Add release v1.9.8

Allow any non-local traffic onto the weave bridge

.ruby-version

@@ -1 +1 @@
-2.3.0
+2.3.4

CHANGELOG.md

@@ -1,3 +1,19 @@
+## Release 1.9.8
+
+Bug fixes and minor improvements
+
+* Fix weave-npc blocking NodePort and any other non-local access #3011,#3014
+* Fix bug where IPAM would duplicate a fixed IP address assigned via Docker plugin #3003,#3010
+
+[Full list of changes](https://github.com/weaveworks/weave/milestone/56?closed=1).
+
+
+## Release 1.9.7
+
+This is identical to 1.9.6 with one additional bug-fix:
+
+* weave-npc would block everything if `kubelet --hostname-override` was used #2995,#2996
+
 ## Release 1.9.6
 
 Bug fixes and minor improvements

ipam/allocator_test.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/weaveworks/weave/api"
 	"github.com/weaveworks/weave/common"
 	"github.com/weaveworks/weave/net/address"
 	"github.com/weaveworks/weave/testing/gossip"
@@ -30,6 +31,10 @@ func (alloc *Allocator) SimplyClaim(ident string, cidr address.CIDR) error {
 	return alloc.Claim(ident, cidr, true, true, returnFalse)
 }
 
+func (alloc *Allocator) AnonymousClaim(cidr address.CIDR) error {
+	return alloc.Claim(api.NoContainerID, cidr, false, true, returnFalse)
+}
+
 func TestAllocFree(t *testing.T) {
 	const (
 		container1 = "abcdef"
@@ -170,6 +175,8 @@ func TestAllocatorClaim(t *testing.T) {
 		universe   = "10.0.3.0/24"
 		testAddr1  = "10.0.3.5/24"
 		testAddr2  = "10.0.4.2/24"
+		testAddr4  = "10.0.2.3/23"
+		subnet4    = "10.0.2.0/23"
 		testPre    = "10.0.3.1/24"
 	)
 
@@ -203,6 +210,9 @@ func TestAllocatorClaim(t *testing.T) {
 	// claim for a different container should fail
 	err = alloc.SimplyClaim(container1, addr1)
 	require.Error(t, err)
+	// claim for an anonymous container, will assume it's the same one
+	err = alloc.AnonymousClaim(addr1)
+	require.NoError(t, err)
 	// claiming the address allocated on the other peer should fail
 	err = alloc.SimplyClaim(container1, address.MakeCIDR(subnet, addrx))
 	require.Error(t, err, "claiming address allocated on other peer should fail")
@@ -215,6 +225,15 @@ func TestAllocatorClaim(t *testing.T) {
 	addr2, _ := address.ParseCIDR(testAddr2)
 	err = alloc.SimplyClaim(container1, addr2)
 	require.NoError(t, err)
+	err = alloc.SimplyClaim(container3, addr2)
+	require.Error(t, err)
+	// Anonymous claim outside of our universe
+	addr4, _ := address.ParseCIDR(testAddr4)
+	subnet4cidr, _ := address.ParseCIDR(subnet4)
+	require.NoError(t, alloc.AnonymousClaim(addr4))
+	addr5, err := alloc.Allocate(api.NoContainerID, subnet4cidr, false, returnFalse)
+	require.NoError(t, err)
+	require.NotEqual(t, addr4.Start(), addr5)
 }
 
 func (alloc *Allocator) pause() func() {

ipam/claim.go

@@ -40,10 +40,29 @@ func (c *claim) Try(alloc *Allocator) bool {
 		return true
 	}
 
