Update test.sh with coveralls job inclusion

This change fixes glide.yaml: track on cni's subpackage change and
some error about bytes package. With this change, verified that
'glide up' works without any error.

.travis.yml

@@ -3,15 +3,19 @@ language: go
 # for the detail
 # sudo: requried
 dist: trusty
+env:
+  global:
+    - REGISTRY_USER=nfvperobot
+    - secure: "LnQV09sy5nfrJd0PKAbxYPdKJ5QtLECofsunYfVk7tFp+ivKyZBXHwi4V4aGFuB2SqCnpauXBRTLet8hrfm5kN9ZZQRqy0WNs/fJHdFC6YKOKwyCQwczFb1by/iTX68dxWc2nK9+Opi6s/81Bh5yb3Oquqzdk+OEgaQHz2KP7BwI4yDrobinBR5laJ4KdxZJYgYx4mP6uUPxj7UZww+HaWqyiGy8cAeK3L81sGjxXJIYTRRfG1J4pifI5A3c3IOJRID0pvifgUIsQXp5MHpx+nxmhRJ7KMBLeNkUKruLTEsufgGCvhY5eWpdBhVN2YefGTqlKBCtKEqRUPlLbP5eJGUdY1PlUMUnQsr+FRWAZz90A1TESOZXZqDs4xR1ox1wX7mBUeelViXvUfLQB9sOD8G86FkXqNTqx/thp3x0Dqgy44pL+12Y3k5xVZmIsWDSpGmmIe1jOCsoL26Fdic+dTO/l3mx3KP1+gPNqbScuJsccLyPsr96uFCBCPJ2mSy7nCqb01KZTbbkIvv6oOCQ+Mfq8MT9lkxf6FJ+K+7vVbcgshOGhqA/l1UO3rKxnGt8Rkj/5XoHkcjXjM6YzT5LvljVWszJGXeTQxGjcsPrK2AscyX7JvNp/AMElII/Hxm6P0NESfV0whrZHyVOaqIRrbhUsK9j4YP8IMFoI4qYp4g="
 
 before_install:
   - sudo apt-get update -qq
+  - go get github.com/mattn/goveralls
 
 install:
   # workaround golint install error in https://github.com/golang/lint/issues/288
   - mkdir -p $GOPATH/src/golang.org/x
   - pushd $GOPATH/src/golang.org/x
-  - git clone https://github.com/golang/tools.git
   - git clone https://github.com/golang/lint.git
   - go get github.com/golang/lint/golint
   - popd
@@ -24,8 +28,11 @@ before_script:
 
 script:
   - ./build
+  - sudo ./test.sh
+  - $GOPATH/bin/goveralls  -coverprofile=coverage.out -service=travis-ci
   - mkdir -p ${TRAVIS_BUILD_DIR}/dist
   - tar cvfz ${TRAVIS_BUILD_DIR}/dist/multus-cni_amd64.tar.gz --warning=no-file-changed --exclude="dist" --exclude="vendor" .
+  - docker build -t nfvpe/multus -f ./images/Dockerfile .
 
 before_deploy:
   - go get -u github.com/laher/goxc
@@ -33,16 +40,28 @@ before_deploy:
   - goxc -d=$TRAVIS_BUILD_DIR/dist -pv=$TRAVIS_TAG -bc=linux -tasks=clean-destination,xc,archive,rmbin
 
 deploy:
-  provider: releases
-  api_key:
-    secure: "iy7eqzXNvb/juc+5eVPQ/pFYDTCqDt8Zjt63n+zEK856Qzr2aEZwwOguMWs78XFDMFXagCs5PRTvtvZz8apoTfHX7Wkss3kRyEziAkuldQbH5yGDvpGyHsGBw78N95hauMoogefE7NuuLG3qRSWPeVz8RAKGhP7ADwEVyyfQKKYdum3Bqrz0D89HqKbCQqs3eZae7ppDIler3lab9WAQGuKNJ2HL6mqREVe48kb8sdsuSr+yV4qwVrBDNhXxQDxAT6LYuMXbknE7qTde2vViP13ZHpptbuZqiZG2ytzReIIs/iC9AWoIQXr3XTXl9z8fqlC3VljPCikBWVcmxDFA2aANYzx3M/7fMOO/DniwNhlZc9+pYfAkUrpoQPfPOWNqf45Qz0jP3wk49xy5hxEqe/rfmo5lipSsqeUsk+j3pT8kjVIAnDLrQpxSx7xwnijPLgtm34UwROVowfwLlOhE/7mUOFCbYlzEo3CKvjDN3Kmn35yHEueuu//Gv5jesVYvgcNPBHqaTKb5AXVTqymNBtA43PchLJ8gCC1mNukzSZifQP996vzbV5c9AxzBLjWbiDJ3lOFIpNhF8Sed0m0C0RylrTXHTX5TSrlMdXXffzYwbjJ96J+cFPBTpJNfSn+3N7hiart1r1k1bSXoPqYW4+94M8E1eZ5LjszoeiZbRrI="
-  file_glob: true
-  file: "$TRAVIS_BUILD_DIR/dist/*/*.gz"
-  skip_cleanup: true
-  on:
-    tags: true
-    all_branches: true
-    condition: "$TRAVIS_TAG =~ ^v[0-9].*$"
+  - provider: releases
+    api_key:
+      secure: "iy7eqzXNvb/juc+5eVPQ/pFYDTCqDt8Zjt63n+zEK856Qzr2aEZwwOguMWs78XFDMFXagCs5PRTvtvZz8apoTfHX7Wkss3kRyEziAkuldQbH5yGDvpGyHsGBw78N95hauMoogefE7NuuLG3qRSWPeVz8RAKGhP7ADwEVyyfQKKYdum3Bqrz0D89HqKbCQqs3eZae7ppDIler3lab9WAQGuKNJ2HL6mqREVe48kb8sdsuSr+yV4qwVrBDNhXxQDxAT6LYuMXbknE7qTde2vViP13ZHpptbuZqiZG2ytzReIIs/iC9AWoIQXr3XTXl9z8fqlC3VljPCikBWVcmxDFA2aANYzx3M/7fMOO/DniwNhlZc9+pYfAkUrpoQPfPOWNqf45Qz0jP3wk49xy5hxEqe/rfmo5lipSsqeUsk+j3pT8kjVIAnDLrQpxSx7xwnijPLgtm34UwROVowfwLlOhE/7mUOFCbYlzEo3CKvjDN3Kmn35yHEueuu//Gv5jesVYvgcNPBHqaTKb5AXVTqymNBtA43PchLJ8gCC1mNukzSZifQP996vzbV5c9AxzBLjWbiDJ3lOFIpNhF8Sed0m0C0RylrTXHTX5TSrlMdXXffzYwbjJ96J+cFPBTpJNfSn+3N7hiart1r1k1bSXoPqYW4+94M8E1eZ5LjszoeiZbRrI="
+    file_glob: true
+    file: "$TRAVIS_BUILD_DIR/dist/*/*.gz"
+    skip_cleanup: true
+    on:
+      tags: true
+      all_branches: true
+      condition: "$TRAVIS_TAG =~ ^v[0-9].*$"
+  # Push images to Dockerhub
+  - provider: script
+    script: >
+      bash -c '
+      docker tag nfvpe/multus nfvpe/multus:$TRAVIS_TAG;
+      docker login -u "$REGISTRY_USER" -p "$REGISTRY_PASS"; 
+      docker push nfvpe/multus; 
+      docker push nfvpe/multus:$TRAVIS_TAG'
+    on:
+      tags: true
+      all_branches: true
+      condition: "$TRAVIS_TAG =~ ^v[0-9].*$"
 
 after_success:
   # put build tgz to bintray

README.md

@@ -1,18 +1,21 @@
 ![multus-cni Logo](https://github.com/intel/multus-cni/blob/master/doc/images/Multus.png)
 
+[![Travis CI](https://travis-ci.org/intel/multus-cni.svg?branch=master)](https://travis-ci.org/intel/multus-cni/builds)[![Coverage Status](https://coveralls.io/repos/github/intel/multus-cni/badge.svg?branch=master)](https://coveralls.io/github/intel/multus-cni?branch=master)[![Go Report Card](https://goreportcard.com/badge/github.com/intel/multus-cni)](https://goreportcard.com/report/github.com/intel/multus-cni)
+
    * [MULTUS CNI plugin](#multus-cni-plugin)
+      * [Quickstart Guide](#quickstart-guide)
       * [Multi-Homed pod](#multi-homed-pod)
-      * [Build](#build)
+      * [Building from source](#building-from-source)
       * [Work flow](#work-flow)
       * [Usage with Kubernetes CRD based network objects](#usage-with-kubernetes-crd-based-network-objects)
          * [Creating "Network" resources in Kubernetes](#creating-network-resources-in-kubernetes)
             * [<strong>CRD based Network objects</strong>](#crd-based-network-objects)
-         * [Creating network resources in Kubernetes](#creating-network-resources-in-kubernetes-1)
          * [Configuring Multus to use the kubeconfig](#configuring-multus-to-use-the-kubeconfig)
          * [Configuring Multus to use kubeconfig and a default network](#configuring-multus-to-use-kubeconfig-and-a-default-network)
          * [Configuring Pod to use the CRD network objects](#configuring-pod-to-use-the-crd-network-objects)
          * [Verifying Pod network interfaces](#verifying-pod-network-interfaces)
       * [Using with Multus conf file](#using-with-multus-conf-file)
+      * [Logging Options](#logging-options)
       * [Testing Multus CNI](#testing-multus-cni)
          * [Multiple flannel networks](#multiple-flannel-networks)
             * [Configure Kubernetes with CNI](#configure-kubernetes-with-cni)
@@ -33,6 +36,70 @@
 
 Please check the [CNI](https://github.com/containernetworking/cni) documentation for more information on container networking.
 
+# Quickstart Guide
+
+Multus may be deployed as a Daemonset, and is provided in this guide along with Flannel. Flannel is deployed as a pod-to-pod network that is used as our "default network". Each network attachment is made in addition to this default network.
+
+Firstly, clone this GitHub repository. We'll apply files to `kubectl` from this repo.
+
+We apply these files as such:
+
+```
+$ cat ./images/{multus-daemonset.yml,flannel-daemonset.yml} | kubectl apply -f -
+```
+
+Create a CNI configuration loaded as a CRD object, in this case a macvlan CNI configuration is defined. You may replace the `config` field with any valid CNI configuration where the CNI binary is available on the nodes.
+
+```
+cat <<EOF | kubectl create -f -
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
+metadata:
+  name: macvlan-conf
+spec: 
+  config: '{
+      "cniVersion": "0.3.0",
+      "type": "macvlan",
+      "master": "eth0",
+      "mode": "bridge",
+      "ipam": {
+        "type": "host-local",
+        "subnet": "192.168.1.0/24",
+        "rangeStart": "192.168.1.200",
+        "rangeEnd": "192.168.1.216",
+        "routes": [
+          { "dst": "0.0.0.0/0" }
+        ],
+        "gateway": "192.168.1.1"
+      }
+    }'
+EOF
+```
+
+You may then create a pod which attached this additional interface, where the annotation correlates to the `name` in the `NetworkAttachmentDefinition` above.
+
+```
+cat <<EOF | kubectl create -f -
+apiVersion: v1
+kind: Pod
+metadata:
+  name: samplepod
+  annotations:
+    k8s.v1.cni.cncf.io/networks: macvlan-conf
+spec:
+  containers:
+  - name: samplepod
+    command: ["/bin/bash", "-c", "sleep 2000000000000"]
+    image: dougbtv/centos-network
+EOF
+```
+
+You may now inspect the pod and see that there is an additional interface configured, like so:
+
+```
+$ kubectl exec -it samplepod -- ip a
+```
+
 # Kubernetes Network Custom Resource Definition De-facto Standard - Reference implementation
 
 * This project is a reference implementation for Kubernetes Network Custom Resource Definition De-facto Standard. For more information refer [Network Plumbing Working Group Agenda](https://docs.google.com/document/d/1oE93V3SgOGWJ4O1zeD1UmpeToa0ZiiO6LqRAmZBPFWM/edit)
@@ -43,25 +110,27 @@ Please check the [CNI](https://github.com/containernetworking/cni) documentation
    * CNI configuration stored in on-disk file
    > refer the section 3.2 Network Object Definition for more details in Kubernetes Network Custom Resource Definition De-facto Standard
 * Refer the reference implemenation presentation and demo details - [link](https://docs.google.com/presentation/d/1dbCin6MnhK-BjjcVun5YiPTL99VA2uSiyWAtWAPNlIc/edit?usp=sharing)
-* Release version from v2.0 is not compatible with v1.1 and v1.2 network CRD specifications.
+* Release version from v2.0 is not compatible with v1.1 and v1.2 network CRD 
+  * [MULTUS CNI plugin](#multus-cni-plugin)specifications.
 
 ## Multi-Homed pod
 <p align="center">
    <img src="doc/images/multus_cni_pod.png" width="1008" />
 </p>
 
-## Build
+## Building from source
 
-**This plugin requires Go 1.8 to build.**
+**This plugin requires Go 1.8 (or later) to build.**
 
-Go 1.5 users will need to set GO15VENDOREXPERIMENT=1 to get vendored dependencies. This flag is set by default in 1.6.
 ```
 #./build
 ```
+
 ## Work flow
 <p align="center">
    <img src="doc/images/workflow.png" width="1008" />
 </p>
+
 ## Network configuration reference
 
 - name (string, required): the name of the network
@@ -79,89 +148,32 @@ Kubelet is responsible for establishing network interfaces for pods; it does thi
 
 ### Creating &quot;Network&quot; resources in Kubernetes
 
-Multus is compatible to work with both CRD and TPR(deprecated in K8s 1.7).
+You may wish to create the `network-attachment-definition` manually if you haven't installed using the daemonset technique, which includes the CRD, and you can verify if it's loaded with `kubectl get crd` and look for the presence of `network-attachment-definition`.
 
-##### **CRD based Network objects**
-
-1. Create a Custom Resource Definition &quot;crdnetwork.yaml&quot; for the network object as shown below:
+1. Create a Custom Resource Definition (CRD) `crdnetwork.yaml`; for the network object using the YAML from the examples directory.
 
 ```
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  # name must match the spec fields below, and be in the form: <plural>.<group>
-  name: networks.kubernetes.cni.cncf.io
-spec:
-  # group name to use for REST API: /apis/<group>/<version>
-  group: kubernetes.cni.cncf.io
-  # version name to use for REST API: /apis/<group>/<version>
-  version: v1
-  # either Namespaced or Cluster
-  scope: Namespaced
-  names:
-    # plural name to be used in the URL: /apis/<group>/<version>/<plural>
-    plural: networks
-    # singular name to be used as an alias on the CLI and for display
-    singular: network
-    # kind is normally the CamelCased singular type. Your resource manifests use this.
-    kind: Network
-    # shortNames allow shorter string to match your resource on the CLI
-    shortNames:
-    - net
-```
-2. Run kubectl create command for the Custom Resource Definition
-```
-# kubectl create -f ./crdnetwork.yaml
-customresourcedefinition "networks.kubernetes.cni.cncf.io" created
+$ kubectl create -f ./examples/crd.yml
+customresourcedefinition.apiextensions.k8s.io/network-attachment-definitions.k8s.cni.cncf.io created
 ```
+
 3. Run kubectl get command to check the Network CRD creation
+
 ```
-# kubectl get CustomResourceDefinition
+$ kubectl get crd
 NAME                      KIND
-networks.kubernetes.cni.cncf.io   CustomResourceDefinition.v1beta1.apiextensions.k8s.io
-```
-For Kubernetes v1.7 and above use CRD to create network object. For version older than 1.7 use TPR based objects as shown below: 
-
-Note: Both TPR and CRD will have same selfLink : 
-
-*/apis/kubernetes.cni.cncf.io/v1/namespaces/default/networks/*
-
-
-#### TPR based Network objects
-
-1. Create a Third Party Resource &quot;tprnetwork.yaml&quot; for the network object as shown below:
-
-```
-apiVersion: extensions/v1beta1
-kind: ThirdPartyResource
-metadata:
-  name: network.kubernetes.cni.cncf.io
-description: "A specification of a Network obj in the kubernetes"
-versions:
-- name: v1
+network-attachment-definitions.k8s.cni.cncf.io   CustomResourceDefinition.v1beta1.apiextensions.k8s.io
 ```
 
-2. Run kubectl create command for the Third Party Resource
+### Creating CRD network resources in Kubernetes
 
-```
-# kubectl create -f ./tprnetwork.yaml
-thirdpartyresource "network.kubernetes.cni.cncf.io" created
-```
-3. Run kubectl get command to check the Network TPR creation
-```
-# kubectl get thirdpartyresource
-NAME                     DESCRIPTION                                          VERSION(S)
-network.kubernetes.cni.cncf.io   A specification of a Network obj in the kubernetes   v1
-```
-### Creating network resources in Kubernetes
-
-1. After creating CRD network object you can create network resources in Kubernetes. These network resources may contain additional underlying CNI plugin parameters given in JSON format. In the following example shown below the args field contains parameters that will be passed into “flannel” plugin.
+1. After creating CRD network object you can create network resources in Kubernetes. These network resources may contain additional underlying CNI plugin parameters given in JSON format. In the following example shown below the args field contains parameters that will be passed into Flannel plugin.
 
 2. Save the following YAML to flannel-network.yaml
 
 ```
-apiVersion: "kubernetes.cni.cncf.io/v1"
-kind: Network
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
 metadata:
   name: flannel-networkobj
 spec: 
@@ -177,18 +189,19 @@ spec:
 3. Create the custom resource definition
 
 ```
-# kubectl create -f customCRD/flannel-network.yaml
+$ kubectl create -f ./flannel-network.yaml
 network "flannel-networkobj" created
-```
-```
-# kubectl get network
+
+$ kubectl get net-attach-def
 NAME                         AGE
 flannel-networkobj           26s
 ```
+
 4. Get the custom network object details
+
 ```
-apiVersion: kubernetes.cni.cncf.io/v1
-kind: Network
+apiVersion: k8s.cni.cncf.io/v1
+kind: NetworkAttachmentDefinition
 metadata:
   clusterName: ""
   creationTimestamp: 2018-05-17T09:13:20Z
@@ -198,16 +211,18 @@ metadata:
   name: flannel-networkobj
   namespace: default
   resourceVersion: "21176114"
-  selfLink: /apis/kubernetes.cni.cncf.io/v1/namespaces/default/networks/flannel-networkobj
+  selfLink: /apis/k8s.cni.cncf.io/v1/namespaces/default/networks/flannel-networkobj
   uid: 8ac8f873-59b2-11e8-8308-a4bf01024e6f
 spec:
   config: '{ "cniVersion": "0.3.0", "type": "flannel", "delegate": { "isDefaultGateway":
     true } }'
 ```
+
 5. Save the following YAML to sriov-network.yaml to creating sriov network object. ( Refer to [Intel - SR-IOV CNI](https://github.com/Intel-Corp/sriov-cni) or contact @kural in [Intel-Corp Slack](https://intel-corp.herokuapp.com/) for running the DPDK based workloads in Kubernetes)
+
 ```
-apiVersion: "kubernetes.cni.cncf.io/v1"
-kind: Network
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
 metadata:
   name: sriov-conf
 spec:
@@ -226,11 +241,12 @@ spec:
     }
   }'
 ```
+
 6. Likewise save the following YAML to sriov-vlanid-l2enable-network.yaml to create another sriov based network object:
 
 ```
-apiVersion: "kubernetes.cni.cncf.io/v1"
-kind: Network
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
 metadata:
   name: sriov-vlanid-l2enable-conf
 spec:
@@ -241,18 +257,24 @@ spec:
     "l2enable": true
   }'
 ```
+
 7. Follow step 3 above to create &quot;sriov-vlanid-l2enable-conf&quot; and &quot;sriov-conf&quot; network objects
+
 8. View network objects using kubectl
+
 ```
-# kubectl get network
+# kubectl get net-attach-def
 NAME                         AGE
 flannel-networkobj           29m
 sriov-conf                   6m
 sriov-vlanid-l2enable-conf   2m
 
 ```
+
 ### Configuring Multus to use the kubeconfig
-1. Create a Mutlus CNI configuration file on each Kubernetes node. This file should be created in: /etc/cni/net.d/multus-cni.conf with the content shown below. Use only the absolute path to point to the kubeconfig file (as it may change depending upon your cluster env). We are assuming all CNI plugin binaries are default location (`\opt\cni\bin dir`)
+
+1. Create a Mutlus CNI configuration file on each Kubernetes node. This file should be created in: /etc/cni/net.d/multus-cni.conf with the content shown below. Use only the absolute path to point to the kubeconfig file (as it may change depending upon your cluster env). We are assuming all CNI plugin binaries are default location (`/opt/cni/bin dir`)
+
 ```
 {
     "name": "node-cni-network",
@@ -260,10 +282,7 @@ sriov-vlanid-l2enable-conf   2m
     "kubeconfig": "/etc/kubernetes/node-kubeconfig.yaml"
 }
 ```
-2. Restart kubelet service
-```
-# systemctl restart kubelet
-```
+
 ### Configuring Multus to use kubeconfig and a default network
 
 1. Many users want Kubernetes default networking feature along with network objects. Refer to issues [#14](https://github.com/intel/multus-cni/issues/14) &amp; [#17](https://github.com/intel/multus-cni/issues/17) for more information. In the following Multus configuration, Weave act as the default network in the absence of network field in the pod metadata annotation.
@@ -275,16 +294,12 @@ sriov-vlanid-l2enable-conf   2m
     "kubeconfig": "/etc/kubernetes/node-kubeconfig.yaml",
     "delegates": [{
         "type": "weave-net",
-        "hairpinMode": true,
-        "masterplugin": true
+        "hairpinMode": true
     }]
 }
 ```
-2. Restart kubelet service
 
-```
-# systemctl restart kubelet
-```
+Configurations referenced in annotations are created in addition to the default network.
 
 ### Configuring Pod to use the CRD network objects
 
@@ -296,7 +311,7 @@ kind: Pod
 metadata:
   name: multus-multi-net-poc
   annotations:
-    kubernetes.v1.cni.cncf.io/networks: '[
+    k8s.v1.cni.cncf.io/networks: '[
             { "name": "flannel-conf" },
             { "name": "sriov-conf" },
             { "name": "sriov-vlanid-l2enable-conf",
@@ -328,7 +343,8 @@ multus-multi-net-poc   1/1       Running   0          30s
 
 ### Verifying Pod network interfaces
 
-1. Run &quot;ifconfig&quot; command in Pod:
+1. Run `ifconfig` command in Pod:
+
 ```
 # kubectl exec -it multus-multi-net-poc -- ifconfig       
 eth0      Link encap:Ethernet  HWaddr C6:43:7C:09:B4:9C
@@ -374,6 +390,7 @@ north     Link encap:Ethernet  HWaddr BE:F2:48:42:83:12
           collisions:0 txqueuelen:1000 
           RX bytes:95956 (93.7 KiB)  TX bytes:82200 (80.2 KiB)
 ```
+
 | Interface name | Description |
 | --- | --- |
 | lo | loopback |
@@ -434,7 +451,6 @@ Given the following network configuration:
         },
         {
                 "type": "flannel",
-                "masterplugin": true,
                 "delegate": {
                         "isDefaultGateway": true
                 }
@@ -444,6 +460,38 @@ Given the following network configuration:
 EOF
 ```
 
+## Logging Options
+
+You may wish to enable some enhanced logging for Multus, especially during the process where you're configuring Multus and need to understand what is or isn't working with your particular configuration. 
+
+Multus will always log via `STDERR`, which is the standard method by which CNI plugins communicate errors, and these errors are logged by the Kubelet. This method is always enabled.
+
+### Writing to a Log File
+
+Optionally, you may have Multus log to a file on the filesystem. This file will be written locally on each node where Multus is executed. You may configure this via the `LogFile` option in the CNI configuration. By default this additional logging to a flat file is disabled.
+
+For example in your CNI configuration, you may set:
+
+```
+    "LogFile": "/var/log/multus.log",
+```
+
+### Logging Level
+
+The default logging level is set as `panic` -- this will log only the most critical errors, and is the least verbose logging level.
+
+The available logging level values, in descreasing order of verbosity are:
+
+* `debug`
+* `error`
+* `panic`
+
+You may configure the logging level by using the `LogLevel` option in your CNI configuration. For example:
+
+```
+    "LogLevel": "debug",
+```
+
 ## Testing Multus CNI
 
 ### Multiple flannel networks
@@ -453,7 +501,8 @@ Github user [YYGCui](https://github.com/YYGCui) has used multiple flannel networ
 Make sure that the multus, [sriov](https://github.com/Intel-Corp/sriov-cni), [flannel](https://github.com/containernetworking/cni/blob/master/Documentation/flannel.md), and [ptp](https://github.com/containernetworking/cni/blob/master/Documentation/ptp.md) binaries are in the /opt/cni/bin directories and follow the steps as mentioned in the [CNI](https://github.com/containernetworking/cni/#running-a-docker-container-with-network-namespace-set-up-by-cni-plugins)
 
 #### Configure Kubernetes with CNI
-Kubelet must be configured to run with the CNI network plugin. Edit /etc/kubernetes/kubelet file and add "--network-plugin=cni" flags in KUBELET\_OPTS as shown below:
+
+Kubelet must be configured to run with the CNI network plugin. Edit `/etc/kubernetes/kubelet` file and add `--network-plugin=cni` flags in `KUBELET\_OPTS `as shown below:
 
 ```
 KUBELET_OPTS="...
@@ -461,22 +510,19 @@ KUBELET_OPTS="...
 --network-plugin=cni
 "
 ```
+
 Refer to the Kubernetes User Guide and network plugin for more information.
 - [Single Node](https://kubernetes.io/docs/getting-started-guides/fedora/fedora_manual_config/)
 - [Multi Node](https://kubernetes.io/docs/getting-started-guides/fedora/flannel_multi_node_cluster/)
 - [Network plugin](https://kubernetes.io/docs/admin/network-plugins/)
 
-Restart kubelet:
-```
-# systemctl restart kubelet.service
-```
 #### Launching workloads in Kubernetes
 
 With Multus CNI configured as described in sections above each workload launched via a Kubernetes Pod will have multiple network interfacesLaunch the workload using yaml file in the kubernetes master, with above configuration in the multus CNI, each pod should have multiple interfaces.
 
-Note: To verify whether Multus CNI plugin is working correctly, create a pod containing one &quot;busybox&quot; container and execute &quot;ip link&quot; command to check if interfaces management follows configuration.
+Note: To verify whether Multus CNI plugin is working correctly, create a pod containing one `busybox` container and execute `ip link` command to check if interfaces management follows configuration.
 
-1. Create &quot;multus-test.yaml&quot; file containing below configuration. Created pod will consist of one &quot;busybox&quot; container running &quot;top&quot; command.
+1. Create `multus-test.yaml` file containing below configuration. Created pod will consist of one `busybox` container running `top` command.
 
 ```
 apiVersion: v1
@@ -493,12 +539,14 @@ spec:  # specification of the pod's contents
     tty: true
 
 ```
+
 2. Create pod using command:
 
 ```
 # kubectl create -f multus-test.yaml
 pod "multus-test" created
 ```
+
 3. Run &quot;ip link&quot; command inside the container:
 
 ```
@@ -554,5 +602,7 @@ pod "multus-test" created
 - Feel free to [submit](https://github.com/Intel-Corp/multus-cni/issues/new) an issue
 
 Please fill in the Questions/feedback - [google-form](https://goo.gl/forms/upBWyGs8Wmq69IEi2)!
+
 ## Contacts
 For any questions about Multus CNI, please reach out on github issue or feel free to contact the developer @kural in our [Intel-Corp Slack](https://intel-corp.herokuapp.com/)
+

examples/README.md

@@ -12,7 +12,7 @@ More specifically, these examples show:
 
 * Multus configured, using CNI a `.conf` file, with CRD support, specifying that we will use a "default network".
 * A resource definition with a daemonset that places the `.conf` on each node in the cluster.
-* A CRD definining the "networks" @ `networks.kubernetes.cni.cncf.io` 
+* A CRD definining the "networks" @ `network-attachment-definitions.k8s.cni.cncf.io` 
 * CRD objects containing the configuration for both Flannel & macvlan.
 
 ## Quick-start instructions

examples/crd.yml

@@ -1,22 +1,21 @@
 apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
-  # name must match the spec fields below, and be in the form: <plural>.<group>
-  name: networks.kubernetes.cni.cncf.io
+  name: network-attachment-definitions.k8s.cni.cncf.io
 spec:
-  # group name to use for REST API: /apis/<group>/<version>
-  group: kubernetes.cni.cncf.io
-  # version name to use for REST API: /apis/<group>/<version>
+  group: k8s.cni.cncf.io
   version: v1
-  # either Namespaced or Cluster
   scope: Namespaced
   names:
-    # plural name to be used in the URL: /apis/<group>/<version>/<plural>
-    plural: networks
-    # singular name to be used as an alias on the CLI and for display
-    singular: network
-    # kind is normally the CamelCased singular type. Your resource manifests use this.
-    kind: Network
-    # shortNames allow shorter string to match your resource on the CLI
+    plural: network-attachment-definitions
+    singular: network-attachment-definition
+    kind: NetworkAttachmentDefinition
     shortNames:
-    - net
+    - net-attach-def
+  validation:
+    openAPIV3Schema:
+      properties:
+        spec:
+          properties:
+            config:
+                 type: string

examples/flannel-conf.yml

@@ -1,5 +1,5 @@
-apiVersion: "kubernetes.cni.cncf.io/v1"
-kind: Network
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
 metadata:
   name: flannel-conf
 spec: 
@@ -9,4 +9,4 @@ spec:
     "delegate": {
       "isDefaultGateway": true
     }
-  }'
+  }'

examples/macvlan-conf.yml

@@ -1,5 +1,5 @@
-apiVersion: "kubernetes.cni.cncf.io/v1"
-kind: Network
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
 metadata:
   name: macvlan-conf
 spec: 
@@ -18,4 +18,4 @@ spec:
         ],
         "gateway": "192.168.1.1"
       }
-    }'
+    }'

examples/npwg-demo-1/04_macvlan1.yml

@@ -1,6 +1,6 @@
 ---
-apiVersion: "kubernetes.cni.cncf.io/v1"
-kind: Network
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
 metadata:
   name: macvlan-conf-1
 spec: 
@@ -17,8 +17,8 @@ spec:
             }
         }'
 ---
-apiVersion: "kubernetes.cni.cncf.io/v1"
-kind: Network
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
 metadata:
   name: macvlan-conf-2
 spec: 
@@ -35,8 +35,8 @@ spec:
             }
         }'
 ---
-apiVersion: "kubernetes.cni.cncf.io/v1"
-kind: Network
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
 metadata:
   name: macvlan-conf-3
 spec: 
@@ -53,8 +53,8 @@ spec:
             }
         }'
 ---
-apiVersion: "kubernetes.cni.cncf.io/v1"
-kind: Network
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
 metadata:
   name: macvlan-conf-4
 spec: 

examples/npwg-demo-1/05_vlan1.yml

@@ -1,6 +1,6 @@
 ---
-apiVersion: "kubernetes.cni.cncf.io/v1"
-kind: Network
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
 metadata:
   name: vlan-conf-1-1
   namespace: testns1

examples/npwg-demo-1/07_ptp_tuning_conflist.yml

@@ -0,0 +1,30 @@
+---
+apiVersion: "k8s.cni.cncf.io/v1"
+kind: NetworkAttachmentDefinition
+metadata:
+  name: ptp-tuning-conflist
+spec: 
+  config: '{
+	"cniVersion": "0.3.1",
+	"name": "ptp-tuning-conflist",
+	"plugins": [{
+			"type": "ptp",
+			"ipMasq": true,
+			"mtu": 512,
+			"ipam": {
+				"type": "host-local",
+				"subnet": "172.16.0.0/24"
+			},
+			"dns": {
+				"nameservers": ["172.16.1.1"]
+			}
+		},
+		{
+			"name": "mytuning",
+			"type": "tuning",
+			"sysctl": {
+				"net.core.somaxconn": "500"
+			}
+		}
+	]
+}'

examples/npwg-demo-1/11_pod_case1.yml

@@ -4,7 +4,7 @@ kind: Pod
 metadata:
   name: pod-case-01
   annotations:
-    kubernetes.v1.cni.cncf.io/networks: macvlan-conf-1
+    k8s.v1.cni.cncf.io/networks: macvlan-conf-1
 spec:
   containers:
   - name: pod-case-01

examples/npwg-demo-1/12_pod_case2.yml

@@ -4,7 +4,7 @@ kind: Pod
 metadata:
   name: pod-case-02
   annotations:
-    kubernetes.v1.cni.cncf.io/networks: '[
+    k8s.v1.cni.cncf.io/networks: '[
             { "name": "macvlan-conf-2" },
             { "name": "vlan-conf-1-1",
               "namespace": "testns1",

examples/npwg-demo-1/13_pod_case3.yml

@@ -4,7 +4,7 @@ kind: Pod
 metadata:
   name: pod-case-03
   annotations:
-    kubernetes.v1.cni.cncf.io/networks: '[
+    k8s.v1.cni.cncf.io/networks: '[
             { "name": "macvlan-conf-3" },
             { "name": "macvlan-conf-4" },
             { "name": "flannel-2" }

examples/npwg-demo-1/15_pod_case5.yml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: pod-case-05
+  annotations:
+    k8s.v1.cni.cncf.io/networks: '[
+            { "name": "ptp-tuning-conflist" }
+    ]'
+spec:
+  containers:
+  - name: pod-case-05
+    image: docker.io/centos/tools:latest
+    command:
+    - /sbin/init

examples/sample-pod.yml

@@ -4,7 +4,7 @@ kind: Pod
 metadata:
   name: samplepod
   annotations:
-    kubernetes.v1.cni.cncf.io/networks: macvlan-conf
+    k8s.v1.cni.cncf.io/networks: macvlan-conf
 spec:
   containers:
   - name: samplepod

