Add release v2.6.4

Only drop traffic to the Weave Net port on 127.0.0.1

CHANGELOG.md

@@ -1,3 +1,9 @@
+## Release 2.6.4
+
+Improves the iptables rule added in 2.6.3 to block just the Weave Net
+control port and avoid blocking other uses of 127.0.0.1.	#3811
+
+
 ## Release 2.6.3
 
 This release has a couple of security improvements, and some other fixes.

bin/provision_test_vms.sh

@@ -13,13 +13,6 @@ function install_terraform() {
     curl -fsS https://releases.hashicorp.com/terraform/0.11.14/terraform_0.11.14_linux_amd64.zip | gunzip >terraform && chmod +x terraform && sudo mv terraform /usr/bin
 }
 
-function install_ansible() {
-    sudo apt-get update || true
-    sudo apt-get install -qq -y python-pip python-dev libffi-dev libssl-dev \
-        && pip install --user -U setuptools cffi \
-        && pip install --user ansible
-}
-
 [ -n "$SECRET_KEY" ] || {
     echo "Cannot run smoke tests: no secret key"
     exit 1
@@ -28,7 +21,6 @@ function install_ansible() {
 source "$SRCDIR/bin/circle-env"
 
 install_terraform
-install_ansible
 
 # Only attempt to create GCP image in first container, wait for it to be created otherwise:
 [ "$CIRCLE_NODE_INDEX" != "0" ] && export CREATE_IMAGE=0

net/bridge.go

@@ -221,6 +221,7 @@ type BridgeConfig struct {
 	MTU              int
 	Mac              string
 	Port             int
+	ControlPort      string
 	NoMasqLocal      bool
 }
 
@@ -469,10 +470,17 @@ func configureIPTables(config *BridgeConfig, ips ipset.Interface) error {
 		}
 	}
 
-	// Block non-local traffic to the Weave control port
-	if err = ipt.AppendUnique("filter", "INPUT", "-p", "tcp", "--dst", "127.0.0.1", "-m", "addrtype", "!", "--src-type", "LOCAL", "-m", "conntrack", "!", "--ctstate", "RELATED,ESTABLISHED", "-j", "DROP"); err != nil {
-		return err
+	if config.ControlPort != "" {
+		if err = ipt.AppendUnique("filter", "INPUT", "-p", "tcp", "--dst", "127.0.0.1", "--dport", config.ControlPort,
+			"-m", "addrtype", "!", "--src-type", "LOCAL",
+			"-m", "conntrack", "!", "--ctstate", "RELATED,ESTABLISHED",
+			"-m", "comment", "--comment", "Block non-local access to Weave Net control port",
+			"-j", "DROP"); err != nil {
+			return err
+		}
 	}
+	// Remove the rule from Weave Net 2.6.3 which dropped too much.
+	_ = ipt.Delete("filter", "INPUT", "-p", "tcp", "--dst", "127.0.0.1", "-m", "addrtype", "!", "--src-type", "LOCAL", "-m", "conntrack", "!", "--ctstate", "RELATED,ESTABLISHED", "-j", "DROP")
 
 	if config.NPC {
 		// Steer traffic via the NPC.

prog/weaver/main.go

@@ -307,6 +307,11 @@ func main() {
 
 	bridgeConfig.Mac = name.String()
 	bridgeConfig.Port = config.Port
+	if httpAddr != "" {
+		if _, port, err := net.SplitHostPort(httpAddr); err == nil {
+			bridgeConfig.ControlPort = port
+		}
+	}
 	ips := ipset.New(common.LogLogger(), 0)
 	bridgeType, err := weavenet.EnsureBridge(procPath, &bridgeConfig, Log, ips)
 	checkFatal(err)

test/run-integration-tests.sh

@@ -66,7 +66,7 @@ function print_vars() {
 }
 
 function verify_dependencies() {
-    local deps=(python terraform ansible-playbook gcloud)
+    local deps=(python terraform gcloud)
     for dep in "${deps[@]}"; do
         if [ ! "$(which "$dep")" ]; then
             echo >&2 "$dep is not installed or not in PATH."
@@ -141,9 +141,18 @@ function wait_for_image() {
     exit 1
 }
 
+function install_ansible() {
+    sudo apt-get update || true
+    sudo apt-get install -qq -y python-pip python-dev libffi-dev libssl-dev \
+        && pip install --user -U setuptools cffi \
+        && pip install --user ansible
+}
+
 # shellcheck disable=SC2155
 function create_image() {
     if [[ "$CREATE_IMAGE" == 1 ]]; then
+        install_ansible
+
         greenly echo "> Creating GCP image $IMAGE_NAME..."
         local begin_img=$(date +%s)
         local num_hosts=1

weave

@@ -483,7 +483,7 @@ destroy_bridge() {
 
     [ -n "$DOCKER_BRIDGE_IP" ] || DOCKER_BRIDGE_IP=$(util_op bridge-ip $DOCKER_BRIDGE)
 
-    run_iptables -t filter -D INPUT -d 127.0.0.1/32 -p tcp -m addrtype ! --src-type LOCAL -m conntrack ! --ctstate RELATED,ESTABLISHED -j DROP >/dev/null 2>&1 || true
+    run_iptables -t filter -D INPUT -d 127.0.0.1/32 -p tcp --dport 6784 -m addrtype ! --src-type LOCAL -m conntrack ! --ctstate RELATED,ESTABLISHED -m comment --comment "Block non-local access to Weave Net control port" -j DROP >/dev/null 2>&1 || true
     run_iptables -t filter -D INPUT -i $DOCKER_BRIDGE -p udp --dport 53  -j ACCEPT  >/dev/null 2>&1 || true
     run_iptables -t filter -D INPUT -i $DOCKER_BRIDGE -p tcp --dport 53  -j ACCEPT  >/dev/null 2>&1 || true