-url="https://github.com/weaveworks/weave" \
-      org.label-schema.vendor="Weaveworks"
-
-WORKDIR /home/weave
 ENTRYPOINT ["/home/weave/sigproxy", "/home/weave/weave"]

-RUN apk add --update \
-    curl \
-    ethtool \
-    iptables \
-    iproute2 \
-    util-linux \
-    conntrack-tools \
-    bind-tools \
-  && rm -rf /var/cache/apk/*
-
-ADD ./weave ./sigproxy ./weaveproxy ./symlink /home/weave/
-ADD ./weaveutil /usr/bin/
+ADD ./sigproxy ./symlink /home/weave/
+ADD ./docker /usr/bin/
 ADD ./weavewait /w/w
 ADD ./weavewait_noop /w-noop/w
 ADD ./weavewait_nomcast /w-nomcast/w
-ADD ./docker /usr/bin/
+WORKDIR /home/weave
@@ -1,84 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-	"strings"
-
-	"github.com/weaveworks/common/mflag"
-	"github.com/weaveworks/common/mflagext"
-	"github.com/weaveworks/common/signals"
-	"github.com/weaveworks/weave/common"
-	"github.com/weaveworks/weave/proxy"
-)
-
-var version = "unreleased"
-
-var Log = common.Log
-
-func getenv(key, defaultVal string) string {
-	if v := os.Getenv(key); v != "" {
-		return v
-	}
-	return defaultVal
-}
-
-func main() {
-	var (
-		justVersion bool
-		logLevel    = "info"
-		c           proxy.Config
-		withDNS     bool
-	)
-
-	c.Version = version
-
-	mflag.BoolVar(&justVersion, []string{"#version", "-version"}, false, "print version and exit")
-	mflag.StringVar(&logLevel, []string{"-log-level"}, "info", "logging level (debug, info, warning, error)")
-	mflagext.ListVar(&c.ListenAddrs, []string{"H"}, nil, "addresses on which to listen")
-	mflag.StringVar(&c.HostnameFromLabel, []string{"-hostname-from-label"}, "", "Key of container label from which to obtain the container's hostname")
-	mflag.StringVar(&c.HostnameMatch, []string{"-hostname-match"}, "(.*)", "Regexp pattern to apply on container names (e.g. '^aws-[0-9]+-(.*)$')")
-	mflag.StringVar(&c.HostnameReplacement, []string{"-hostname-replacement"}, "$1", "Expression to generate hostnames based on matches from --hostname-match (e.g. 'my-app-$1')")
-	mflag.BoolVar(&c.RewriteInspect, []string{"-rewrite-inspect"}, false, "Rewrite 'inspect' calls to return the weave network settings (if attached)")
-	mflag.BoolVar(&c.NoDefaultIPAM, []string{"#-no-default-ipam", "-no-default-ipalloc"}, false, "do not automatically allocate addresses for containers without a WEAVE_CIDR")
-	mflag.BoolVar(&c.NoRewriteHosts, []string{"-no-rewrite-hosts"}, false, "do not automatically rewrite /etc/hosts. Use if you need the docker IP to remain in /etc/hosts")
-	mflag.StringVar(&c.TLSConfig.CACert, []string{"#tlscacert", "-tlscacert"}, "", "Trust certs signed only by this CA")
-	mflag.StringVar(&c.TLSConfig.Cert, []string{"#tlscert", "-tlscert"}, "", "Path to TLS certificate file")
-	mflag.BoolVar(&c.TLSConfig.Enabled, []string{"#tls", "-tls"}, false, "Use TLS; implied by --tlsverify")
-	mflag.StringVar(&c.TLSConfig.Key, []string{"#tlskey", "-tlskey"}, "", "Path to TLS key file")
-	mflag.BoolVar(&c.TLSConfig.Verify, []string{"#tlsverify", "-tlsverify"}, false, "Use TLS and verify the remote")
-	mflag.BoolVar(&withDNS, []string{"#-with-dns", "#w"}, false, "option removed")
-	mflag.BoolVar(&c.WithoutDNS, []string{"-without-dns"}, false, "instruct created containers to never use weaveDNS as their nameserver")
-	mflag.BoolVar(&c.NoMulticastRoute, []string{"-no-multicast-route"}, false, "do not add a multicast route via the weave interface when attaching containers")
-	mflag.Parse()
-
-	if justVersion {
-		fmt.Printf("weave proxy  %s\n", version)
-		os.Exit(0)
-	}
-
-	common.SetLogLevel(logLevel)
-
-	Log.Infoln("weave proxy", version)
-	Log.Infoln("Command line arguments:", strings.Join(os.Args[1:], " "))
-
-	if withDNS {
-		Log.Warning("--with-dns option has been removed; DNS is on by default")
-	}
-
-	c.Image = getenv("EXEC_IMAGE", "weaveworks/weaveexec")
-	c.DockerBridge = getenv("DOCKER_BRIDGE", "docker0")
-	c.DockerHost = getenv("DOCKER_HOST", "unix:///var/run/docker.sock")
-
-	p, err := proxy.NewProxy(c)
-	if err != nil {
-		Log.Fatalf("Could not start proxy: %s", err)
-	}
-	defer p.Stop()
-
-	listeners := p.Listen()
-	p.AttachExistingContainers()
-	go p.Serve(listeners)
-	go p.ListenAndServeStatus("/home/weave/status.sock")
-	signals.SignalHandlerLoop(common.Log)
-}
@@ -1,12 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	weavetest "github.com/weaveworks/weave/testing"
-)
-
-func TestMain(t *testing.T) {
-	weavetest.TrimTestArgs()
-	main()
-}
@@ -1,6 +1,31 @@
-FROM DOCKERHUB_USER/weaveexecARCH_EXT
-WORKDIR /home/weave
-ADD ./weaver /home/weave/
+FROM ALPINE_BASEIMAGE
+
+# If we're building for another architecture than amd64, the CROSS_BUILD_ placeholder is removed so e.g. CROSS_BUILD_COPY turns into COPY
+# If we're building normally, for amd64, CROSS_BUILD lines are removed
+CROSS_BUILD_COPY qemu-QEMUARCH-static /usr/bin/
+
+LABEL maintainer "Weaveworks Inc <help@weave.works>"
+LABEL works.weave.role=system \
+      org.label-schema.name="Weave Net" \
+      org.label-schema.description="Weave Net creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery" \
+      org.label-schema.url="https://weave.works" \
+      org.label-schema.vcs-url="https://github.com/weaveworks/weave" \
+      org.label-schema.vendor="Weaveworks"
+
+RUN apk add --update \
+    curl \
+    ethtool \
+    iptables \
+    ipset \
+    iproute2 \
+    util-linux \
+    conntrack-tools \
+    bind-tools \
+  && rm -rf /var/cache/apk/*
+
+ADD ./weave ./weaver /home/weave/
+ADD ./weaveutil /usr/bin/
 ADD weavedata.db /weavedb/
 COPY ca-certificates.crt /etc/ssl/certs/
 ENTRYPOINT ["/home/weave/weaver"]
+WORKDIR /home/weave
@@ -6,6 +6,7 @@ import (
 	"time"