glide.lock

@@ -1,128 +1,182 @@
-hash: 9f567f5e6122fc0f7092f9373f1cfd491978315b0d9ff01ab81cebe269ffa048
-updated: 2018-05-08T04:22:31.321965197-04:00
+hash: 0c4ea2a342364d2ff3b43242730cb3b1db3b7e8456f6cf43da3c51dbb67e18da
+updated: 2018-07-27T03:29:02.093332104+01:00
 imports:
 - name: github.com/containernetworking/cni
-  version: 137b4975ecab6e1f0c24c1e3c228a50a3cfba75e
+  version: 07c1a6da47b7fbf8b357f4949ecce2113e598491
   subpackages:
   - libcni
   - pkg/invoke
   - pkg/ip
   - pkg/ipam
-  - pkg/ns
   - pkg/skel
   - pkg/types
   - pkg/types/020
   - pkg/types/current
   - pkg/version
-- name: github.com/davecgh/go-spew
-  version: 5215b55f46b2b919f50a1df0eaa5886afe4e3b3d
+- name: github.com/containernetworking/plugins
+  version: 2b8b1ac0af4568e928d96ccc5f47b075416eeabd
   subpackages:
-  - spew
-- name: github.com/docker/distribution
-  version: cd27f179f2c10c5d300e6d09025b538c475b0d51
-  subpackages:
-  - digest
-  - reference
-- name: github.com/emicklei/go-restful
-  version: 09691a3b6378b740595c1002f40c34dd5f218a22
-  subpackages:
-  - log
-  - swagger
+  - pkg/ns
+  - pkg/testutils
 - name: github.com/ghodss/yaml
   version: 73d445a93680fa1a78ae23a5839bad48f32ba1ee
-- name: github.com/go-openapi/jsonpointer
-  version: 46af16f9f7b149af66e5d1bd010e3574dc06de98
-- name: github.com/go-openapi/jsonreference
-  version: 13c6e3589ad90f49bd3e3bbe2c2cb3d7a4142272
-- name: github.com/go-openapi/spec
-  version: 6aced65f8501fe1217321abf0749d354824ba2ff
-- name: github.com/go-openapi/swag
-  version: 1d0bd113de87027671077d3c71eb3ac5d7dbba72
 - name: github.com/gogo/protobuf
-  version: e18d7aa8f8c624c915db340349aad4c49b10d173
+  version: c0656edd0d9eab7c66d1eb0c568f9039345796f7
   subpackages:
   - proto
   - sortkeys
 - name: github.com/golang/glog
   version: 44145f04b68cf362d9c4df2182967c2275eaefed
+- name: github.com/golang/protobuf
+  version: b4deda0973fb4c70b50d226b1af49f3da59f5265
+  subpackages:
+  - proto
+  - ptypes
+  - ptypes/any
+  - ptypes/duration
+  - ptypes/timestamp
+- name: github.com/google/btree
+  version: 7d79101e329e5a3adf994758c578dab82b90c017
 - name: github.com/google/gofuzz
   version: 44d81051d367757e1c7c6a5a86423ece9afcf63c
-- name: github.com/howeyc/gopass
-  version: 3ca23474a7c7203e0a0a070fd33508f6efdb9b3d
+- name: github.com/googleapis/gnostic
+  version: 0c5108395e2debce0d731cf0287ddf7242066aba
+  subpackages:
+  - OpenAPIv2
+  - compiler
+  - extensions
+- name: github.com/gregjones/httpcache
+  version: 787624de3eb7bd915c329cba748687a3b22666a6
+  subpackages:
+  - diskcache
 - name: github.com/imdario/mergo
   version: 6633656539c1639d9d78127b7d47c622b5d7b6dc
-- name: github.com/juju/ratelimit
-  version: 77ed1c8a01217656d2080ad51981f6e99adaa177
-- name: github.com/mailru/easyjson
-  version: d5b7844b561a7bc640052f1b935f7b800330d7e0
+- name: github.com/json-iterator/go
+  version: f2b4162afba35581b6d4a50d3b8f34e33c144682
+- name: github.com/modern-go/concurrent
+  version: bacd9c7ef1dd9b15be4a9909b8ac7a4e313eec94
+- name: github.com/modern-go/reflect2
+  version: 05fbef0ca5da472bbf96c9322b84a53edc03c9fd
+- name: github.com/onsi/ginkgo
+  version: 7f8ab55aaf3b86885aa55b762e803744d1674700
   subpackages:
-  - buffer
-  - jlexer
-  - jwriter
-- name: github.com/PuerkitoBio/purell
-  version: 8a290539e2e8629dbc4e6bad948158f790ec31f4
-- name: github.com/PuerkitoBio/urlesc
-  version: 5bd2802263f21d8788851d5305584c82a5c75d7e
+  - config
+  - internal/codelocation
+  - internal/containernode
+  - internal/failer
+  - internal/leafnodes
+  - internal/remote
+  - internal/spec
+  - internal/specrunner
+  - internal/suite
+  - internal/testingtproxy
+  - internal/writer
+  - reporters
+  - reporters/stenographer
+  - types
+- name: github.com/onsi/gomega
+  version: 2152b45fa28a361beba9aab0885972323a444e28
+  subpackages:
+  - format
+  - internal/assertion
+  - internal/asyncassertion
+  - internal/oraclematcher
+  - internal/testingtsupport
+  - matchers
+  - matchers/support/goraph/bipartitegraph
+  - matchers/support/goraph/edge
+  - matchers/support/goraph/node
+  - matchers/support/goraph/util
+  - types
+- name: github.com/peterbourgon/diskv
+  version: 5f041e8faa004a95c88a202771f4cc3e991971e6
+- name: github.com/pkg/errors
+  version: 816c9085562cd7ee03e7f8188a1cfd942858cded
 - name: github.com/spf13/pflag
-  version: 9ff6c6923cfffbcd502984b8e0c80539a94968b7
-- name: github.com/ugorji/go
-  version: ded73eae5db7e7a0ef6f55aace87a2873c5d2b74
-  subpackages:
-  - codec
+  version: 583c0c0531f06d5278b7d917446061adc344b5cd
 - name: github.com/vishvananda/netlink
-  version: 4e28683688429fdf8413cc610d59fb1841986300
+  version: 6e453822d85ef5721799774b654d4d02fed62afb
   subpackages:
   - nl
 - name: github.com/vishvananda/netns
-  version: be1fbeda19366dea804f00efff2dd73a1642fdcc
+  version: 54f0e4339ce73702a0607f49922aaa1e749b418d
 - name: golang.org/x/crypto
-  version: d172538b2cfce0c13cee31e647d0367aa8cd2486
+  version: 49796115aa4b964c318aad4f3084fdb41e9aa067
   subpackages:
   - ssh/terminal
 - name: golang.org/x/net
-  version: e90d6d0afc4c315a0d87a568ae68577cc15149a0
+  version: 1c05540f6879653db88113bc4a2b70aec4bd491f
   subpackages:
+  - context
   - http2
   - http2/hpack
   - idna
   - lex/httplex
 - name: golang.org/x/sys
-  version: 076b546753157f758b316e59bcb51e6807c04057
+  version: 95c6576299259db960f6c5b9b69ea52422860fce
   subpackages:
   - unix
+  - windows
 - name: golang.org/x/text
-  version: 2910a502d2bf9e43193af9d68ca516529614eed3
+  version: b19bf474d317b857955b12035d2c5acb57ce8b01
   subpackages:
-  - cases
-  - internal/tag
-  - language
-  - runes
   - secure/bidirule
-  - secure/precis
   - transform
   - unicode/bidi
   - unicode/norm
-  - width
+- name: golang.org/x/time
+  version: f51c12702a4d776e4c1fa9b0fabab841babae631
+  subpackages:
+  - rate
 - name: gopkg.in/inf.v0
   version: 3887ee99ecf07df5b447e9b00d9c0b2adaa9f3e4
 - name: gopkg.in/yaml.v2
-  version: 53feefa2559fb8dfa8d81baad31be332c97d6c77
+  version: 670d4cfef0544295bc27a114dbac37980d83185a
+- name: k8s.io/api
+  version: 2d6f90ab1293a1fb871cf149423ebb72aa7423aa
+  subpackages:
+  - admissionregistration/v1alpha1
+  - admissionregistration/v1beta1
+  - apps/v1
+  - apps/v1beta1
+  - apps/v1beta2
+  - authentication/v1
+  - authentication/v1beta1
+  - authorization/v1
+  - authorization/v1beta1
+  - autoscaling/v1
+  - autoscaling/v2beta1
+  - batch/v1
+  - batch/v1beta1
+  - batch/v2alpha1
+  - certificates/v1beta1
+  - core/v1
+  - events/v1beta1
+  - extensions/v1beta1
+  - networking/v1
+  - policy/v1beta1
+  - rbac/v1
+  - rbac/v1alpha1
+  - rbac/v1beta1
+  - scheduling/v1alpha1
+  - scheduling/v1beta1
+  - settings/v1alpha1
+  - storage/v1
+  - storage/v1alpha1
+  - storage/v1beta1
 - name: k8s.io/apimachinery
-  version: b317fa7ec8e0e7d1f77ac63bf8c3ec7b29a2a215
+  version: 103fd098999dc9c0c88536f5c9ad2e5da39373ae
   subpackages:
   - pkg/api/errors
   - pkg/api/meta
   - pkg/api/resource
-  - pkg/apimachinery
-  - pkg/apimachinery/announced
-  - pkg/apimachinery/registered
   - pkg/apis/meta/v1
   - pkg/apis/meta/v1/unstructured
+  - pkg/apis/meta/v1beta1
   - pkg/conversion
   - pkg/conversion/queryparams
   - pkg/fields
   - pkg/labels
-  - pkg/openapi
   - pkg/runtime
   - pkg/runtime/schema
   - pkg/runtime/serializer
@@ -133,12 +187,12 @@ imports:
   - pkg/runtime/serializer/versioning
   - pkg/selection
   - pkg/types
+  - pkg/util/clock
   - pkg/util/errors
   - pkg/util/framer
   - pkg/util/intstr
   - pkg/util/json
   - pkg/util/net
-  - pkg/util/rand
   - pkg/util/runtime
   - pkg/util/sets
   - pkg/util/validation
@@ -149,74 +203,45 @@ imports:
   - pkg/watch
   - third_party/forked/golang/reflect
 - name: k8s.io/client-go
-  version: 4a3ab2f5be5177366f8206fd79ce55ca80e417fa
+  version: 59698c7d9724b0f95f9dc9e7f7dfdcc3dfeceb82
   subpackages:
   - discovery
   - kubernetes
   - kubernetes/scheme
+  - kubernetes/typed/admissionregistration/v1alpha1
+  - kubernetes/typed/admissionregistration/v1beta1
+  - kubernetes/typed/apps/v1
   - kubernetes/typed/apps/v1beta1
+  - kubernetes/typed/apps/v1beta2
   - kubernetes/typed/authentication/v1
   - kubernetes/typed/authentication/v1beta1
   - kubernetes/typed/authorization/v1
   - kubernetes/typed/authorization/v1beta1
   - kubernetes/typed/autoscaling/v1
-  - kubernetes/typed/autoscaling/v2alpha1
+  - kubernetes/typed/autoscaling/v2beta1
   - kubernetes/typed/batch/v1
+  - kubernetes/typed/batch/v1beta1
   - kubernetes/typed/batch/v2alpha1
   - kubernetes/typed/certificates/v1beta1
   - kubernetes/typed/core/v1
+  - kubernetes/typed/events/v1beta1
   - kubernetes/typed/extensions/v1beta1
+  - kubernetes/typed/networking/v1
   - kubernetes/typed/policy/v1beta1
+  - kubernetes/typed/rbac/v1
   - kubernetes/typed/rbac/v1alpha1
   - kubernetes/typed/rbac/v1beta1
+  - kubernetes/typed/scheduling/v1alpha1
+  - kubernetes/typed/scheduling/v1beta1
   - kubernetes/typed/settings/v1alpha1
   - kubernetes/typed/storage/v1
+  - kubernetes/typed/storage/v1alpha1
   - kubernetes/typed/storage/v1beta1
-  - pkg/api
-  - pkg/api/install
-  - pkg/api/v1
-  - pkg/apis/apps
-  - pkg/apis/apps/install
-  - pkg/apis/apps/v1beta1
-  - pkg/apis/authentication
-  - pkg/apis/authentication/install
-  - pkg/apis/authentication/v1
-  - pkg/apis/authentication/v1beta1
-  - pkg/apis/authorization
-  - pkg/apis/authorization/install
-  - pkg/apis/authorization/v1
-  - pkg/apis/authorization/v1beta1
-  - pkg/apis/autoscaling
-  - pkg/apis/autoscaling/install
-  - pkg/apis/autoscaling/v1
-  - pkg/apis/autoscaling/v2alpha1
-  - pkg/apis/batch
-  - pkg/apis/batch/install
-  - pkg/apis/batch/v1
-  - pkg/apis/batch/v2alpha1
-  - pkg/apis/certificates
-  - pkg/apis/certificates/install
-  - pkg/apis/certificates/v1beta1
-  - pkg/apis/extensions
-  - pkg/apis/extensions/install
-  - pkg/apis/extensions/v1beta1
-  - pkg/apis/policy
-  - pkg/apis/policy/install
-  - pkg/apis/policy/v1beta1
-  - pkg/apis/rbac
-  - pkg/apis/rbac/install
-  - pkg/apis/rbac/v1alpha1
-  - pkg/apis/rbac/v1beta1
-  - pkg/apis/settings
-  - pkg/apis/settings/install
-  - pkg/apis/settings/v1alpha1
-  - pkg/apis/storage
-  - pkg/apis/storage/install
-  - pkg/apis/storage/v1
-  - pkg/apis/storage/v1beta1
-  - pkg/util
-  - pkg/util/parsers
+  - pkg/apis/clientauthentication
+  - pkg/apis/clientauthentication/v1alpha1
+  - pkg/apis/clientauthentication/v1beta1
   - pkg/version
+  - plugin/pkg/client/auth/exec
   - rest
   - rest/watch
   - tools/auth
@@ -225,10 +250,12 @@ imports:
   - tools/clientcmd/api/latest
   - tools/clientcmd/api/v1
   - tools/metrics
+  - tools/reference
   - transport
   - util/cert
-  - util/clock
+  - util/connrotation
   - util/flowcontrol
   - util/homedir
   - util/integer
+  - util/retry
 testImports: []

glide.yaml

@@ -1,19 +1,36 @@
 package: github.com/intel/multus-cni
+ignore:
+- bytes
 import:
 - package: github.com/containernetworking/cni
-  version: v0.5.2
+  version: 07c1a6da47b7fbf8b357f4949ecce2113e598491
+  subpackages:
+  - pkg/skel
+  - pkg/types
+  - pkg/version
+- package: github.com/containernetworking/plugins
+  version: 2b8b1ac0af4568e928d96ccc5f47b075416eeabd
   subpackages:
   - pkg/ip
   - pkg/ipam
   - pkg/ns
-  - pkg/skel
-  - pkg/types
-  - pkg/version
+- package: github.com/onsi/ginkgo
+  version: 7f8ab55aaf3b86885aa55b762e803744d1674700
+- package: github.com/onsi/gomega
+  version: 2152b45fa28a361beba9aab0885972323a444e28
 - package: github.com/golang/glog
 - package: github.com/vishvananda/netlink
+- package: k8s.io/apimachinery
+  version: kubernetes-1.11.1
+- package: k8s.io/api
+  version: kubernetes-1.11.1
+  subpackages:
+  - core/v1
 - package: k8s.io/client-go
-  version: 4a3ab2f5be5177366f8206fd79ce55ca80e417fa
+  version: kubernetes-1.11.1
   subpackages:
   - kubernetes
   - tools/clientcmd
+  - util/retry
 - package: github.com/vishvananda/netns
+- package: github.com/pkg/errors

images/70-multus.conf

@@ -0,0 +1,15 @@
+{
+  "name": "multus-cni-network",
+  "type": "multus",
+  "delegates": [
+    {
+      "type": "flannel",
+      "name": "flannel.1",
+      "delegate": {
+        "isDefaultGateway": true,
+        "hairpinMode": true
+      }
+    }
+  ],
+  "kubeconfig": "/etc/cni/net.d/multus.d/multus.kubeconfig"
+}

images/Dockerfile

@@ -0,0 +1,27 @@
+FROM centos:centos7
+
+# Add everything
+ADD . /usr/src/multus-cni
+
+ENV INSTALL_PKGS "git golang"
+RUN yum install -y $INSTALL_PKGS && \
+    rpm -V $INSTALL_PKGS && \
+    cd /usr/src/multus-cni && \
+    ./build && \
+    yum autoremove -y $INSTALL_PKGS && \
+    yum clean all && \
+    rm -rf /tmp/*
+
+WORKDIR /
+
+LABEL io.k8s.display-name="Multus CNI" \
+      io.k8s.description="This is a component of OpenShift Container Platform and provides a meta CNI plugin." \
+      io.openshift.tags="openshift" \
+      maintainer="Doug Smith <dosmith@redhat.com>"
+
+ADD ./images/entrypoint.sh /
+
+# does it require a root user?
+# USER 1001
+
+ENTRYPOINT /entrypoint.sh

images/README.md

@@ -0,0 +1,65 @@
+## Dockerfile build
+
+This is used for distribution of Multus in a Docker image.
+
+Typically you'd build this from the root of your Multus clone, and you'd set the `-f` flag to specify the Dockerfile during build time. This allows the addition of the entirety of the Multus git clone as part of the Docker context. Use the `-f` flag with the root of the clone as the context (e.g. your current work directory would be root of git clone), such as:
+
+```
+$ docker build -t dougbtv/multus -f ./images/Dockerfile .
+```
+
+---
+
+## Daemonset deployment
+
+You may wish to deploy Multus as a daemonset, you can do so by starting with the example Daemonset shown here:
+
+```
+$ kubectl create -f ./images/multus-daemonset.yml
+```
+
+Note: The likely best practice here is to build your own image given the Dockerfile, and then push it to your preferred registry, and change the `image` fields in the Daemonset YAML to reference that image.
+
+---
+
+### `entrypoint.sh` parameters
+
+The entrypoint takes named parameters for the configuration
+
+You can get get help with the `--help` flag.
+
+```
+$ ./entrypoint.sh --help
+
+This is an entrypoint script for Multus CNI to overlay its
+binary and configuration into locations in a filesystem.
+The configuration & binary file will be copied to the 
+corresponding configuration directory.
+
+./entrypoint.sh
+    -h --help
+    --cni-conf-dir=/host/etc/cni/net.d
+    --cni-bin-dir=/host/opt/cni/bin
+    --multus-conf-file=/usr/src/multus-cni/images/70-multus.conf
+    --multus-bin-file=/usr/src/multus-cni/bin/multus
+```
+
+You must use an `=` to delimit the parameter name and the value. For example you may set a custom `cni-conf-dir` like so:
+
+```
+./entrypoint.sh --cni-conf-dir=/special/path/to/cni/configs/
+```
+
+Note: You'll noticed that there's a `/host/...` directory from the root for the default for both the `cni-conf-dir` and `cni-bin-dir` as it's intended for the host volumes to be mounted specially under this directory to help in the semantics of which paths belong to the host or container.
+
+---
+
+### Development notes
+
+Example docker run command:
+
+```
+$ docker run -it -v /opt/cni/bin/:/host/opt/cni/bin/ -v /etc/cni/net.d/:/host/etc/cni/net.d/ --entrypoint=/bin/bash dougbtv/multus 
+```
+
+Originally inspired by and is a portmanteau of the [Flannel daemonset](https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel.yml), the [Calico Daemonset](https://github.com/projectcalico/calico/blob/master/v2.0/getting-started/kubernetes/installation/hosted/k8s-backend-addon-manager/calico-daemonset.yaml), and the [Calico CNI install bash script](https://github.com/projectcalico/cni-plugin/blob/be4df4db2e47aa7378b1bdf6933724bac1f348d0/k8s-install/scripts/install-cni.sh#L104-L153).

images/entrypoint.sh

@@ -0,0 +1,140 @@
+#!/bin/bash
+
+# Always exit on errors.
+set -e
+
+# Set our known directories.
+CNI_CONF_DIR="/host/etc/cni/net.d"
+CNI_BIN_DIR="/host/opt/cni/bin"
+MULTUS_CONF_FILE="/usr/src/multus-cni/images/70-multus.conf"
+MULTUS_BIN_FILE="/usr/src/multus-cni/bin/multus"
+
+# Give help text for parameters.
+function usage()
+{
+    echo -e "This is an entrypoint script for Multus CNI to overlay its"
+    echo -e "binary and configuration into locations in a filesystem."
+    echo -e "The configuration & binary file will be copied to the "
+    echo -e "corresponding configuration directory."
+    echo -e ""
+    echo -e "./entrypoint.sh"
+    echo -e "\t-h --help"
+    echo -e "\t--cni-conf-dir=$CNI_CONF_DIR"
+    echo -e "\t--cni-bin-dir=$CNI_BIN_DIR"
+    echo -e "\t--multus-conf-file=$MULTUS_CONF_FILE"
+    echo -e "\t--multus-bin-file=$MULTUS_BIN_FILE"
+}
+
+# Parse parameters given as arguments to this script.
+while [ "$1" != "" ]; do
+    PARAM=`echo $1 | awk -F= '{print $1}'`
+    VALUE=`echo $1 | awk -F= '{print $2}'`
+    case $PARAM in
+        -h | --help)
+            usage
+            exit
+            ;;
+        --cni-conf-dir)
+            CNI_CONF_DIR=$VALUE
+            ;;
+        --cni-bin-dir)
+            CNI_BIN_DIR=$VALUE
+            ;;
+        --multus-conf-file)
+            MULTUS_CONF_FILE=$VALUE
+            ;;
+        --multus-bin-file)
+            MULTUS_BIN_FILE=$VALUE
+            ;;
+        *)
+            echo "ERROR: unknown parameter \"$PARAM\""
+            usage
+            exit 1
+            ;;
+    esac
+    shift
+done
+
+
+# Create array of known locations
+declare -a arr=($CNI_CONF_DIR $CNI_BIN_DIR $MULTUS_CONF_FILE $MULTUS_BIN_FILE)
+
+# Loop through and verify each location each.
+for i in "${arr[@]}"
+do
+  if [ ! -e "$i" ]; then
+    echo "Location $i does not exist"
+    exit 1;
+  fi
+done
+
+# Copy files into proper places.
+cp -f $MULTUS_CONF_FILE $CNI_CONF_DIR
+cp -f $MULTUS_BIN_FILE $CNI_BIN_DIR
+
+# Make a multus.d directory (for our kubeconfig)
+
+mkdir -p $CNI_CONF_DIR/multus.d
+MULTUS_KUBECONFIG=$CNI_CONF_DIR/multus.d/multus.kubeconfig
+
+# ------------------------------- Generate a "kube-config"
+# Inspired by: https://tinyurl.com/y7r2knme
+SERVICE_ACCOUNT_PATH=/var/run/secrets/kubernetes.io/serviceaccount
+KUBE_CA_FILE=${KUBE_CA_FILE:-$SERVICE_ACCOUNT_PATH/ca.crt}
+SERVICEACCOUNT_TOKEN=$(cat $SERVICE_ACCOUNT_PATH/token)
+SKIP_TLS_VERIFY=${SKIP_TLS_VERIFY:-false}
+
+
+# Check if we're running as a k8s pod.
+if [ -f "$SERVICE_ACCOUNT_PATH/token" ]; then
+  # We're running as a k8d pod - expect some variables.
+  if [ -z ${KUBERNETES_SERVICE_HOST} ]; then
+    echo "KUBERNETES_SERVICE_HOST not set"; exit 1;
+  fi
+  if [ -z ${KUBERNETES_SERVICE_PORT} ]; then
+    echo "KUBERNETES_SERVICE_PORT not set"; exit 1;
+  fi
+
+  if [ "$SKIP_TLS_VERIFY" == "true" ]; then
+    TLS_CFG="insecure-skip-tls-verify: true"
+  elif [ -f "$KUBE_CA_FILE" ]; then
+    TLS_CFG="certificate-authority-data: $(cat $KUBE_CA_FILE | base64 | tr -d '\n')"
+  fi
+
+  # Write a kubeconfig file for the CNI plugin.  Do this
+  # to skip TLS verification for now.  We should eventually support
+  # writing more complete kubeconfig files. This is only used
+  # if the provided CNI network config references it.
+  touch $MULTUS_KUBECONFIG
+  chmod ${KUBECONFIG_MODE:-600} $MULTUS_KUBECONFIG
+  cat > $MULTUS_KUBECONFIG <<EOF
+# Kubeconfig file for Multus CNI plugin.
+apiVersion: v1
+kind: Config
+clusters:
+- name: local
+  cluster:
+    server: ${KUBERNETES_SERVICE_PROTOCOL:-https}://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}
+    $TLS_CFG
+users:
+- name: multus
+  user:
+    token: "${SERVICEACCOUNT_TOKEN}"
+contexts:
+- name: multus-context
+  context:
+    cluster: local
+    user: multus
+current-context: multus-context
+EOF
+
+else
+  echo "WARNING: Doesn't look like we're running in a kubernetes environment (no serviceaccount token)"
+fi
+
+# ---------------------- end Generate a "kube-config".
+
+echo "Entering sleep... (success)"
+
+# Sleep forever.
+sleep infinity

images/flannel-daemonset.yml

@@ -0,0 +1,479 @@
+# This is a modified Flannel daemonset.
+# it is based on: https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
+# Notably, it removes the creation of an configuration file in/etc/cni/net.d/ 
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: flannel
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - nodes
+    verbs:
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - nodes/status
+    verbs:
+      - patch
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: flannel
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: flannel
+subjects:
+- kind: ServiceAccount
+  name: flannel
+  namespace: kube-system
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: flannel
+  namespace: kube-system
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: kube-flannel-cfg
+  namespace: kube-system
+  labels:
+    tier: node
+    app: flannel
+data:
+  cni-conf.json: |
+    {
+      "name": "cbr0",
+      "plugins": [
+        {
+          "type": "flannel",
+          "delegate": {
+            "hairpinMode": true,
+            "isDefaultGateway": true
+          }
+        },
+        {
+          "type": "portmap",
+          "capabilities": {
+            "portMappings": true
+          }
+        }
+      ]
+    }
+  net-conf.json: |
+    {
+      "Network": "10.244.0.0/16",
+      "Backend": {
+        "Type": "vxlan"
+      }
+    }
+---
+apiVersion: extensions/v1beta1
+kind: DaemonSet
+metadata:
+  name: kube-flannel-ds-amd64
+  namespace: kube-system
+  labels:
+    tier: node
+    app: flannel
+spec:
+  template:
+    metadata:
+      labels:
+        tier: node
+        app: flannel
+    spec:
+      hostNetwork: true
+      nodeSelector:
+        beta.kubernetes.io/arch: amd64
+      tolerations:
+      - key: node-role.kubernetes.io/master
+        operator: Exists
+        effect: NoSchedule
+      serviceAccountName: flannel
+      # ------------------------------- Intentionally removed, Multus daemonset configures /etc/cni/net.d
+      # initContainers:
+      # - name: install-cni
+      #   image: quay.io/coreos/flannel:v0.10.0-amd64
+      #   command:
+      #   - cp
+      #   args:
+      #   - -f
+      #   - /etc/kube-flannel/cni-conf.json
+      #   - /etc/cni/net.d/10-flannel.conflist
+      #   volumeMounts:
+      #   - name: cni
+      #     mountPath: /etc/cni/net.d
+      #   - name: flannel-cfg
+      #     mountPath: /etc/kube-flannel/
+      containers:
+      - name: kube-flannel
+        image: quay.io/coreos/flannel:v0.10.0-amd64
+        command:
+        - /opt/bin/flanneld
+        args:
+        - --ip-masq
+        - --kube-subnet-mgr
+        resources:
+          requests:
+            cpu: "100m"
+            memory: "50Mi"
+          limits:
+            cpu: "100m"
+            memory: "50Mi"
+        securityContext:
+          privileged: true
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        volumeMounts:
+        - name: run
+          mountPath: /run
+        - name: flannel-cfg
+          mountPath: /etc/kube-flannel/
+      volumes:
+        - name: run
+          hostPath:
+            path: /run
+        - name: cni
+          hostPath:
+            path: /etc/cni/net.d
+        - name: flannel-cfg
+          configMap:
+            name: kube-flannel-cfg
+---
+apiVersion: extensions/v1beta1
+kind: DaemonSet
+metadata:
+  name: kube-flannel-ds-arm64
+  namespace: kube-system
+  labels:
+    tier: node
+    app: flannel
+spec:
+  template:
+    metadata:
+      labels:
+        tier: node
+        app: flannel
+    spec:
+      hostNetwork: true
+      nodeSelector:
+        beta.kubernetes.io/arch: arm64
+      tolerations:
+      - key: node-role.kubernetes.io/master
+        operator: Exists
+        effect: NoSchedule
+      serviceAccountName: flannel
+      initContainers:
+      - name: install-cni
+        image: quay.io/coreos/flannel:v0.10.0-arm64
+        command:
+        - cp
+        args:
+        - -f
+        - /etc/kube-flannel/cni-conf.json
+        - /etc/cni/net.d/10-flannel.conflist
+        volumeMounts:
+        - name: cni
+          mountPath: /etc/cni/net.d
+        - name: flannel-cfg
+          mountPath: /etc/kube-flannel/
+      containers:
+      - name: kube-flannel
+        image: quay.io/coreos/flannel:v0.10.0-arm64
+        command:
+        - /opt/bin/flanneld
+        args:
+        - --ip-masq
+        - --kube-subnet-mgr
+        resources:
+          requests:
+            cpu: "100m"
+            memory: "50Mi"
+          limits:
+            cpu: "100m"
+            memory: "50Mi"
+        securityContext:
+          privileged: true
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        volumeMounts:
+        - name: run
+          mountPath: /run
+        - name: flannel-cfg
+          mountPath: /etc/kube-flannel/
+      volumes:
+        - name: run
+          hostPath:
+            path: /run
+        - name: cni
+          hostPath:
+            path: /etc/cni/net.d
+        - name: flannel-cfg
+          configMap:
+            name: kube-flannel-cfg
+---
+apiVersion: extensions/v1beta1
+kind: DaemonSet
+metadata:
+  name: kube-flannel-ds-arm
+  namespace: kube-system
+  labels:
+    tier: node
+    app: flannel
+spec:
+  template:
+    metadata:
+      labels:
+        tier: node
+        app: flannel
+    spec:
+      hostNetwork: true
+      nodeSelector:
+        beta.kubernetes.io/arch: arm
+      tolerations:
+      - key: node-role.kubernetes.io/master
+        operator: Exists
+        effect: NoSchedule
+      serviceAccountName: flannel
+      initContainers:
+      - name: install-cni
+        image: quay.io/coreos/flannel:v0.10.0-arm
+        command:
+        - cp
+        args:
+        - -f
+        - /etc/kube-flannel/cni-conf.json
+        - /etc/cni/net.d/10-flannel.conflist
+        volumeMounts:
+        - name: cni
+          mountPath: /etc/cni/net.d
+        - name: flannel-cfg
+          mountPath: /etc/kube-flannel/
+      containers:
+      - name: kube-flannel
+        image: quay.io/coreos/flannel:v0.10.0-arm
+        command:
+        - /opt/bin/flanneld
+        args:
+        - --ip-masq
+        - --kube-subnet-mgr
+        resources:
+          requests:
+            cpu: "100m"
+            memory: "50Mi"
+          limits:
+            cpu: "100m"
+            memory: "50Mi"
+        securityContext:
+          privileged: true
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        volumeMounts:
+        - name: run
+          mountPath: /run
+        - name: flannel-cfg
+          mountPath: /etc/kube-flannel/
+      volumes:
+        - name: run
+          hostPath:
+            path: /run
+        - name: cni
+          hostPath:
+            path: /etc/cni/net.d
+        - name: flannel-cfg
+          configMap:
+            name: kube-flannel-cfg
+---
+apiVersion: extensions/v1beta1
+kind: DaemonSet
+metadata:
+  name: kube-flannel-ds-ppc64le
+  namespace: kube-system
+  labels:
+    tier: node
+    app: flannel
+spec:
+  template:
+    metadata:
+      labels:
+        tier: node
+        app: flannel
+    spec:
+      hostNetwork: true
+      nodeSelector:
+        beta.kubernetes.io/arch: ppc64le
+      tolerations:
+      - key: node-role.kubernetes.io/master
+        operator: Exists
+        effect: NoSchedule
+      serviceAccountName: flannel
+      initContainers:
+      - name: install-cni
+        image: quay.io/coreos/flannel:v0.10.0-ppc64le
+        command:
+        - cp
+        args:
+        - -f
+        - /etc/kube-flannel/cni-conf.json
+        - /etc/cni/net.d/10-flannel.conflist
+        volumeMounts:
+        - name: cni
+          mountPath: /etc/cni/net.d
+        - name: flannel-cfg
+          mountPath: /etc/kube-flannel/
+      containers:
+      - name: kube-flannel
+        image: quay.io/coreos/flannel:v0.10.0-ppc64le
+        command:
+        - /opt/bin/flanneld
+        args:
+        - --ip-masq
+        - --kube-subnet-mgr
+        resources:
+          requests:
+            cpu: "100m"
+            memory: "50Mi"
+          limits:
+            cpu: "100m"
+            memory: "50Mi"
+        securityContext:
+          privileged: true
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        volumeMounts:
+        - name: run
+          mountPath: /run
+        - name: flannel-cfg
+          mountPath: /etc/kube-flannel/
+      volumes:
+        - name: run
+          hostPath:
+            path: /run
+        - name: cni
+          hostPath:
+            path: /etc/cni/net.d
+        - name: flannel-cfg
+          configMap:
+            name: kube-flannel-cfg
+---
+apiVersion: extensions/v1beta1
+kind: DaemonSet
+metadata:
+  name: kube-flannel-ds-s390x
+  namespace: kube-system
+  labels:
+    tier: node
+    app: flannel
+spec:
+  template:
+    metadata:
+      labels:
+        tier: node
+        app: flannel
+    spec:
+      hostNetwork: true
+      nodeSelector:
+        beta.kubernetes.io/arch: s390x
+      tolerations:
+      - key: node-role.kubernetes.io/master
+        operator: Exists
+        effect: NoSchedule
+      serviceAccountName: flannel
+      initContainers:
+      - name: install-cni
+        image: quay.io/coreos/flannel:v0.10.0-s390x
+        command:
+        - cp
+        args:
+        - -f
+        - /etc/kube-flannel/cni-conf.json
+        - /etc/cni/net.d/10-flannel.conflist
+        volumeMounts:
+        - name: cni
+          mountPath: /etc/cni/net.d
+        - name: flannel-cfg
+          mountPath: /etc/kube-flannel/
+      containers:
+      - name: kube-flannel
+        image: quay.io/coreos/flannel:v0.10.0-s390x
+        command:
+        - /opt/bin/flanneld
+        args:
+        - --ip-masq
+        - --kube-subnet-mgr
+        resources:
+          requests:
+            cpu: "100m"
+            memory: "50Mi"
+          limits:
+            cpu: "100m"
+            memory: "50Mi"
+        securityContext:
+          privileged: true
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        volumeMounts:
+        - name: run
+          mountPath: /run
+        - name: flannel-cfg
+          mountPath: /etc/kube-flannel/
+      volumes:
+        - name: run
+          hostPath:
+            path: /run
+        - name: cni
+          hostPath:
+            path: /etc/cni/net.d
+        - name: flannel-cfg
+          configMap:
+            name: kube-flannel-cfg

images/multus-daemonset.yml

@@ -0,0 +1,144 @@
+---
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: network-attachment-definitions.k8s.cni.cncf.io
+spec:
+  group: k8s.cni.cncf.io
+  version: v1
+  scope: Namespaced
+  names:
+    plural: network-attachment-definitions
+    singular: network-attachment-definition
+    kind: NetworkAttachmentDefinition
+    shortNames:
+    - net-attach-def
+  validation:
+    openAPIV3Schema:
+      properties:
+        spec:
+          properties:
+            config:
+                 type: string
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: multus
+rules:
+- apiGroups:
+  - '*'
+  resources:
+  - '*'
+  verbs:
+  - '*'
+- nonResourceURLs:
+  - '*'
+  verbs:
+  - '*'
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: multus
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: multus
+subjects:
+- kind: ServiceAccount
+  name: multus
+  namespace: kube-system
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: multus
+  namespace: kube-system
+---
+# ------------------------------------------------------
+# Currently unused!
+# If you wish to customize, mount this in the 
+# daemonset @ /usr/src/multus-cni/images/70-multus.conf
+# ------------------------------------------------------
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: multus-cni-config
+  namespace: kube-system
+  labels:
+    tier: node
+    app: multus
+data:
+  cni-conf.json: |
+    {
+      "name": "multus-cni-network",
+      "type": "multus",
+      "delegates": [
+        {
+          "type": "flannel",
+          "name": "flannel.1",
+          "delegate": {
+            "isDefaultGateway": true
+          }
+        }
+      ],
+      "kubeconfig": "/etc/cni/net.d/multus.d/multus.kubeconfig"
+    }
+# -------------- for openshift.
+# "delegates": [{
+#   "type": "openshift-sdn",
+#   "name:" "openshift.1",
+#   "masterplugin": true
+# }],
+---
+apiVersion: extensions/v1beta1
+kind: DaemonSet
+metadata:
+  name: kube-multus-ds-amd64
+  namespace: kube-system
+  labels:
+    tier: node
+    app: multus
+spec:
+  template:
+    metadata:
+      labels:
+        tier: node
+        app: multus
+    spec:
+      hostNetwork: true
+      nodeSelector:
+        beta.kubernetes.io/arch: amd64
+      tolerations:
+      - key: node-role.kubernetes.io/master
+        operator: Exists
+        effect: NoSchedule
+      serviceAccountName: multus
+      containers:
+      - name: kube-multus
+        image: nfvpe/multus:latest
+        resources:
+          requests:
+            cpu: "100m"
+            memory: "50Mi"
+          limits:
+            cpu: "100m"
+            memory: "50Mi"
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - name: cni
+          mountPath: /host/etc/cni/net.d
+        - name: cnibin
+          mountPath: /host/opt/cni/bin
+      volumes:
+        - name: cni
+          hostPath:
+            path: /etc/cni/net.d
+        - name: cnibin
+          hostPath:
+            path: /opt/cni/bin
+        - name: multus-cfg
+          configMap:
+            name: multus-cni-config

k8sclient/k8sclient.go

@@ -15,20 +15,24 @@
 package k8sclient
 
 import (
-	"bytes"
 	"encoding/json"
 	"fmt"
+	"os"
 	"regexp"
 	"strings"
 
