levaliciousandClaude Opus 5.5
602e2da73c
The holder could tell a member's node only by source port block, so replies without ports never got back: ICMP errors (path-MTU "too big", unreachable, time exceeded), ping, and port-less protocols. Now every node pair has its own ipip tunnel (rweg-<hash of the peer>, between the two weave bridges), so the holder knows the sending node by the device a packet arrives on: - it tags each connection arriving from a peer's tunnel with that peer (connmark: peer index in the top byte, plus 0x200000), once; - replies and related ICMP errors restore the tag, and a policy rule per peer (ahead of the local table, like the port rules) routes them into that peer's tunnel, where the member node's conntrack translates them back to the member; - an arrival on one peer's tunnel whose connection another peer already holds (a port-less protocol to the same remote from two nodes) is dropped, never delivered across; - the stateless port-block rules stay, now for TCP, UDP and SCTP. Members' SNAT keeps TCP, UDP and SCTP within the node's block and puts everything else (ping, GRE, ...) on the address alone; the guard lets any protocol into the holder's tunnel and nothing anywhere else. The holder only accepts, per tunnel, the address with that node's ports. Routes in the reply tables are now read with one dump per pass instead of one per candidate table. reweave/test/egress/run.sh also checks ping from every node, that ICMP errors from routers beyond the holder reach a member (traceroute), and that ping is dropped while nobody holds the address. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UHXzGrsxfkGk8LmwrBbHNZ
Weave Net
This repository contains a fork of Weave Net, the first product developed by Weaveworks. Since Weaveworks has shut down, this repo aims to continue maintaining Weave Net, and to publish releases regularly.
The history of the fork can be found in HISTORY.md.
Using Weave Net on Kubernetes
On a newly created Kubernetes cluster, the Weave Net CNI pluging can be installed by running the following command:
kubectl apply -f https://reweave.azurewebsites.net/k8s/v1.29/net.yaml
Replace v1.29 with the version on Kubernetes on your cluster.
That endpoint is provided by the companion project weave-endpoint.
Using Weave Net in other ways
Please refer to the documentation.
Building Weave Net
Details can be found here.
Documentation status
The public documentation that used to exist in the site directory has been moved to the original/site directory. A new website directory has been created, and populated with the content of the original/site directory, rearranged and reformatted for being built with Jekyll and published to the GitHub pages site https://rajch.github.io/weave.
The documentation will now be maintained and published from the website directory exclusively.