 	"github.com/weaveworks/go-checkpoint"
+	weave "github.com/weaveworks/weave/router"
 )

 var checker *checkpoint.Checker
@@ -16,7 +17,7 @@ const (
 	updateCheckPeriod = 6 * time.Hour
 )

-func checkForUpdates(dockerVersion string, network string) {
+func checkForUpdates(dockerVersion string, router *weave.NetworkRouter) {
 	newVersion.Store("")
 	success.Store(true)

@@ -51,9 +52,6 @@ func checkForUpdates(dockerVersion string, network string) {
 		"docker-version": dockerVersion,
 		"kernel-version": kernelVersion,
 	}
-	if network != "" {
-		flags["network"] = network
-	}

 	// Start background version checking
 	params := checkpoint.CheckParams{
@@ -61,6 +59,21 @@ func checkForUpdates(dockerVersion string, network string) {
 		Version:       version,
 		SignatureFile: "",
 		Flags:         flags,
+		ExtraFlags:    func() []checkpoint.Flag { return checkpointFlags(router) },
 	}
 	checker = checkpoint.CheckInterval(&params, updateCheckPeriod, handleResponse)
 }
+
+func checkpointFlags(router *weave.NetworkRouter) []checkpoint.Flag {
+	flags := []checkpoint.Flag{}
+	status := weave.NewNetworkRouterStatus(router)
+	for _, conn := range status.Connections {
+		if connectionName, ok := conn.Attrs["name"].(string); ok {
+			if _, encrypted := conn.Attrs["encrypted"]; encrypted {
+				connectionName = connectionName + " encrypted"
+			}
+			flags = append(flags, checkpoint.Flag{Key: "network", Value: connectionName})
+		}
+	}
+	return flags
+}
@@ -0,0 +1,104 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"time"
+
+	"github.com/gorilla/mux"
+
+	"github.com/weaveworks/weave/ipam"
+)
+
+// TODO: move these definitions somewhere more shareable
+type PeerUpdateRequest struct {
+	Name      string   `json:"peername"`
+	Nickname  string   `json:"nickname"`  // optional
+	Addresses []string `json:"addresses"` // can be empty
+}
+
+type PeerUpdateResponse struct {
+	Addresses []string `json:"addresses"`
+	PeerCount int      `json:"peercount"`
+}
+
+var httpClient = &http.Client{Timeout: 30 * time.Second}
+
+func do(verb string, discoveryEndpoint, token string, request interface{}, response interface{}) error {
+	body := new(bytes.Buffer)
+	err := json.NewEncoder(body).Encode(request)
+	if err != nil {
+		return err
+	}
+	req, err := http.NewRequest(verb, discoveryEndpoint+"/peer", body)
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", fmt.Sprintf("Scope-Probe token=%s", token))
+	req.Header.Set("X-Weave-Net-Version", version)
+	req.Header.Set("Content-Type", "application/json")
+	Log.Printf("Calling peer discovery %s with %s", req.URL, request)
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		rbody, _ := ioutil.ReadAll(resp.Body)
+		return errors.New(resp.Status + ": " + string(rbody))
+	}
+	if response == nil {
+		return nil
+	}
+	err = json.NewDecoder(resp.Body).Decode(response)
+	Log.Printf("peer discovery result: (%v) %v", err, response)
+	return err
+}
+
+func peerDiscoveryUpdate(discoveryEndpoint, token, peername, nickname string, addresses []string) ([]string, int, error) {
+	request := PeerUpdateRequest{
+		Name:      peername,
+		Nickname:  nickname,
+		Addresses: addresses,
+	}
+	var updateResponse PeerUpdateResponse
+	err := do("POST", discoveryEndpoint, token, request, &updateResponse)
+	return updateResponse.Addresses, updateResponse.PeerCount, err
+}
+
+func peerDiscoveryDelete(discoveryEndpoint, token, peername string) error {
+	request := PeerUpdateRequest{Name: peername}
+	return do("DELETE", discoveryEndpoint, token, request, nil)
+}
+
+func HandleHTTPPeer(router *mux.Router, alloc *ipam.Allocator, discoveryEndpoint, token, peername string) {
+	router.Methods("DELETE").Path("/peer").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if discoveryEndpoint != "" && token != "" {
+			if err := peerDiscoveryDelete(discoveryEndpoint, token, peername); err != nil {
+				Log.Errorf("Error while deleting self from peer discovery: %s", err)
+			}
+		}
+		if alloc != nil {
+			alloc.Shutdown()
+		}
+		w.WriteHeader(204)
+	})
+
+	router.Methods("DELETE").Path("/peer/{id}").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ident := mux.Vars(r)["id"]
+		if discoveryEndpoint != "" && token != "" {
+			// TODO: deal with this being either a peername or a nickname
+			if err := peerDiscoveryDelete(discoveryEndpoint, token, ident); err != nil {
+				Log.Errorf("Error while deleting self from peer discovery: %s", err)
+			}
+		}
+		if alloc != nil {
+			transferred := alloc.AdminTakeoverRanges(ident)
+			fmt.Fprintf(w, "%d IPs taken over from %s\n", transferred, ident)
+		}
+	})
+}
@@ -13,9 +13,12 @@ import (
 	"github.com/weaveworks/mesh"

 	"github.com/weaveworks/go-checkpoint"
+	"github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/ipam"
 	"github.com/weaveworks/weave/nameserver"
 	"github.com/weaveworks/weave/net/address"
+	"github.com/weaveworks/weave/plugin"
+	"github.com/weaveworks/weave/proxy"
 	weave "github.com/weaveworks/weave/router"
 )

@@ -178,7 +181,7 @@ var statusTemplate = defTemplate("status", `\
 {{if allIPAMOwnersUnreachable .IPAM}}\
         Status: all IP ranges owned by unreachable peers - use 'rmpeer' if they are dead
 {{else if len .IPAM.PendingAllocates}}\
-         Status: waiting for IP range grant from peers
+         Status: waiting for IP(s) to become available
 {{else}}\
         Status: ready
 {{end}}\
@@ -202,6 +205,20 @@ var statusTemplate = defTemplate("status", `\
            TTL: {{.DNS.TTL}}
        Entries: {{countDNSEntries .DNS.Entries}}
 {{end}}\
+{{if .Proxy}}\
+
+        Service: proxy
+        Address: {{printList .Proxy.Addresses}}
+{{end}}\
+{{if .Plugin}}\
+
+{{if .Plugin.Config.EnableV2}}\
+        Service: plugin (v2)
+{{else}}\
+        Service: plugin (legacy)
+     DriverName: {{.Plugin.DriverName}}
+{{end}}\
+{{end}}\
 `)

 var targetsTemplate = defTemplate("targetsTemplate", `\
@@ -273,22 +290,29 @@ func (v *VersionCheck) String() string {
 }

 type WeaveStatus struct {
+	Ready        bool
 	Version      string
 	VersionCheck *VersionCheck              `json:"VersionCheck,omitempty"`
 	Router       *weave.NetworkRouterStatus `json:"Router,omitempty"`
 	IPAM         *ipam.Status               `json:"IPAM,omitempty"`
 	DNS          *nameserver.Status         `json:"DNS,omitempty"`
+	Proxy        *proxy.Status              `json:"Proxy,omitempty"`
+	Plugin       *plugin.Status             `json:"Plugin,omitempty"`
 }