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/clientcmd"
+	"k8s.io/client-go/util/retry"
 
-	"github.com/intel/multus-cni/types"
 	"github.com/containernetworking/cni/libcni"
 	"github.com/containernetworking/cni/pkg/skel"
 	cnitypes "github.com/containernetworking/cni/pkg/types"
+	"github.com/intel/multus-cni/logging"
+	"github.com/intel/multus-cni/types"
 )
 
 // NoK8sNetworkError indicates error, no network in kubernetes
@@ -36,30 +40,107 @@ type NoK8sNetworkError struct {
 	message string
 }
 
-func (e *NoK8sNetworkError) Error() string { return string(e.message) }
-
-func createK8sClient(kubeconfig string) (*kubernetes.Clientset, error) {
-
-	// uses the current context in kubeconfig
-	config, err := clientcmd.BuildConfigFromFlags("", kubeconfig)
-	if err != nil {
-		return nil, fmt.Errorf("createK8sClient: failed to get context for the kubeconfig %v, refer Multus README.md for the usage guide: %v", kubeconfig, err)
-	}
-
-	// creates the clientset
-	return kubernetes.NewForConfig(config)
+type clientInfo struct {
+	Client       KubeClient
+	Podnamespace string
+	Podname      string
 }
 
-func getPodNetworkAnnotation(client *kubernetes.Clientset, k8sArgs types.K8sArgs) (string, error) {
-	var annot string
-	var err error
+func (e *NoK8sNetworkError) Error() string { return string(e.message) }
 
-	pod, err := client.Pods(string(k8sArgs.K8S_POD_NAMESPACE)).Get(fmt.Sprintf("%s", string(k8sArgs.K8S_POD_NAME)), metav1.GetOptions{})
+type defaultKubeClient struct {
+	client kubernetes.Interface
+}
+
+// defaultKubeClient implements KubeClient
+var _ KubeClient = &defaultKubeClient{}
+
+func (d *defaultKubeClient) GetRawWithPath(path string) ([]byte, error) {
+	return d.client.ExtensionsV1beta1().RESTClient().Get().AbsPath(path).DoRaw()
+}
+
+func (d *defaultKubeClient) GetPod(namespace, name string) (*v1.Pod, error) {
+	return d.client.Core().Pods(namespace).Get(name, metav1.GetOptions{})
+}
+
+func (d *defaultKubeClient) UpdatePodStatus(pod *v1.Pod) (*v1.Pod, error) {
+	return d.client.Core().Pods(pod.Namespace).UpdateStatus(pod)
+}
+
+func setKubeClientInfo(c *clientInfo, client KubeClient, k8sArgs *types.K8sArgs) {
+	logging.Debugf("setKubeClientInfo: %v, %v, %v", c, client, k8sArgs)
+	c.Client = client
+	c.Podnamespace = string(k8sArgs.K8S_POD_NAMESPACE)
+	c.Podname = string(k8sArgs.K8S_POD_NAME)
+}
+
+func SetNetworkStatus(k *clientInfo, netStatus []*types.NetworkStatus) error {
+
+	logging.Debugf("SetNetworkStatus: %v, %v", k, netStatus)
+	pod, err := k.Client.GetPod(k.Podnamespace, k.Podname)
 	if err != nil {
-		return annot, fmt.Errorf("getPodNetworkAnnotation: failed to query the pod %v in out of cluster comm: %v", string(k8sArgs.K8S_POD_NAME), err)
+		return logging.Errorf("SetNetworkStatus: failed to query the pod %v in out of cluster comm: %v", k.Podname, err)
 	}
 
-	return pod.Annotations["kubernetes.v1.cni.cncf.io/networks"], nil
+	var ns string
+	if netStatus != nil {
+		var networkStatus []string
+		for _, nets := range netStatus {
+			data, err := json.MarshalIndent(nets, "", "    ")
+			if err != nil {
+				return logging.Errorf("SetNetworkStatus: error with Marshal Indent: %v", err)
+			}
+			networkStatus = append(networkStatus, string(data))
+		}
+
+		ns = fmt.Sprintf("[%s]", strings.Join(networkStatus, ","))
+	}
+	_, err = setPodNetworkAnnotation(k.Client, k.Podnamespace, pod, ns)
+	if err != nil {
+		return logging.Errorf("SetNetworkStatus: failed to update the pod %v in out of cluster comm: %v", k.Podname, err)
+	}
+
+	return nil
+}
+
+func setPodNetworkAnnotation(client KubeClient, namespace string, pod *v1.Pod, networkstatus string) (*v1.Pod, error) {
+	logging.Debugf("setPodNetworkAnnotation: %v, %s, %v, %s", client, namespace, pod, networkstatus)
+	//if pod annotations is empty, make sure it allocatable
+	if len(pod.Annotations) == 0 {
+		pod.Annotations = make(map[string]string)
+	}
+
+	pod.Annotations["k8s.v1.cni.cncf.io/networks-status"] = networkstatus
+
+	pod = pod.DeepCopy()
+	var err error
+	if resultErr := retry.RetryOnConflict(retry.DefaultBackoff, func() error {
+		if err != nil {
+			// Re-get the pod unless it's the first attempt to update
+			pod, err = client.GetPod(pod.Namespace, pod.Name)
+			if err != nil {
+				return err
+			}
+		}
+
+		pod, err = client.UpdatePodStatus(pod)
+		return err
+	}); resultErr != nil {
+		return nil, logging.Errorf("status update failed for pod %s/%s: %v", pod.Namespace, pod.Name, resultErr)
+	}
+	return pod, nil
+}
+
+func getPodNetworkAnnotation(client KubeClient, k8sArgs *types.K8sArgs) (string, string, error) {
+	var err error
+
+	logging.Debugf("getPodNetworkAnnotation: %v, %v", client, k8sArgs)
+	pod, err := client.GetPod(string(k8sArgs.K8S_POD_NAMESPACE), string(k8sArgs.K8S_POD_NAME))
+	if err != nil {
+		return "", "", logging.Errorf("getPodNetworkAnnotation: failed to query the pod %v in out of cluster comm: %v", string(k8sArgs.K8S_POD_NAME), err)
+	}
+
+	return pod.Annotations["k8s.v1.cni.cncf.io/networks"], pod.ObjectMeta.Namespace, nil
 }
 
 func parsePodNetworkObjectName(podnetwork string) (string, string, string, error) {
@@ -67,6 +148,7 @@ func parsePodNetworkObjectName(podnetwork string) (string, string, string, error
 	var netIfName string
 	var networkName string
 
+	logging.Debugf("parsePodNetworkObjectName: %s", podnetwork)
 	slashItems := strings.Split(podnetwork, "/")
 	if len(slashItems) == 2 {
 		netNsName = strings.TrimSpace(slashItems[0])
@@ -74,7 +156,7 @@ func parsePodNetworkObjectName(podnetwork string) (string, string, string, error
 	} else if len(slashItems) == 1 {
 		networkName = slashItems[0]
 	} else {
-		return "", "", "", fmt.Errorf("Invalid network object (failed at '/')")
+		return "", "", "", logging.Errorf("Invalid network object (failed at '/')")
 	}
 
 	atItems := strings.Split(networkName, "@")
@@ -82,7 +164,7 @@ func parsePodNetworkObjectName(podnetwork string) (string, string, string, error
 	if len(atItems) == 2 {
 		netIfName = strings.TrimSpace(atItems[1])
 	} else if len(atItems) != 1 {
-		return "", "", "", fmt.Errorf("Invalid network object (failed at '@')")
+		return "", "", "", logging.Errorf("Invalid network object (failed at '@')")
 	}
 
 	// Check and see if each item matches the specification for valid attachment name.
@@ -94,303 +176,300 @@ func parsePodNetworkObjectName(podnetwork string) (string, string, string, error
 	for i := range allItems {
 		matched, _ := regexp.MatchString("^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", allItems[i])
 		if !matched && len([]rune(allItems[i])) > 0 {
-			return "", "", "", fmt.Errorf(fmt.Sprintf("Failed to parse: one or more items did not match comma-delimited format (must consist of lower case alphanumeric characters). Must start and end with an alphanumeric character), mismatch @ '%v'", allItems[i]))
+			return "", "", "", logging.Errorf(fmt.Sprintf("Failed to parse: one or more items did not match comma-delimited format (must consist of lower case alphanumeric characters). Must start and end with an alphanumeric character), mismatch @ '%v'", allItems[i]))
 		}
 	}
 
+	logging.Debugf("parsePodNetworkObjectName: parsed: %s, %s, %s", netNsName, networkName, netIfName)
 	return netNsName, networkName, netIfName, nil
 }
 
-func parsePodNetworkObject(podnetwork string) ([]map[string]interface{}, error) {
-	var podNet []map[string]interface{}
+func parsePodNetworkAnnotation(podNetworks, defaultNamespace string) ([]*types.NetworkSelectionElement, error) {
+	var networks []*types.NetworkSelectionElement
 
-	if podnetwork == "" {
-		return nil, fmt.Errorf("parsePodNetworkObject: pod annotation not having \"network\" as key, refer Multus README.md for the usage guide")
+	logging.Debugf("parsePodNetworkAnnotation: %s, %s", podNetworks, defaultNamespace)
+	if podNetworks == "" {
+		return nil, logging.Errorf("parsePodNetworkAnnotation: pod annotation not having \"network\" as key, refer Multus README.md for the usage guide")
 	}
 
-	// Parse the podnetwork string, and assume it is JSON.
-	if err := json.Unmarshal([]byte(podnetwork), &podNet); err != nil {
-
-		// If JSON doesn't parse, assume comma-delimited.
-		commaItems := strings.Split(podnetwork, ",")
-
-		// Build a map from the comma delimited items.
-		for i := range commaItems {
-
+	if strings.IndexAny(podNetworks, "[{\"") >= 0 {
+		if err := json.Unmarshal([]byte(podNetworks), &networks); err != nil {
+			return nil, logging.Errorf("parsePodNetworkAnnotation: failed to parse pod Network Attachment Selection Annotation JSON format: %v", err)
+		}
+	} else {
+		// Comma-delimited list of network attachment object names
+		for _, item := range strings.Split(podNetworks, ",") {
 			// Remove leading and trailing whitespace.
-			commaItems[i] = strings.TrimSpace(commaItems[i])
+			item = strings.TrimSpace(item)
 
 			// Parse network name (i.e. <namespace>/<network name>@<ifname>)
-			netNsName, networkName, netIfName, err := parsePodNetworkObjectName(commaItems[i])
+			netNsName, networkName, netIfName, err := parsePodNetworkObjectName(item)
 			if err != nil {
-				return nil, fmt.Errorf("parsePodNetworkObject: %v", err)
-			}
-			m := make(map[string]interface{})
-			m["name"] = networkName
-			if netNsName != "" {
-				m["namespace"] = netNsName
-			}
-			if netIfName != "" {
-				m["interfaceRequest"] = netIfName
+				return nil, logging.Errorf("parsePodNetworkAnnotation: %v", err)
 			}
 
-			podNet = append(podNet, m)
+			networks = append(networks, &types.NetworkSelectionElement{
+				Name:             networkName,
+				Namespace:        netNsName,
+				InterfaceRequest: netIfName,
+			})
 		}
 	}
 
-	return podNet, nil
+	for _, net := range networks {
+		if net.Namespace == "" {
+			net.Namespace = defaultNamespace
+		}
+	}
+
+	return networks, nil
 }
 
-func getCNIConfig(name string, primary bool, ifname string, confdir string) (string, error) {
+func getCNIConfigFromFile(name string, confdir string) ([]byte, error) {
+	logging.Debugf("getCNIConfigFromFile: %s, %s", name, confdir)
 
 	// In the absence of valid keys in a Spec, the runtime (or
 	// meta-plugin) should load and execute a CNI .configlist
 	// or .config (in that order) file on-disk whose JSON
 	// “name” key matches this Network object’s name.
 
-	//Todo
-	// support conflist for chaining mechanism
 	// In part, adapted from K8s pkg/kubelet/dockershim/network/cni/cni.go#getDefaultCNINetwork
-	files, err := libcni.ConfFiles(confdir, []string{".conf", ".json"})
+	files, err := libcni.ConfFiles(confdir, []string{".conf", ".json", ".conflist"})
 	switch {
 	case err != nil:
-		fmt.Errorf("No networks found in %s", confdir)
+		return nil, logging.Errorf("No networks found in %s", confdir)
 	case len(files) == 0:
-		fmt.Errorf("No networks found in %s", confdir)
+		return nil, logging.Errorf("No networks found in %s", confdir)
 	}
 
 	for _, confFile := range files {
-		conf, err := libcni.ConfFromFile(confFile)
-		if err != nil {
-			return "", fmt.Errorf("Error loading CNI config file %s: %v", confFile, err)
-		}
-
-		if conf.Network.Name == name {
-			// Ensure the config has a "type" so we know what plugin to run.
-			// Also catches the case where somebody put a conflist into a conf file.
-			if conf.Network.Type == "" {
-				return "", fmt.Errorf("Error loading CNI config file %s: no 'type'; perhaps this is a .conflist?", confFile)
+		var confList *libcni.NetworkConfigList
+		if strings.HasSuffix(confFile, ".conflist") {
+			confList, err = libcni.ConfListFromFile(confFile)
+			if err != nil {
+				return nil, logging.Errorf("Error loading CNI conflist file %s: %v", confFile, err)
 			}
 
-			return getConfig(string(conf.Bytes[:]), primary, ifname), nil
+			if confList.Name == name {
+				return confList.Bytes, nil
+			}
 
+		} else {
+			conf, err := libcni.ConfFromFile(confFile)
+			if err != nil {
+				return nil, logging.Errorf("Error loading CNI config file %s: %v", confFile, err)
+			}
+
+			if conf.Network.Name == name {
+				// Ensure the config has a "type" so we know what plugin to run.
+				// Also catches the case where somebody put a conflist into a conf file.
+				if conf.Network.Type == "" {
+					return nil, logging.Errorf("Error loading CNI config file %s: no 'type'; perhaps this is a .conflist?", confFile)
+				}
+				return conf.Bytes, nil
+			}
 		}
 	}
 
-	return "", fmt.Errorf("no network available in the name %s in cni dir %s", name, confdir)
+	return nil, logging.Errorf("no network available in the name %s in cni dir %s", name, confdir)
 }
 
-func getPlugin(plugin string, name string, primary bool, ifname string) string {
-	tmpconfig := []string{}
-
-	tmpconfig = append(tmpconfig, fmt.Sprintf(`{"cniVersion": "0.3.1" , "name": "%s", "type": "%s"`, name, plugin))
-
-	if primary != false {
-		tmpconfig = append(tmpconfig, `, "masterplugin": true`)
-	}
-
-	if ifname != "" {
-		tmpconfig = append(tmpconfig, fmt.Sprintf(`, "ifnameRequest": "%s"`, ifname))
-	}
-
-	tmpconfig = append(tmpconfig, "}")
-
-	return strings.Join(tmpconfig, "")
-
-}
-
-func getConfig(config string, primary bool, ifname string) string {
-	tmpconfig := []string{}
-
-	config = strings.TrimSpace(config)
-	tmpconfig = append(tmpconfig, config[:1])
-
-	if primary != false {
-		tmpconfig = append(tmpconfig, ` "masterplugin": true,`)
-	}
-
-	if ifname != "" {
-		tmpconfig = append(tmpconfig, fmt.Sprintf(` "ifnameRequest": "%s",`, ifname))
-	}
-
-	tmpconfig = append(tmpconfig, config[1:])
-
-	return strings.Join(tmpconfig, "")
-
-}
-
-func getNetSpec(ns types.NetworkSpec, name string, primary bool, ifname string) (string, error) {
-
-	if ns.Plugin == "" && ns.Config == "" {
-		return "", fmt.Errorf("Network Object spec plugin and config can't be empty")
-	}
-
-	if ns.Plugin != "" && ns.Config != "" {
-		return "", fmt.Errorf("Network Object spec can't have both plugin and config")
-	}
-
-	if ns.Plugin != "" {
-		// Plugin contains the name of a CNI plugin on-disk in a
-		// runtime-defined path (eg /opt/cni/bin and/or other paths.
-		// This plugin should be executed with a basic CNI JSON
-		// configuration on stdin containing the Network object
-		// name and the plugin:
-		//   { “cniVersion”: “0.3.1”, “type”: <Plugin>, “name”: <Network.Name> }
-		// and any additional “runtimeConfig” field per the
-		// CNI specification and conventions.
-		return getPlugin(ns.Plugin, name, primary, ifname), nil
-	}
-
-	// Config contains a standard JSON-encoded CNI configuration
-	// or configuration list which defines the plugin chain to
-	// execute.  If present, this key takes precedence over
-	// ‘Plugin’.
-	return getConfig(ns.Config, primary, ifname), nil
-
-}
-
-func getNetObject(net types.Network, primary bool, ifname string, confdir string) (string, error) {
-	var config string
+// getCNIConfigFromSpec reads a CNI JSON configuration from the NetworkAttachmentDefinition
+// object's Spec.Config field and fills in any missing details like the network name
+func getCNIConfigFromSpec(configData, netName string) ([]byte, error) {
+	var rawConfig map[string]interface{}
 	var err error
 
-	if (types.NetworkSpec{}) == net.Spec {
-		config, err = getCNIConfig(net.Metadata.Name, primary, ifname, confdir)
+	logging.Debugf("getCNIConfigFromSpec: %s, %s", configData, netName)
+	configBytes := []byte(configData)
+	err = json.Unmarshal(configBytes, &rawConfig)
+	if err != nil {
+		return nil, logging.Errorf("getCNIConfigFromSpec: failed to unmarshal Spec.Config: %v", err)
+	}
+
+	// Inject network name if missing from Config for the thick plugin case
+	if n, ok := rawConfig["name"]; !ok || n == "" {
+		rawConfig["name"] = netName
+		configBytes, err = json.Marshal(rawConfig)
 		if err != nil {
-			return "", fmt.Errorf("getNetObject: err in getCNIConfig: %v", err)
+			return nil, logging.Errorf("getCNIConfigFromSpec: failed to re-marshal Spec.Config: %v", err)
+		}
+	}
+
+	return configBytes, nil
+}
+
+func cniConfigFromNetworkResource(customResource *types.NetworkAttachmentDefinition, confdir string) ([]byte, error) {
+	var config []byte
+	var err error
+
+	logging.Debugf("cniConfigFromNetworkResource: %v, %s", customResource, confdir)
+	emptySpec := types.NetworkAttachmentDefinitionSpec{}
+	if customResource.Spec == emptySpec {
+		// Network Spec empty; generate delegate from CNI JSON config
+		// from the configuration directory that has the same network
+		// name as the custom resource
+		config, err = getCNIConfigFromFile(customResource.Metadata.Name, confdir)
+		if err != nil {
+			return nil, logging.Errorf("cniConfigFromNetworkResource: err in getCNIConfigFromFile: %v", err)
 		}
 	} else {
-		config, err = getNetSpec(net.Spec, net.Metadata.Name, primary, ifname)
+		// Config contains a standard JSON-encoded CNI configuration
+		// or configuration list which defines the plugin chain to
+		// execute.
+		config, err = getCNIConfigFromSpec(customResource.Spec.Config, customResource.Metadata.Name)
 		if err != nil {
-			return "", fmt.Errorf("getNetObject: err in getNetSpec: %v", err)
+			return nil, logging.Errorf("cniConfigFromNetworkResource: err in getCNIConfigFromSpec: %v", err)
 		}
 	}
 
 	return config, nil
 }
 
-func getnetplugin(client *kubernetes.Clientset, networkinfo map[string]interface{}, primary bool, confdir string) (string, error) {
-	networkname := networkinfo["name"].(string)
-	if networkname == "" {
-		return "", fmt.Errorf("getnetplugin: network name can't be empty")
-	}
-
-	netNsName := "default"
-	if networkinfo["namespace"] != nil {
-		netNsName = networkinfo["namespace"].(string)
-	}
-
-	tprclient := fmt.Sprintf("/apis/kubernetes.cni.cncf.io/v1/namespaces/%s/networks/%s", netNsName, networkname)
-
-	netobjdata, err := client.ExtensionsV1beta1().RESTClient().Get().AbsPath(tprclient).DoRaw()
+func getKubernetesDelegate(client KubeClient, net *types.NetworkSelectionElement, confdir string) (*types.DelegateNetConf, error) {
+	logging.Debugf("getKubernetesDelegate: %v, %v, %s", client, net, confdir)
+	rawPath := fmt.Sprintf("/apis/k8s.cni.cncf.io/v1/namespaces/%s/network-attachment-definitions/%s", net.Namespace, net.Name)
+	netData, err := client.GetRawWithPath(rawPath)
 	if err != nil {
-		return "", fmt.Errorf("getnetplugin: failed to get CRD (result: %s), refer Multus README.md for the usage guide: %v", netobjdata, err)
+		return nil, logging.Errorf("getKubernetesDelegate: failed to get network resource, refer Multus README.md for the usage guide: %v", err)
 	}
 
-	netobj := types.Network{}
-	if err := json.Unmarshal(netobjdata, &netobj); err != nil {
-		return "", fmt.Errorf("getnetplugin: failed to get the netplugin data: %v", err)
+	customResource := &types.NetworkAttachmentDefinition{}
+	if err := json.Unmarshal(netData, customResource); err != nil {
+		return nil, logging.Errorf("getKubernetesDelegate: failed to get the netplugin data: %v", err)
 	}
 
-	ifnameRequest := ""
-	if networkinfo["interfaceRequest"] != nil {
-		ifnameRequest = networkinfo["interfaceRequest"].(string)
-	}
-
-	netargs, err := getNetObject(netobj, primary, ifnameRequest, confdir)
+	configBytes, err := cniConfigFromNetworkResource(customResource, confdir)
 	if err != nil {
-		return "", err
+		return nil, err
 	}
 
-	return netargs, nil
+	delegate, err := types.LoadDelegateNetConf(configBytes, net.InterfaceRequest)
+	if err != nil {
+		return nil, err
+	}
+
+	return delegate, nil
 }
 
-func getPodNetworkObj(client *kubernetes.Clientset, netObjs []map[string]interface{}, confdir string) (string, error) {
+type KubeClient interface {
+	GetRawWithPath(path string) ([]byte, error)
+	GetPod(namespace, name string) (*v1.Pod, error)
+	UpdatePodStatus(pod *v1.Pod) (*v1.Pod, error)
+}
 
-	var np string
+func GetK8sArgs(args *skel.CmdArgs) (*types.K8sArgs, error) {
+	k8sArgs := &types.K8sArgs{}
+
+	logging.Debugf("GetK8sNetwork: %v", args)
+	err := cnitypes.LoadArgs(args.Args, k8sArgs)
+	if err != nil {
+		return nil, err
+	}
+
+	return k8sArgs, nil
+}
+
+// Attempts to load Kubernetes-defined delegates and add them to the Multus config.
+// Returns the number of Kubernetes-defined delegates added or an error.
+func TryLoadK8sDelegates(k8sArgs *types.K8sArgs, conf *types.NetConf, kubeClient KubeClient) (int, *clientInfo, error) {
 	var err error
+	clientInfo := &clientInfo{}
 
-	var str bytes.Buffer
-	str.WriteString("[")
+	logging.Debugf("TryLoadK8sDelegates: %v, %v, %v", k8sArgs, conf, kubeClient)
+	kubeClient, err = GetK8sClient(conf.Kubeconfig, kubeClient)
+	if err != nil {
+		return 0, nil, err
+	}
 
-	for index, net := range netObjs {
-		var primary bool
-
-		if index == 0 {
-			primary = true
+	if kubeClient == nil {
+		if len(conf.Delegates) == 0 {
+			// No available kube client and no delegates, we can't do anything
+			return 0, nil, logging.Errorf("must have either Kubernetes config or delegates, refer Multus README.md for the usage guide")
 		}
+		return 0, nil, nil
+	}
 
-		np, err = getnetplugin(client, net, primary, confdir)
+	setKubeClientInfo(clientInfo, kubeClient, k8sArgs)
+	delegates, err := GetK8sNetwork(kubeClient, k8sArgs, conf.ConfDir)
+	if err != nil {
+		if _, ok := err.(*NoK8sNetworkError); ok {
+			return 0, clientInfo, nil
+		}
+		return 0, nil, logging.Errorf("Multus: Err in getting k8s network from pod: %v", err)
+	}
+
+	if err = conf.AddDelegates(delegates); err != nil {
+		return 0, nil, err
+	}
+
+	return len(delegates), clientInfo, nil
+}
+
+func GetK8sClient(kubeconfig string, kubeClient KubeClient) (KubeClient, error) {
+	logging.Debugf("GetK8sClient: %s, %v", kubeconfig, kubeClient)
+	// If we get a valid kubeClient (eg from testcases) just return that
+	// one.
+	if kubeClient != nil {
+		return kubeClient, nil
+	}
+
+	var err error
+	var config *rest.Config
+
+	// Otherwise try to create a kubeClient from a given kubeConfig
+	if kubeconfig != "" {
+		// uses the current context in kubeconfig
+		config, err = clientcmd.BuildConfigFromFlags("", kubeconfig)
 		if err != nil {
-			return "", fmt.Errorf("getPodNetworkObj: failed in getting the netplugin: %v", err)
+			return nil, logging.Errorf("GetK8sClient: failed to get context for the kubeconfig %v, refer Multus README.md for the usage guide: %v", kubeconfig, err)
 		}
-
-		str.WriteString(np)
-		if index != (len(netObjs) - 1) {
-			str.WriteString(",")
+	} else if os.Getenv("KUBERNETES_SERVICE_HOST") != "" && os.Getenv("KUBERNETES_SERVICE_PORT") != "" {
+		// Try in-cluster config where multus might be running in a kubernetes pod
+		config, err = rest.InClusterConfig()
+		if err != nil {
+			return nil, logging.Errorf("createK8sClient: failed to get context for in-cluster kube config, refer Multus README.md for the usage guide: %v", err)
 		}
+	} else {
+		// No kubernetes config; assume we shouldn't talk to Kube at all
+		return nil, nil
 	}
 
-	str.WriteString("]")
-	netconf := str.String()
-	return netconf, nil
+	// creates the clientset
+	client, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		return nil, err
+	}
+
+	return &defaultKubeClient{client: client}, nil
 }
 
-func getMultusDelegates(delegate string) ([]map[string]interface{}, error) {
-	tmpNetconf := &types.NetConf{}
-	tmpDelegate := "{\"delegates\": " + delegate + "}"
+func GetK8sNetwork(k8sclient KubeClient, k8sArgs *types.K8sArgs, confdir string) ([]*types.DelegateNetConf, error) {
+	logging.Debugf("GetK8sNetwork: %v, %v, %v", k8sclient, k8sArgs, confdir)
 
-	if delegate == "" {
-		return nil, fmt.Errorf("getMultusDelegates: TPR network obj data can't be empty")
-	}
-
-	if err := json.Unmarshal([]byte(tmpDelegate), tmpNetconf); err != nil {
-		return nil, fmt.Errorf("getMultusDelegates: failed to load netconf for delegate %v: %v", delegate, err)
-	}
-
-	if tmpNetconf.Delegates == nil {
-		return nil, fmt.Errorf(`getMultusDelegates: "delegates" is must, refer Multus README.md for the usage guide`)
-	}
-
-	return tmpNetconf.Delegates, nil
-}
-
-func GetK8sNetwork(args *skel.CmdArgs, kubeconfig string, confdir string) ([]map[string]interface{}, error) {
-	k8sArgs := types.K8sArgs{}
-	var podNet []map[string]interface{}
-
-	err := cnitypes.LoadArgs(args.Args, &k8sArgs)
+	netAnnot, defaultNamespace, err := getPodNetworkAnnotation(k8sclient, k8sArgs)
 	if err != nil {
-		return podNet, err
-	}
-
-	k8sclient, err := createK8sClient(kubeconfig)
-	if err != nil {
-		return podNet, err
-	}
-
-	netAnnot, err := getPodNetworkAnnotation(k8sclient, k8sArgs)
-	if err != nil {
-		return podNet, err
+		return nil, err
 	}
 
 	if len(netAnnot) == 0 {
-		return podNet, &NoK8sNetworkError{"no kubernetes network found"}
+		return nil, &NoK8sNetworkError{"no kubernetes network found"}
 	}
 
-	netObjs, err := parsePodNetworkObject(netAnnot)
+	networks, err := parsePodNetworkAnnotation(netAnnot, defaultNamespace)
 	if err != nil {
-		return podNet, err
+		return nil, err
 	}
 
-	multusDelegates, err := getPodNetworkObj(k8sclient, netObjs, confdir)
-	if err != nil {
-		return podNet, err
+	// Read all network objects referenced by 'networks'
+	var delegates []*types.DelegateNetConf
+	for _, net := range networks {
+		delegate, err := getKubernetesDelegate(k8sclient, net, confdir)
+		if err != nil {
+			return nil, logging.Errorf("GetK8sNetwork: failed getting the delegate: %v", err)
+		}
+		delegates = append(delegates, delegate)
 	}
 
