levaliciousandClaude Opus 5.5
ee1c2f905d
images / images (push) Successful in 17m57s
- The tunnel needs an address. Reverse-path filtering (loose, as on our
nodes) rejects what arrives on a device without an IPv4 address unless
the reverse route leaves by that very device: the holder dropped every
member packet after decapsulation (ip route get: EXDEV), and a member's
node would drop the replies. reweave-eg now carries the node's bridge
address as a /32 (it never shows on the wire: the tunnel sets the outer
source itself, and what crosses it is forwarded).
- The kernel leaves out the priority attribute of a rule at 0, so the
default local rule lists as unset (-1) and moveLocalRule never found
it: it stayed at 0 beside the new one at 100, and the holder delivered
replies to its own address to itself (answering with RSTs). Unset now
counts as 0.
- install_cni_plugin copied the plugin only when weave-plugin-$VERSION was
missing, and every build of ours is "latest": nodes kept a plugin that
ignores egressAdmission, so a new member's first connection left from
its node. It is now replaced whenever its content differs (sha256),
atomically.
Also: the end-to-end manifest's non-member label is a string ("none", not
YAML's boolean no).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UHXzGrsxfkGk8LmwrBbHNZ