 // Read-only functions, suitable for exposing on an unprotected socket
-func HandleHTTP(muxRouter *mux.Router, version string, router *weave.NetworkRouter, allocator *ipam.Allocator, defaultSubnet address.CIDR, ns *nameserver.Nameserver, dnsserver *nameserver.DNSServer) {
+func HandleHTTP(muxRouter *mux.Router, version string, router *weave.NetworkRouter, allocator *ipam.Allocator, defaultSubnet address.CIDR, ns *nameserver.Nameserver, dnsserver *nameserver.DNSServer, prxy *proxy.Proxy, plugin *plugin.Plugin, waitReady *common.WaitGroup) {
 	status := func() WeaveStatus {
 		return WeaveStatus{
+			waitReady.IsDone(),
 			version,
 			versionCheck(),
 			weave.NewNetworkRouterStatus(router),
 			ipam.NewStatus(allocator, defaultSubnet),
-			nameserver.NewStatus(ns, dnsserver)}
+			nameserver.NewStatus(ns, dnsserver),
+			proxy.NewStatus(prxy),
+			plugin.NewStatus(),
+		}
 	}
 	muxRouter.Methods("GET").Path("/report").Headers("Accept", "application/json").HandlerFunc(
 		func(w http.ResponseWriter, r *http.Request) {
@@ -324,7 +348,11 @@ func HandleHTTP(muxRouter *mux.Router, version string, router *weave.NetworkRout
 	defHandler := func(path string, template *template.Template) {
 		muxRouter.Methods("GET").Path(path).HandlerFunc(
 			func(w http.ResponseWriter, r *http.Request) {
-				if err := template.Execute(w, status()); err != nil {
+				s := status()
+				if !s.Ready {
+					w.WriteHeader(http.StatusServiceUnavailable)
+				}
+				if err := template.Execute(w, s); err != nil {
 					http.Error(w, "error during template execution", http.StatusInternalServerError)
 					Log.Error(err)
 				}
@@ -14,6 +14,7 @@ import (
 	"github.com/gorilla/mux"
 	"github.com/pkg/profile"
 	"github.com/weaveworks/common/mflag"
+	"github.com/weaveworks/common/mflagext"
 	"github.com/weaveworks/common/signals"
 	"github.com/weaveworks/mesh"

@@ -25,6 +26,8 @@ import (
 	"github.com/weaveworks/weave/nameserver"
 	weavenet "github.com/weaveworks/weave/net"
 	"github.com/weaveworks/weave/net/address"
+	"github.com/weaveworks/weave/plugin"
+	weaveproxy "github.com/weaveworks/weave/proxy"
 	weave "github.com/weaveworks/weave/router"
 )

@@ -53,7 +56,7 @@ type dnsConfig struct {
 func (c *ipamConfig) Enabled() bool {
 	var (
 		hasPeerCount = c.PeerCount > 0
-		hasMode      = len(c.Mode) > 0
+		hasMode      = c.HasMode()
 		hasRange     = c.IPRangeCIDR != ""
 		hasSubnet    = c.IPSubnetCIDR != ""
 	)
@@ -63,9 +66,7 @@ func (c *ipamConfig) Enabled() bool {
 	case !hasRange && hasSubnet:
 		Log.Fatal("--ipalloc-default-subnet specified without --ipalloc-range.")
 	case !hasRange:
-		Log.Fatal("--ipalloc-init or --init-peer-count specified without --ipalloc-range.")
-	case hasMode && hasPeerCount:
-		Log.Fatal("At most one of --ipalloc-init or --init-peer-count may be specified.")
+		Log.Fatal("--ipalloc-init specified without --ipalloc-range.")
 	}
 	if hasMode {
 		if err := c.parseMode(); err != nil {
@@ -75,6 +76,10 @@ func (c *ipamConfig) Enabled() bool {
 	return true
 }

+func (c ipamConfig) HasMode() bool {
+	return len(c.Mode) > 0
+}
+
 func (c *ipamConfig) parseMode() error {
 	modeAndParam := strings.SplitN(c.Mode, "=", 2)

@@ -108,6 +113,13 @@ func (c *ipamConfig) parseMode() error {
 	return nil
 }

+func getenvOrDefault(key, defaultVal string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return defaultVal
+}
+
 func main() {
 	procs := runtime.NumCPU()
 	// packet sniffing can block an OS thread, so we need one thread
@@ -120,15 +132,15 @@ func main() {
 	var (
 		justVersion        bool
 		config             mesh.Config
+		bridgeConfig       weavenet.BridgeConfig
 		networkConfig      weave.NetworkConfig
 		protocolMinVersion int
 		resume             bool
-		ifaceName          string
 		routerName         string
 		nickName           string
 		password           string
 		pktdebug           bool
-		logLevel           string
+		logLevel           = "info"
 		prof               string
 		bufSzMB            int
 		noDiscovery        bool
@@ -139,40 +151,41 @@ func main() {
 		peers              []string
 		noDNS              bool
 		dnsConfig          dnsConfig
-		datapathName       string
 		trustedSubnetStr   string
 		dbPrefix           string
-		isAWSVPC           bool
-
-		defaultDockerHost = "unix:///var/run/docker.sock"
+		hostRoot           string
+		procPath           string
+		discoveryEndpoint  string
+		token              string
+		advertiseAddress   string
+		pluginConfig       plugin.Config
+		defaultDockerHost  = getenvOrDefault("DOCKER_HOST", "unix:///var/run/docker.sock")
 	)