-	podNet, err = getMultusDelegates(multusDelegates)
-	if err != nil {
-		return podNet, err
-	}
-
-	return podNet, nil
+	return delegates, nil
 }

k8sclient/k8sclient_test.go

@@ -0,0 +1,279 @@
+// Copyright (c) 2017 Intel Corporation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package k8sclient
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"testing"
+
+	testutils "github.com/intel/multus-cni/testing"
+
+	"github.com/containernetworking/cni/pkg/skel"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+func TestK8sClient(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "k8sclient")
+}
+
+var _ = Describe("k8sclient operations", func() {
+	var tmpDir string
+	var err error
+
+	BeforeEach(func() {
+		tmpDir, err = ioutil.TempDir("", "multus_tmp")
+		Expect(err).NotTo(HaveOccurred())
+	})
+
+	AfterEach(func() {
+		err := os.RemoveAll(tmpDir)
+		Expect(err).NotTo(HaveOccurred())
+	})
+
+	It("retrieves delegates from kubernetes using simple format annotation", func() {
+		fakePod := testutils.NewFakePod("testpod", "net1,net2")
+		net1 := `{
+	"name": "net1",
+	"type": "mynet",
+	"cniVersion": "0.2.0"
+}`
+		net2 := `{
+	"name": "net2",
+	"type": "mynet2",
+	"cniVersion": "0.2.0"
+}`
+		net3 := `{
+	"name": "net3",
+	"type": "mynet3",
+	"cniVersion": "0.2.0"
+}`
+		args := &skel.CmdArgs{
+			Args: fmt.Sprintf("K8S_POD_NAME=%s;K8S_POD_NAMESPACE=%s", fakePod.ObjectMeta.Name, fakePod.ObjectMeta.Namespace),
+		}
+
+		fKubeClient := testutils.NewFakeKubeClient()
+		fKubeClient.AddPod(fakePod)
+		fKubeClient.AddNetConfig(fakePod.ObjectMeta.Namespace, "net1", net1)
+		fKubeClient.AddNetConfig(fakePod.ObjectMeta.Namespace, "net2", net2)
+		// net3 is not used; make sure it's not accessed
+		fKubeClient.AddNetConfig(fakePod.ObjectMeta.Namespace, "net3", net3)
+
+		kubeClient, err := GetK8sClient("", fKubeClient)
+		Expect(err).NotTo(HaveOccurred())
+		k8sArgs, err := GetK8sArgs(args)
+		Expect(err).NotTo(HaveOccurred())
+		delegates, err := GetK8sNetwork(kubeClient, k8sArgs, tmpDir)
+		Expect(err).NotTo(HaveOccurred())
+		Expect(fKubeClient.PodCount).To(Equal(1))
+		Expect(fKubeClient.NetCount).To(Equal(2))
+
+		Expect(len(delegates)).To(Equal(2))
+		Expect(delegates[0].Conf.Name).To(Equal("net1"))
+		Expect(delegates[0].Conf.Type).To(Equal("mynet"))
+		Expect(delegates[0].MasterPlugin).To(BeFalse())
+		Expect(delegates[1].Conf.Name).To(Equal("net2"))
+		Expect(delegates[1].Conf.Type).To(Equal("mynet2"))
+		Expect(delegates[1].MasterPlugin).To(BeFalse())
+	})
+
+	It("fails when the network does not exist", func() {
+		fakePod := testutils.NewFakePod("testpod", "net1,net2")
+		net3 := `{
+	"name": "net3",
+	"type": "mynet3",
+	"cniVersion": "0.2.0"
+}`
+		args := &skel.CmdArgs{
+			Args: fmt.Sprintf("K8S_POD_NAME=%s;K8S_POD_NAMESPACE=%s", fakePod.ObjectMeta.Name, fakePod.ObjectMeta.Namespace),
+		}
+
+		fKubeClient := testutils.NewFakeKubeClient()
+		fKubeClient.AddPod(fakePod)
+		fKubeClient.AddNetConfig(fakePod.ObjectMeta.Namespace, "net3", net3)
+
+		kubeClient, err := GetK8sClient("", fKubeClient)
+		Expect(err).NotTo(HaveOccurred())
+		k8sArgs, err := GetK8sArgs(args)
+		Expect(err).NotTo(HaveOccurred())
+		delegates, err := GetK8sNetwork(kubeClient, k8sArgs, tmpDir)
+		Expect(len(delegates)).To(Equal(0))
+		Expect(err).To(MatchError("GetK8sNetwork: failed getting the delegate: getKubernetesDelegate: failed to get network resource, refer Multus README.md for the usage guide: resource not found"))
+	})
+
+	It("retrieves delegates from kubernetes using JSON format annotation", func() {
+		fakePod := testutils.NewFakePod("testpod", `[
+{"name":"net1"},
+{
+  "name":"net2",
+  "ipRequest": "1.2.3.4",
+  "macRequest": "aa:bb:cc:dd:ee:ff"
+},
+{
+  "name":"net3",
+  "namespace":"other-ns"
+}
+]`)
+		args := &skel.CmdArgs{
+			Args: fmt.Sprintf("K8S_POD_NAME=%s;K8S_POD_NAMESPACE=%s", fakePod.ObjectMeta.Name, fakePod.ObjectMeta.Namespace),
+		}
+
+		fKubeClient := testutils.NewFakeKubeClient()
+		fKubeClient.AddPod(fakePod)
+		fKubeClient.AddNetConfig(fakePod.ObjectMeta.Namespace, "net1", `{
+	"name": "net1",
+	"type": "mynet",
+	"cniVersion": "0.2.0"
+}`)
+		fKubeClient.AddNetConfig(fakePod.ObjectMeta.Namespace, "net2", `{
+	"name": "net2",
+	"type": "mynet2",
+	"cniVersion": "0.2.0"
+}`)
+		fKubeClient.AddNetConfig("other-ns", "net3", `{
+	"name": "net3",
+	"type": "mynet3",
+	"cniVersion": "0.2.0"
+}`)
+
+		kubeClient, err := GetK8sClient("", fKubeClient)
+		Expect(err).NotTo(HaveOccurred())
+		k8sArgs, err := GetK8sArgs(args)
+		Expect(err).NotTo(HaveOccurred())
+		delegates, err := GetK8sNetwork(kubeClient, k8sArgs, tmpDir)
+		Expect(err).NotTo(HaveOccurred())
+		Expect(fKubeClient.PodCount).To(Equal(1))
+		Expect(fKubeClient.NetCount).To(Equal(3))
+
+		Expect(len(delegates)).To(Equal(3))
+		Expect(delegates[0].Conf.Name).To(Equal("net1"))
+		Expect(delegates[0].Conf.Type).To(Equal("mynet"))
+		Expect(delegates[1].Conf.Name).To(Equal("net2"))
+		Expect(delegates[1].Conf.Type).To(Equal("mynet2"))
+		Expect(delegates[2].Conf.Name).To(Equal("net3"))
+		Expect(delegates[2].Conf.Type).To(Equal("mynet3"))
+	})
+
+	It("fails when the JSON format annotation is invalid", func() {
+		fakePod := testutils.NewFakePod("testpod", "[adsfasdfasdfasf]")
+		args := &skel.CmdArgs{
+			Args: fmt.Sprintf("K8S_POD_NAME=%s;K8S_POD_NAMESPACE=%s", fakePod.ObjectMeta.Name, fakePod.ObjectMeta.Namespace),
+		}
+
+		fKubeClient := testutils.NewFakeKubeClient()
+		fKubeClient.AddPod(fakePod)
+
+		kubeClient, err := GetK8sClient("", fKubeClient)
+		Expect(err).NotTo(HaveOccurred())
+		k8sArgs, err := GetK8sArgs(args)
+		Expect(err).NotTo(HaveOccurred())
+		delegates, err := GetK8sNetwork(kubeClient, k8sArgs, tmpDir)
+		Expect(len(delegates)).To(Equal(0))
+		Expect(err).To(MatchError("parsePodNetworkAnnotation: failed to parse pod Network Attachment Selection Annotation JSON format: invalid character 'a' looking for beginning of value"))
+	})
+
+	It("retrieves delegates from kubernetes using on-disk config files", func() {
+		fakePod := testutils.NewFakePod("testpod", "net1,net2")
+		args := &skel.CmdArgs{
+			Args: fmt.Sprintf("K8S_POD_NAME=%s;K8S_POD_NAMESPACE=%s", fakePod.ObjectMeta.Name, fakePod.ObjectMeta.Namespace),
+		}
+
+		fKubeClient := testutils.NewFakeKubeClient()
+		fKubeClient.AddPod(fakePod)
+		net1Name := filepath.Join(tmpDir, "10-net1.conf")
+		fKubeClient.AddNetFile(fakePod.ObjectMeta.Namespace, "net1", net1Name, `{
+	"name": "net1",
+	"type": "mynet",
+	"cniVersion": "0.2.0"
+}`)
+		net2Name := filepath.Join(tmpDir, "20-net2.conf")
+		fKubeClient.AddNetFile(fakePod.ObjectMeta.Namespace, "net2", net2Name, `{
+	"name": "net2",
+	"type": "mynet2",
+	"cniVersion": "0.2.0"
+}`)
+
+		kubeClient, err := GetK8sClient("", fKubeClient)
+		Expect(err).NotTo(HaveOccurred())
+		k8sArgs, err := GetK8sArgs(args)
+		Expect(err).NotTo(HaveOccurred())
+		delegates, err := GetK8sNetwork(kubeClient, k8sArgs, tmpDir)
+		Expect(err).NotTo(HaveOccurred())
+		Expect(fKubeClient.PodCount).To(Equal(1))
+		Expect(fKubeClient.NetCount).To(Equal(2))
+
+		Expect(len(delegates)).To(Equal(2))
+		Expect(delegates[0].Conf.Name).To(Equal("net1"))
+		Expect(delegates[0].Conf.Type).To(Equal("mynet"))
+		Expect(delegates[1].Conf.Name).To(Equal("net2"))
+		Expect(delegates[1].Conf.Type).To(Equal("mynet2"))
+	})
+
+	It("injects network name into minimal thick plugin CNI config", func() {
+		fakePod := testutils.NewFakePod("testpod", "net1")
+		args := &skel.CmdArgs{
+			Args: fmt.Sprintf("K8S_POD_NAME=%s;K8S_POD_NAMESPACE=%s", fakePod.ObjectMeta.Name, fakePod.ObjectMeta.Namespace),
+		}
+
+		fKubeClient := testutils.NewFakeKubeClient()
+		fKubeClient.AddPod(fakePod)
+		fKubeClient.AddNetConfig(fakePod.ObjectMeta.Namespace, "net1", "{\"type\": \"mynet\"}")
+
+		kubeClient, err := GetK8sClient("", fKubeClient)
+		Expect(err).NotTo(HaveOccurred())
+		k8sArgs, err := GetK8sArgs(args)
+		Expect(err).NotTo(HaveOccurred())
+		delegates, err := GetK8sNetwork(kubeClient, k8sArgs, tmpDir)
+		Expect(err).NotTo(HaveOccurred())
+		Expect(fKubeClient.PodCount).To(Equal(1))
+		Expect(fKubeClient.NetCount).To(Equal(1))
+
+		Expect(len(delegates)).To(Equal(1))
+		Expect(delegates[0].Conf.Name).To(Equal("net1"))
+		Expect(delegates[0].Conf.Type).To(Equal("mynet"))
+	})
+
+	It("fails when on-disk config file is not valid", func() {
+		fakePod := testutils.NewFakePod("testpod", "net1,net2")
+		args := &skel.CmdArgs{
+			Args: fmt.Sprintf("K8S_POD_NAME=%s;K8S_POD_NAMESPACE=%s", fakePod.ObjectMeta.Name, fakePod.ObjectMeta.Namespace),
+		}
+
+		fKubeClient := testutils.NewFakeKubeClient()
+		fKubeClient.AddPod(fakePod)
+		net1Name := filepath.Join(tmpDir, "10-net1.conf")
+		fKubeClient.AddNetFile(fakePod.ObjectMeta.Namespace, "net1", net1Name, `{
+	"name": "net1",
+	"type": "mynet",
+	"cniVersion": "0.2.0"
+}`)
+		net2Name := filepath.Join(tmpDir, "20-net2.conf")
+		fKubeClient.AddNetFile(fakePod.ObjectMeta.Namespace, "net2", net2Name, "asdfasdfasfdasfd")
+
+		kubeClient, err := GetK8sClient("", fKubeClient)
+		Expect(err).NotTo(HaveOccurred())
+		k8sArgs, err := GetK8sArgs(args)
+		Expect(err).NotTo(HaveOccurred())
+		delegates, err := GetK8sNetwork(kubeClient, k8sArgs, tmpDir)
+		Expect(len(delegates)).To(Equal(0))
+		Expect(err).To(MatchError(fmt.Sprintf("GetK8sNetwork: failed getting the delegate: cniConfigFromNetworkResource: err in getCNIConfigFromFile: Error loading CNI config file %s: error parsing configuration: invalid character 'a' looking for beginning of value", net2Name)))
+	})
+})

logging/logging.go

@@ -0,0 +1,132 @@
+// Copyright (c) 2018 Intel Corporation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package logging
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+)
+
+// Level type
+type Level uint32
+
+const (
+	PanicLevel Level = iota
+	ErrorLevel
+	DebugLevel
+	MaxLevel
+	UnknownLevel
+)
+
+var loggingStderr bool
+var loggingFp *os.File
+var loggingLevel Level
+
+const defaultTimestampFormat = time.RFC3339
+
+func (l Level) String() string {
+	switch l {
+	case PanicLevel:
+		return "panic"
+	case ErrorLevel:
+		return "error"
+	case DebugLevel:
+		return "debug"
+	}
+	return "unknown"
+}
+
+func Printf(level Level, format string, a ...interface{}) {
+	header := "%s [%s] "
+	t := time.Now()
+	if level > loggingLevel {
+		return
+	}
+
+	if loggingStderr {
+		fmt.Fprintf(os.Stderr, header, t.Format(defaultTimestampFormat), level)
+		fmt.Fprintf(os.Stderr, format, a...)
+		fmt.Fprintf(os.Stderr, "\n")
+	}
+
+	if loggingFp != nil {
+		fmt.Fprintf(loggingFp, header, t.Format(defaultTimestampFormat), level)
+		fmt.Fprintf(loggingFp, format, a...)
+		fmt.Fprintf(loggingFp, "\n")
+	}
+}
+
+func Debugf(format string, a ...interface{}) {
+	Printf(DebugLevel, format, a...)
+}
+
+func Errorf(format string, a ...interface{}) error {
+	Printf(ErrorLevel, format, a...)
+	return fmt.Errorf(format, a...)
+}
+
+func Panicf(format string, a ...interface{}) {
+	Printf(PanicLevel, format, a...)
+	Printf(PanicLevel, "========= Stack trace output ========")
+	Printf(PanicLevel, "%+v", errors.New("Multus Panic"))
+	Printf(PanicLevel, "========= Stack trace output end ========")
+}
+
+func GetLoggingLevel(levelStr string) Level {
+	switch strings.ToLower(levelStr) {
+	case "debug":
+		return DebugLevel
+	case "error":
+		return ErrorLevel
+	case "panic":
+		return PanicLevel
+	}
+	fmt.Fprintf(os.Stderr, "multus logging: cannot set logging level to %s\n", levelStr)
+	return UnknownLevel
+}
+
+func SetLogLevel(levelStr string) {
+	level := GetLoggingLevel(levelStr)
+	if level < MaxLevel {
+		loggingLevel = level
+	}
+}
+
+func SetLogStderr(enable bool) {
+	loggingStderr = enable
+}
+
+func SetLogFile(filename string) {
+	if filename == "" {
+		return
+	}
+
+	fp, err := os.OpenFile(filename, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0644)
+	if err != nil {
+		loggingFp = nil
+		fmt.Fprintf(os.Stderr, "multus logging: cannot open %s", filename)
+	}
+	loggingFp = fp
+}
+
+func init() {
+	loggingStderr = true
+	loggingFp = nil
+	loggingLevel = PanicLevel
+}

logging/logging_test.go

@@ -0,0 +1,68 @@
+// Copyright (c) 2018 Intel Corporation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package logging
+
+import (
+	"testing"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+func TestLogging(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "Logging")
+}
+
+var _ = Describe("logging operations", func() {
+
+	BeforeEach(func() {
+		loggingStderr = false
+		loggingFp = nil
+		loggingLevel = PanicLevel
+	})
+
+	It("Check file setter with empty", func() {
+		SetLogFile("")
+		Expect(loggingFp).To(BeNil())
+	})
+
+	It("Check file setter with empty", func() {
+		SetLogFile("/tmp/foobar.logging")
+		Expect(loggingFp).NotTo(Equal(nil))
+		// check file existance
+	})
+
+	It("Check loglevel setter", func() {
+		SetLogLevel("debug")
+		Expect(loggingLevel).To(Equal(DebugLevel))
+		SetLogLevel("Error")
+		Expect(loggingLevel).To(Equal(ErrorLevel))
+		SetLogLevel("PANIC")
+		Expect(loggingLevel).To(Equal(PanicLevel))
+	})
+
+	It("Check loglevel setter with invalid level", func() {
+		currentLevel := loggingLevel
+		SetLogLevel("XXXX")
+		Expect(loggingLevel).To(Equal(currentLevel))
+	})
+
+	It("Check log to stderr setter with invalid level", func() {
+		currentVal := loggingStderr
+		SetLogStderr(!currentVal)
+		Expect(loggingStderr).NotTo(Equal(currentVal))
+	})
+})

multus/multus.go

@@ -25,153 +25,76 @@ import (
 	"os"
 	"path/filepath"
 
-	k8s "github.com/intel/multus-cni/k8sclient"
-	"github.com/intel/multus-cni/types"
+	"github.com/containernetworking/cni/libcni"
 	"github.com/containernetworking/cni/pkg/invoke"
-	"github.com/containernetworking/cni/pkg/ns"
 	"github.com/containernetworking/cni/pkg/skel"
+	cnitypes "github.com/containernetworking/cni/pkg/types"
 	"github.com/containernetworking/cni/pkg/version"
+	"github.com/containernetworking/plugins/pkg/ns"
+	k8s "github.com/intel/multus-cni/k8sclient"
+	"github.com/intel/multus-cni/logging"
+	"github.com/intel/multus-cni/types"
 	"github.com/vishvananda/netlink"
 )
 
-const (
-	defaultCNIDir  = "/var/lib/cni/multus"
-	defaultConfDir = "/etc/cni/multus/net.d"
-)
-
-var masterpluginEnabled bool
-var defaultcninetwork bool
-
-//taken from cni/plugins/meta/flannel/flannel.go
-func isString(i interface{}) bool {
-	_, ok := i.(string)
-	return ok
-}
-
-func isBool(i interface{}) bool {
-	_, ok := i.(bool)
-	return ok
-}
-
-func loadNetConf(bytes []byte) (*types.NetConf, error) {
-	netconf := &types.NetConf{}
-	if err := json.Unmarshal(bytes, netconf); err != nil {
-		return nil, fmt.Errorf("failed to load netconf: %v", err)
-	}
-
-	if netconf.Kubeconfig != "" && netconf.Delegates != nil {
-		defaultcninetwork = true
-	}
-
-	if netconf.CNIDir == "" {
-		netconf.CNIDir = defaultCNIDir
-	}
-
-	if netconf.ConfDir == "" {
-		netconf.ConfDir = defaultConfDir
-	}
-
-	if netconf.Kubeconfig == "" || !defaultcninetwork {
-		return nil, fmt.Errorf(`You must also set the delegates & the kubeconfig, refer to the README`)
-	}
-
-	if len(netconf.Delegates) == 0 && !defaultcninetwork {
-		return nil, fmt.Errorf(`delegates or kubeconfig option is must, refer README.md`)
-	}
-
-	// default network in multus conf as master plugin
-	netconf.Delegates[0]["masterplugin"] = true
-
-	return netconf, nil
-}
-
 func saveScratchNetConf(containerID, dataDir string, netconf []byte) error {
+	logging.Debugf("saveScratchNetConf: %s, %s, %s", containerID, dataDir, string(netconf))
 	if err := os.MkdirAll(dataDir, 0700); err != nil {
-		return fmt.Errorf("failed to create the multus data directory(%q): %v", dataDir, err)
+		return logging.Errorf("failed to create the multus data directory(%q): %v", dataDir, err)
 	}
 
 	path := filepath.Join(dataDir, containerID)
 
 	err := ioutil.WriteFile(path, netconf, 0600)
 	if err != nil {
-		return fmt.Errorf("failed to write container data in the path(%q): %v", path, err)
+		return logging.Errorf("failed to write container data in the path(%q): %v", path, err)
 	}
 
 	return err
 }
 
 func consumeScratchNetConf(containerID, dataDir string) ([]byte, error) {
+	logging.Debugf("consumeScratchNetConf: %s, %s", containerID, dataDir)
 	path := filepath.Join(dataDir, containerID)
 	defer os.Remove(path)
 
 	return ioutil.ReadFile(path)
 }
 
-func getifname() (f func() string) {
-	var interfaceIndex int
-	f = func() string {
-		ifname := fmt.Sprintf("net%d", interfaceIndex)
-		interfaceIndex++
-		return ifname
+func getIfname(delegate *types.DelegateNetConf, argif string, idx int) string {
+	logging.Debugf("getIfname: %v, %s, %d", delegate, argif, idx)
+	if delegate.IfnameRequest != "" {
+		return delegate.IfnameRequest
+	}
+	if delegate.MasterPlugin {
+		// master plugin always uses the CNI-provided interface name
+		return argif
 	}
 
-	return
+	// Otherwise construct a unique interface name from the delegate's
+	// position in the delegate list
+	return fmt.Sprintf("net%d", idx)
 }
 
-func saveDelegates(containerID, dataDir string, delegates []map[string]interface{}) error {
+func saveDelegates(containerID, dataDir string, delegates []*types.DelegateNetConf) error {
+	logging.Debugf("saveDelegates: %s, %s, %v", containerID, dataDir, delegates)
 	delegatesBytes, err := json.Marshal(delegates)
 	if err != nil {
-		return fmt.Errorf("error serializing delegate netconf: %v", err)
+		return logging.Errorf("error serializing delegate netconf: %v", err)
 	}
 
 	if err = saveScratchNetConf(containerID, dataDir, delegatesBytes); err != nil {
-		return fmt.Errorf("error in saving the  delegates : %v", err)
+		return logging.Errorf("error in saving the  delegates : %v", err)
 	}
 
 	return err
 }
 
-func checkDelegate(netconf map[string]interface{}) error {
-	if netconf["type"] == nil {
-		return fmt.Errorf("delegate must have the field 'type'")
-	}
-
-	if !isString(netconf["type"]) {
-		return fmt.Errorf("delegate field 'type' must be a string")
-	}
-
-	if netconf["masterplugin"] != nil {
-		if !isBool(netconf["masterplugin"]) {
-			return fmt.Errorf("delegate field 'masterplugin' must be a bool")
-		}
-	}
-
-	if netconf["masterplugin"] != nil {
-		if netconf["masterplugin"].(bool) != false && masterpluginEnabled != true {
-			masterpluginEnabled = true
-		} else if netconf["masterplugin"].(bool) != false && masterpluginEnabled == true {
-			return fmt.Errorf("only one delegate can have 'masterplugin'")
-		}
-	}
-	return nil
-}
-
-func isMasterplugin(netconf map[string]interface{}) bool {
-	if netconf["masterplugin"] == nil {
-		return false
-	}
-
-	if netconf["masterplugin"].(bool) == true {
-		return true
-	}
-
-	return false
-}
-
 func validateIfName(nsname string, ifname string) error {
+	logging.Debugf("validateIfName: %s, %s", nsname, ifname)
 	podNs, err := ns.GetNS(nsname)
 	if err != nil {
-		return fmt.Errorf("no netns: %v", err)
+		return logging.Errorf("no netns: %v", err)
 	}
 
 	err = podNs.Do(func(_ ns.NetNS) error {
@@ -182,234 +105,281 @@ func validateIfName(nsname string, ifname string) error {
 			}
 			return err
 		}
-		return fmt.Errorf("ifname %s is already exist", ifname)
+		return logging.Errorf("ifname %s is already exist", ifname)
 	})
 
 	return err
 }
 
-func delegateAdd(podif func() string, argif string, netconf map[string]interface{}, onlyMaster bool) (bool, error) {
-	netconfBytes, err := json.Marshal(netconf)
+func conflistAdd(rt *libcni.RuntimeConf, rawnetconflist []byte, binDir string) (cnitypes.Result, error) {
+	logging.Debugf("conflistAdd: %v, %s, %s", rt, string(rawnetconflist), binDir)
+	// In part, adapted from K8s pkg/kubelet/dockershim/network/cni/cni.go
+	binDirs := []string{binDir}
+	cniNet := libcni.CNIConfig{Path: binDirs}
+
+	confList, err := libcni.ConfListFromBytes(rawnetconflist)
 	if err != nil {
-		return true, fmt.Errorf("Multus: error serializing multus delegate netconf: %v", err)
+		return nil, logging.Errorf("error in converting the raw bytes to conflist: %v", err)
 	}
 
-	if isMasterplugin(netconf) != onlyMaster {
-		return true, nil
-	}
-
-	if !isMasterplugin(netconf) {
-		if os.Setenv("CNI_IFNAME", podif()) != nil {
-			return true, fmt.Errorf("Multus: error in setting CNI_IFNAME")
-		}
-	} else {
-		if os.Setenv("CNI_IFNAME", argif) != nil {
-			return true, fmt.Errorf("Multus: error in setting CNI_IFNAME")
-		}
-	}
-
-	if netconf["ifnameRequest"] != nil {
-		if os.Setenv("CNI_IFNAME", netconf["ifnameRequest"].(string)) != nil {
-			return true, fmt.Errorf("Multus: error in setting CNI_IFNAME")
-		}
-	}
-
-	err = validateIfName(os.Getenv("CNI_NETNS"), os.Getenv("CNI_IFNAME"))
+	result, err := cniNet.AddNetworkList(confList, rt)
 	if err != nil {
-		return true, fmt.Errorf("cannot set %q ifname: %v", netconf["type"].(string), err)
+		return nil, logging.Errorf("error in getting result from AddNetworkList: %v", err)
 	}
 
-	result, err := invoke.DelegateAdd(netconf["type"].(string), netconfBytes)
-	if err != nil {
-		return true, fmt.Errorf("Multus: error in invoke Delegate add - %q: %v", netconf["type"].(string), err)
-	}
-
-	if !isMasterplugin(netconf) {
-		return true, nil
-	}
-
-	return false, result.Print()
+	return result, nil
 }
 
-func delegateDel(podif func() string, argif string, netconf map[string]interface{}) error {
-	netconfBytes, err := json.Marshal(netconf)
+func conflistDel(rt *libcni.RuntimeConf, rawnetconflist []byte, binDir string) error {
+	logging.Debugf("conflistDel: %v, %s, %s", rt, string(rawnetconflist), binDir)
+	// In part, adapted from K8s pkg/kubelet/dockershim/network/cni/cni.go
+	binDirs := []string{binDir}
+	cniNet := libcni.CNIConfig{Path: binDirs}
+
+	confList, err := libcni.ConfListFromBytes(rawnetconflist)
 	if err != nil {
-		return fmt.Errorf("Multus: error serializing multus delegate netconf: %v", err)
+		return logging.Errorf("error in converting the raw bytes to conflist: %v", err)
 	}
 
-	if !isMasterplugin(netconf) {
-		if os.Setenv("CNI_IFNAME", podif()) != nil {
-			return fmt.Errorf("Multus: error in setting CNI_IFNAME")
-		}
-	} else {
-		if os.Setenv("CNI_IFNAME", argif) != nil {
-			return fmt.Errorf("Multus: error in setting CNI_IFNAME")
-		}
-	}
-
-	err = invoke.DelegateDel(netconf["type"].(string), netconfBytes)
+	err = cniNet.DelNetworkList(confList, rt)
 	if err != nil {
-		return fmt.Errorf("Multus: error in invoke Delegate del - %q: %v", netconf["type"].(string), err)
+		return logging.Errorf("error in getting result from DelNetworkList: %v", err)
 	}
 
 	return err
 }
 
-func clearPlugins(mIdx int, pIdx int, argIfname string, delegates []map[string]interface{}) error {
+func delegateAdd(exec invoke.Exec, ifName string, delegate *types.DelegateNetConf, rt *libcni.RuntimeConf, binDir string) (cnitypes.Result, error) {
+	logging.Debugf("delegateAdd: %v, %s, %v, %v, %s", exec, ifName, delegate, rt, binDir)
+	if os.Setenv("CNI_IFNAME", ifName) != nil {
+		return nil, logging.Errorf("Multus: error in setting CNI_IFNAME")
+	}
 
+	if err := validateIfName(os.Getenv("CNI_NETNS"), ifName); err != nil {
+		return nil, logging.Errorf("cannot set %q ifname to %q: %v", delegate.Conf.Type, ifName, err)
+	}
+
+	if delegate.ConfListPlugin != false {
+		result, err := conflistAdd(rt, delegate.Bytes, binDir)
+		if err != nil {
+			return nil, logging.Errorf("Multus: error in invoke Conflist add - %q: %v", delegate.ConfList.Name, err)
+		}
+
+		return result, nil
+	}
+
+	result, err := invoke.DelegateAdd(delegate.Conf.Type, delegate.Bytes, exec)
+	if err != nil {
+		return nil, logging.Errorf("Multus: error in invoke Delegate add - %q: %v", delegate.Conf.Type, err)
+	}
+
+	return result, nil
+}
+
+func delegateDel(exec invoke.Exec, ifName string, delegateConf *types.DelegateNetConf, rt *libcni.RuntimeConf, binDir string) error {
+	logging.Debugf("delegateDel: %v, %s, %v, %v, %s", exec, ifName, delegateConf, rt, binDir)
+	if os.Setenv("CNI_IFNAME", ifName) != nil {
+		return logging.Errorf("Multus: error in setting CNI_IFNAME")
+	}
+
+	if delegateConf.ConfListPlugin != false {
+		err := conflistDel(rt, delegateConf.Bytes, binDir)
+		if err != nil {
+			return logging.Errorf("Multus: error in invoke Conflist Del - %q: %v", delegateConf.ConfList.Name, err)
+		}
+
+		return err
+	}
+
+	if err := invoke.DelegateDel(delegateConf.Conf.Type, delegateConf.Bytes, exec); err != nil {
+		return logging.Errorf("Multus: error in invoke Delegate del - %q: %v", delegateConf.Conf.Type, err)
+	}
+
+	return nil
+}
+
+func delPlugins(exec invoke.Exec, argIfname string, delegates []*types.DelegateNetConf, lastIdx int, rt *libcni.RuntimeConf, binDir string) error {
+	logging.Debugf("delPlugins: %v, %s, %v, %d, %v, %s", exec, argIfname, delegates, lastIdx, rt, binDir)
 	if os.Setenv("CNI_COMMAND", "DEL") != nil {
-		return fmt.Errorf("Multus: error in setting CNI_COMMAND to DEL")
+		return logging.Errorf("Multus: error in setting CNI_COMMAND to DEL")
 	}
 
-	podifName := getifname()
-	r := delegateDel(podifName, argIfname, delegates[mIdx])
-	if r != nil {
-		return r
-	}
-
-	for idx := 0; idx < pIdx && idx != mIdx; idx++ {
-		r := delegateDel(podifName, argIfname, delegates[idx])
-		if r != nil {
-			return r
+	for idx := lastIdx; idx >= 0; idx-- {
+		ifName := getIfname(delegates[idx], argIfname, idx)
+		rt.IfName = ifName
+		if err := delegateDel(exec, ifName, delegates[idx], rt, binDir); err != nil {
+			return err
 		}
 	}
 
 	return nil
 }
 
-func cmdAdd(args *skel.CmdArgs) error {
-	var result error
-	var nopodnet bool
-	n, err := loadNetConf(args.StdinData)
+func cmdAdd(args *skel.CmdArgs, exec invoke.Exec, kubeClient k8s.KubeClient) (cnitypes.Result, error) {
+	logging.Debugf("cmdAdd: %v, %v, %v", args, exec, kubeClient)
+	n, err := types.LoadNetConf(args.StdinData)
 	if err != nil {
-		return fmt.Errorf("err in loading netconf: %v", err)
+		return nil, logging.Errorf("err in loading netconf: %v", err)
 	}
 
-	if n.Kubeconfig != "" {
-		podDelegate, err := k8s.GetK8sNetwork(args, n.Kubeconfig, n.ConfDir)
-		if err != nil {
-			if _, ok := err.(*k8s.NoK8sNetworkError); ok {
-				nopodnet = true
-				if !defaultcninetwork {
-					return fmt.Errorf("Multus: Err in getting k8s network from the pod spec annotation, check the pod spec or set delegate for the default network, Refer the README.md: %v", err)
-				}
-			} else if !defaultcninetwork {
-				return fmt.Errorf("Multus: Err in getting k8s network from pod: %v", err)
-			}
-		}
-
-		// If it's empty just leave it as the netconfig states (e.g. just default)
-		if len(podDelegate) != 0 {
-			// In the case that we force the default
-			// We add the found configs from CRD
-			for _, eachDelegate := range podDelegate {
-				eachDelegate["masterplugin"] = false
-				n.Delegates = append(n.Delegates, eachDelegate)
-			}
-		}
+	k8sArgs, err := k8s.GetK8sArgs(args)
+	if err != nil {
+		return nil, logging.Errorf("Multus: Err in getting k8s args: %v", err)
 	}
 