+	addOwned := func() {
+		if c.ident == api.NoContainerID {
+			alloc.addOwned(c.cidr.Addr.String(), c.cidr, c.isContainer)
+		} else {
+			alloc.addOwned(c.ident, c.cidr, c.isContainer)
+		}
+	}
+
 	if !alloc.ring.Contains(c.cidr.Addr) {
-		// Address not within our universe; assume user knows what they are doing
 		alloc.infof("Address %s claimed by %s - not in our range", c.cidr, c.ident)
-		alloc.addOwned(c.ident, c.cidr, c.isContainer)
+		previousOwner := alloc.findOwner(c.cidr.Addr)
+		switch {
+		case previousOwner == "":
+			addOwned()
+		case previousOwner == c.ident: // already owned by this ID
+		case c.ident == api.NoContainerID: // already owned by anonymous container
+			// do nothing (no automatic fall-through in Go)
+		case !alloc.dead[previousOwner].IsZero(): // already owned by dead container
+			alloc.removeOwned(previousOwner, c.cidr.Addr)
+			addOwned()
+		default:
+			c.sendResult(fmt.Errorf("address %s already in use by %s", c.cidr, previousOwner))
+		}
 		c.sendResult(nil)
 		return true
 	}
@@ -85,11 +104,7 @@ func (c *claim) Try(alloc *Allocator) bool {
 		// Unused address, we try to claim it:
 		if err := alloc.space.Claim(c.cidr.Addr); err == nil {
 			alloc.debugln("Claimed", c.cidr, "for", c.ident)
-			if c.ident == api.NoContainerID {
+			addOwned()
-				alloc.addOwned(c.cidr.Addr.String(), c.cidr, c.isContainer)
-			} else {
-				alloc.addOwned(c.ident, c.cidr, c.isContainer)
-			}
 			c.sendResult(nil)
 		} else {
 			c.sendResult(err)

prog/weave-kube/weave-daemonset-k8s-1.6.yaml

@@ -92,6 +92,12 @@ spec:
               cpu: 10m
           securityContext:
             privileged: true
+          env:
+          - name: HOSTNAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: spec.nodeName
       restartPolicy: Always
       tolerations:
       - key: node-role.kubernetes.io/master

prog/weave-kube/weave-daemonset.yaml

@@ -59,6 +59,12 @@ spec:
               cpu: 10m
           securityContext:
             privileged: true
+          env:
+          - name: HOSTNAME
+            valueFrom:
+              fieldRef:
+                apiVersion: v1
+                fieldPath: spec.nodeName
       restartPolicy: Always
       volumes:
         - name: weavedb

prog/weave-npc/main.go

@@ -117,7 +117,6 @@ func createBaseRules(ipt *iptables.IPTables, ips ipset.Interface) error {
 		return err
 	}
 	if err := ipt.Append(npc.TableFilter, npc.MainChain,
-		"-m", "set", "--match-set", npc.LocalIpset, "src",
 		"-m", "set", "!", "--match-set", npc.LocalIpset, "dst", "-j", "ACCEPT"); err != nil {
 		return err
 	}

site/plugin/plugin-how-it-works.md

@@ -23,7 +23,7 @@ If you do create additional networks using the `weavemesh` driver, containers at
 
 There's no specific documentation from Docker on using a cluster
 store, but the first part of
-[Getting Started with Docker Multi-host Networking](https://github.com/docker/docker/blob/master/docs/userguide/networking/get-started-overlay.md) is a good place to start.
+[Getting Started with Docker Multi-host Networking](https://docs.docker.com/engine/userguide/networking/get-started-overlay/) is a good place to start.
 
 >**Note:** In the case of multiple networks using the `weave` driver, all containers are on the same virtual network but Docker allocates their addresses on different subnets so they cannot talk to each other directly.
 

test/run_all.sh

@@ -23,4 +23,4 @@ if [ -n "$CIRCLECI" -o -n "$PARALLEL" ]; then
     RUNNER_ARGS="$RUNNER_ARGS -parallel"
 fi
 
-HOSTS="$HOSTS" "${DIR}/../tools/runner/runner" $RUNNER_ARGS $TESTS
+HOSTS="$HOSTS" "${DIR}/../tools/runner/runner" -timeout=240 $RUNNER_ARGS $TESTS