-	if val := os.Getenv("DOCKER_HOST"); val != "" {
-		defaultDockerHost = val
-	}
-
-	mflag.BoolVar(&justVersion, []string{"#version", "-version"}, false, "print version and exit")
+	mflag.BoolVar(&justVersion, []string{"-version"}, false, "print version and exit")
 	mflag.StringVar(&config.Host, []string{"-host"}, "", "router host")
-	mflag.IntVar(&config.Port, []string{"#port", "-port"}, mesh.Port, "router port")
+	mflag.IntVar(&config.Port, []string{"-port"}, mesh.Port, "router port")
 	mflag.IntVar(&protocolMinVersion, []string{"-min-protocol-version"}, mesh.ProtocolMinVersion, "minimum weave protocol version")
 	mflag.BoolVar(&resume, []string{"-resume"}, false, "resume connections to previous peers")
-	mflag.StringVar(&ifaceName, []string{"#iface", "-iface"}, "", "name of interface to capture/inject from (disabled if blank)")
-	mflag.StringVar(&routerName, []string{"#name", "-name"}, "", "name of router (defaults to MAC of interface)")
-	mflag.StringVar(&nickName, []string{"#nickname", "-nickname"}, "", "nickname of peer (defaults to hostname)")
-	mflag.StringVar(&password, []string{"#password", "-password"}, "", "network password")
+	mflag.StringVar(&bridgeConfig.WeaveBridgeName, []string{"-weave-bridge"}, "weave", "name of weave bridge")
+	mflag.StringVar(&bridgeConfig.DockerBridgeName, []string{"-docker-bridge"}, "", "name of Docker bridge")
+	mflag.BoolVar(&bridgeConfig.NPC, []string{"-expect-npc"}, false, "set up iptables rules for npc")
+	mflag.StringVar(&routerName, []string{"-name"}, "", "name of router (defaults to MAC of interface)")
+	mflag.StringVar(&nickName, []string{"-nickname"}, "", "nickname of peer (defaults to hostname)")
+	mflag.StringVar(&password, []string{"-password"}, "", "network password")
 	mflag.StringVar(&logLevel, []string{"-log-level"}, "info", "logging level (debug, info, warning, error)")
-	mflag.BoolVar(&pktdebug, []string{"#pktdebug", "#-pktdebug", "-pkt-debug"}, false, "enable per-packet debug logging")
-	mflag.StringVar(&prof, []string{"#profile", "-profile"}, "", "enable profiling and write profiles to given path")
-	mflag.IntVar(&config.ConnLimit, []string{"#connlimit", "#-connlimit", "-conn-limit"}, 30, "connection limit (0 for unlimited)")
-	mflag.BoolVar(&noDiscovery, []string{"#nodiscovery", "#-nodiscovery", "-no-discovery"}, false, "disable peer discovery")
-	mflag.IntVar(&bufSzMB, []string{"#bufsz", "-bufsz"}, 8, "capture buffer size in MB")
-	mflag.StringVar(&httpAddr, []string{"#httpaddr", "#-httpaddr", "-http-addr"}, "", "address to bind HTTP interface to (disabled if blank, absolute path indicates unix domain socket)")
+	mflag.BoolVar(&pktdebug, []string{"-pkt-debug"}, false, "enable per-packet debug logging")
+	mflag.StringVar(&prof, []string{"-profile"}, "", "enable profiling and write profiles to given path")
+	mflag.IntVar(&config.ConnLimit, []string{"-conn-limit"}, 30, "connection limit (0 for unlimited)")
+	mflag.BoolVar(&noDiscovery, []string{"-no-discovery"}, false, "disable peer discovery")
+	mflag.IntVar(&bufSzMB, []string{"-bufsz"}, 8, "capture buffer size in MB")
+	mflag.IntVar(&bridgeConfig.MTU, []string{"-mtu"}, 0, "MTU size")
+	mflag.StringVar(&httpAddr, []string{"-http-addr"}, "", "address to bind HTTP interface to (disabled if blank, absolute path indicates unix domain socket)")
 	mflag.StringVar(&statusAddr, []string{"-status-addr"}, "", "address to bind status+metrics interface to (disabled if blank, absolute path indicates unix domain socket)")
 	mflag.StringVar(&ipamConfig.Mode, []string{"-ipalloc-init"}, "", "allocator initialisation strategy (consensus, seed or observer)")
-	mflag.StringVar(&ipamConfig.IPRangeCIDR, []string{"#iprange", "#-iprange", "-ipalloc-range"}, "", "IP address range reserved for automatic allocation, in CIDR notation")
-	mflag.StringVar(&ipamConfig.IPSubnetCIDR, []string{"#ipsubnet", "#-ipsubnet", "-ipalloc-default-subnet"}, "", "subnet to allocate within by default, in CIDR notation")
-	mflag.IntVar(&ipamConfig.PeerCount, []string{"#initpeercount", "#-initpeercount", "-init-peer-count"}, 0, "number of peers in network (for IP address allocation)")
-	mflag.StringVar(&dockerAPI, []string{"#api", "#-api", "-docker-api"}, defaultDockerHost, "Docker API endpoint")
+	mflag.StringVar(&ipamConfig.IPRangeCIDR, []string{"-ipalloc-range"}, "", "IP address range reserved for automatic allocation, in CIDR notation")
+	mflag.StringVar(&ipamConfig.IPSubnetCIDR, []string{"-ipalloc-default-subnet"}, "", "subnet to allocate within by default, in CIDR notation")
+	mflag.StringVar(&dockerAPI, []string{"-docker-api"}, defaultDockerHost, "Docker API endpoint")
 	mflag.BoolVar(&noDNS, []string{"-no-dns"}, false, "disable DNS server")
 	mflag.StringVar(&dnsConfig.Domain, []string{"-dns-domain"}, nameserver.DefaultDomain, "local domain to server requests for")
 	mflag.StringVar(&dnsConfig.ListenAddress, []string{"-dns-listen-address"}, nameserver.DefaultListenAddress, "address to listen on for DNS requests")
@@ -180,10 +193,28 @@ func main() {
 	mflag.DurationVar(&dnsConfig.ClientTimeout, []string{"-dns-fallback-timeout"}, nameserver.DefaultClientTimeout, "timeout for fallback DNS requests")
 	mflag.StringVar(&dnsConfig.EffectiveListenAddress, []string{"-dns-effective-listen-address"}, "", "address DNS will actually be listening, after Docker port mapping")
 	mflag.StringVar(&dnsConfig.ResolvConf, []string{"-resolv-conf"}, "", "path to resolver configuration for fallback DNS lookups")
-	mflag.StringVar(&datapathName, []string{"-datapath"}, "", "ODP datapath name")
+	mflag.StringVar(&bridgeConfig.DatapathName, []string{"-datapath"}, "", "ODP datapath name")
+	mflag.BoolVar(&bridgeConfig.NoFastdp, []string{"-no-fastdp"}, false, "Disable Fast Datapath")
 	mflag.StringVar(&trustedSubnetStr, []string{"-trusted-subnets"}, "", "comma-separated list of trusted subnets in CIDR notation")
 	mflag.StringVar(&dbPrefix, []string{"-db-prefix"}, "/weavedb/weave", "pathname/prefix of filename to store data")
-	mflag.BoolVar(&isAWSVPC, []string{"-awsvpc"}, false, "use AWS VPC for routing")
+	mflag.StringVar(&procPath, []string{"-proc-path"}, "/proc", "path to reach host /proc filesystem")
+	mflag.BoolVar(&bridgeConfig.AWSVPC, []string{"-awsvpc"}, false, "use AWS VPC for routing")
+	mflag.StringVar(&hostRoot, []string{"-host-root"}, "", "path to reach host filesystem")
+	mflag.StringVar(&discoveryEndpoint, []string{"-peer-discovery-url"}, "https://cloud.weave.works/api/net", "url for peer discovery")
+	mflag.StringVar(&token, []string{"-token"}, "", "token for peer discovery")
+	mflag.StringVar(&advertiseAddress, []string{"-advertise-address"}, "", "address to advertise for peer discovery")
+
+	mflag.BoolVar(&pluginConfig.Enable, []string{"-plugin"}, false, "enable Docker plugin (v1)")
+	mflag.BoolVar(&pluginConfig.EnableV2, []string{"-plugin-v2"}, false, "enable Docker plugin (v2)")
+	mflag.BoolVar(&pluginConfig.EnableV2Multicast, []string{"-plugin-v2-multicast"}, false, "enable multicast for Docker plugin (v2)")
+	mflag.StringVar(&pluginConfig.Socket, []string{"-plugin-socket"}, "/run/docker/plugins/weave.sock", "plugin socket on which to listen")
+	mflag.StringVar(&pluginConfig.MeshSocket, []string{"-plugin-mesh-socket"}, "/run/docker/plugins/weavemesh.sock", "plugin socket on which to listen in mesh mode")
+
+	proxyConfig := configureProxy(version, defaultDockerHost)
+	if bridgeConfig.AWSVPC {
+		proxyConfig.NoMulticastRoute = true
+		proxyConfig.KeepTXOn = true
+	}