-	for _, delegate := range n.Delegates {
-		if err := checkDelegate(delegate); err != nil {
-			return fmt.Errorf("Multus: Err in delegate conf: %v", err)
-		}
+	numK8sDelegates, kc, err := k8s.TryLoadK8sDelegates(k8sArgs, n, kubeClient)
+	if err != nil {
+		return nil, logging.Errorf("Multus: Err in loading K8s Delegates k8s args: %v", err)
 	}
 
-	if n.Kubeconfig == "" || nopodnet {
+	if numK8sDelegates == 0 {
+		// cache the multus config if we have only Multus delegates
 		if err := saveDelegates(args.ContainerID, n.CNIDir, n.Delegates); err != nil {
-			return fmt.Errorf("Multus: Err in saving the delegates: %v", err)
+			return nil, logging.Errorf("Multus: Err in saving the delegates: %v", err)
 		}
 	}
 
-	podifName := getifname()
-	var mIndex int
-	for index, delegate := range n.Delegates {
-		err, r := delegateAdd(podifName, args.IfName, delegate, true)
-		if err != true {
-			result = r
-			mIndex = index
-		} else if (err != false) && r != nil {
-			return r
+	var result, tmpResult cnitypes.Result
+	var netStatus []*types.NetworkStatus
+	var rt *libcni.RuntimeConf
+	lastIdx := 0
+	for idx, delegate := range n.Delegates {
+		lastIdx = idx
+		ifName := getIfname(delegate, args.IfName, idx)
+		rt, _ = types.LoadCNIRuntimeConf(args, k8sArgs, ifName)
+		tmpResult, err = delegateAdd(exec, ifName, delegate, rt, n.BinDir)
+		if err != nil {
+			break
 		}
-	}
 
-	for index, delegate := range n.Delegates {
-		err, r := delegateAdd(podifName, args.IfName, delegate, false)
-		if err != true {
-			result = r
-		} else if (err != false) && r != nil {
-			perr := clearPlugins(mIndex, index, args.IfName, n.Delegates)
-			if perr != nil {
-				return perr
+		// Master plugin result is always used if present
+		if delegate.MasterPlugin || result == nil {
+			result = tmpResult
+		}
+
+		//create the network status, only in case Multus as kubeconfig
+		if n.Kubeconfig != "" && kc != nil {
+			if kc.Podnamespace != "kube-system" {
+				delegateNetStatus, err := types.LoadNetworkStatus(tmpResult, delegate.Conf.Name, delegate.MasterPlugin)
+				if err != nil {
+					return nil, logging.Errorf("Multus: Err in setting  networks status: %v", err)
+				}
+
+				netStatus = append(netStatus, delegateNetStatus)
 			}
-			return r
 		}
 	}
 
-	return result
+	if err != nil {
+		// Ignore errors; DEL must be idempotent anyway
+		_ = delPlugins(exec, args.IfName, n.Delegates, lastIdx, rt, n.BinDir)
+		return nil, logging.Errorf("Multus: Err in tearing down failed plugins: %v", err)
+	}
+
+	//set the network status annotation in apiserver, only in case Multus as kubeconfig
+	if n.Kubeconfig != "" && kc != nil {
+		if kc.Podnamespace != "kube-system" {
+			err = k8s.SetNetworkStatus(kc, netStatus)
+			if err != nil {
+				return nil, logging.Errorf("Multus: Err set the networks status: %v", err)
+			}
+		}
+	}
+
+	return result, nil
 }
 
-func cmdDel(args *skel.CmdArgs) error {
-	var result error
-	var nopodnet bool
+func cmdGet(args *skel.CmdArgs, exec invoke.Exec, kubeClient k8s.KubeClient) (cnitypes.Result, error) {
+	logging.Debugf("cmdGet: %v, %v, %v", args, exec, kubeClient)
+	in, err := types.LoadNetConf(args.StdinData)
+	if err != nil {
+		return nil, err
+	}
 
-	in, err := loadNetConf(args.StdinData)
+	// FIXME: call all delegates
+
+	return in.PrevResult, nil
+}
+
+func cmdDel(args *skel.CmdArgs, exec invoke.Exec, kubeClient k8s.KubeClient) error {
+	logging.Debugf("cmdDel: %v, %v, %v", args, exec, kubeClient)
+	in, err := types.LoadNetConf(args.StdinData)
 	if err != nil {
 		return err
 	}
 
-	if in.Kubeconfig != "" {
-		podDelegate, r := k8s.GetK8sNetwork(args, in.Kubeconfig, in.ConfDir)
-		if r != nil {
-			if _, ok := r.(*k8s.NoK8sNetworkError); ok {
-				nopodnet = true
-				// no network found from default and annotaed network,
-				// we do nothing to remove network for the pod!
-				if !defaultcninetwork {
-					return fmt.Errorf("Multus: Err in getting k8s network from the poc spec, check the pod spec or set delegate for the default network, Refer the README.md: %v", r)
-				}
-			} else {
-				return fmt.Errorf("Multus: Err in getting k8s network from pod: %v", r)
-			}
+	if args.Netns == "" {
+		return nil
+	}
+	netns, err := ns.GetNS(args.Netns)
+	if err != nil {
+		//  if NetNs is passed down by the Cloud Orchestration Engine, or if it called multiple times
+		// so don't return an error if the device is already removed.
+		// https://github.com/kubernetes/kubernetes/issues/43014#issuecomment-287164444
+		_, ok := err.(ns.NSPathNotExistErr)
+		if ok {
+			return nil
 		}
+		return fmt.Errorf("failed to open netns %q: %v", netns, err)
+	}
+	defer netns.Close()
 
-		if len(podDelegate) != 0 {
-			// In the case that we force the default
-			// We add the found configs from CRD (in reverse order)
-			for i := len(podDelegate) - 1; i >= 0; i-- {
-				podDelegate[i]["masterplugin"] = false
-				in.Delegates = append(in.Delegates, podDelegate[i])
-			}
-		}
+	k8sArgs, err := k8s.GetK8sArgs(args)
+	if err != nil {
+		return logging.Errorf("Multus: Err in getting k8s args: %v", err)
 	}
 
-	if in.Kubeconfig == "" || nopodnet {
+	numK8sDelegates, kc, err := k8s.TryLoadK8sDelegates(k8sArgs, in, kubeClient)
+	if err != nil {
+		return err
+	}
+
+	if numK8sDelegates == 0 {
+		// re-read the scratch multus config if we have only Multus delegates
 		netconfBytes, err := consumeScratchNetConf(args.ContainerID, in.CNIDir)
 		if err != nil {
 			if os.IsNotExist(err) {
 				// Per spec should ignore error if resources are missing / already removed
 				return nil
 			}
-			return fmt.Errorf("Multus: Err in  reading the delegates: %v", err)
+			return logging.Errorf("Multus: Err in  reading the delegates: %v", err)
 		}
 
 		if err := json.Unmarshal(netconfBytes, &in.Delegates); err != nil {
-			return fmt.Errorf("Multus: failed to load netconf: %v", err)
+			return logging.Errorf("Multus: failed to load netconf: %v", err)
 		}
 	}
 
-	podifName := getifname()
-	for _, delegate := range in.Delegates {
-		r := delegateDel(podifName, args.IfName, delegate)
-		if r != nil {
-			return r
+	//unset the network status annotation in apiserver, only in case Multus as kubeconfig
+	if in.Kubeconfig != "" && kc != nil {
+		if kc.Podnamespace != "kube-system" {
+			err := k8s.SetNetworkStatus(kc, nil)
+			if err != nil {
+				return logging.Errorf("Multus: Err unset the networks status: %v", err)
+			}
 		}
-		result = r
 	}
 
-	return result
+	rt, _ := types.LoadCNIRuntimeConf(args, k8sArgs, "")
+	return delPlugins(exec, args.IfName, in.Delegates, len(in.Delegates)-1, rt, in.BinDir)
 }
 
 func main() {
-	skel.PluginMain(cmdAdd, cmdDel, version.All)
+	skel.PluginMain(
+		func(args *skel.CmdArgs) error {
+			result, err := cmdAdd(args, nil, nil)
+			if err != nil {
+				return err
+			}
+			return result.Print()
+		},
+		func(args *skel.CmdArgs) error {
+			result, err := cmdGet(args, nil, nil)
+			if err != nil {
+				return err
+			}
+			return result.Print()
+		},
+		func(args *skel.CmdArgs) error { return cmdDel(args, nil, nil) },
+		version.All, "meta-plugin that delegates to other CNI plugins")
 }

multus/multus_test.go

@@ -0,0 +1,309 @@
+// Copyright (c) 2017 Intel Corporation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/containernetworking/cni/pkg/skel"
+	cnitypes "github.com/containernetworking/cni/pkg/types"
+	"github.com/containernetworking/cni/pkg/types/020"
+	"github.com/containernetworking/cni/pkg/version"
+	"github.com/containernetworking/plugins/pkg/ns"
+	"github.com/containernetworking/plugins/pkg/testutils"
+
+	testhelpers "github.com/intel/multus-cni/testing"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+func TestMultus(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "multus")
+}
+
+type fakePlugin struct {
+	expectedEnv    []string
+	expectedConf   string
+	expectedIfname string
+	result         cnitypes.Result
+	err            error
+}
+
+type fakeExec struct {
+	version.PluginDecoder
+
+	addIndex int
+	delIndex int
+	plugins  []*fakePlugin
+}
+
+func (f *fakeExec) addPlugin(expectedEnv []string, expectedIfname, expectedConf string, result *types020.Result, err error) {
+	f.plugins = append(f.plugins, &fakePlugin{
+		expectedEnv:    expectedEnv,
+		expectedConf:   expectedConf,
+		expectedIfname: expectedIfname,
+		result:         result,
+		err:            err,
+	})
+}
+
+func matchArray(a1, a2 []string) {
+	Expect(len(a1)).To(Equal(len(a2)))
+	for _, e1 := range a1 {
+		found := ""
+		for _, e2 := range a2 {
+			if e1 == e2 {
+				found = e2
+				break
+			}
+		}
+		// Compare element values for more descriptive test failure
+		Expect(e1).To(Equal(found))
+	}
+}
+
+// When faking plugin execution the ExecPlugin() call environ is not populated
+// (while it would be for real exec). Filter the environment variables for
+// CNI-specific ones that testcases will care about.
+func gatherCNIEnv() []string {
+	filtered := make([]string, 0)
+	for _, env := range os.Environ() {
+		if strings.HasPrefix(env, "CNI_") {
+			filtered = append(filtered, env)
+		}
+	}
+	return filtered
+}
+
+func (f *fakeExec) ExecPlugin(pluginPath string, stdinData []byte, environ []string) ([]byte, error) {
+	cmd := os.Getenv("CNI_COMMAND")
+	var index int
+	switch cmd {
+	case "ADD":
+		Expect(len(f.plugins)).To(BeNumerically(">", f.addIndex))
+		index = f.addIndex
+		f.addIndex++
+	case "DEL":
+		Expect(len(f.plugins)).To(BeNumerically(">", f.delIndex))
+		index = len(f.plugins) - f.delIndex - 1
+		f.delIndex++
+	default:
+		// Should never be reached
+		Expect(false).To(BeTrue())
+	}
+	plugin := f.plugins[index]
+
+	GinkgoT().Logf("[%s %d] exec plugin %q found %+v\n", cmd, index, pluginPath, plugin)
+
+	if plugin.expectedConf != "" {
+		Expect(string(stdinData)).To(MatchJSON(plugin.expectedConf))
+	}
+	if plugin.expectedIfname != "" {
+		Expect(os.Getenv("CNI_IFNAME")).To(Equal(plugin.expectedIfname))
+	}
+	if len(plugin.expectedEnv) > 0 {
+		matchArray(gatherCNIEnv(), plugin.expectedEnv)
+	}
+
+	if plugin.err != nil {
+		return nil, plugin.err
+	}
+
+	resultJSON, err := json.Marshal(plugin.result)
+	Expect(err).NotTo(HaveOccurred())
+	return resultJSON, nil
+}
+
+func (f *fakeExec) FindInPath(plugin string, paths []string) (string, error) {
+	Expect(len(paths)).To(BeNumerically(">", 0))
+	return filepath.Join(paths[0], plugin), nil
+}
+
+var _ = Describe("multus operations", func() {
+	var testNS ns.NetNS
+	var tmpDir string
+
+	BeforeEach(func() {
+		// Create a new NetNS so we don't modify the host
+		var err error
+		testNS, err = testutils.NewNS()
+		Expect(err).NotTo(HaveOccurred())
+		os.Setenv("CNI_NETNS", testNS.Path())
+		os.Setenv("CNI_PATH", "/some/path")
+
+		tmpDir, err = ioutil.TempDir("", "multus_tmp")
+		Expect(err).NotTo(HaveOccurred())
+	})
+
+	AfterEach(func() {
+		Expect(testNS.Close()).To(Succeed())
+		os.Unsetenv("CNI_PATH")
+		os.Unsetenv("CNI_ARGS")
+		err := os.RemoveAll(tmpDir)
+		Expect(err).NotTo(HaveOccurred())
+	})
+
+	It("executes delegates", func() {
+		args := &skel.CmdArgs{
+			ContainerID: "123456789",
+			Netns:       testNS.Path(),
+			IfName:      "eth0",
+			StdinData: []byte(`{
+    "name": "node-cni-network",
+    "type": "multus",
+    "delegates": [{
+        "name": "weave1",
+        "cniVersion": "0.2.0",
+        "type": "weave-net"
+    },{
+        "name": "other1",
+        "cniVersion": "0.2.0",
+        "type": "other-plugin"
+    }]
+}`),
+		}
+
+		fExec := &fakeExec{}
+		expectedResult1 := &types020.Result{
+			CNIVersion: "0.2.0",
+			IP4: &types020.IPConfig{
+				IP: *testhelpers.EnsureCIDR("1.1.1.2/24"),
+			},
+		}
+		expectedConf1 := `{
+    "name": "weave1",
+    "cniVersion": "0.2.0",
+    "type": "weave-net"
+}`
+		fExec.addPlugin(nil, "eth0", expectedConf1, expectedResult1, nil)
+
+		expectedResult2 := &types020.Result{
+			CNIVersion: "0.2.0",
+			IP4: &types020.IPConfig{
+				IP: *testhelpers.EnsureCIDR("1.1.1.5/24"),
+			},
+		}
+		expectedConf2 := `{
+    "name": "other1",
+    "cniVersion": "0.2.0",
+    "type": "other-plugin"
+}`
+		fExec.addPlugin(nil, "net1", expectedConf2, expectedResult2, nil)
+
+		os.Setenv("CNI_COMMAND", "ADD")
+		os.Setenv("CNI_IFNAME", "eth0")
+		result, err := cmdAdd(args, fExec, nil)
+		Expect(err).NotTo(HaveOccurred())
+		Expect(fExec.addIndex).To(Equal(len(fExec.plugins)))
+		r := result.(*types020.Result)
+		// plugin 1 is the masterplugin
+		Expect(reflect.DeepEqual(r, expectedResult1)).To(BeTrue())
+
+		os.Setenv("CNI_COMMAND", "DEL")
+		os.Setenv("CNI_IFNAME", "eth0")
+		err = cmdDel(args, fExec, nil)
+		Expect(err).NotTo(HaveOccurred())
+		Expect(fExec.delIndex).To(Equal(len(fExec.plugins)))
+	})
+
+	It("executes delegates and kubernetes networks", func() {
+		fakePod := testhelpers.NewFakePod("testpod", "net1,net2")
+		net1 := `{
+	"name": "net1",
+	"type": "mynet",
+	"cniVersion": "0.2.0"
+}`
+		net2 := `{
+	"name": "net2",
+	"type": "mynet2",
+	"cniVersion": "0.2.0"
+}`
+		net3 := `{
+	"name": "net3",
+	"type": "mynet3",
+	"cniVersion": "0.2.0"
+}`
+		args := &skel.CmdArgs{
+			ContainerID: "123456789",
+			Netns:       testNS.Path(),
+			IfName:      "eth0",
+			Args:        fmt.Sprintf("K8S_POD_NAME=%s;K8S_POD_NAMESPACE=%s", fakePod.ObjectMeta.Name, fakePod.ObjectMeta.Namespace),
+			StdinData: []byte(`{
+    "name": "node-cni-network",
+    "type": "multus",
+    "kubeconfig": "/etc/kubernetes/node-kubeconfig.yaml",
+    "delegates": [{
+        "name": "weave1",
+        "cniVersion": "0.2.0",
+        "type": "weave-net"
+    }]
+}`),
+		}
+
+		fExec := &fakeExec{}
+		expectedResult1 := &types020.Result{
+			CNIVersion: "0.2.0",
+			IP4: &types020.IPConfig{
+				IP: *testhelpers.EnsureCIDR("1.1.1.2/24"),
+			},
+		}
+		expectedConf1 := `{
+    "name": "weave1",
+    "cniVersion": "0.2.0",
+    "type": "weave-net"
+}`
+		fExec.addPlugin(nil, "eth0", expectedConf1, expectedResult1, nil)
+		fExec.addPlugin(nil, "net1", net1, &types020.Result{
+			CNIVersion: "0.2.0",
+			IP4: &types020.IPConfig{
+				IP: *testhelpers.EnsureCIDR("1.1.1.3/24"),
+			},
+		}, nil)
+		fExec.addPlugin(nil, "net2", net2, &types020.Result{
+			CNIVersion: "0.2.0",
+			IP4: &types020.IPConfig{
+				IP: *testhelpers.EnsureCIDR("1.1.1.4/24"),
+			},
+		}, nil)
+
+		fKubeClient := testhelpers.NewFakeKubeClient()
+		fKubeClient.AddPod(fakePod)
+		fKubeClient.AddNetConfig(fakePod.ObjectMeta.Namespace, "net1", net1)
+		fKubeClient.AddNetConfig(fakePod.ObjectMeta.Namespace, "net2", net2)
+		// net3 is not used; make sure it's not accessed
+		fKubeClient.AddNetConfig(fakePod.ObjectMeta.Namespace, "net3", net3)
+
+		os.Setenv("CNI_COMMAND", "ADD")
+		os.Setenv("CNI_IFNAME", "eth0")
+		result, err := cmdAdd(args, fExec, fKubeClient)
+		Expect(err).NotTo(HaveOccurred())
+		Expect(fExec.addIndex).To(Equal(len(fExec.plugins)))
+		Expect(fKubeClient.PodCount).To(Equal(2))
+		Expect(fKubeClient.NetCount).To(Equal(2))
+		r := result.(*types020.Result)
+		// plugin 1 is the masterplugin
+		Expect(reflect.DeepEqual(r, expectedResult1)).To(BeTrue())
+	})
+})

test.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -e
+
+ORG_PATH="github.com/intel"
+REPO_PATH="${ORG_PATH}/multus-cni"
+
+if [ ! -h gopath/src/${REPO_PATH} ]; then
+	mkdir -p gopath/src/${ORG_PATH}
+	ln -s ../../../.. gopath/src/${REPO_PATH} || exit 255
+fi
+
+export GO15VENDOREXPERIMENT=1
+export GOBIN=${PWD}/bin
+export GOPATH=${PWD}/gopath
+
+bash -c "umask 0; cd ${GOPATH}/src/${REPO_PATH}; PATH=${GOROOT}/bin:$(pwd)/bin:${PATH} go test -v -covermode=count -coverprofile=coverage.out ./..."
+

testing/testing.go

@@ -0,0 +1,133 @@
+// Copyright (c) 2017 Intel Corporation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package testing
+
+import (
+	"fmt"
+	"io/ioutil"
+	"net"
+	"strings"
+
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	. "github.com/onsi/gomega"
+)
+
+type FakeKubeClient struct {
+	pods     map[string]*v1.Pod
+	PodCount int
+	nets     map[string]string
+	NetCount int
+}
+
+func NewFakeKubeClient() *FakeKubeClient {
+	return &FakeKubeClient{
+		pods: make(map[string]*v1.Pod),
+		nets: make(map[string]string),
+	}
+}
+
+func (f *FakeKubeClient) GetRawWithPath(path string) ([]byte, error) {
+	obj, ok := f.nets[path]
+	if !ok {
+		return nil, fmt.Errorf("resource not found")
+	}
+	f.NetCount++
+	return []byte(obj), nil
+}
+
+func (f *FakeKubeClient) AddNetConfig(namespace, name, data string) {
+	cr := fmt.Sprintf(`{
+  "apiVersion": "k8s.cni.cncf.io/v1",
+  "kind": "Network",
+  "metadata": {
+    "namespace": "%s",
+    "name": "%s"
+  },
+  "spec": {
+    "config": "%s"
+  }
+}`, namespace, name, strings.Replace(data, "\"", "\\\"", -1))
+	cr = strings.Replace(cr, "\n", "", -1)
+	cr = strings.Replace(cr, "\t", "", -1)
+	f.nets[fmt.Sprintf("/apis/k8s.cni.cncf.io/v1/namespaces/%s/network-attachment-definitions/%s", namespace, name)] = cr
+}
+
+func (f *FakeKubeClient) AddNetFile(namespace, name, filePath, fileData string) {
+	cr := fmt.Sprintf(`{
+  "apiVersion": "k8s.cni.cncf.io/v1",
+  "kind": "Network",
+  "metadata": {
+    "namespace": "%s",
+    "name": "%s"
+  }
+}`, namespace, name)
+	f.nets[fmt.Sprintf("/apis/k8s.cni.cncf.io/v1/namespaces/%s/network-attachment-definitions/%s", namespace, name)] = cr
+
+	err := ioutil.WriteFile(filePath, []byte(fileData), 0600)
+	Expect(err).NotTo(HaveOccurred())
+}
+
+func (f *FakeKubeClient) GetPod(namespace, name string) (*v1.Pod, error) {
+	key := fmt.Sprintf("%s/%s", namespace, name)
+	pod, ok := f.pods[key]
+	if !ok {
+		return nil, fmt.Errorf("pod not found")
+	}
+	f.PodCount++
+	return pod, nil
+}
+
+func (f *FakeKubeClient) UpdatePodStatus(pod *v1.Pod) (*v1.Pod, error) {
+	key := fmt.Sprintf("%s/%s", pod.Namespace, pod.Name)
+	f.pods[key] = pod
+	return f.pods[key], nil
+}
+
+func (f *FakeKubeClient) AddPod(pod *v1.Pod) {
+	key := fmt.Sprintf("%s/%s", pod.ObjectMeta.Namespace, pod.ObjectMeta.Name)
+	f.pods[key] = pod
+}
+
+func NewFakePod(name string, netAnnotation string) *v1.Pod {
+	pod := &v1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: "test",
+		},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{
+				{Name: "ctr1", Image: "image"},
+			},
+		},
+	}
+	if netAnnotation != "" {
+		netAnnotation = strings.Replace(netAnnotation, "\n", "", -1)
+		netAnnotation = strings.Replace(netAnnotation, "\t", "", -1)
+		pod.ObjectMeta.Annotations = map[string]string{
+			"k8s.v1.cni.cncf.io/networks": netAnnotation,
+		}
+	}
+	return pod
+}
+
+func EnsureCIDR(cidr string) *net.IPNet {
+	ip, net, err := net.ParseCIDR(cidr)
+	Expect(err).NotTo(HaveOccurred())
+	net.IP = ip
+	return net
+}

types/conf.go

@@ -0,0 +1,212 @@
+// Copyright (c) 2017 Intel Corporation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package types
+
+import (
+	"encoding/json"
+
+	"github.com/containernetworking/cni/libcni"
+	"github.com/containernetworking/cni/pkg/skel"
+	"github.com/containernetworking/cni/pkg/types"
+	"github.com/containernetworking/cni/pkg/types/current"
+	"github.com/containernetworking/cni/pkg/version"
+	"github.com/intel/multus-cni/logging"
+)
+
+const (
+	defaultCNIDir  = "/var/lib/cni/multus"
+	defaultConfDir = "/etc/cni/multus/net.d"
+	defaultBinDir  = "/opt/cni/bin"
+)
+
+func LoadDelegateNetConfList(bytes []byte, delegateConf *DelegateNetConf) error {
+
+	logging.Debugf("LoadDelegateNetConfList: %s, %v", string(bytes), delegateConf)
+	if err := json.Unmarshal(bytes, &delegateConf.ConfList); err != nil {
+		return logging.Errorf("err in unmarshalling delegate conflist: %v", err)
+	}
+
+	if delegateConf.ConfList.Plugins == nil {
+		return logging.Errorf("delegate must have the 'type'or 'Plugin' field")
+	}
+	if delegateConf.ConfList.Plugins[0].Type == "" {
+		return logging.Errorf("a plugin delegate must have the 'type' field")
+	}
+	delegateConf.ConfListPlugin = true
+	return nil
+}
+
+// Convert raw CNI JSON into a DelegateNetConf structure
+func LoadDelegateNetConf(bytes []byte, ifnameRequest string) (*DelegateNetConf, error) {
+	delegateConf := &DelegateNetConf{}
+	logging.Debugf("LoadDelegateNetConf: %s, %s", string(bytes), ifnameRequest)
+	if err := json.Unmarshal(bytes, &delegateConf.Conf); err != nil {
+		return nil, logging.Errorf("error in LoadDelegateNetConf - unmarshalling delegate config: %v", err)
+	}
+
+	// Do some minimal validation
+	if delegateConf.Conf.Type == "" {
+		if err := LoadDelegateNetConfList(bytes, delegateConf); err != nil {
+			return nil, logging.Errorf("error in LoadDelegateNetConf: %v", err)
+		}
+	}
+
+	if ifnameRequest != "" {
+		delegateConf.IfnameRequest = ifnameRequest
+	}
+
+	delegateConf.Bytes = bytes
+
+	return delegateConf, nil
+}
+
+func LoadCNIRuntimeConf(args *skel.CmdArgs, k8sArgs *K8sArgs, ifName string) (*libcni.RuntimeConf, error) {
+
+	logging.Debugf("LoadCNIRuntimeConf: %v, %v, %s", args, k8sArgs, ifName)
+	// In part, adapted from K8s pkg/kubelet/dockershim/network/cni/cni.go#buildCNIRuntimeConf
+	// Todo
+	// ingress, egress and bandwidth capability features as same as kubelet.
+	rt := &libcni.RuntimeConf{
+		ContainerID: args.ContainerID,
+		NetNS:       args.Netns,
+		IfName:      ifName,
+		Args: [][2]string{
+			{"IgnoreUnknown", "1"},
+			{"K8S_POD_NAMESPACE", string(k8sArgs.K8S_POD_NAMESPACE)},
+			{"K8S_POD_NAME", string(k8sArgs.K8S_POD_NAME)},
+			{"K8S_POD_INFRA_CONTAINER_ID", string(k8sArgs.K8S_POD_INFRA_CONTAINER_ID)},
+		},
+	}
+	return rt, nil
+}
+
+func LoadNetworkStatus(r types.Result, netName string, defaultNet bool) (*NetworkStatus, error) {
+	logging.Debugf("LoadNetworkStatus: %v, %s, %s", r, netName, defaultNet)
+
+	// Convert whatever the IPAM result was into the current Result type
+	result, err := current.NewResultFromResult(r)
+	if err != nil {
+		return nil, logging.Errorf("error convert the type.Result to current.Result: %v", err)
+	}
+
+	netstatus := &NetworkStatus{}
+	netstatus.Name = netName
+	netstatus.Default = defaultNet
+
+	for _, ifs := range result.Interfaces {
+		//Only pod interfaces can have sandbox information
+		if ifs.Sandbox != "" {
+			netstatus.Interface = ifs.Name
+			netstatus.Mac = ifs.Mac
+		}
+	}
+
+	for _, ipconfig := range result.IPs {
+		if ipconfig.Version == "4" && ipconfig.Address.IP.To4() != nil {
+			netstatus.IPs = append(netstatus.IPs, ipconfig.Address.IP.String())
+		}
+
+		if ipconfig.Version == "6" && ipconfig.Address.IP.To16() != nil {
+			netstatus.IPs = append(netstatus.IPs, ipconfig.Address.IP.String())
+		}
+	}
+
+	netstatus.DNS = result.DNS
+
+	return netstatus, nil
+
+}
+
+func LoadNetConf(bytes []byte) (*NetConf, error) {
+	netconf := &NetConf{}
+
+	logging.Debugf("LoadNetConf: %s", string(bytes))
+	if err := json.Unmarshal(bytes, netconf); err != nil {
+		return nil, logging.Errorf("failed to load netconf: %v", err)
+	}
+
+	// Logging
+	if netconf.LogFile != "" {
+		logging.SetLogFile(netconf.LogFile)
+	}
+	if netconf.LogLevel != "" {
+		logging.SetLogLevel(netconf.LogLevel)
+	}
+
+	// Parse previous result
+	if netconf.RawPrevResult != nil {
+		resultBytes, err := json.Marshal(netconf.RawPrevResult)
+		if err != nil {
+			return nil, logging.Errorf("could not serialize prevResult: %v", err)
+		}
+		res, err := version.NewResult(netconf.CNIVersion, resultBytes)
+		if err != nil {
+			return nil, logging.Errorf("could not parse prevResult: %v", err)
+		}
+		netconf.RawPrevResult = nil
+		netconf.PrevResult, err = current.NewResultFromResult(res)
+		if err != nil {
+			return nil, logging.Errorf("could not convert result to current version: %v", err)
+		}
+	}
+
+	// Delegates must always be set. If no kubeconfig is present, the
+	// delegates are executed in-order.  If a kubeconfig is present,
+	// at least one delegate must be present and the first delegate is
+	// the master plugin. Kubernetes CRD delegates are then appended to
+	// the existing delegate list and all delegates executed in-order.
+
+	if len(netconf.RawDelegates) == 0 {
+		return nil, logging.Errorf("at least one delegate must be specified")
+	}
+
+	if netconf.CNIDir == "" {
+		netconf.CNIDir = defaultCNIDir
+	}
+
+	if netconf.ConfDir == "" {
+		netconf.ConfDir = defaultConfDir
+	}
+
+	if netconf.BinDir == "" {
+		netconf.BinDir = defaultBinDir
+	}
+
+	for idx, rawConf := range netconf.RawDelegates {
+		bytes, err := json.Marshal(rawConf)
+		if err != nil {
+			return nil, logging.Errorf("error marshalling delegate %d config: %v", idx, err)
+		}
+		delegateConf, err := LoadDelegateNetConf(bytes, "")
+		if err != nil {
+			return nil, logging.Errorf("failed to load delegate %d config: %v", idx, err)
+		}
+		netconf.Delegates = append(netconf.Delegates, delegateConf)
+	}
+	netconf.RawDelegates = nil
+
+	// First delegate is always the master plugin
+	netconf.Delegates[0].MasterPlugin = true
+
+	return netconf, nil
+}
+
+// AddDelegates appends the new delegates to the delegates list
+func (n *NetConf) AddDelegates(newDelegates []*DelegateNetConf) error {
+	logging.Debugf("AddDelegates: %v", newDelegates)
+	n.Delegates = append(n.Delegates, newDelegates...)
+	return nil
+}

types/conf_test.go

@@ -0,0 +1,84 @@
+// Copyright (c) 2017 Intel Corporation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package types
+
+import (
+	"testing"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+func TestConf(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "conf")
+}
+
+var _ = Describe("config operations", func() {
+	It("parses a valid multus configuration", func() {
+		conf := `{
+    "name": "node-cni-network",
+    "type": "multus",
+    "kubeconfig": "/etc/kubernetes/node-kubeconfig.yaml",
+    "delegates": [{
+        "type": "weave-net"
+    }]
+}`
+		netConf, err := LoadNetConf([]byte(conf))
+		Expect(err).NotTo(HaveOccurred())
+		Expect(len(netConf.Delegates)).To(Equal(1))
+		Expect(netConf.Delegates[0].Conf.Type).To(Equal("weave-net"))
+		Expect(netConf.Delegates[0].MasterPlugin).To(BeTrue())
+	})
+
+	It("succeeds if only delegates are set", func() {
+		conf := `{
+    "name": "node-cni-network",
+    "type": "multus",
+    "delegates": [{
+        "type": "weave-net"
+    },{
+        "type": "foobar"
+    }]
+}`
+		netConf, err := LoadNetConf([]byte(conf))
+		Expect(err).NotTo(HaveOccurred())
+		Expect(len(netConf.Delegates)).To(Equal(2))
+		Expect(netConf.Delegates[0].Conf.Type).To(Equal("weave-net"))
+		Expect(netConf.Delegates[0].MasterPlugin).To(BeTrue())
+		Expect(netConf.Delegates[1].Conf.Type).To(Equal("foobar"))
+		Expect(netConf.Delegates[1].MasterPlugin).To(BeFalse())
+	})
+
+	It("fails if no kubeconfig or delegates are set", func() {
+		conf := `{
+    "name": "node-cni-network",
+    "type": "multus"
+}`
+		_, err := LoadNetConf([]byte(conf))
+		Expect(err).To(HaveOccurred())
+	})
+
+	It("fails if kubeconfig is present but no delegates are set", func() {
+		conf := `{
+    "name": "node-cni-network",
+    "type": "multus",
+    "kubeconfig": "/etc/kubernetes/node-kubeconfig.yaml"
+}`
+		_, err := LoadNetConf([]byte(conf))
+		Expect(err).To(HaveOccurred())
+	})
+})

types/types.go

@@ -19,19 +19,54 @@ import (
 	"net"
 
 	"github.com/containernetworking/cni/pkg/types"
+	"github.com/containernetworking/cni/pkg/types/current"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
 // NetConf for cni config file written in json
 type NetConf struct {
 	types.NetConf
-	ConfDir    string                   `json:"confDir"`
-	CNIDir     string                   `json:"cniDir"`
-	Delegates  []map[string]interface{} `json:"delegates"`
-	Kubeconfig string                   `json:"kubeconfig"`
+
+	// support chaining for master interface and IP decisions
+	// occurring prior to running ipvlan plugin
+	RawPrevResult *map[string]interface{} `json:"prevResult"`
+	PrevResult    *current.Result         `json:"-"`
+
+	ConfDir string `json:"confDir"`
+	CNIDir  string `json:"cniDir"`
+	BinDir  string `json:"binDir"`
+	// RawDelegates is private to the NetConf class; use Delegates instead
+	RawDelegates []map[string]interface{} `json:"delegates"`
+	Delegates    []*DelegateNetConf       `json:"-"`
+	NetStatus    []*NetworkStatus         `json:"-"`
+	Kubeconfig   string                   `json:"kubeconfig"`
+	LogFile      string                   `json:"logFile"`
+	LogLevel     string                   `json:"logLevel"`
 }
 
