levaliciousandClaude Opus 5.5
685d084af7
images / images (push) Successful in 7m6s
A pod could put any source MAC or address on the wire: weave has no layer-2 anti-spoofing, so a pod with NET_RAW could pose as another pod or as a node's bridge, on its own node (local bridging never reaches the router) and, through weave, on others. That undercut every rule that trusts a source MAC or address, including the egress holder's check of which node a tunnel packet came from. The CNI plugin now locks the host side of each pod's veth with tc ingress filters: IPv4 from the pod's MAC and address, ARP speaking for exactly those (or probing from 0.0.0.0) pass; everything else is dropped before the bridge sees it. The u32 keys follow iproute2's layout for "ether src" (-8, -4) and "ip src" (12). ADD fails if the port cannot be locked, so an unlocked pod never starts. The filters go away with the veth. Pods attached before this plugin get locked by weave-init: "weaveutil lock-ports" walks libcni's result cache (each attachment's netns, interface and address) and locks their ports, leaving locked ones alone. weave-init mounts the cache and /var/run/netns read-only for it. TestPortLockInKernel (root) builds a bridge and two pods in throwaway namespaces and checks what reaches the other pod; reweave/test/portlock runs the same against a live cluster, across nodes, after checking every port is locked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UHXzGrsxfkGk8LmwrBbHNZ
72 lines
2.6 KiB
Bash
Executable File
72 lines
2.6 KiB
Bash
Executable File
#!/bin/sh
|
|
# Initialisation of Weave Net pod: check Linux settings and install CNI plugin
|
|
|
|
set -e
|
|
|
|
[ -n "$WEAVE_DEBUG" ] && set -x
|
|
|
|
modprobe_safe() {
|
|
modprobe $1 || echo "Ignore the error if \"$1\" is built-in in the kernel" >&2
|
|
}
|
|
|
|
# Check whether xt_set actually exists
|
|
xt_set_exists() {
|
|
# Clean everything up in advance, in case there's leftovers
|
|
iptables -w -F WEAVE-KUBE-TEST 2>/dev/null || true
|
|
iptables -w -X WEAVE-KUBE-TEST 2>/dev/null || true
|
|
ipset destroy weave-kube-test 2>/dev/null || true
|
|
|
|
ipset create weave-kube-test hash:ip
|
|
iptables -w -t filter -N WEAVE-KUBE-TEST
|
|
if ! iptables -w -A WEAVE-KUBE-TEST -m set --match-set weave-kube-test src -j DROP; then
|
|
NOT_EXIST=1
|
|
fi
|
|
iptables -w -F WEAVE-KUBE-TEST
|
|
iptables -w -X WEAVE-KUBE-TEST
|
|
# delay to allow kernel to clean up - see https://github.com/weaveworks/weave/issues/3847
|
|
sleep 1
|
|
ipset destroy weave-kube-test
|
|
[ -z "$NOT_EXIST" ] || (echo "\"xt_set\" does not exist" >&2 && return 1)
|
|
}
|
|
|
|
# Default for network policy
|
|
EXPECT_NPC=${EXPECT_NPC:-1}
|
|
|
|
# Ensure we have the required modules for NPC
|
|
if [ "${EXPECT_NPC}" != "0" ]; then
|
|
modprobe_safe br_netfilter
|
|
modprobe_safe xt_set
|
|
xt_set_exists
|
|
fi
|
|
|
|
# kube-proxy requires that bridged traffic passes through netfilter
|
|
if ! BRIDGE_NF_ENABLED=$(cat /proc/sys/net/bridge/bridge-nf-call-iptables); then
|
|
echo "Cannot detect bridge-nf support - network policy and iptables mode kubeproxy may not work reliably" >&2
|
|
else
|
|
if [ "$BRIDGE_NF_ENABLED" != "1" ]; then
|
|
echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables
|
|
fi
|
|
fi
|
|
|
|
# This is where we expect the manifest to map host directories
|
|
HOST_ROOT=${HOST_ROOT:-/host}
|
|
|
|
# Install CNI plugin binary to typical CNI bin location
|
|
# with fall-back to CNI directory used by kube-up on GCI OS
|
|
if ! mkdir -p $HOST_ROOT/opt/cni/bin ; then
|
|
if mkdir -p $HOST_ROOT/home/kubernetes/bin ; then
|
|
export WEAVE_CNI_PLUGIN_DIR=$HOST_ROOT/home/kubernetes/bin
|
|
else
|
|
echo "Failed to install the Weave CNI plugin" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
mkdir -p $HOST_ROOT/etc/cni/net.d
|
|
export HOST_ROOT
|
|
/home/weave/weave --local setup-cni
|
|
|
|
# Lock the ports of pods attached before the CNI plugin locked ports itself (it locks every pod it attaches from
|
|
# now on), from the runtime's record of each attachment. A port that cannot be locked stays as it was and is
|
|
# reported; weave starts regardless, since holding back the whole node's network would not make that port safer.
|
|
/usr/bin/weaveutil lock-ports "$HOST_ROOT/var/lib/cni/results" weave || echo "Some pods' ports could not be locked (see above)" >&2
|