 	// crude way of detecting that we probably have been started in a
 	// container, with `weave launch` --> suppress misleading paths in
@@ -195,19 +226,19 @@ func main() {

 	mflag.Parse()

+	if justVersion {
+		fmt.Printf("weave %s\n", version)
+		os.Exit(0)
+	}
+
 	peers = mflag.Args()
 	if resume && len(peers) > 0 {
 		Log.Fatalf("You must not specify an initial peer list in conjunction with --resume")
 	}

 	common.SetLogLevel(logLevel)
-
-	if justVersion {
-		fmt.Printf("weave router %s\n", version)
-		os.Exit(0)
-	}
-
 	Log.Println("Command line options:", options())
+	Log.Infoln("weave ", version)

 	if prof != "" {
 		defer profile.Start(profile.CPUProfile, profile.ProfilePath(prof), profile.NoShutdownHook).Stop()
@@ -218,24 +249,58 @@ func main() {
 	}
 	config.ProtocolMinVersion = byte(protocolMinVersion)

+	var waitReady common.WaitGroup
+
+	var proxy *weaveproxy.Proxy
+	var err error
+	if proxyConfig.Enabled {
+		if noDNS {
+			proxyConfig.WithoutDNS = true
+		}
+		// Start Weave Proxy:
+		proxy, err = weaveproxy.NewProxy(*proxyConfig)
+		if err != nil {
+			Log.Fatalf("Could not start proxy: %s", err)
+		}
+		defer proxy.Stop()
+		listeners := proxy.Listen()
+		proxy.AttachExistingContainers()
+		go proxy.Serve(listeners, waitReady.Add())
+	}
+
 	if pktdebug {
 		networkConfig.PacketLogging = packetLogging{}
 	} else {
 		networkConfig.PacketLogging = nopPacketLogging{}
 	}

-	config.Password = determinePassword(password)
-
-	overlay, bridge := createOverlay(datapathName, ifaceName, isAWSVPC, config.Host, config.Port, bufSzMB, config.Password != nil)
-	networkConfig.Bridge = bridge
-
-	if bridge != nil {
-		if err := weavenet.DetectHairpin("vethwe-bridge", Log); err != nil {
-			Log.Errorf("DetectHairpin failed: %s", err)
+	if bridgeConfig.DockerBridgeName != "" {
+		if setAddr, err := weavenet.EnforceAddrAssignType(bridgeConfig.DockerBridgeName); err != nil {
+			Log.Errorf("While checking address assignment type of %s: %s", bridgeConfig.DockerBridgeName, err)
+		} else if setAddr {
+			Log.Warningf("Setting %s MAC (mitigate https://github.com/docker/docker/issues/14908)", bridgeConfig.DockerBridgeName)
 		}
 	}

-	name := peerName(routerName)
+	name := peerName(routerName, bridgeConfig.WeaveBridgeName, dbPrefix, hostRoot)
+
+	bridgeConfig.Mac = name.String()
+	bridgeConfig.Port = config.Port
+	bridgeType, err := weavenet.EnsureBridge(procPath, &bridgeConfig, Log)
+	checkFatal(err)
+	Log.Println("Bridge type is", bridgeType)
+
+	config.Password = determinePassword(password)
+
+	overlay, injectorConsumer := createOverlay(bridgeType, bridgeConfig, config.Host, config.Port, bufSzMB, config.Password != nil)
+	networkConfig.InjectorConsumer = injectorConsumer
+
+	if injectorConsumer != nil {
+		if err := weavenet.DetectHairpin("vethwe-bridge", Log); err != nil {
+			Log.Errorf("Setting may cause connectivity issues : %s", err)
+			Log.Infof("Hairpin mode may have been enabled by other software on this machine")
+		}
+	}

 	if nickName == "" {
 		var err error
@@ -246,18 +311,39 @@ func main() {
 	config.TrustedSubnets = parseTrustedSubnets(trustedSubnetStr)
 	config.PeerDiscovery = !noDiscovery

-	if isAWSVPC && len(config.Password) > 0 {
+	if bridgeConfig.AWSVPC && len(config.Password) > 0 {
 		Log.Fatalf("--awsvpc mode is not compatible with the --password option")
 	}
+	if bridgeConfig.AWSVPC && !ipamConfig.Enabled() {
+		Log.Fatalf("--awsvpc mode requires IPAM enabled")
+	}

-	db, err := db.NewBoltDB(dbPrefix + db.FileName)
+	db, err := db.NewBoltDB(dbPrefix)
 	checkFatal(err)
 	defer db.Close()

-	router := weave.NewNetworkRouter(config, networkConfig, name, nickName, overlay, db)
+	router, err := weave.NewNetworkRouter(config, networkConfig, name, nickName, overlay, db)
+	checkFatal(err)
 	Log.Println("Our name is", router.Ourself)

-	if peers, err = router.InitialPeers(resume, peers); err != nil {
+	if token != "" {
+		var addresses []string
+		if advertiseAddress == "" {
+			localAddrs, err := weavenet.LocalAddresses()
+			checkFatal(err)
+			for _, addr := range localAddrs {
+				addresses = append(addresses, addr.IP.String())
+			}
+		} else {
+			addresses = strings.Split(advertiseAddress, ",")
+		}
+		discoveredPeers, count, err := peerDiscoveryUpdate(discoveryEndpoint, token, name.String(), nickName, addresses)
+		checkFatal(err)
+		if !ipamConfig.HasMode() {
+			ipamConfig.PeerCount = len(peers) + count
+		}
+		peers = append(peers, discoveredPeers...)
+	} else if peers, err = router.InitialPeers(resume, peers); err != nil {
 		Log.Fatal("Unable to get initial peer set: ", err)
 	}

@@ -274,11 +360,7 @@ func main() {
 		dockerVersion = dockerCli.DockerVersion()
 	}