-type Network struct {
+type NetworkStatus struct {
+	Name      string    `json:"name"`
+	Interface string    `json:"interface,omitempty"`
+	IPs       []string  `json:"ips,omitempty"`
+	Mac       string    `json:"mac,omitempty"`
+	Default   bool      `json:"default,omitempty"`
+	DNS       types.DNS `json:"dns,omitempty"`
+}
+
+type DelegateNetConf struct {
+	Conf          types.NetConf
+	ConfList      types.NetConfList
+	IfnameRequest string `json:"ifnameRequest,omitempty"`
+	// MasterPlugin is only used internal housekeeping
+	MasterPlugin bool `json:"-"`
+	// Conflist plugin is only used internal housekeeping
+	ConfListPlugin bool `json:"-"`
+
+	// Raw JSON
+	Bytes []byte
+}
+
+type NetworkAttachmentDefinition struct {
 	metav1.TypeMeta `json:",inline"`
 	// Note that ObjectMeta is mandatory, as an object
 	// name is required
@@ -44,27 +79,36 @@ type Network struct {
 	// or .config (in that order) file on-disk whose JSON
 	// “name” key matches this Network object’s name.
 	// +optional
-	Spec NetworkSpec `json:"spec"`
+	Spec NetworkAttachmentDefinitionSpec `json:"spec"`
 }
 
-type NetworkSpec struct {
+type NetworkAttachmentDefinitionSpec struct {
 	// Config contains a standard JSON-encoded CNI configuration
 	// or configuration list which defines the plugin chain to
 	// execute.  If present, this key takes precedence over
 	// ‘Plugin’.
 	// +optional
 	Config string `json:"config"`
+}
 
-	// Plugin contains the name of a CNI plugin on-disk in a
-	// runtime-defined path (eg /opt/cni/bin and/or other paths.
-	// This plugin should be executed with a basic CNI JSON
-	// configuration on stdin containing the Network object
-	// name and the plugin:
-	//   { “cniVersion”: “0.3.1”, “type”: <Plugin>, “name”: <Network.Name> }
-	// and any additional “runtimeConfig” field per the
-	// CNI specification and conventions.
-	// +optional
-	Plugin string `json:"plugin"`
+// NetworkSelectionElement represents one element of the JSON format
+// Network Attachment Selection Annotation as described in section 4.1.2
+// of the CRD specification.
+type NetworkSelectionElement struct {
+	// Name contains the name of the Network object this element selects
+	Name string `json:"name"`
+	// Namespace contains the optional namespace that the network referenced
+	// by Name exists in
+	Namespace string `json:"namespace,omitempty"`
+	// IPRequest contains an optional requested IP address for this network
+	// attachment
+	IPRequest string `json:"ipRequest,omitempty"`
+	// MacRequest contains an optional requested MAC address for this
+	// network attachment
+	MacRequest string `json:"macRequest,omitempty"`
+	// InterfaceRequest contains an optional requested name for the
+	// network interface this attachment will create in the container
+	InterfaceRequest string `json:"interfaceRequest,omitempty"`
 }
 
 // K8sArgs is the valid CNI_ARGS used for Kubernetes

vendor/github.com/PuerkitoBio/purell/.gitignore

@@ -1,5 +0,0 @@
-*.sublime-*
-.DS_Store
-*.swp
-*.swo
-tags

vendor/github.com/PuerkitoBio/purell/.travis.yml

@@ -1,7 +0,0 @@
-language: go
-
-go:
-    - 1.4
-    - 1.5
-    - 1.6
-    - tip

vendor/github.com/PuerkitoBio/purell/LICENSE

@@ -1,12 +0,0 @@
-Copyright (c) 2012, Martin Angers
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
-
-* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
-
-* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
-
-* Neither the name of the author nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/PuerkitoBio/purell/README.md

@@ -1,185 +0,0 @@
-# Purell
-
-Purell is a tiny Go library to normalize URLs. It returns a pure URL. Pure-ell. Sanitizer and all. Yeah, I know...
-
-Based on the [wikipedia paper][wiki] and the [RFC 3986 document][rfc].
-
-[![build status](https://secure.travis-ci.org/PuerkitoBio/purell.png)](http://travis-ci.org/PuerkitoBio/purell)
-
-## Install
-
-`go get github.com/PuerkitoBio/purell`
-
-## Changelog
-
-*    **2016-07-27 (v1.0.0)** : Normalize IDN to ASCII (thanks to @zenovich).
-*    **2015-02-08** : Add fix for relative paths issue ([PR #5][pr5]) and add fix for unnecessary encoding of reserved characters ([see issue #7][iss7]).
-*    **v0.2.0** : Add benchmarks, Attempt IDN support.
-*    **v0.1.0** : Initial release.
-
-## Examples
-
-From `example_test.go` (note that in your code, you would import "github.com/PuerkitoBio/purell", and would prefix references to its methods and constants with "purell."):
-
-```go
-package purell
-
-import (
-  "fmt"
-  "net/url"
-)
-
-func ExampleNormalizeURLString() {
-  if normalized, err := NormalizeURLString("hTTp://someWEBsite.com:80/Amazing%3f/url/",
-    FlagLowercaseScheme|FlagLowercaseHost|FlagUppercaseEscapes); err != nil {
-    panic(err)
-  } else {
-    fmt.Print(normalized)
-  }
-  // Output: http://somewebsite.com:80/Amazing%3F/url/
-}
-
-func ExampleMustNormalizeURLString() {
-  normalized := MustNormalizeURLString("hTTpS://someWEBsite.com:443/Amazing%fa/url/",
-    FlagsUnsafeGreedy)
-  fmt.Print(normalized)
-
-  // Output: http://somewebsite.com/Amazing%FA/url
-}
-
-func ExampleNormalizeURL() {
-  if u, err := url.Parse("Http://SomeUrl.com:8080/a/b/.././c///g?c=3&a=1&b=9&c=0#target"); err != nil {
-    panic(err)
-  } else {
-    normalized := NormalizeURL(u, FlagsUsuallySafeGreedy|FlagRemoveDuplicateSlashes|FlagRemoveFragment)
-    fmt.Print(normalized)
-  }
-
-  // Output: http://someurl.com:8080/a/c/g?c=3&a=1&b=9&c=0
-}
-```
-
-## API
-
-As seen in the examples above, purell offers three methods, `NormalizeURLString(string, NormalizationFlags) (string, error)`, `MustNormalizeURLString(string, NormalizationFlags) (string)` and `NormalizeURL(*url.URL, NormalizationFlags) (string)`. They all normalize the provided URL based on the specified flags. Here are the available flags:
-
-```go
-const (
-	// Safe normalizations
-	FlagLowercaseScheme           NormalizationFlags = 1 << iota // HTTP://host -> http://host, applied by default in Go1.1
-	FlagLowercaseHost                                            // http://HOST -> http://host
-	FlagUppercaseEscapes                                         // http://host/t%ef -> http://host/t%EF
-	FlagDecodeUnnecessaryEscapes                                 // http://host/t%41 -> http://host/tA
-	FlagEncodeNecessaryEscapes                                   // http://host/!"#$ -> http://host/%21%22#$
-	FlagRemoveDefaultPort                                        // http://host:80 -> http://host
-	FlagRemoveEmptyQuerySeparator                                // http://host/path? -> http://host/path
-
-	// Usually safe normalizations
-	FlagRemoveTrailingSlash // http://host/path/ -> http://host/path
-	FlagAddTrailingSlash    // http://host/path -> http://host/path/ (should choose only one of these add/remove trailing slash flags)
-	FlagRemoveDotSegments   // http://host/path/./a/b/../c -> http://host/path/a/c
-
-	// Unsafe normalizations
-	FlagRemoveDirectoryIndex   // http://host/path/index.html -> http://host/path/
-	FlagRemoveFragment         // http://host/path#fragment -> http://host/path
-	FlagForceHTTP              // https://host -> http://host
-	FlagRemoveDuplicateSlashes // http://host/path//a///b -> http://host/path/a/b
-	FlagRemoveWWW              // http://www.host/ -> http://host/
-	FlagAddWWW                 // http://host/ -> http://www.host/ (should choose only one of these add/remove WWW flags)
-	FlagSortQuery              // http://host/path?c=3&b=2&a=1&b=1 -> http://host/path?a=1&b=1&b=2&c=3
-
-	// Normalizations not in the wikipedia article, required to cover tests cases
-	// submitted by jehiah
-	FlagDecodeDWORDHost           // http://1113982867 -> http://66.102.7.147
-	FlagDecodeOctalHost           // http://0102.0146.07.0223 -> http://66.102.7.147
-	FlagDecodeHexHost             // http://0x42660793 -> http://66.102.7.147
-	FlagRemoveUnnecessaryHostDots // http://.host../path -> http://host/path
-	FlagRemoveEmptyPortSeparator  // http://host:/path -> http://host/path
-
-	// Convenience set of safe normalizations
-	FlagsSafe NormalizationFlags = FlagLowercaseHost | FlagLowercaseScheme | FlagUppercaseEscapes | FlagDecodeUnnecessaryEscapes | FlagEncodeNecessaryEscapes | FlagRemoveDefaultPort | FlagRemoveEmptyQuerySeparator
-
-	// For convenience sets, "greedy" uses the "remove trailing slash" and "remove www. prefix" flags,
-	// while "non-greedy" uses the "add (or keep) the trailing slash" and "add www. prefix".
-
-	// Convenience set of usually safe normalizations (includes FlagsSafe)
-	FlagsUsuallySafeGreedy    NormalizationFlags = FlagsSafe | FlagRemoveTrailingSlash | FlagRemoveDotSegments
-	FlagsUsuallySafeNonGreedy NormalizationFlags = FlagsSafe | FlagAddTrailingSlash | FlagRemoveDotSegments
-
-	// Convenience set of unsafe normalizations (includes FlagsUsuallySafe)
-	FlagsUnsafeGreedy    NormalizationFlags = FlagsUsuallySafeGreedy | FlagRemoveDirectoryIndex | FlagRemoveFragment | FlagForceHTTP | FlagRemoveDuplicateSlashes | FlagRemoveWWW | FlagSortQuery
-	FlagsUnsafeNonGreedy NormalizationFlags = FlagsUsuallySafeNonGreedy | FlagRemoveDirectoryIndex | FlagRemoveFragment | FlagForceHTTP | FlagRemoveDuplicateSlashes | FlagAddWWW | FlagSortQuery
-
-	// Convenience set of all available flags
-	FlagsAllGreedy    = FlagsUnsafeGreedy | FlagDecodeDWORDHost | FlagDecodeOctalHost | FlagDecodeHexHost | FlagRemoveUnnecessaryHostDots | FlagRemoveEmptyPortSeparator
-	FlagsAllNonGreedy = FlagsUnsafeNonGreedy | FlagDecodeDWORDHost | FlagDecodeOctalHost | FlagDecodeHexHost | FlagRemoveUnnecessaryHostDots | FlagRemoveEmptyPortSeparator
-)
-```
-
-For convenience, the set of flags `FlagsSafe`, `FlagsUsuallySafe[Greedy|NonGreedy]`, `FlagsUnsafe[Greedy|NonGreedy]` and `FlagsAll[Greedy|NonGreedy]` are provided for the similarly grouped normalizations on [wikipedia's URL normalization page][wiki]. You can add (using the bitwise OR `|` operator) or remove (using the bitwise AND NOT `&^` operator) individual flags from the sets if required, to build your own custom set.
-
-The [full godoc reference is available on gopkgdoc][godoc].
-
-Some things to note:
-
-*    `FlagDecodeUnnecessaryEscapes`, `FlagEncodeNecessaryEscapes`, `FlagUppercaseEscapes` and `FlagRemoveEmptyQuerySeparator` are always implicitly set, because internally, the URL string is parsed as an URL object, which automatically decodes unnecessary escapes, uppercases and encodes necessary ones, and removes empty query separators (an unnecessary `?` at the end of the url). So this operation cannot **not** be done. For this reason, `FlagRemoveEmptyQuerySeparator` (as well as the other three) has been included in the `FlagsSafe` convenience set, instead of `FlagsUnsafe`, where Wikipedia puts it.
-
-*    The `FlagDecodeUnnecessaryEscapes` decodes the following escapes (*from -> to*):
-    -    %24 -> $
-    -    %26 -> &
-    -    %2B-%3B -> +,-./0123456789:;
-    -    %3D -> =
-    -    %40-%5A -> @ABCDEFGHIJKLMNOPQRSTUVWXYZ
-    -    %5F -> _
-    -    %61-%7A -> abcdefghijklmnopqrstuvwxyz
-    -    %7E -> ~
-
-
-*    When the `NormalizeURL` function is used (passing an URL object), this source URL object is modified (that is, after the call, the URL object will be modified to reflect the normalization).
-
-*    The *replace IP with domain name* normalization (`http://208.77.188.166/ → http://www.example.com/`) is obviously not possible for a library without making some network requests. This is not implemented in purell.
-
-*    The *remove unused query string parameters* and *remove default query parameters* are also not implemented, since this is a very case-specific normalization, and it is quite trivial to do with an URL object.
-
-### Safe vs Usually Safe vs Unsafe
-
-Purell allows you to control the level of risk you take while normalizing an URL. You can aggressively normalize, play it totally safe, or anything in between.
-
-Consider the following URL:
-
-`HTTPS://www.RooT.com/toto/t%45%1f///a/./b/../c/?z=3&w=2&a=4&w=1#invalid`
-
-Normalizing with the `FlagsSafe` gives:
-
-`https://www.root.com/toto/tE%1F///a/./b/../c/?z=3&w=2&a=4&w=1#invalid`
-
-With the `FlagsUsuallySafeGreedy`:
-
-`https://www.root.com/toto/tE%1F///a/c?z=3&w=2&a=4&w=1#invalid`
-
-And with `FlagsUnsafeGreedy`:
-
-`http://root.com/toto/tE%1F/a/c?a=4&w=1&w=2&z=3`
-
-## TODOs
-
-*    Add a class/default instance to allow specifying custom directory index names? At the moment, removing directory index removes `(^|/)((?:default|index)\.\w{1,4})$`.
-
-## Thanks / Contributions
-
-@rogpeppe
-@jehiah
-@opennota
-@pchristopher1275
-@zenovich
-
-## License
-
-The [BSD 3-Clause license][bsd].
-
-[bsd]: http://opensource.org/licenses/BSD-3-Clause
-[wiki]: http://en.wikipedia.org/wiki/URL_normalization
-[rfc]: http://tools.ietf.org/html/rfc3986#section-6
-[godoc]: http://go.pkgdoc.org/github.com/PuerkitoBio/purell
-[pr5]: https://github.com/PuerkitoBio/purell/pull/5
-[iss7]: https://github.com/PuerkitoBio/purell/issues/7

vendor/github.com/PuerkitoBio/purell/bench_test.go

@@ -1,57 +0,0 @@
-package purell
-
-import (
-	"testing"
-)
-
-var (
-	safeUrl        = "HttPS://..iaMHost..Test:443/paTh^A%ef//./%41PaTH/..//?"
-	usuallySafeUrl = "HttPS://..iaMHost..Test:443/paTh^A%ef//./%41PaTH/../final/"
-	unsafeUrl      = "HttPS://..www.iaMHost..Test:443/paTh^A%ef//./%41PaTH/../final/index.html?t=val1&a=val4&z=val5&a=val1#fragment"
-	allDWORDUrl    = "HttPS://1113982867:/paTh^A%ef//./%41PaTH/../final/index.html?t=val1&a=val4&z=val5&a=val1#fragment"
-	allOctalUrl    = "HttPS://0102.0146.07.0223:/paTh^A%ef//./%41PaTH/../final/index.html?t=val1&a=val4&z=val5&a=val1#fragment"
-	allHexUrl      = "HttPS://0x42660793:/paTh^A%ef//./%41PaTH/../final/index.html?t=val1&a=val4&z=val5&a=val1#fragment"
-	allCombinedUrl = "HttPS://..0x42660793.:/paTh^A%ef//./%41PaTH/../final/index.html?t=val1&a=val4&z=val5&a=val1#fragment"
-)
-
-func BenchmarkSafe(b *testing.B) {
-	for i := 0; i < b.N; i++ {
-		NormalizeURLString(safeUrl, FlagsSafe)
-	}
-}
-
-func BenchmarkUsuallySafe(b *testing.B) {
-	for i := 0; i < b.N; i++ {
-		NormalizeURLString(usuallySafeUrl, FlagsUsuallySafeGreedy)
-	}
-}
-
-func BenchmarkUnsafe(b *testing.B) {
-	for i := 0; i < b.N; i++ {
-		NormalizeURLString(unsafeUrl, FlagsUnsafeGreedy)
-	}
-}
-
-func BenchmarkAllDWORD(b *testing.B) {
-	for i := 0; i < b.N; i++ {
-		NormalizeURLString(allDWORDUrl, FlagsAllGreedy)
-	}
-}
-
-func BenchmarkAllOctal(b *testing.B) {
-	for i := 0; i < b.N; i++ {
-		NormalizeURLString(allOctalUrl, FlagsAllGreedy)
-	}
-}
-
-func BenchmarkAllHex(b *testing.B) {
-	for i := 0; i < b.N; i++ {
-		NormalizeURLString(allHexUrl, FlagsAllGreedy)
-	}
-}
-
-func BenchmarkAllCombined(b *testing.B) {
-	for i := 0; i < b.N; i++ {
-		NormalizeURLString(allCombinedUrl, FlagsAllGreedy)
-	}
-}

vendor/github.com/PuerkitoBio/purell/benchmarks/v0.1.0

@@ -1,9 +0,0 @@
-PASS
-BenchmarkSafe	  500000	      6131 ns/op
-BenchmarkUsuallySafe	  200000	      7864 ns/op
-BenchmarkUnsafe	  100000	     28560 ns/op
-BenchmarkAllDWORD	   50000	     38722 ns/op
-BenchmarkAllOctal	   50000	     40941 ns/op
-BenchmarkAllHex	   50000	     44063 ns/op
-BenchmarkAllCombined	   50000	     33613 ns/op
-ok  	github.com/PuerkitoBio/purell	17.404s

vendor/github.com/PuerkitoBio/purell/example_test.go

@@ -1,35 +0,0 @@
-package purell
-
-import (
-	"fmt"
-	"net/url"
-)
-
-func ExampleNormalizeURLString() {
-	if normalized, err := NormalizeURLString("hTTp://someWEBsite.com:80/Amazing%3f/url/",
-		FlagLowercaseScheme|FlagLowercaseHost|FlagUppercaseEscapes); err != nil {
-		panic(err)
-	} else {
-		fmt.Print(normalized)
-	}
-	// Output: http://somewebsite.com:80/Amazing%3F/url/
-}
-
-func ExampleMustNormalizeURLString() {
-	normalized := MustNormalizeURLString("hTTpS://someWEBsite.com:443/Amazing%fa/url/",
-		FlagsUnsafeGreedy)
-	fmt.Print(normalized)
-
-	// Output: http://somewebsite.com/Amazing%FA/url
-}
-
-func ExampleNormalizeURL() {
-	if u, err := url.Parse("Http://SomeUrl.com:8080/a/b/.././c///g?c=3&a=1&b=9&c=0#target"); err != nil {
-		panic(err)
-	} else {
-		normalized := NormalizeURL(u, FlagsUsuallySafeGreedy|FlagRemoveDuplicateSlashes|FlagRemoveFragment)
-		fmt.Print(normalized)
-	}
-
-	// Output: http://someurl.com:8080/a/c/g?c=3&a=1&b=9&c=0
-}

vendor/github.com/PuerkitoBio/purell/purell.go

@@ -1,375 +0,0 @@
-/*
-Package purell offers URL normalization as described on the wikipedia page:
-http://en.wikipedia.org/wiki/URL_normalization
-*/
-package purell
-
-import (
-	"bytes"
-	"fmt"
-	"net/url"
-	"regexp"
-	"sort"
-	"strconv"
-	"strings"
-
-	"github.com/PuerkitoBio/urlesc"
-	"golang.org/x/net/idna"
-	"golang.org/x/text/secure/precis"
-	"golang.org/x/text/unicode/norm"
-)
-
-// A set of normalization flags determines how a URL will
-// be normalized.
-type NormalizationFlags uint
-
-const (
-	// Safe normalizations
-	FlagLowercaseScheme           NormalizationFlags = 1 << iota // HTTP://host -> http://host, applied by default in Go1.1
-	FlagLowercaseHost                                            // http://HOST -> http://host
-	FlagUppercaseEscapes                                         // http://host/t%ef -> http://host/t%EF
-	FlagDecodeUnnecessaryEscapes                                 // http://host/t%41 -> http://host/tA
-	FlagEncodeNecessaryEscapes                                   // http://host/!"#$ -> http://host/%21%22#$
-	FlagRemoveDefaultPort                                        // http://host:80 -> http://host
-	FlagRemoveEmptyQuerySeparator                                // http://host/path? -> http://host/path
-
-	// Usually safe normalizations
-	FlagRemoveTrailingSlash // http://host/path/ -> http://host/path
-	FlagAddTrailingSlash    // http://host/path -> http://host/path/ (should choose only one of these add/remove trailing slash flags)
-	FlagRemoveDotSegments   // http://host/path/./a/b/../c -> http://host/path/a/c
-
-	// Unsafe normalizations
-	FlagRemoveDirectoryIndex   // http://host/path/index.html -> http://host/path/
-	FlagRemoveFragment         // http://host/path#fragment -> http://host/path
-	FlagForceHTTP              // https://host -> http://host
-	FlagRemoveDuplicateSlashes // http://host/path//a///b -> http://host/path/a/b
-	FlagRemoveWWW              // http://www.host/ -> http://host/
-	FlagAddWWW                 // http://host/ -> http://www.host/ (should choose only one of these add/remove WWW flags)
-	FlagSortQuery              // http://host/path?c=3&b=2&a=1&b=1 -> http://host/path?a=1&b=1&b=2&c=3
-
-	// Normalizations not in the wikipedia article, required to cover tests cases
-	// submitted by jehiah
-	FlagDecodeDWORDHost           // http://1113982867 -> http://66.102.7.147
-	FlagDecodeOctalHost           // http://0102.0146.07.0223 -> http://66.102.7.147
-	FlagDecodeHexHost             // http://0x42660793 -> http://66.102.7.147
-	FlagRemoveUnnecessaryHostDots // http://.host../path -> http://host/path
-	FlagRemoveEmptyPortSeparator  // http://host:/path -> http://host/path
-
-	// Convenience set of safe normalizations
-	FlagsSafe NormalizationFlags = FlagLowercaseHost | FlagLowercaseScheme | FlagUppercaseEscapes | FlagDecodeUnnecessaryEscapes | FlagEncodeNecessaryEscapes | FlagRemoveDefaultPort | FlagRemoveEmptyQuerySeparator
-
-	// For convenience sets, "greedy" uses the "remove trailing slash" and "remove www. prefix" flags,
-	// while "non-greedy" uses the "add (or keep) the trailing slash" and "add www. prefix".
-
-	// Convenience set of usually safe normalizations (includes FlagsSafe)
-	FlagsUsuallySafeGreedy    NormalizationFlags = FlagsSafe | FlagRemoveTrailingSlash | FlagRemoveDotSegments
-	FlagsUsuallySafeNonGreedy NormalizationFlags = FlagsSafe | FlagAddTrailingSlash | FlagRemoveDotSegments
-
-	// Convenience set of unsafe normalizations (includes FlagsUsuallySafe)
-	FlagsUnsafeGreedy    NormalizationFlags = FlagsUsuallySafeGreedy | FlagRemoveDirectoryIndex | FlagRemoveFragment | FlagForceHTTP | FlagRemoveDuplicateSlashes | FlagRemoveWWW | FlagSortQuery
-	FlagsUnsafeNonGreedy NormalizationFlags = FlagsUsuallySafeNonGreedy | FlagRemoveDirectoryIndex | FlagRemoveFragment | FlagForceHTTP | FlagRemoveDuplicateSlashes | FlagAddWWW | FlagSortQuery
-
-	// Convenience set of all available flags
-	FlagsAllGreedy    = FlagsUnsafeGreedy | FlagDecodeDWORDHost | FlagDecodeOctalHost | FlagDecodeHexHost | FlagRemoveUnnecessaryHostDots | FlagRemoveEmptyPortSeparator
-	FlagsAllNonGreedy = FlagsUnsafeNonGreedy | FlagDecodeDWORDHost | FlagDecodeOctalHost | FlagDecodeHexHost | FlagRemoveUnnecessaryHostDots | FlagRemoveEmptyPortSeparator
-)
-
-const (
-	defaultHttpPort  = ":80"
-	defaultHttpsPort = ":443"
-)
-
-// Regular expressions used by the normalizations
-var rxPort = regexp.MustCompile(`(:\d+)/?$`)
-var rxDirIndex = regexp.MustCompile(`(^|/)((?:default|index)\.\w{1,4})$`)
-var rxDupSlashes = regexp.MustCompile(`/{2,}`)
-var rxDWORDHost = regexp.MustCompile(`^(\d+)((?:\.+)?(?:\:\d*)?)$`)
-var rxOctalHost = regexp.MustCompile(`^(0\d*)\.(0\d*)\.(0\d*)\.(0\d*)((?:\.+)?(?:\:\d*)?)$`)
-var rxHexHost = regexp.MustCompile(`^0x([0-9A-Fa-f]+)((?:\.+)?(?:\:\d*)?)$`)
-var rxHostDots = regexp.MustCompile(`^(.+?)(:\d+)?$`)
-var rxEmptyPort = regexp.MustCompile(`:+$`)
-
-// Map of flags to implementation function.
-// FlagDecodeUnnecessaryEscapes has no action, since it is done automatically
-// by parsing the string as an URL. Same for FlagUppercaseEscapes and FlagRemoveEmptyQuerySeparator.
-
-// Since maps have undefined traversing order, make a slice of ordered keys
-var flagsOrder = []NormalizationFlags{
-	FlagLowercaseScheme,
-	FlagLowercaseHost,
-	FlagRemoveDefaultPort,
-	FlagRemoveDirectoryIndex,
-	FlagRemoveDotSegments,
-	FlagRemoveFragment,
-	FlagForceHTTP, // Must be after remove default port (because https=443/http=80)
-	FlagRemoveDuplicateSlashes,
-	FlagRemoveWWW,
-	FlagAddWWW,
-	FlagSortQuery,
-	FlagDecodeDWORDHost,
-	FlagDecodeOctalHost,
-	FlagDecodeHexHost,
-	FlagRemoveUnnecessaryHostDots,
-	FlagRemoveEmptyPortSeparator,
-	FlagRemoveTrailingSlash, // These two (add/remove trailing slash) must be last
-	FlagAddTrailingSlash,
-}
-
-// ... and then the map, where order is unimportant
-var flags = map[NormalizationFlags]func(*url.URL){
-	FlagLowercaseScheme:           lowercaseScheme,
-	FlagLowercaseHost:             lowercaseHost,
-	FlagRemoveDefaultPort:         removeDefaultPort,
-	FlagRemoveDirectoryIndex:      removeDirectoryIndex,
-	FlagRemoveDotSegments:         removeDotSegments,
-	FlagRemoveFragment:            removeFragment,
-	FlagForceHTTP:                 forceHTTP,
-	FlagRemoveDuplicateSlashes:    removeDuplicateSlashes,
-	FlagRemoveWWW:                 removeWWW,
-	FlagAddWWW:                    addWWW,
-	FlagSortQuery:                 sortQuery,
-	FlagDecodeDWORDHost:           decodeDWORDHost,
-	FlagDecodeOctalHost:           decodeOctalHost,
-	FlagDecodeHexHost:             decodeHexHost,
-	FlagRemoveUnnecessaryHostDots: removeUnncessaryHostDots,
-	FlagRemoveEmptyPortSeparator:  removeEmptyPortSeparator,
-	FlagRemoveTrailingSlash:       removeTrailingSlash,
-	FlagAddTrailingSlash:          addTrailingSlash,
-}
-
-// MustNormalizeURLString returns the normalized string, and panics if an error occurs.
-// It takes an URL string as input, as well as the normalization flags.
-func MustNormalizeURLString(u string, f NormalizationFlags) string {
-	result, e := NormalizeURLString(u, f)
-	if e != nil {
-		panic(e)
-	}
-	return result
-}
-
-// NormalizeURLString returns the normalized string, or an error if it can't be parsed into an URL object.
-// It takes an URL string as input, as well as the normalization flags.
-func NormalizeURLString(u string, f NormalizationFlags) (string, error) {
-	if parsed, e := url.Parse(u); e != nil {
-		return "", e
-	} else {
-		options := make([]precis.Option, 1, 3)
-		options[0] = precis.IgnoreCase
-		if f&FlagLowercaseHost == FlagLowercaseHost {
-			options = append(options, precis.FoldCase())
-		}
-		options = append(options, precis.Norm(norm.NFC))
-		profile := precis.NewFreeform(options...)
-		if parsed.Host, e = idna.ToASCII(profile.NewTransformer().String(parsed.Host)); e != nil {
-			return "", e
-		}
-		return NormalizeURL(parsed, f), nil
-	}
-	panic("Unreachable code.")
-}
-
-// NormalizeURL returns the normalized string.
-// It takes a parsed URL object as input, as well as the normalization flags.
-func NormalizeURL(u *url.URL, f NormalizationFlags) string {
-	for _, k := range flagsOrder {
-		if f&k == k {
-			flags[k](u)
-		}
-	}
-	return urlesc.Escape(u)
-}
-
-func lowercaseScheme(u *url.URL) {
-	if len(u.Scheme) > 0 {
-		u.Scheme = strings.ToLower(u.Scheme)
-	}
-}
-
-func lowercaseHost(u *url.URL) {
-	if len(u.Host) > 0 {
-		u.Host = strings.ToLower(u.Host)
-	}
-}
-
-func removeDefaultPort(u *url.URL) {
-	if len(u.Host) > 0 {
-		scheme := strings.ToLower(u.Scheme)
-		u.Host = rxPort.ReplaceAllStringFunc(u.Host, func(val string) string {
-			if (scheme == "http" && val == defaultHttpPort) || (scheme == "https" && val == defaultHttpsPort) {
-				return ""
-			}
-			return val
-		})
-	}
-}
-
-func removeTrailingSlash(u *url.URL) {
-	if l := len(u.Path); l > 0 {
-		if strings.HasSuffix(u.Path, "/") {
-			u.Path = u.Path[:l-1]
-		}
-	} else if l = len(u.Host); l > 0 {
-		if strings.HasSuffix(u.Host, "/") {
-			u.Host = u.Host[:l-1]
-		}
-	}
-}
-
-func addTrailingSlash(u *url.URL) {
-	if l := len(u.Path); l > 0 {
-		if !strings.HasSuffix(u.Path, "/") {
-			u.Path += "/"
-		}
-	} else if l = len(u.Host); l > 0 {
-		if !strings.HasSuffix(u.Host, "/") {
-			u.Host += "/"
-		}
-	}
-}
-
-func removeDotSegments(u *url.URL) {
-	if len(u.Path) > 0 {
-		var dotFree []string
-		var lastIsDot bool
-
-		sections := strings.Split(u.Path, "/")
-		for _, s := range sections {
-			if s == ".." {
-				if len(dotFree) > 0 {
-					dotFree = dotFree[:len(dotFree)-1]
-				}
-			} else if s != "." {
-				dotFree = append(dotFree, s)
-			}
-			lastIsDot = (s == "." || s == "..")
-		}
-		// Special case if host does not end with / and new path does not begin with /
-		u.Path = strings.Join(dotFree, "/")
-		if u.Host != "" && !strings.HasSuffix(u.Host, "/") && !strings.HasPrefix(u.Path, "/") {
-			u.Path = "/" + u.Path
-		}
-		// Special case if the last segment was a dot, make sure the path ends with a slash
-		if lastIsDot && !strings.HasSuffix(u.Path, "/") {
-			u.Path += "/"
-		}
-	}
-}
-
-func removeDirectoryIndex(u *url.URL) {
-	if len(u.Path) > 0 {
-		u.Path = rxDirIndex.ReplaceAllString(u.Path, "$1")
-	}
-}
-
-func removeFragment(u *url.URL) {
-	u.Fragment = ""
-}
-
-func forceHTTP(u *url.URL) {
-	if strings.ToLower(u.Scheme) == "https" {
-		u.Scheme = "http"
-	}
-}
-
-func removeDuplicateSlashes(u *url.URL) {
-	if len(u.Path) > 0 {
-		u.Path = rxDupSlashes.ReplaceAllString(u.Path, "/")
-	}
-}
-
-func removeWWW(u *url.URL) {
-	if len(u.Host) > 0 && strings.HasPrefix(strings.ToLower(u.Host), "www.") {
-		u.Host = u.Host[4:]
-	}
-}
-
-func addWWW(u *url.URL) {
-	if len(u.Host) > 0 && !strings.HasPrefix(strings.ToLower(u.Host), "www.") {
-		u.Host = "www." + u.Host
-	}
-}
-
-func sortQuery(u *url.URL) {
-	q := u.Query()
-
-	if len(q) > 0 {
-		arKeys := make([]string, len(q))
-		i := 0
-		for k, _ := range q {
-			arKeys[i] = k
-			i++
-		}
-		sort.Strings(arKeys)
-		buf := new(bytes.Buffer)
-		for _, k := range arKeys {
-			sort.Strings(q[k])
-			for _, v := range q[k] {
-				if buf.Len() > 0 {
-					buf.WriteRune('&')
-				}
-				buf.WriteString(fmt.Sprintf("%s=%s", k, urlesc.QueryEscape(v)))
-			}
-		}
-
-		// Rebuild the raw query string
-		u.RawQuery = buf.String()
-	}
-}
-
-func decodeDWORDHost(u *url.URL) {
-	if len(u.Host) > 0 {
-		if matches := rxDWORDHost.FindStringSubmatch(u.Host); len(matches) > 2 {
-			var parts [4]int64
-
-			dword, _ := strconv.ParseInt(matches[1], 10, 0)
-			for i, shift := range []uint{24, 16, 8, 0} {
-				parts[i] = dword >> shift & 0xFF
-			}
-			u.Host = fmt.Sprintf("%d.%d.%d.%d%s", parts[0], parts[1], parts[2], parts[3], matches[2])
-		}
-	}
-}
-
-func decodeOctalHost(u *url.URL) {
-	if len(u.Host) > 0 {
-		if matches := rxOctalHost.FindStringSubmatch(u.Host); len(matches) > 5 {
-			var parts [4]int64
-
-			for i := 1; i <= 4; i++ {
-				parts[i-1], _ = strconv.ParseInt(matches[i], 8, 0)
-			}
-			u.Host = fmt.Sprintf("%d.%d.%d.%d%s", parts[0], parts[1], parts[2], parts[3], matches[5])
-		}
-	}
-}
-
-func decodeHexHost(u *url.URL) {
-	if len(u.Host) > 0 {
-		if matches := rxHexHost.FindStringSubmatch(u.Host); len(matches) > 2 {
-			// Conversion is safe because of regex validation
-			parsed, _ := strconv.ParseInt(matches[1], 16, 0)
-			// Set host as DWORD (base 10) encoded host
-			u.Host = fmt.Sprintf("%d%s", parsed, matches[2])
-			// The rest is the same as decoding a DWORD host
-			decodeDWORDHost(u)
-		}
-	}
-}
-
-func removeUnncessaryHostDots(u *url.URL) {
-	if len(u.Host) > 0 {
-		if matches := rxHostDots.FindStringSubmatch(u.Host); len(matches) > 1 {
-			// Trim the leading and trailing dots
-			u.Host = strings.Trim(matches[1], ".")
-			if len(matches) > 2 {
-				u.Host += matches[2]
-			}
-		}
-	}
-}
-
-func removeEmptyPortSeparator(u *url.URL) {
-	if len(u.Host) > 0 {
-		u.Host = rxEmptyPort.ReplaceAllString(u.Host, "")
-	}
-}