-	network := ""
-	if isAWSVPC {
-		network = "awsvpc"
-	}
-	checkForUpdates(dockerVersion, network)
+	checkForUpdates(dockerVersion, router)

 	observeContainers := func(o docker.ContainerObserver) {
 		if dockerCli != nil {
@@ -298,20 +380,25 @@ func main() {
 	)
 	if ipamConfig.Enabled() {
 		var t tracker.LocalRangeTracker
-		if isAWSVPC {
+		if bridgeConfig.AWSVPC {
 			Log.Infoln("Creating AWSVPC LocalRangeTracker")
-			t, err = tracker.NewAWSVPCTracker()
+			t, err = tracker.NewAWSVPCTracker(bridgeConfig.WeaveBridgeName)
 			if err != nil {
 				Log.Fatalf("Cannot create AWSVPC LocalRangeTracker: %s", err)
 			}
 			trackerName = "awsvpc"
 		}
-		allocator, defaultSubnet = createAllocator(router, ipamConfig, db, t, isKnownPeer)
+
+		preClaims, err := findExistingAddresses(dockerCli, bridgeConfig.WeaveBridgeName)
+		checkFatal(err)
+
+		allocator, defaultSubnet = createAllocator(router, ipamConfig, preClaims, db, t, isKnownPeer)
 		observeContainers(allocator)
+
 		if dockerCli != nil {
-			ids, err := dockerCli.AllContainerIDs()
+			allContainerIDs, err := dockerCli.RunningContainerIDs()
 			checkFatal(err)
-			allocator.PruneOwned(ids)
+			allocator.PruneOwned(allContainerIDs)
 		}
 	}

@@ -325,6 +412,9 @@ func main() {
 		ns.Start()
 		defer ns.Stop()
 		dnsserver.ActivateAndServe()
+		if dockerCli != nil {
+			populateDNS(ns, dockerCli, name, bridgeConfig.WeaveBridgeName)
+		}
 		defer dnsserver.Stop()
 	}

@@ -334,6 +424,10 @@ func main() {
 	}
 	checkFatal(router.CreateRestartSentinel())

+	pluginConfig.DNS = !noDNS
+	pluginConfig.DefaultSubnet = defaultSubnet.String()
+	plugin := plugin.NewPlugin(pluginConfig)
+
 	// The weave script always waits for a status call to succeed,
 	// so there is no point in doing "weave launch --http-addr ''".
 	// This is here to support stand-alone use of weaver.
@@ -346,8 +440,12 @@ func main() {
 			ns.HandleHTTP(muxRouter, dockerCli)
 		}
 		router.HandleHTTP(muxRouter)
-		HandleHTTP(muxRouter, version, router, allocator, defaultSubnet, ns, dnsserver)
+		HandleHTTP(muxRouter, version, router, allocator, defaultSubnet, ns, dnsserver, proxy, plugin, &waitReady)
+		HandleHTTPPeer(muxRouter, allocator, discoveryEndpoint, token, name.String())
 		muxRouter.Methods("GET").Path("/metrics").Handler(metricsHandler(router, allocator, ns, dnsserver))
+		if proxy != nil {
+			muxRouter.Methods("GET").Path("/proxyaddrs").HandlerFunc(proxy.StatusHTTP)
+		}
 		http.Handle("/", common.LoggingHTTPHandler(muxRouter))
 		Log.Println("Listening for HTTP control messages on", httpAddr)
 		go listenAndServeHTTP(httpAddr, nil)
@@ -355,7 +453,7 @@ func main() {

 	if statusAddr != "" {
 		muxRouter := mux.NewRouter()
-		HandleHTTP(muxRouter, version, router, allocator, defaultSubnet, ns, dnsserver)
+		HandleHTTP(muxRouter, version, router, allocator, defaultSubnet, ns, dnsserver, proxy, plugin, &waitReady)
 		muxRouter.Methods("GET").Path("/metrics").Handler(metricsHandler(router, allocator, ns, dnsserver))
 		statusMux := http.NewServeMux()
 		statusMux.Handle("/", muxRouter)
@@ -363,16 +461,37 @@ func main() {
 		go listenAndServeHTTP(statusAddr, statusMux)
 	}

+	if plugin != nil {
+		go plugin.Start(httpAddr, dockerCli, waitReady.Add())
+	}
+
+	if bridgeConfig.AWSVPC {
+		// Run this on its own goroutine because the allocator can block
+		// We remove the default route installed by the kernel,
+		// because awsvpc has installed it as well
+		go expose(allocator, defaultSubnet, bridgeConfig.WeaveBridgeName, bridgeConfig.AWSVPC, waitReady.Add())
+	}
+
 	signals.SignalHandlerLoop(common.Log, router)
 }

+func expose(alloc *ipam.Allocator, subnet address.CIDR, bridgeName string, removeDefaultRoute bool, ready func()) {
+	addr, err := alloc.Allocate("weave:expose", subnet, false, func() bool { return false })
+	checkFatal(err)
+	cidr := address.MakeCIDR(subnet, addr)
+	err = weavenet.AddBridgeAddr(bridgeName, cidr.IPNet(), removeDefaultRoute)
+	checkFatal(err)
+	Log.Printf("Bridge %q exposed on address %v", bridgeName, cidr)
+	ready()
+}
+
 func options() map[string]string {
 	options := make(map[string]string)
 	mflag.Visit(func(f *mflag.Flag) {
 		value := f.Value.String()
 		name := canonicalName(f)
-		if name == "password" {
-			value = "<elided>"
+		if name == "password" || name == "token" {
+			value = "<redacted>"
 		}
 		options[name] = value
 	})
@@ -406,34 +525,57 @@ func (nopPacketLogging) LogPacket(string, weave.PacketKey) {
 func (nopPacketLogging) LogForwardPacket(string, weave.ForwardPacketKey) {
 }

-func createOverlay(datapathName string, ifaceName string, isAWSVPC bool, host string, port int, bufSzMB int, enableEncryption bool) (weave.NetworkOverlay, weave.Bridge) {
+func configureProxy(version string, defaultDockerHost string) *weaveproxy.Config {
+	proxyConfig := weaveproxy.Config{
+		Version:      version,
+		Image:        getenvOrDefault("EXEC_IMAGE", "weaveworks/weaveexec"),
+		DockerBridge: getenvOrDefault("DOCKER_BRIDGE", "docker0"),
+		DockerHost:   defaultDockerHost,
+	}
+	mflag.BoolVar(&proxyConfig.Enabled, []string{"-proxy"}, false, "instruct Weave Net to start its Docker proxy")
+	mflagext.ListVar(&proxyConfig.ListenAddrs, []string{"H"}, nil, "addresses on which to listen for Docker proxy")
+	mflag.StringVar(&proxyConfig.HostnameFromLabel, []string{"-hostname-from-label"}, "", "Key of container label from which to obtain the container's hostname")
+	mflag.StringVar(&proxyConfig.HostnameMatch, []string{"-hostname-match"}, "(.*)", "Regexp pattern to apply on container names (e.g. '^aws-[0-9]+-(.*)$')")
+	mflag.StringVar(&proxyConfig.HostnameReplacement, []string{"-hostname-replacement"}, "$1", "Expression to generate hostnames based on matches from --hostname-match (e.g. 'my-app-$1')")
+	mflag.BoolVar(&proxyConfig.RewriteInspect, []string{"-rewrite-inspect"}, false, "Rewrite 'inspect' calls to return the weave network settings (if attached)")
+	mflag.BoolVar(&proxyConfig.NoDefaultIPAM, []string{"-no-default-ipalloc"}, false, "proxy: do not automatically allocate addresses for containers without a WEAVE_CIDR")
+	mflag.BoolVar(&proxyConfig.NoRewriteHosts, []string{"-no-rewrite-hosts"}, false, "proxy: do not automatically rewrite /etc/hosts. Use if you need the docker IP to remain in /etc/hosts")
+	mflag.StringVar(&proxyConfig.TLSConfig.CACert, []string{"-tlscacert"}, "", "Trust certs signed only by this CA")
+	mflag.StringVar(&proxyConfig.TLSConfig.Cert, []string{"-tlscert"}, "", "Path to TLS certificate file")
+	mflag.BoolVar(&proxyConfig.TLSConfig.Enabled, []string{"-tls"}, false, "Use TLS; implied by --tlsverify")
+	mflag.StringVar(&proxyConfig.TLSConfig.Key, []string{"-tlskey"}, "", "Path to TLS key file")
+	mflag.BoolVar(&proxyConfig.TLSConfig.Verify, []string{"-tlsverify"}, false, "Use TLS and verify the remote")
+	mflag.BoolVar(&proxyConfig.WithoutDNS, []string{"-without-dns"}, false, "proxy: instruct created containers to never use weaveDNS as their nameserver")
+	mflag.BoolVar(&proxyConfig.NoMulticastRoute, []string{"-no-multicast-route"}, false, "proxy: do not add a multicast route via the weave interface when attaching containers")
+	return &proxyConfig
+}
+
+func createOverlay(bridgeType weavenet.Bridge, config weavenet.BridgeConfig, host string, port int, bufSzMB int, enableEncryption bool) (weave.NetworkOverlay, weave.InjectorConsumer) {
 	overlay := weave.NewOverlaySwitch()
-	var bridge weave.Bridge
+	var injectorConsumer weave.InjectorConsumer
 	var ignoreSleeve bool