vendor/github.com/PuerkitoBio/purell/purell_test.go

@@ -1,768 +0,0 @@
-package purell
-
-import (
-	"fmt"
-	"net/url"
-	"testing"
-)
-
-type testCase struct {
-	nm     string
-	src    string
-	flgs   NormalizationFlags
-	res    string
-	parsed bool
-}
-
-var (
-	cases = [...]*testCase{
-		&testCase{
-			"LowerScheme",
-			"HTTP://www.SRC.ca",
-			FlagLowercaseScheme,
-			"http://www.SRC.ca",
-			false,
-		},
-		&testCase{
-			"LowerScheme2",
-			"http://www.SRC.ca",
-			FlagLowercaseScheme,
-			"http://www.SRC.ca",
-			false,
-		},
-		&testCase{
-			"LowerHost",
-			"HTTP://www.SRC.ca/",
-			FlagLowercaseHost,
-			"http://www.src.ca/", // Since Go1.1, scheme is automatically lowercased
-			false,
-		},
-		&testCase{
-			"UpperEscapes",
-			`http://www.whatever.com/Some%aa%20Special%8Ecases/`,
-			FlagUppercaseEscapes,
-			"http://www.whatever.com/Some%AA%20Special%8Ecases/",
-			false,
-		},
-		&testCase{
-			"UnnecessaryEscapes",
-			`http://www.toto.com/%41%42%2E%44/%32%33%52%2D/%5f%7E`,
-			FlagDecodeUnnecessaryEscapes,
-			"http://www.toto.com/AB.D/23R-/_~",
-			false,
-		},
-		&testCase{
-			"RemoveDefaultPort",
-			"HTTP://www.SRC.ca:80/",
-			FlagRemoveDefaultPort,
-			"http://www.SRC.ca/", // Since Go1.1, scheme is automatically lowercased
-			false,
-		},
-		&testCase{
-			"RemoveDefaultPort2",
-			"HTTP://www.SRC.ca:80",
-			FlagRemoveDefaultPort,
-			"http://www.SRC.ca", // Since Go1.1, scheme is automatically lowercased
-			false,
-		},
-		&testCase{
-			"RemoveDefaultPort3",
-			"HTTP://www.SRC.ca:8080",
-			FlagRemoveDefaultPort,
-			"http://www.SRC.ca:8080", // Since Go1.1, scheme is automatically lowercased
-			false,
-		},
-		&testCase{
-			"Safe",
-			"HTTP://www.SRC.ca:80/to%1ato%8b%ee/OKnow%41%42%43%7e",
-			FlagsSafe,
-			"http://www.src.ca/to%1Ato%8B%EE/OKnowABC~",
-			false,
-		},
-		&testCase{
-			"BothLower",
-			"HTTP://www.SRC.ca:80/to%1ato%8b%ee/OKnow%41%42%43%7e",
-			FlagLowercaseHost | FlagLowercaseScheme,
-			"http://www.src.ca:80/to%1Ato%8B%EE/OKnowABC~",
-			false,
-		},
-		&testCase{
-			"RemoveTrailingSlash",
-			"HTTP://www.SRC.ca:80/",
-			FlagRemoveTrailingSlash,
-			"http://www.SRC.ca:80", // Since Go1.1, scheme is automatically lowercased
-			false,
-		},
-		&testCase{
-			"RemoveTrailingSlash2",
-			"HTTP://www.SRC.ca:80/toto/titi/",
-			FlagRemoveTrailingSlash,
-			"http://www.SRC.ca:80/toto/titi", // Since Go1.1, scheme is automatically lowercased
-			false,
-		},
-		&testCase{
-			"RemoveTrailingSlash3",
-			"HTTP://www.SRC.ca:80/toto/titi/fin/?a=1",
-			FlagRemoveTrailingSlash,
-			"http://www.SRC.ca:80/toto/titi/fin?a=1", // Since Go1.1, scheme is automatically lowercased
-			false,
-		},
-		&testCase{
-			"AddTrailingSlash",
-			"HTTP://www.SRC.ca:80",
-			FlagAddTrailingSlash,
-			"http://www.SRC.ca:80/", // Since Go1.1, scheme is automatically lowercased
-			false,
-		},
-		&testCase{
-			"AddTrailingSlash2",
-			"HTTP://www.SRC.ca:80/toto/titi.html",
-			FlagAddTrailingSlash,
-			"http://www.SRC.ca:80/toto/titi.html/", // Since Go1.1, scheme is automatically lowercased
-			false,
-		},
-		&testCase{
-			"AddTrailingSlash3",
-			"HTTP://www.SRC.ca:80/toto/titi/fin?a=1",
-			FlagAddTrailingSlash,
-			"http://www.SRC.ca:80/toto/titi/fin/?a=1", // Since Go1.1, scheme is automatically lowercased
-			false,
-		},
-		&testCase{
-			"RemoveDotSegments",
-			"HTTP://root/a/b/./../../c/",
-			FlagRemoveDotSegments,
-			"http://root/c/", // Since Go1.1, scheme is automatically lowercased
-			false,
-		},
-		&testCase{
-			"RemoveDotSegments2",
-			"HTTP://root/../a/b/./../c/../d",
-			FlagRemoveDotSegments,
-			"http://root/a/d", // Since Go1.1, scheme is automatically lowercased
-			false,
-		},
-		&testCase{
-			"UsuallySafe",
-			"HTTP://www.SRC.ca:80/to%1ato%8b%ee/./c/d/../OKnow%41%42%43%7e/?a=b#test",
-			FlagsUsuallySafeGreedy,
-			"http://www.src.ca/to%1Ato%8B%EE/c/OKnowABC~?a=b#test",
-			false,
-		},
-		&testCase{
-			"RemoveDirectoryIndex",
-			"HTTP://root/a/b/c/default.aspx",
-			FlagRemoveDirectoryIndex,
-			"http://root/a/b/c/", // Since Go1.1, scheme is automatically lowercased
-			false,
-		},
-		&testCase{
-			"RemoveDirectoryIndex2",
-			"HTTP://root/a/b/c/default#a=b",
-			FlagRemoveDirectoryIndex,
-			"http://root/a/b/c/default#a=b", // Since Go1.1, scheme is automatically lowercased
-			false,
-		},
-		&testCase{
-			"RemoveFragment",
-			"HTTP://root/a/b/c/default#toto=tata",
-			FlagRemoveFragment,
-			"http://root/a/b/c/default", // Since Go1.1, scheme is automatically lowercased
-			false,
-		},
-		&testCase{
-			"ForceHTTP",
-			"https://root/a/b/c/default#toto=tata",
-			FlagForceHTTP,
-			"http://root/a/b/c/default#toto=tata",
-			false,
-		},
-		&testCase{
-			"RemoveDuplicateSlashes",
-			"https://root/a//b///c////default#toto=tata",
-			FlagRemoveDuplicateSlashes,
-			"https://root/a/b/c/default#toto=tata",
-			false,
-		},
-		&testCase{
-			"RemoveDuplicateSlashes2",
-			"https://root//a//b///c////default#toto=tata",
-			FlagRemoveDuplicateSlashes,
-			"https://root/a/b/c/default#toto=tata",
-			false,
-		},
-		&testCase{
-			"RemoveWWW",
-			"https://www.root/a/b/c/",
-			FlagRemoveWWW,
-			"https://root/a/b/c/",
-			false,
-		},
-		&testCase{
-			"RemoveWWW2",
-			"https://WwW.Root/a/b/c/",
-			FlagRemoveWWW,
-			"https://Root/a/b/c/",
-			false,
-		},
-		&testCase{
-			"AddWWW",
-			"https://Root/a/b/c/",
-			FlagAddWWW,
-			"https://www.Root/a/b/c/",
-			false,
-		},
-		&testCase{
-			"SortQuery",
-			"http://root/toto/?b=4&a=1&c=3&b=2&a=5",
-			FlagSortQuery,
-			"http://root/toto/?a=1&a=5&b=2&b=4&c=3",
-			false,
-		},
-		&testCase{
-			"RemoveEmptyQuerySeparator",
-			"http://root/toto/?",
-			FlagRemoveEmptyQuerySeparator,
-			"http://root/toto/",
-			false,
-		},
-		&testCase{
-			"Unsafe",
-			"HTTPS://www.RooT.com/toto/t%45%1f///a/./b/../c/?z=3&w=2&a=4&w=1#invalid",
-			FlagsUnsafeGreedy,
-			"http://root.com/toto/tE%1F/a/c?a=4&w=1&w=2&z=3",
-			false,
-		},
-		&testCase{
-			"Safe2",
-			"HTTPS://www.RooT.com/toto/t%45%1f///a/./b/../c/?z=3&w=2&a=4&w=1#invalid",
-			FlagsSafe,
-			"https://www.root.com/toto/tE%1F///a/./b/../c/?z=3&w=2&a=4&w=1#invalid",
-			false,
-		},
-		&testCase{
-			"UsuallySafe2",
-			"HTTPS://www.RooT.com/toto/t%45%1f///a/./b/../c/?z=3&w=2&a=4&w=1#invalid",
-			FlagsUsuallySafeGreedy,
-			"https://www.root.com/toto/tE%1F///a/c?z=3&w=2&a=4&w=1#invalid",
-			false,
-		},
-		&testCase{
-			"AddTrailingSlashBug",
-			"http://src.ca/",
-			FlagsAllNonGreedy,
-			"http://www.src.ca/",
-			false,
-		},
-		&testCase{
-			"SourceModified",
-			"HTTPS://www.RooT.com/toto/t%45%1f///a/./b/../c/?z=3&w=2&a=4&w=1#invalid",
-			FlagsUnsafeGreedy,
-			"http://root.com/toto/tE%1F/a/c?a=4&w=1&w=2&z=3",
-			true,
-		},
-		&testCase{
-			"IPv6-1",
-			"http://[2001:db8:1f70::999:de8:7648:6e8]/test",
-			FlagsSafe | FlagRemoveDotSegments,
-			"http://[2001:db8:1f70::999:de8:7648:6e8]/test",
-			false,
-		},
-		&testCase{
-			"IPv6-2",
-			"http://[::ffff:192.168.1.1]/test",
-			FlagsSafe | FlagRemoveDotSegments,
-			"http://[::ffff:192.168.1.1]/test",
-			false,
-		},
-		&testCase{
-			"IPv6-3",
-			"http://[::ffff:192.168.1.1]:80/test",
-			FlagsSafe | FlagRemoveDotSegments,
-			"http://[::ffff:192.168.1.1]/test",
-			false,
-		},
-		&testCase{
-			"IPv6-4",
-			"htTps://[::fFff:192.168.1.1]:443/test",
-			FlagsSafe | FlagRemoveDotSegments,
-			"https://[::ffff:192.168.1.1]/test",
-			false,
-		},
-		&testCase{
-			"FTP",
-			"ftp://user:pass@ftp.foo.net/foo/bar",
-			FlagsSafe | FlagRemoveDotSegments,
-			"ftp://user:pass@ftp.foo.net/foo/bar",
-			false,
-		},
-		&testCase{
-			"Standard-1",
-			"http://www.foo.com:80/foo",
-			FlagsSafe | FlagRemoveDotSegments,
-			"http://www.foo.com/foo",
-			false,
-		},
-		&testCase{
-			"Standard-2",
-			"http://www.foo.com:8000/foo",
-			FlagsSafe | FlagRemoveDotSegments,
-			"http://www.foo.com:8000/foo",
-			false,
-		},
-		&testCase{
-			"Standard-3",
-			"http://www.foo.com/%7ebar",
-			FlagsSafe | FlagRemoveDotSegments,
-			"http://www.foo.com/~bar",
-			false,
-		},
-		&testCase{
-			"Standard-4",
-			"http://www.foo.com/%7Ebar",
-			FlagsSafe | FlagRemoveDotSegments,
-			"http://www.foo.com/~bar",
-			false,
-		},
-		&testCase{
-			"Standard-5",
-			"http://USER:pass@www.Example.COM/foo/bar",
-			FlagsSafe | FlagRemoveDotSegments,
-			"http://USER:pass@www.example.com/foo/bar",
-			false,
-		},
-		&testCase{
-			"Standard-6",
-			"http://test.example/?a=%26&b=1",
-			FlagsSafe | FlagRemoveDotSegments,
-			"http://test.example/?a=%26&b=1",
-			false,
-		},
-		&testCase{
-			"Standard-7",
-			"http://test.example/%25/?p=%20val%20%25",
-			FlagsSafe | FlagRemoveDotSegments,
-			"http://test.example/%25/?p=%20val%20%25",
-			false,
-		},
-		&testCase{
-			"Standard-8",
-			"http://test.example/path/with a%20space+/",
-			FlagsSafe | FlagRemoveDotSegments,
-			"http://test.example/path/with%20a%20space+/",
-			false,
-		},
-		&testCase{
-			"Standard-9",
-			"http://test.example/?",
-			FlagsSafe | FlagRemoveDotSegments,
-			"http://test.example/",
-			false,
-		},
-		&testCase{
-			"Standard-10",
-			"http://a.COM/path/?b&a",
-			FlagsSafe | FlagRemoveDotSegments,
-			"http://a.com/path/?b&a",
-			false,
-		},
-		&testCase{
-			"StandardCasesAddTrailingSlash",
-			"http://test.example?",
-			FlagsSafe | FlagAddTrailingSlash,
-			"http://test.example/",
-			false,
-		},
-		&testCase{
-			"OctalIP-1",
-			"http://0123.011.0.4/",
-			FlagsSafe | FlagDecodeOctalHost,
-			"http://0123.011.0.4/",
-			false,
-		},
-		&testCase{
-			"OctalIP-2",
-			"http://0102.0146.07.0223/",
-			FlagsSafe | FlagDecodeOctalHost,
-			"http://66.102.7.147/",
-			false,
-		},
-		&testCase{
-			"OctalIP-3",
-			"http://0102.0146.07.0223.:23/",
-			FlagsSafe | FlagDecodeOctalHost,
-			"http://66.102.7.147.:23/",
-			false,
-		},
-		&testCase{
-			"OctalIP-4",
-			"http://USER:pass@0102.0146.07.0223../",
-			FlagsSafe | FlagDecodeOctalHost,
-			"http://USER:pass@66.102.7.147../",
-			false,
-		},
-		&testCase{
-			"DWORDIP-1",
-			"http://123.1113982867/",
-			FlagsSafe | FlagDecodeDWORDHost,
-			"http://123.1113982867/",
-			false,
-		},
-		&testCase{
-			"DWORDIP-2",
-			"http://1113982867/",
-			FlagsSafe | FlagDecodeDWORDHost,
-			"http://66.102.7.147/",
-			false,
-		},
-		&testCase{
-			"DWORDIP-3",
-			"http://1113982867.:23/",
-			FlagsSafe | FlagDecodeDWORDHost,
-			"http://66.102.7.147.:23/",
-			false,
-		},
-		&testCase{
-			"DWORDIP-4",
-			"http://USER:pass@1113982867../",
-			FlagsSafe | FlagDecodeDWORDHost,
-			"http://USER:pass@66.102.7.147../",
-			false,
-		},
-		&testCase{
-			"HexIP-1",
-			"http://0x123.1113982867/",
-			FlagsSafe | FlagDecodeHexHost,
-			"http://0x123.1113982867/",
-			false,
-		},
-		&testCase{
-			"HexIP-2",
-			"http://0x42660793/",
-			FlagsSafe | FlagDecodeHexHost,
-			"http://66.102.7.147/",
-			false,
-		},
-		&testCase{
-			"HexIP-3",
-			"http://0x42660793.:23/",
-			FlagsSafe | FlagDecodeHexHost,
-			"http://66.102.7.147.:23/",
-			false,
-		},
-		&testCase{
-			"HexIP-4",
-			"http://USER:pass@0x42660793../",
-			FlagsSafe | FlagDecodeHexHost,
-			"http://USER:pass@66.102.7.147../",
-			false,
-		},
-		&testCase{
-			"UnnecessaryHostDots-1",
-			"http://.www.foo.com../foo/bar.html",
-			FlagsSafe | FlagRemoveUnnecessaryHostDots,
-			"http://www.foo.com/foo/bar.html",
-			false,
-		},
-		&testCase{
-			"UnnecessaryHostDots-2",
-			"http://www.foo.com./foo/bar.html",
-			FlagsSafe | FlagRemoveUnnecessaryHostDots,
-			"http://www.foo.com/foo/bar.html",
-			false,
-		},
-		&testCase{
-			"UnnecessaryHostDots-3",
-			"http://www.foo.com.:81/foo",
-			FlagsSafe | FlagRemoveUnnecessaryHostDots,
-			"http://www.foo.com:81/foo",
-			false,
-		},
-		&testCase{
-			"UnnecessaryHostDots-4",
-			"http://www.example.com./",
-			FlagsSafe | FlagRemoveUnnecessaryHostDots,
-			"http://www.example.com/",
-			false,
-		},
-		&testCase{
-			"EmptyPort-1",
-			"http://www.thedraymin.co.uk:/main/?p=308",
-			FlagsSafe | FlagRemoveEmptyPortSeparator,
-			"http://www.thedraymin.co.uk/main/?p=308",
-			false,
-		},
-		&testCase{
-			"EmptyPort-2",
-			"http://www.src.ca:",
-			FlagsSafe | FlagRemoveEmptyPortSeparator,
-			"http://www.src.ca",
-			false,
-		},
-		&testCase{
-			"Slashes-1",
-			"http://test.example/foo/bar/.",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/foo/bar/",
-			false,
-		},
-		&testCase{
-			"Slashes-2",
-			"http://test.example/foo/bar/./",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/foo/bar/",
-			false,
-		},
-		&testCase{
-			"Slashes-3",
-			"http://test.example/foo/bar/..",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/foo/",
-			false,
-		},
-		&testCase{
-			"Slashes-4",
-			"http://test.example/foo/bar/../",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/foo/",
-			false,
-		},
-		&testCase{
-			"Slashes-5",
-			"http://test.example/foo/bar/../baz",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/foo/baz",
-			false,
-		},
-		&testCase{
-			"Slashes-6",
-			"http://test.example/foo/bar/../..",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/",
-			false,
-		},
-		&testCase{
-			"Slashes-7",
-			"http://test.example/foo/bar/../../",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/",
-			false,
-		},
-		&testCase{
-			"Slashes-8",
-			"http://test.example/foo/bar/../../baz",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/baz",
-			false,
-		},
-		&testCase{
-			"Slashes-9",
-			"http://test.example/foo/bar/../../../baz",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/baz",
-			false,
-		},
-		&testCase{
-			"Slashes-10",
-			"http://test.example/foo/bar/../../../../baz",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/baz",
-			false,
-		},
-		&testCase{
-			"Slashes-11",
-			"http://test.example/./foo",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/foo",
-			false,
-		},
-		&testCase{
-			"Slashes-12",
-			"http://test.example/../foo",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/foo",
-			false,
-		},
-		&testCase{
-			"Slashes-13",
-			"http://test.example/foo.",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/foo.",
-			false,
-		},
-		&testCase{
-			"Slashes-14",
-			"http://test.example/.foo",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/.foo",
-			false,
-		},
-		&testCase{
-			"Slashes-15",
-			"http://test.example/foo..",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/foo..",
-			false,
-		},
-		&testCase{
-			"Slashes-16",
-			"http://test.example/..foo",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/..foo",
-			false,
-		},
-		&testCase{
-			"Slashes-17",
-			"http://test.example/./../foo",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/foo",
-			false,
-		},
-		&testCase{
-			"Slashes-18",
-			"http://test.example/./foo/.",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/foo/",
-			false,
-		},
-		&testCase{
-			"Slashes-19",
-			"http://test.example/foo/./bar",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/foo/bar",
-			false,
-		},
-		&testCase{
-			"Slashes-20",
-			"http://test.example/foo/../bar",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/bar",
-			false,
-		},
-		&testCase{
-			"Slashes-21",
-			"http://test.example/foo//",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/foo/",
-			false,
-		},
-		&testCase{
-			"Slashes-22",
-			"http://test.example/foo///bar//",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"http://test.example/foo/bar/",
-			false,
-		},
-		&testCase{
-			"Relative",
-			"foo/bar",
-			FlagsAllGreedy,
-			"foo/bar",
-			false,
-		},
-		&testCase{
-			"Relative-1",
-			"./../foo",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"foo",
-			false,
-		},
-		&testCase{
-			"Relative-2",
-			"./foo/bar/../baz/../bang/..",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"foo/",
-			false,
-		},
-		&testCase{
-			"Relative-3",
-			"foo///bar//",
-			FlagsSafe | FlagRemoveDotSegments | FlagRemoveDuplicateSlashes,
-			"foo/bar/",
-			false,
-		},
-		&testCase{
-			"Relative-4",
-			"www.youtube.com",
-			FlagsUsuallySafeGreedy,
-			"www.youtube.com",
-			false,
-		},
-		/*&testCase{
-			"UrlNorm-5",
-			"http://ja.wikipedia.org/wiki/%E3%82%AD%E3%83%A3%E3%82%BF%E3%83%94%E3%83%A9%E3%83%BC%E3%82%B8%E3%83%A3%E3%83%91%E3%83%B3",
-			FlagsSafe | FlagRemoveDotSegments,
-			"http://ja.wikipedia.org/wiki/\xe3\x82\xad\xe3\x83\xa3\xe3\x82\xbf\xe3\x83\x94\xe3\x83\xa9\xe3\x83\xbc\xe3\x82\xb8\xe3\x83\xa3\xe3\x83\x91\xe3\x83\xb3",
-			false,
-		},
-		&testCase{
-			"UrlNorm-1",
-			"http://test.example/?a=%e3%82%82%26",
-			FlagsAllGreedy,
-			"http://test.example/?a=\xe3\x82\x82%26",
-			false,
-		},*/
-	}
-)
-
-func TestRunner(t *testing.T) {
-	for _, tc := range cases {
-		runCase(tc, t)
-	}
-}
-
-func runCase(tc *testCase, t *testing.T) {
-	t.Logf("running %s...", tc.nm)
-	if tc.parsed {
-		u, e := url.Parse(tc.src)
-		if e != nil {
-			t.Errorf("%s - FAIL : %s", tc.nm, e)
-			return
-		} else {
-			NormalizeURL(u, tc.flgs)
-			if s := u.String(); s != tc.res {
-				t.Errorf("%s - FAIL expected '%s', got '%s'", tc.nm, tc.res, s)
-			}
-		}
-	} else {
-		if s, e := NormalizeURLString(tc.src, tc.flgs); e != nil {
-			t.Errorf("%s - FAIL : %s", tc.nm, e)
-		} else if s != tc.res {
-			t.Errorf("%s - FAIL expected '%s', got '%s'", tc.nm, tc.res, s)
-		}
-	}
-}
-
-func TestDecodeUnnecessaryEscapesAll(t *testing.T) {
-	var url = "http://host/"
-
-	for i := 0; i < 256; i++ {
-		url += fmt.Sprintf("%%%02x", i)
-	}
-	if s, e := NormalizeURLString(url, FlagDecodeUnnecessaryEscapes); e != nil {
-		t.Fatalf("Got error %s", e.Error())
-	} else {
-		const want = "http://host/%00%01%02%03%04%05%06%07%08%09%0A%0B%0C%0D%0E%0F%10%11%12%13%14%15%16%17%18%19%1A%1B%1C%1D%1E%1F%20!%22%23$%25&'()*+,-./0123456789:;%3C=%3E%3F@ABCDEFGHIJKLMNOPQRSTUVWXYZ[%5C]%5E_%60abcdefghijklmnopqrstuvwxyz%7B%7C%7D~%7F%80%81%82%83%84%85%86%87%88%89%8A%8B%8C%8D%8E%8F%90%91%92%93%94%95%96%97%98%99%9A%9B%9C%9D%9E%9F%A0%A1%A2%A3%A4%A5%A6%A7%A8%A9%AA%AB%AC%AD%AE%AF%B0%B1%B2%B3%B4%B5%B6%B7%B8%B9%BA%BB%BC%BD%BE%BF%C0%C1%C2%C3%C4%C5%C6%C7%C8%C9%CA%CB%CC%CD%CE%CF%D0%D1%D2%D3%D4%D5%D6%D7%D8%D9%DA%DB%DC%DD%DE%DF%E0%E1%E2%E3%E4%E5%E6%E7%E8%E9%EA%EB%EC%ED%EE%EF%F0%F1%F2%F3%F4%F5%F6%F7%F8%F9%FA%FB%FC%FD%FE%FF"
-		if s != want {
-			t.Errorf("DecodeUnnecessaryEscapesAll:\nwant\n%s\ngot\n%s", want, s)
-		}
-	}
-}
-
-func TestEncodeNecessaryEscapesAll(t *testing.T) {
-	var url = "http://host/"
-
-	for i := 0; i < 256; i++ {
-		if i != 0x25 {
-			url += string(i)
-		}
-	}
-	if s, e := NormalizeURLString(url, FlagEncodeNecessaryEscapes); e != nil {
-		t.Fatalf("Got error %s", e.Error())
-	} else {
-		const want = "http://host/%00%01%02%03%04%05%06%07%08%09%0A%0B%0C%0D%0E%0F%10%11%12%13%14%15%16%17%18%19%1A%1B%1C%1D%1E%1F%20!%22#$&'()*+,-./0123456789:;%3C=%3E?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[%5C]%5E_%60abcdefghijklmnopqrstuvwxyz%7B%7C%7D~%7F%C2%80%C2%81%C2%82%C2%83%C2%84%C2%85%C2%86%C2%87%C2%88%C2%89%C2%8A%C2%8B%C2%8C%C2%8D%C2%8E%C2%8F%C2%90%C2%91%C2%92%C2%93%C2%94%C2%95%C2%96%C2%97%C2%98%C2%99%C2%9A%C2%9B%C2%9C%C2%9D%C2%9E%C2%9F%C2%A0%C2%A1%C2%A2%C2%A3%C2%A4%C2%A5%C2%A6%C2%A7%C2%A8%C2%A9%C2%AA%C2%AB%C2%AC%C2%AD%C2%AE%C2%AF%C2%B0%C2%B1%C2%B2%C2%B3%C2%B4%C2%B5%C2%B6%C2%B7%C2%B8%C2%B9%C2%BA%C2%BB%C2%BC%C2%BD%C2%BE%C2%BF%C3%80%C3%81%C3%82%C3%83%C3%84%C3%85%C3%86%C3%87%C3%88%C3%89%C3%8A%C3%8B%C3%8C%C3%8D%C3%8E%C3%8F%C3%90%C3%91%C3%92%C3%93%C3%94%C3%95%C3%96%C3%97%C3%98%C3%99%C3%9A%C3%9B%C3%9C%C3%9D%C3%9E%C3%9F%C3%A0%C3%A1%C3%A2%C3%A3%C3%A4%C3%A5%C3%A6%C3%A7%C3%A8%C3%A9%C3%AA%C3%AB%C3%AC%C3%AD%C3%AE%C3%AF%C3%B0%C3%B1%C3%B2%C3%B3%C3%B4%C3%B5%C3%B6%C3%B7%C3%B8%C3%B9%C3%BA%C3%BB%C3%BC%C3%BD%C3%BE%C3%BF"
-		if s != want {
-			t.Errorf("EncodeNecessaryEscapesAll:\nwant\n%s\ngot\n%s", want, s)
-		}
-	}
-}

vendor/github.com/PuerkitoBio/purell/urlnorm_test.go

@@ -1,52 +0,0 @@
-package purell
-
-import (
-	"testing"
-)
-
-// Test cases merged from PR #1
-// Originally from https://github.com/jehiah/urlnorm/blob/master/test_urlnorm.py
-
-func assertMap(t *testing.T, cases map[string]string, f NormalizationFlags) {
-	for bad, good := range cases {
-		s, e := NormalizeURLString(bad, f)
-		if e != nil {
-			t.Errorf("%s normalizing %v to %v", e.Error(), bad, good)
-		} else {
-			if s != good {
-				t.Errorf("source: %v expected: %v got: %v", bad, good, s)
-			}
-		}
-	}
-}
-
-// This tests normalization to a unicode representation
-// precent escapes for unreserved values are unescaped to their unicode value
-// tests normalization to idna domains
-// test ip word handling, ipv6 address handling, and trailing domain periods
-// in general, this matches google chromes unescaping for things in the address bar.
-// spaces are converted to '+' (perhaphs controversial)
-// http://code.google.com/p/google-url/ probably is another good reference for this approach
-func TestUrlnorm(t *testing.T) {
-	testcases := map[string]string{
-		"http://test.example/?a=%e3%82%82%26": "http://test.example/?a=%e3%82%82%26",
-		//"http://test.example/?a=%e3%82%82%26": "http://test.example/?a=\xe3\x82\x82%26", //should return a unicode character
-		"http://s.xn--q-bga.DE/":    "http://s.xn--q-bga.de/",       //should be in idna format
-		"http://XBLA\u306eXbox.com": "http://xn--xblaxbox-jf4g.com", //test utf8 and unicode
-		"http://президент.рф":       "http://xn--d1abbgf6aiiy.xn--p1ai",
-		"http://ПРЕЗИДЕНТ.РФ":       "http://xn--d1abbgf6aiiy.xn--p1ai",
-		"http://\u00e9.com":         "http://xn--9ca.com",
-		"http://e\u0301.com":        "http://xn--9ca.com",
-		"http://ja.wikipedia.org/wiki/%E3%82%AD%E3%83%A3%E3%82%BF%E3%83%94%E3%83%A9%E3%83%BC%E3%82%B8%E3%83%A3%E3%83%91%E3%83%B3": "http://ja.wikipedia.org/wiki/%E3%82%AD%E3%83%A3%E3%82%BF%E3%83%94%E3%83%A9%E3%83%BC%E3%82%B8%E3%83%A3%E3%83%91%E3%83%B3",
-		//"http://ja.wikipedia.org/wiki/%E3%82%AD%E3%83%A3%E3%82%BF%E3%83%94%E3%83%A9%E3%83%BC%E3%82%B8%E3%83%A3%E3%83%91%E3%83%B3": "http://ja.wikipedia.org/wiki/\xe3\x82\xad\xe3\x83\xa3\xe3\x82\xbf\xe3\x83\x94\xe3\x83\xa9\xe3\x83\xbc\xe3\x82\xb8\xe3\x83\xa3\xe3\x83\x91\xe3\x83\xb3",
-
-		"http://test.example/\xe3\x82\xad": "http://test.example/%E3%82%AD",
-		//"http://test.example/\xe3\x82\xad":              "http://test.example/\xe3\x82\xad",
-		"http://test.example/?p=%23val#test-%23-val%25": "http://test.example/?p=%23val#test-%23-val%25", //check that %23 (#) is not escaped where it shouldn't be
-
-		"http://test.domain/I%C3%B1t%C3%ABrn%C3%A2ti%C3%B4n%EF%BF%BDliz%C3%A6ti%C3%B8n": "http://test.domain/I%C3%B1t%C3%ABrn%C3%A2ti%C3%B4n%EF%BF%BDliz%C3%A6ti%C3%B8n",
-		//"http://test.domain/I%C3%B1t%C3%ABrn%C3%A2ti%C3%B4n%EF%BF%BDliz%C3%A6ti%C3%B8n": "http://test.domain/I\xc3\xb1t\xc3\xabrn\xc3\xa2ti\xc3\xb4n\xef\xbf\xbdliz\xc3\xa6ti\xc3\xb8n",
-	}
-
-	assertMap(t, testcases, FlagsSafe|FlagRemoveDotSegments)
-}