 	switch {
-	case isAWSVPC:
+	case config.AWSVPC:
 		vpc := weave.NewAWSVPC()
 		overlay.Add("awsvpc", vpc)
-		bridge = weave.NullBridge{}
+		injectorConsumer = weave.NullInjectorConsumer{}
 		// Currently, we do not support any overlay with AWSVPC
 		ignoreSleeve = true
-	case datapathName != "" && ifaceName != "":
-		Log.Fatal("At most one of --datapath and --iface must be specified.")
-	case datapathName != "":
-		iface, err := weavenet.EnsureInterface(datapathName)
+	case bridgeType == nil:
+		injectorConsumer = weave.NullInjectorConsumer{}
+	case bridgeType.IsFastdp():
+		iface, err := weavenet.EnsureInterface(config.DatapathName)
 		checkFatal(err)
 		fastdp, err := weave.NewFastDatapath(iface, port, enableEncryption)
 		checkFatal(err)
-		bridge = fastdp.Bridge()
+		injectorConsumer = fastdp.InjectorConsumer()
 		overlay.Add("fastdp", fastdp.Overlay())
-	case ifaceName != "":
-		iface, err := weavenet.EnsureInterface(ifaceName)
+	case !bridgeType.IsFastdp():
+		iface, err := weavenet.EnsureInterface(weavenet.PcapIfName)
 		checkFatal(err)
-		bridge, err = weave.NewPcap(iface, bufSzMB*1024*1024) // bufsz flag is in MB
+		injectorConsumer, err = weave.NewPcap(iface, bufSzMB*1024*1024) // bufsz flag is in MB
 		checkFatal(err)
-	default:
-		bridge = weave.NullBridge{}
 	}

 	if !ignoreSleeve {
@@ -442,10 +584,10 @@ func createOverlay(datapathName string, ifaceName string, isAWSVPC bool, host st
 		overlay.SetCompatOverlay(sleeve)
 	}

-	return overlay, bridge
+	return overlay, injectorConsumer
 }

-func createAllocator(router *weave.NetworkRouter, config ipamConfig, db db.DB, track tracker.LocalRangeTracker, isKnownPeer func(mesh.PeerName) bool) (*ipam.Allocator, address.CIDR) {
+func createAllocator(router *weave.NetworkRouter, config ipamConfig, preClaims []ipam.PreClaim, db db.DB, track tracker.LocalRangeTracker, isKnownPeer func(mesh.PeerName) bool) (*ipam.Allocator, address.CIDR) {
 	ipRange, err := ipam.ParseCIDRSubnet(config.IPRangeCIDR)
 	checkFatal(err)
 	defaultSubnet := ipRange
@@ -464,6 +606,7 @@ func createAllocator(router *weave.NetworkRouter, config ipamConfig, db db.DB, t
 		Seed:        config.SeedPeerNames,
 		Universe:    ipRange,
 		IsObserver:  config.Observer,
+		PreClaims:   preClaims,
 		Quorum:      func() uint { return determineQuorum(config.PeerCount, router) },
 		Db:          db,
 		IsKnownPeer: isKnownPeer,
@@ -472,7 +615,9 @@ func createAllocator(router *weave.NetworkRouter, config ipamConfig, db db.DB, t

 	allocator := ipam.NewAllocator(c)

-	allocator.SetInterfaces(router.NewGossip("IPallocation", allocator))
+	gossip, err := router.NewGossip("IPallocation", allocator)
+	checkFatal(err)
+	allocator.SetInterfaces(gossip)
 	allocator.Start()
 	router.Peers.OnGC(func(peer *mesh.Peer) { allocator.PeerGone(peer.Name) })

@@ -482,7 +627,9 @@ func createAllocator(router *weave.NetworkRouter, config ipamConfig, db db.DB, t
 func createDNSServer(config dnsConfig, router *mesh.Router, isKnownPeer func(mesh.PeerName) bool) (*nameserver.Nameserver, *nameserver.DNSServer) {
 	ns := nameserver.New(router.Ourself.Peer.Name, config.Domain, isKnownPeer)
 	router.Peers.OnGC(func(peer *mesh.Peer) { ns.PeerGone(peer.Name) })
-	ns.SetGossip(router.NewGossip("nameserver", ns))
+	gossip, err := router.NewGossip("nameserver", ns)
+	checkFatal(err)
+	ns.SetGossip(gossip)
 	upstream := nameserver.NewUpstream(config.ResolvConf, config.EffectiveListenAddress)
 	dnsserver, err := nameserver.NewDNSServer(ns, config.Domain, config.ListenAddress,
 		upstream, uint32(config.TTL), config.ClientTimeout)
@@ -530,13 +677,15 @@ func determinePassword(password string) []byte {
 	return []byte(password)
 }

-func peerName(routerName string) mesh.PeerName {
+func peerName(routerName, bridgeName, dbPrefix, hostRoot string) mesh.PeerName {
 	if routerName == "" {
-		iface, err := net.InterfaceByName(weavenet.WeaveBridgeName)
-		if err != nil {
-			Log.Fatalf("Unable to find bridge %q", weavenet.WeaveBridgeName)
+		iface, err := net.InterfaceByName(bridgeName)
+		if err == nil {
+			routerName = iface.HardwareAddr.String()
+		} else {
+			routerName, err = weavenet.GetSystemPeerName(dbPrefix, hostRoot)
+			checkFatal(err)
 		}
-		routerName = iface.HardwareAddr.String()
 	}
 	name, err := mesh.PeerNameFromUserInput(routerName)
 	checkFatal(err)
@@ -7,6 +7,7 @@ import (
 )

 func TestMain(t *testing.T) {
-	weavetest.TrimTestArgs()
-	main()
+	if weavetest.TrimTestArgs() {
+		main()
+	}
 }
@@ -82,6 +82,18 @@ var metrics = []metric{
 				ch <- intGauge(desc, metrics.Flows)
 			}
 		}},
+	{desc("weave_ipam_pending_allocates", "Number of pending allocates."),
+		func(s WeaveStatus, desc *prometheus.Desc, ch chan<- prometheus.Metric) {
+			if s.IPAM != nil {
+				ch <- intGauge(desc, len(s.IPAM.PendingAllocates))
+			}
+		}},
+	{desc("weave_ipam_pending_claims", "Number of pending claims."),
+		func(s WeaveStatus, desc *prometheus.Desc, ch chan<- prometheus.Metric) {
+			if s.IPAM != nil {
+				ch <- intGauge(desc, len(s.IPAM.PendingClaims))
+			}
+		}},
 }

 func fastDPMetrics(s WeaveStatus) *weave.FastDPMetrics {
@@ -106,10 +118,10 @@ func newMetrics(router *weave.NetworkRouter, allocator *ipam.Allocator, ns *name

 func (m *collector) Collect(ch chan<- prometheus.Metric) {

-	status := WeaveStatus{"", nil,
-		weave.NewNetworkRouterStatus(m.router),
-		ipam.NewStatus(m.allocator, address.CIDR{}),
-		nameserver.NewStatus(m.ns, m.dnsserver)}
+	status := WeaveStatus{
+		Router: weave.NewNetworkRouterStatus(m.router),
+		IPAM:   ipam.NewStatus(m.allocator, address.CIDR{}),
+		DNS:    nameserver.NewStatus(m.ns, m.dnsserver)}

 	for _, metric := range metrics {
 		metric.Collect(status, metric.Desc, ch)
@@ -0,0 +1,138 @@
+package main
+
+import (
+	"net"
+	"strings"
+
+	docker "github.com/fsouza/go-dockerclient"
+
+	"github.com/weaveworks/mesh"
+	"github.com/weaveworks/weave/api"
+	"github.com/weaveworks/weave/common"
+	weavedocker "github.com/weaveworks/weave/common/docker"
+	"github.com/weaveworks/weave/ipam"
+	"github.com/weaveworks/weave/nameserver"
+	weavenet "github.com/weaveworks/weave/net"
+	"github.com/weaveworks/weave/net/address"
+)
+
+func a(cidr *net.IPNet) address.CIDR {
+	prefixLength, _ := cidr.Mask.Size()
+	return address.CIDR{Addr: address.FromIP4(cidr.IP), PrefixLen: prefixLength}
+}
+
+// Get all the existing Weave IPs at startup, so we can stop IPAM
+// giving out any as duplicates
+func findExistingAddresses(dockerCli *weavedocker.Client, bridgeName string) (addrs []ipam.PreClaim, err error) {
+	Log.Infof("Checking for pre-existing addresses on %s bridge", bridgeName)
+	// First get the address for the bridge
+	bridgeNetDev, err := weavenet.GetBridgeNetDev(bridgeName)
+	if err != nil {
+		return nil, err
+	}
+	for _, cidr := range bridgeNetDev.CIDRs {
+		Log.Infof("%s bridge has address %v", bridgeName, cidr)
+		addrs = append(addrs, ipam.PreClaim{Ident: "weave:expose", Cidr: a(cidr)})
+	}
+
+	add := func(cid string, isContainer bool, netDevs []weavenet.Dev) {
+		for _, netDev := range netDevs {
+			for _, cidr := range netDev.CIDRs {
+				Log.Infof("Found address %v for ID %s", cidr, cid)
+				addrs = append(addrs, ipam.PreClaim{Ident: cid, IsContainer: isContainer, Cidr: a(cidr)})
+			}
+		}
+	}
+
+	// Then find all veths connected to the bridge
+	peerIDs, err := weavenet.ConnectedToBridgeVethPeerIds(bridgeName)
+	if err != nil {
+		return nil, err
+	}
+
+	// Now iterate over all containers to see if they have a network
+	// namespace with an attached interface
+	if dockerCli != nil {
+		containerIDs, err := dockerCli.RunningContainerIDs()
+		if err != nil {
+			return nil, err
+		}
+
+		for _, cid := range containerIDs {
+			container, err := dockerCli.InspectContainer(cid)
+			if err != nil {
+				if _, ok := err.(*docker.NoSuchContainer); ok {
+					continue
+				}
+				return nil, err
+			}
+			if container.State.Pid != 0 {
+				netDevs, err := weavenet.GetNetDevsByVethPeerIds(container.State.Pid, peerIDs)
+				if err != nil {
+					return nil, err
+				}
+				add(cid, true, netDevs)
+			}
+		}
+	} else {
+		// If we don't have a Docker connection, iterate over all processes
+		pids, err := common.AllPids("/proc")
+		if err != nil {
+			return nil, err
+		}
+		for _, pid := range pids {
+			netDevs, err := weavenet.GetNetDevsByVethPeerIds(pid, peerIDs)
+			if err != nil {
+				return nil, err
+			}
+			add(api.NoContainerID, false, netDevs)
+		}
+	}
+	return addrs, nil
+}
+
+func populateDNS(ns *nameserver.Nameserver, dockerCli *weavedocker.Client, ourName mesh.PeerName, bridgeName string) (addrs []ipam.PreClaim, err error) {
+	// Find all veths connected to the bridge
+	peerIDs, err := weavenet.ConnectedToBridgeVethPeerIds(bridgeName)
+	if err != nil {
+		return nil, err
+	}
+
+	// Now iterate over all containers to see if they have a network
+	// namespace with an attached interface
+	if dockerCli != nil {
+		containerIDs, err := dockerCli.RunningContainerIDs()
+		if err != nil {
+			return nil, err
+		}
+
+		for _, cid := range containerIDs {
+			container, err := dockerCli.InspectContainer(cid)
+			if err != nil {
+				if _, ok := err.(*docker.NoSuchContainer); ok {
+					continue
+				}
+				return nil, err
+			}
+			if container.State.Pid != 0 {
+				// Docker allows containers to have fqdns in two wauys:
+				// where the container explicitly has a domain name, and when its
+				// hostname contains the domain name, recognized by it having dots.
+				if container.Config.Domainname == "" && !strings.Contains(container.Config.Hostname, ".") {
+					continue
+				}
+				netDevs, err := weavenet.GetNetDevsByVethPeerIds(container.State.Pid, peerIDs)
+				if err != nil {
+					return nil, err
+				}
+				fqdn := container.Config.Hostname + "." + container.Config.Domainname
+				for _, netDev := range netDevs {
+					for _, cidr := range netDev.CIDRs {
+						ns.AddEntryFQDN(fqdn, cid, ourName, address.FromIP4(cidr.IP))
+					}
+				}
+			}
+		}
+	}
+	return addrs, nil
+}