vendor/github.com/PuerkitoBio/urlesc/.travis.yml

@@ -1,11 +0,0 @@
-language: go
-
-go:
-  - 1.4
-  - tip
-
-install:
-  - go build .
-
-script:
-  - go test -v

vendor/github.com/PuerkitoBio/urlesc/LICENSE

@@ -1,27 +0,0 @@
-Copyright (c) 2012 The Go Authors. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-   * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-   * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-   * Neither the name of Google Inc. nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

vendor/github.com/PuerkitoBio/urlesc/README.md

@@ -1,16 +0,0 @@
-urlesc [![Build Status](https://travis-ci.org/PuerkitoBio/urlesc.png?branch=master)](https://travis-ci.org/PuerkitoBio/urlesc) [![GoDoc](http://godoc.org/github.com/PuerkitoBio/urlesc?status.svg)](http://godoc.org/github.com/PuerkitoBio/urlesc)
-======
-
-Package urlesc implements query escaping as per RFC 3986.
-
-It contains some parts of the net/url package, modified so as to allow
-some reserved characters incorrectly escaped by net/url (see [issue 5684](https://github.com/golang/go/issues/5684)).
-
-## Install
-
-    go get github.com/PuerkitoBio/urlesc
-
-## License
-
-Go license (BSD-3-Clause)
-

vendor/github.com/PuerkitoBio/urlesc/urlesc.go

@@ -1,180 +0,0 @@
-// Copyright 2009 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package urlesc implements query escaping as per RFC 3986.
-// It contains some parts of the net/url package, modified so as to allow
-// some reserved characters incorrectly escaped by net/url.
-// See https://github.com/golang/go/issues/5684
-package urlesc
-
-import (
-	"bytes"
-	"net/url"
-	"strings"
-)
-
-type encoding int
-
-const (
-	encodePath encoding = 1 + iota
-	encodeUserPassword
-	encodeQueryComponent
-	encodeFragment
-)
-
-// Return true if the specified character should be escaped when
-// appearing in a URL string, according to RFC 3986.
-func shouldEscape(c byte, mode encoding) bool {
-	// §2.3 Unreserved characters (alphanum)
-	if 'A' <= c && c <= 'Z' || 'a' <= c && c <= 'z' || '0' <= c && c <= '9' {
-		return false
-	}
-
-	switch c {
-	case '-', '.', '_', '~': // §2.3 Unreserved characters (mark)
-		return false
-
-	// §2.2 Reserved characters (reserved)
-	case ':', '/', '?', '#', '[', ']', '@', // gen-delims
-		'!', '$', '&', '\'', '(', ')', '*', '+', ',', ';', '=': // sub-delims
-		// Different sections of the URL allow a few of
-		// the reserved characters to appear unescaped.
-		switch mode {
-		case encodePath: // §3.3
-			// The RFC allows sub-delims and : @.
-			// '/', '[' and ']' can be used to assign meaning to individual path
-			// segments.  This package only manipulates the path as a whole,
-			// so we allow those as well.  That leaves only ? and # to escape.
-			return c == '?' || c == '#'
-
-		case encodeUserPassword: // §3.2.1
-			// The RFC allows : and sub-delims in
-			// userinfo.  The parsing of userinfo treats ':' as special so we must escape
-			// all the gen-delims.
-			return c == ':' || c == '/' || c == '?' || c == '#' || c == '[' || c == ']' || c == '@'
-
-		case encodeQueryComponent: // §3.4
-			// The RFC allows / and ?.
-			return c != '/' && c != '?'
-
-		case encodeFragment: // §4.1
-			// The RFC text is silent but the grammar allows
-			// everything, so escape nothing but #
-			return c == '#'
-		}
-	}
-
-	// Everything else must be escaped.
-	return true
-}
-
-// QueryEscape escapes the string so it can be safely placed
-// inside a URL query.
-func QueryEscape(s string) string {
-	return escape(s, encodeQueryComponent)
-}
-
-func escape(s string, mode encoding) string {
-	spaceCount, hexCount := 0, 0
-	for i := 0; i < len(s); i++ {
-		c := s[i]
-		if shouldEscape(c, mode) {
-			if c == ' ' && mode == encodeQueryComponent {
-				spaceCount++
-			} else {
-				hexCount++
-			}
-		}
-	}
-
-	if spaceCount == 0 && hexCount == 0 {
-		return s
-	}
-
-	t := make([]byte, len(s)+2*hexCount)
-	j := 0
-	for i := 0; i < len(s); i++ {
-		switch c := s[i]; {
-		case c == ' ' && mode == encodeQueryComponent:
-			t[j] = '+'
-			j++
-		case shouldEscape(c, mode):
-			t[j] = '%'
-			t[j+1] = "0123456789ABCDEF"[c>>4]
-			t[j+2] = "0123456789ABCDEF"[c&15]
-			j += 3
-		default:
-			t[j] = s[i]
-			j++
-		}
-	}
-	return string(t)
-}
-
-var uiReplacer = strings.NewReplacer(
-	"%21", "!",
-	"%27", "'",
-	"%28", "(",
-	"%29", ")",
-	"%2A", "*",
-)
-
-// unescapeUserinfo unescapes some characters that need not to be escaped as per RFC3986.
-func unescapeUserinfo(s string) string {
-	return uiReplacer.Replace(s)
-}
-
-// Escape reassembles the URL into a valid URL string.
-// The general form of the result is one of:
-//
-//	scheme:opaque
-//	scheme://userinfo@host/path?query#fragment
-//
-// If u.Opaque is non-empty, String uses the first form;
-// otherwise it uses the second form.
-//
-// In the second form, the following rules apply:
-//	- if u.Scheme is empty, scheme: is omitted.
-//	- if u.User is nil, userinfo@ is omitted.
-//	- if u.Host is empty, host/ is omitted.
-//	- if u.Scheme and u.Host are empty and u.User is nil,
-//	   the entire scheme://userinfo@host/ is omitted.
-//	- if u.Host is non-empty and u.Path begins with a /,
-//	   the form host/path does not add its own /.
-//	- if u.RawQuery is empty, ?query is omitted.
-//	- if u.Fragment is empty, #fragment is omitted.
-func Escape(u *url.URL) string {
-	var buf bytes.Buffer
-	if u.Scheme != "" {
-		buf.WriteString(u.Scheme)
-		buf.WriteByte(':')
-	}
-	if u.Opaque != "" {
-		buf.WriteString(u.Opaque)
-	} else {
-		if u.Scheme != "" || u.Host != "" || u.User != nil {
-			buf.WriteString("//")
-			if ui := u.User; ui != nil {
-				buf.WriteString(unescapeUserinfo(ui.String()))
-				buf.WriteByte('@')
-			}
-			if h := u.Host; h != "" {
-				buf.WriteString(h)
-			}
-		}
-		if u.Path != "" && u.Path[0] != '/' && u.Host != "" {
-			buf.WriteByte('/')
-		}
-		buf.WriteString(escape(u.Path, encodePath))
-	}
-	if u.RawQuery != "" {
-		buf.WriteByte('?')
-		buf.WriteString(u.RawQuery)
-	}
-	if u.Fragment != "" {
-		buf.WriteByte('#')
-		buf.WriteString(escape(u.Fragment, encodeFragment))
-	}
-	return buf.String()
-}

vendor/github.com/PuerkitoBio/urlesc/urlesc_test.go

@@ -1,641 +0,0 @@
-// Copyright 2009 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package urlesc
-
-import (
-	"net/url"
-	"testing"
-)
-
-type URLTest struct {
-	in        string
-	out       *url.URL
-	roundtrip string // expected result of reserializing the URL; empty means same as "in".
-}
-
-var urltests = []URLTest{
-	// no path
-	{
-		"http://www.google.com",
-		&url.URL{
-			Scheme: "http",
-			Host:   "www.google.com",
-		},
-		"",
-	},
-	// path
-	{
-		"http://www.google.com/",
-		&url.URL{
-			Scheme: "http",
-			Host:   "www.google.com",
-			Path:   "/",
-		},
-		"",
-	},
-	// path with hex escaping
-	{
-		"http://www.google.com/file%20one%26two",
-		&url.URL{
-			Scheme: "http",
-			Host:   "www.google.com",
-			Path:   "/file one&two",
-		},
-		"http://www.google.com/file%20one&two",
-	},
-	// user
-	{
-		"ftp://webmaster@www.google.com/",
-		&url.URL{
-			Scheme: "ftp",
-			User:   url.User("webmaster"),
-			Host:   "www.google.com",
-			Path:   "/",
-		},
-		"",
-	},
-	// escape sequence in username
-	{
-		"ftp://john%20doe@www.google.com/",
-		&url.URL{
-			Scheme: "ftp",
-			User:   url.User("john doe"),
-			Host:   "www.google.com",
-			Path:   "/",
-		},
-		"ftp://john%20doe@www.google.com/",
-	},
-	// query
-	{
-		"http://www.google.com/?q=go+language",
-		&url.URL{
-			Scheme:   "http",
-			Host:     "www.google.com",
-			Path:     "/",
-			RawQuery: "q=go+language",
-		},
-		"",
-	},
-	// query with hex escaping: NOT parsed
-	{
-		"http://www.google.com/?q=go%20language",
-		&url.URL{
-			Scheme:   "http",
-			Host:     "www.google.com",
-			Path:     "/",
-			RawQuery: "q=go%20language",
-		},
-		"",
-	},
-	// %20 outside query
-	{
-		"http://www.google.com/a%20b?q=c+d",
-		&url.URL{
-			Scheme:   "http",
-			Host:     "www.google.com",
-			Path:     "/a b",
-			RawQuery: "q=c+d",
-		},
-		"",
-	},
-	// path without leading /, so no parsing
-	{
-		"http:www.google.com/?q=go+language",
-		&url.URL{
-			Scheme:   "http",
-			Opaque:   "www.google.com/",
-			RawQuery: "q=go+language",
-		},
-		"http:www.google.com/?q=go+language",
-	},
-	// path without leading /, so no parsing
-	{
-		"http:%2f%2fwww.google.com/?q=go+language",
-		&url.URL{
-			Scheme:   "http",
-			Opaque:   "%2f%2fwww.google.com/",
-			RawQuery: "q=go+language",
-		},
-		"http:%2f%2fwww.google.com/?q=go+language",
-	},
-	// non-authority with path
-	{
-		"mailto:/webmaster@golang.org",
-		&url.URL{
-			Scheme: "mailto",
-			Path:   "/webmaster@golang.org",
-		},
-		"mailto:///webmaster@golang.org", // unfortunate compromise
-	},
-	// non-authority
-	{
-		"mailto:webmaster@golang.org",
-		&url.URL{
-			Scheme: "mailto",
-			Opaque: "webmaster@golang.org",
-		},
-		"",
-	},
-	// unescaped :// in query should not create a scheme
-	{
-		"/foo?query=http://bad",
-		&url.URL{
-			Path:     "/foo",
-			RawQuery: "query=http://bad",
-		},
-		"",
-	},
-	// leading // without scheme should create an authority
-	{
-		"//foo",
-		&url.URL{
-			Host: "foo",
-		},
-		"",
-	},
-	// leading // without scheme, with userinfo, path, and query
-	{
-		"//user@foo/path?a=b",
-		&url.URL{
-			User:     url.User("user"),
-			Host:     "foo",
-			Path:     "/path",
-			RawQuery: "a=b",
-		},
-		"",
-	},
-	// Three leading slashes isn't an authority, but doesn't return an error.
-	// (We can't return an error, as this code is also used via
-	// ServeHTTP -> ReadRequest -> Parse, which is arguably a
-	// different URL parsing context, but currently shares the
-	// same codepath)
-	{
-		"///threeslashes",
-		&url.URL{
-			Path: "///threeslashes",
-		},
-		"",
-	},
-	{
-		"http://user:password@google.com",
-		&url.URL{
-			Scheme: "http",
-			User:   url.UserPassword("user", "password"),
-			Host:   "google.com",
-		},
-		"http://user:password@google.com",
-	},
-	// unescaped @ in username should not confuse host
-	{
-		"http://j@ne:password@google.com",
-		&url.URL{
-			Scheme: "http",
-			User:   url.UserPassword("j@ne", "password"),
-			Host:   "google.com",
-		},
-		"http://j%40ne:password@google.com",
-	},
-	// unescaped @ in password should not confuse host
-	{
-		"http://jane:p@ssword@google.com",
-		&url.URL{
-			Scheme: "http",
-			User:   url.UserPassword("jane", "p@ssword"),
-			Host:   "google.com",
-		},
-		"http://jane:p%40ssword@google.com",
-	},
-	{
-		"http://j@ne:password@google.com/p@th?q=@go",
-		&url.URL{
-			Scheme:   "http",
-			User:     url.UserPassword("j@ne", "password"),
-			Host:     "google.com",
-			Path:     "/p@th",
-			RawQuery: "q=@go",
-		},
-		"http://j%40ne:password@google.com/p@th?q=@go",
-	},
-	{
-		"http://www.google.com/?q=go+language#foo",
-		&url.URL{
-			Scheme:   "http",
-			Host:     "www.google.com",
-			Path:     "/",
-			RawQuery: "q=go+language",
-			Fragment: "foo",
-		},
-		"",
-	},
-	{
-		"http://www.google.com/?q=go+language#foo%26bar",
-		&url.URL{
-			Scheme:   "http",
-			Host:     "www.google.com",
-			Path:     "/",
-			RawQuery: "q=go+language",
-			Fragment: "foo&bar",
-		},
-		"http://www.google.com/?q=go+language#foo&bar",
-	},
-	{
-		"file:///home/adg/rabbits",
-		&url.URL{
-			Scheme: "file",
-			Host:   "",
-			Path:   "/home/adg/rabbits",
-		},
-		"file:///home/adg/rabbits",
-	},
-	// "Windows" paths are no exception to the rule.
-	// See golang.org/issue/6027, especially comment #9.
-	{
-		"file:///C:/FooBar/Baz.txt",
-		&url.URL{
-			Scheme: "file",
-			Host:   "",
-			Path:   "/C:/FooBar/Baz.txt",
-		},
-		"file:///C:/FooBar/Baz.txt",
-	},
-	// case-insensitive scheme
-	{
-		"MaIlTo:webmaster@golang.org",
-		&url.URL{
-			Scheme: "mailto",
-			Opaque: "webmaster@golang.org",
-		},
-		"mailto:webmaster@golang.org",
-	},
-	// Relative path
-	{
-		"a/b/c",
-		&url.URL{
-			Path: "a/b/c",
-		},
-		"a/b/c",
-	},
-	// escaped '?' in username and password
-	{
-		"http://%3Fam:pa%3Fsword@google.com",
-		&url.URL{
-			Scheme: "http",
-			User:   url.UserPassword("?am", "pa?sword"),
-			Host:   "google.com",
-		},
-		"",
-	},
-	// escaped '?' and '#' in path
-	{
-		"http://example.com/%3F%23",
-		&url.URL{
-			Scheme: "http",
-			Host:   "example.com",
-			Path:   "?#",
-		},
-		"",
-	},
-	// unescaped [ ] ! ' ( ) * in path
-	{
-		"http://example.com/[]!'()*",
-		&url.URL{
-			Scheme: "http",
-			Host:   "example.com",
-			Path:   "[]!'()*",
-		},
-		"http://example.com/[]!'()*",
-	},
-	// escaped : / ? # [ ] @ in username and password
-	{
-		"http://%3A%2F%3F:%23%5B%5D%40@example.com",
-		&url.URL{
-			Scheme: "http",
-			User:   url.UserPassword(":/?", "#[]@"),
-			Host:   "example.com",
-		},
-		"",
-	},
-	// unescaped ! $ & ' ( ) * + , ; = in username and password
-	{
-		"http://!$&'():*+,;=@example.com",
-		&url.URL{
-			Scheme: "http",
-			User:   url.UserPassword("!$&'()", "*+,;="),
-			Host:   "example.com",
-		},
-		"",
-	},
-	// unescaped = : / . ? = in query component
-	{
-		"http://example.com/?q=http://google.com/?q=",
-		&url.URL{
-			Scheme:   "http",
-			Host:     "example.com",
-			Path:     "/",
-			RawQuery: "q=http://google.com/?q=",
-		},
-		"",
-	},
-	// unescaped : / ? [ ] @ ! $ & ' ( ) * + , ; = in fragment
-	{
-		"http://example.com/#:/?%23[]@!$&'()*+,;=",
-		&url.URL{
-			Scheme:   "http",
-			Host:     "example.com",
-			Path:     "/",
-			Fragment: ":/?#[]@!$&'()*+,;=",
-		},
-		"",
-	},
-}
-
-func DoTestString(t *testing.T, parse func(string) (*url.URL, error), name string, tests []URLTest) {
-	for _, tt := range tests {
-		u, err := parse(tt.in)
-		if err != nil {
-			t.Errorf("%s(%q) returned error %s", name, tt.in, err)
-			continue
-		}
-		expected := tt.in
-		if len(tt.roundtrip) > 0 {
-			expected = tt.roundtrip
-		}
-		s := Escape(u)
-		if s != expected {
-			t.Errorf("Escape(%s(%q)) == %q (expected %q)", name, tt.in, s, expected)
-		}
-	}
-}
-
-func TestURLString(t *testing.T) {
-	DoTestString(t, url.Parse, "Parse", urltests)
-
-	// no leading slash on path should prepend
-	// slash on String() call
-	noslash := URLTest{
-		"http://www.google.com/search",
-		&url.URL{
-			Scheme: "http",
-			Host:   "www.google.com",
-			Path:   "search",
-		},
-		"",
-	}
-	s := Escape(noslash.out)
-	if s != noslash.in {
-		t.Errorf("Expected %s; go %s", noslash.in, s)
-	}
-}
-
-type EscapeTest struct {
-	in  string
-	out string
-	err error
-}
-
-var escapeTests = []EscapeTest{
-	{
-		"",
-		"",
-		nil,
-	},
-	{
-		"abc",
-		"abc",
-		nil,
-	},
-	{
-		"one two",
-		"one+two",
-		nil,
-	},
-	{
-		"10%",
-		"10%25",
-		nil,
-	},
-	{
-		" ?&=#+%!<>#\"{}|\\^[]`☺\t:/@$'()*,;",
-		"+?%26%3D%23%2B%25%21%3C%3E%23%22%7B%7D%7C%5C%5E%5B%5D%60%E2%98%BA%09%3A/%40%24%27%28%29%2A%2C%3B",
-		nil,
-	},
-}
-
-func TestEscape(t *testing.T) {
-	for _, tt := range escapeTests {
-		actual := QueryEscape(tt.in)
-		if tt.out != actual {
-			t.Errorf("QueryEscape(%q) = %q, want %q", tt.in, actual, tt.out)
-		}
-
-		// for bonus points, verify that escape:unescape is an identity.
-		roundtrip, err := url.QueryUnescape(actual)
-		if roundtrip != tt.in || err != nil {
-			t.Errorf("QueryUnescape(%q) = %q, %s; want %q, %s", actual, roundtrip, err, tt.in, "[no error]")
-		}
-	}
-}
-
-var resolveReferenceTests = []struct {
-	base, rel, expected string
-}{
-	// Absolute URL references
-	{"http://foo.com?a=b", "https://bar.com/", "https://bar.com/"},
-	{"http://foo.com/", "https://bar.com/?a=b", "https://bar.com/?a=b"},
-	{"http://foo.com/bar", "mailto:foo@example.com", "mailto:foo@example.com"},
-
-	// Path-absolute references
-	{"http://foo.com/bar", "/baz", "http://foo.com/baz"},
-	{"http://foo.com/bar?a=b#f", "/baz", "http://foo.com/baz"},
-	{"http://foo.com/bar?a=b", "/baz?c=d", "http://foo.com/baz?c=d"},
-
-	// Scheme-relative
-	{"https://foo.com/bar?a=b", "//bar.com/quux", "https://bar.com/quux"},
-
-	// Path-relative references:
-
-	// ... current directory
-	{"http://foo.com", ".", "http://foo.com/"},
-	{"http://foo.com/bar", ".", "http://foo.com/"},
-	{"http://foo.com/bar/", ".", "http://foo.com/bar/"},
-
-	// ... going down
-	{"http://foo.com", "bar", "http://foo.com/bar"},
-	{"http://foo.com/", "bar", "http://foo.com/bar"},
-	{"http://foo.com/bar/baz", "quux", "http://foo.com/bar/quux"},
-
-	// ... going up
-	{"http://foo.com/bar/baz", "../quux", "http://foo.com/quux"},
-	{"http://foo.com/bar/baz", "../../../../../quux", "http://foo.com/quux"},
-	{"http://foo.com/bar", "..", "http://foo.com/"},
-	{"http://foo.com/bar/baz", "./..", "http://foo.com/"},
-	// ".." in the middle (issue 3560)
-	{"http://foo.com/bar/baz", "quux/dotdot/../tail", "http://foo.com/bar/quux/tail"},
-	{"http://foo.com/bar/baz", "quux/./dotdot/../tail", "http://foo.com/bar/quux/tail"},
-	{"http://foo.com/bar/baz", "quux/./dotdot/.././tail", "http://foo.com/bar/quux/tail"},
-	{"http://foo.com/bar/baz", "quux/./dotdot/./../tail", "http://foo.com/bar/quux/tail"},
-	{"http://foo.com/bar/baz", "quux/./dotdot/dotdot/././../../tail", "http://foo.com/bar/quux/tail"},
-	{"http://foo.com/bar/baz", "quux/./dotdot/dotdot/./.././../tail", "http://foo.com/bar/quux/tail"},
-	{"http://foo.com/bar/baz", "quux/./dotdot/dotdot/dotdot/./../../.././././tail", "http://foo.com/bar/quux/tail"},
-	{"http://foo.com/bar/baz", "quux/./dotdot/../dotdot/../dot/./tail/..", "http://foo.com/bar/quux/dot/"},
-
-	// Remove any dot-segments prior to forming the target URI.
-	// http://tools.ietf.org/html/rfc3986#section-5.2.4
-	{"http://foo.com/dot/./dotdot/../foo/bar", "../baz", "http://foo.com/dot/baz"},
-
-	// Triple dot isn't special
-	{"http://foo.com/bar", "...", "http://foo.com/..."},
-
-	// Fragment
-	{"http://foo.com/bar", ".#frag", "http://foo.com/#frag"},
-
-	// RFC 3986: Normal Examples
-	// http://tools.ietf.org/html/rfc3986#section-5.4.1
-	{"http://a/b/c/d;p?q", "g:h", "g:h"},
-	{"http://a/b/c/d;p?q", "g", "http://a/b/c/g"},
-	{"http://a/b/c/d;p?q", "./g", "http://a/b/c/g"},
-	{"http://a/b/c/d;p?q", "g/", "http://a/b/c/g/"},
-	{"http://a/b/c/d;p?q", "/g", "http://a/g"},
-	{"http://a/b/c/d;p?q", "//g", "http://g"},
-	{"http://a/b/c/d;p?q", "?y", "http://a/b/c/d;p?y"},
-	{"http://a/b/c/d;p?q", "g?y", "http://a/b/c/g?y"},
-	{"http://a/b/c/d;p?q", "#s", "http://a/b/c/d;p?q#s"},
-	{"http://a/b/c/d;p?q", "g#s", "http://a/b/c/g#s"},
-	{"http://a/b/c/d;p?q", "g?y#s", "http://a/b/c/g?y#s"},
-	{"http://a/b/c/d;p?q", ";x", "http://a/b/c/;x"},
-	{"http://a/b/c/d;p?q", "g;x", "http://a/b/c/g;x"},
-	{"http://a/b/c/d;p?q", "g;x?y#s", "http://a/b/c/g;x?y#s"},
-	{"http://a/b/c/d;p?q", "", "http://a/b/c/d;p?q"},
-	{"http://a/b/c/d;p?q", ".", "http://a/b/c/"},
-	{"http://a/b/c/d;p?q", "./", "http://a/b/c/"},
-	{"http://a/b/c/d;p?q", "..", "http://a/b/"},
-	{"http://a/b/c/d;p?q", "../", "http://a/b/"},
-	{"http://a/b/c/d;p?q", "../g", "http://a/b/g"},
-	{"http://a/b/c/d;p?q", "../..", "http://a/"},
-	{"http://a/b/c/d;p?q", "../../", "http://a/"},
-	{"http://a/b/c/d;p?q", "../../g", "http://a/g"},
-
-	// RFC 3986: Abnormal Examples
-	// http://tools.ietf.org/html/rfc3986#section-5.4.2
-	{"http://a/b/c/d;p?q", "../../../g", "http://a/g"},
-	{"http://a/b/c/d;p?q", "../../../../g", "http://a/g"},
-	{"http://a/b/c/d;p?q", "/./g", "http://a/g"},
-	{"http://a/b/c/d;p?q", "/../g", "http://a/g"},
-	{"http://a/b/c/d;p?q", "g.", "http://a/b/c/g."},
-	{"http://a/b/c/d;p?q", ".g", "http://a/b/c/.g"},
-	{"http://a/b/c/d;p?q", "g..", "http://a/b/c/g.."},
-	{"http://a/b/c/d;p?q", "..g", "http://a/b/c/..g"},
-	{"http://a/b/c/d;p?q", "./../g", "http://a/b/g"},
-	{"http://a/b/c/d;p?q", "./g/.", "http://a/b/c/g/"},
-	{"http://a/b/c/d;p?q", "g/./h", "http://a/b/c/g/h"},
-	{"http://a/b/c/d;p?q", "g/../h", "http://a/b/c/h"},
-	{"http://a/b/c/d;p?q", "g;x=1/./y", "http://a/b/c/g;x=1/y"},
-	{"http://a/b/c/d;p?q", "g;x=1/../y", "http://a/b/c/y"},
-	{"http://a/b/c/d;p?q", "g?y/./x", "http://a/b/c/g?y/./x"},
-	{"http://a/b/c/d;p?q", "g?y/../x", "http://a/b/c/g?y/../x"},
-	{"http://a/b/c/d;p?q", "g#s/./x", "http://a/b/c/g#s/./x"},
-	{"http://a/b/c/d;p?q", "g#s/../x", "http://a/b/c/g#s/../x"},
-
-	// Extras.
-	{"https://a/b/c/d;p?q", "//g?q", "https://g?q"},
-	{"https://a/b/c/d;p?q", "//g#s", "https://g#s"},
-	{"https://a/b/c/d;p?q", "//g/d/e/f?y#s", "https://g/d/e/f?y#s"},
-	{"https://a/b/c/d;p#s", "?y", "https://a/b/c/d;p?y"},
-	{"https://a/b/c/d;p?q#s", "?y", "https://a/b/c/d;p?y"},
-}
-
-func TestResolveReference(t *testing.T) {
-	mustParse := func(url_ string) *url.URL {
-		u, err := url.Parse(url_)
-		if err != nil {
-			t.Fatalf("Expected URL to parse: %q, got error: %v", url_, err)
-		}
-		return u
-	}
-	opaque := &url.URL{Scheme: "scheme", Opaque: "opaque"}
-	for _, test := range resolveReferenceTests {
-		base := mustParse(test.base)
-		rel := mustParse(test.rel)
-		url := base.ResolveReference(rel)
-		if Escape(url) != test.expected {
-			t.Errorf("URL(%q).ResolveReference(%q) == %q, got %q", test.base, test.rel, test.expected, Escape(url))
-		}
-		// Ensure that new instances are returned.
-		if base == url {
-			t.Errorf("Expected URL.ResolveReference to return new URL instance.")
-		}
-		// Test the convenience wrapper too.
-		url, err := base.Parse(test.rel)
-		if err != nil {
-			t.Errorf("URL(%q).Parse(%q) failed: %v", test.base, test.rel, err)
-		} else if Escape(url) != test.expected {
-			t.Errorf("URL(%q).Parse(%q) == %q, got %q", test.base, test.rel, test.expected, Escape(url))
-		} else if base == url {
-			// Ensure that new instances are returned for the wrapper too.
-			t.Errorf("Expected URL.Parse to return new URL instance.")
-		}
-		// Ensure Opaque resets the URL.
-		url = base.ResolveReference(opaque)
-		if *url != *opaque {
-			t.Errorf("ResolveReference failed to resolve opaque URL: want %#v, got %#v", url, opaque)
-		}
-		// Test the convenience wrapper with an opaque URL too.
-		url, err = base.Parse("scheme:opaque")
-		if err != nil {
-			t.Errorf(`URL(%q).Parse("scheme:opaque") failed: %v`, test.base, err)
-		} else if *url != *opaque {
-			t.Errorf("Parse failed to resolve opaque URL: want %#v, got %#v", url, opaque)
-		} else if base == url {
-			// Ensure that new instances are returned, again.
-			t.Errorf("Expected URL.Parse to return new URL instance.")
-		}
-	}
-}
-
-type shouldEscapeTest struct {
-	in     byte
-	mode   encoding
-	escape bool
-}
-
-var shouldEscapeTests = []shouldEscapeTest{
-	// Unreserved characters (§2.3)
-	{'a', encodePath, false},
-	{'a', encodeUserPassword, false},
-	{'a', encodeQueryComponent, false},
-	{'a', encodeFragment, false},
-	{'z', encodePath, false},
-	{'A', encodePath, false},
-	{'Z', encodePath, false},
-	{'0', encodePath, false},
-	{'9', encodePath, false},
-	{'-', encodePath, false},
-	{'-', encodeUserPassword, false},
-	{'-', encodeQueryComponent, false},
-	{'-', encodeFragment, false},
-	{'.', encodePath, false},
-	{'_', encodePath, false},
-	{'~', encodePath, false},
-
-	// User information (§3.2.1)
-	{':', encodeUserPassword, true},
-	{'/', encodeUserPassword, true},
-	{'?', encodeUserPassword, true},
-	{'@', encodeUserPassword, true},
-	{'$', encodeUserPassword, false},
-	{'&', encodeUserPassword, false},
-	{'+', encodeUserPassword, false},
-	{',', encodeUserPassword, false},
-	{';', encodeUserPassword, false},
-	{'=', encodeUserPassword, false},
-}
-
-func TestShouldEscape(t *testing.T) {
-	for _, tt := range shouldEscapeTests {
-		if shouldEscape(tt.in, tt.mode) != tt.escape {
-			t.Errorf("shouldEscape(%q, %v) returned %v; expected %v", tt.in, tt.mode, !tt.escape, tt.escape)
-		}
-	}
-}

vendor/github.com/containernetworking/cni/.appveyor.yml

@@ -0,0 +1,17 @@
+clone_folder: c:\gopath\src\github.com\containernetworking\cni
+
+environment:
+  GOPATH: c:\gopath
+
+install:
+  - echo %PATH%
+  - echo %GOPATH%
+  - set PATH=%GOPATH%\bin;c:\go\bin;%PATH%
+  - go version
+  - go env
+
+build: off
+
+test_script:
+  - go get -t ./...
+  - go test -v ./...

vendor/github.com/containernetworking/cni/.gitignore

@@ -2,3 +2,4 @@ bin/
 gopath/
 *.sw[ponm]
 .vagrant
+release-*

vendor/github.com/containernetworking/cni/.travis.yml

@@ -1,16 +1,11 @@
 language: go
-sudo: required
 dist: trusty
 
 go:
-  - 1.7.x
-  - 1.8.x
+  - 1.9.x
+  - 1.10.x
 
 env:
-  global:
-  - TOOLS_CMD=golang.org/x/tools/cmd
-  - PATH=$GOROOT/bin:$PATH
-  - GO15VENDOREXPERIMENT=1
   matrix:
   - TARGET=amd64
   - TARGET=arm
@@ -22,16 +17,17 @@ matrix:
   fast_finish: true
 
 install:
- - go get ${TOOLS_CMD}/cover
+ - go get golang.org/x/tools/cmd/cover
  - go get github.com/modocache/gover
  - go get github.com/mattn/goveralls
+ - go get -t ./...
 
 script:
  - >
     if [ "${TARGET}" == "amd64" ]; then
       GOARCH="${TARGET}" ./test.sh;
     else
-      GOARCH="${TARGET}" ./build.sh;
+      GOARCH="${TARGET}" go list ./... | xargs -n1 go build -v -o /dev/null
     fi
 
 notifications:

vendor/github.com/containernetworking/cni/CODE-OF-CONDUCT.md

@@ -0,0 +1,4 @@
+## Community Code of Conduct
+
+CNI follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md).
+

vendor/github.com/containernetworking/cni/CONVENTIONS.md

@@ -19,21 +19,18 @@ Establishing these conventions allows plugins to work across multiple runtimes.
 # Current conventions
 Additional conventions can be created by creating PRs which modify this document.
 
-## Plugin specific fields
+## Dynamic Plugin specific fields (Capabilities / Runtime Configuration)
 [Plugin specific fields](https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration) formed part of the original CNI spec and have been present since the initial release.
 > Plugins may define additional fields that they accept and may generate an error if called with unknown fields. The exception to this is the args field may be used to pass arbitrary data which may be ignored by plugins.
 
-A plugin can define any additional fields it needs to work properly. It is expected that it will return an error if it can't act on fields that were expected or where the field values were malformed.
+A plugin can define any additional fields it needs to work properly. It should return an error if it can't act on fields that were expected or where the field values were malformed.
 
-This method of passing information to a plugin is recommended when the following conditions hold
+This method of passing information to a plugin is recommended when the following conditions hold:
 * The configuration has specific meaning to the plugin (i.e. it's not just general meta data)
 * the plugin is expected to act on the configuration or return an error if it can't
 
-Dynamic information (i.e. data that a runtime fills out) should be placed in a `runtimeConfig` section.
-
-| Area  | Purpose| Spec and Example | Runtime implementations | Plugin Implementations |
-| ------ | ------ | ------             | ------  | ------                  | ------                 |  
-| port mappings | Pass mapping from ports on the host to ports in the container network namespace. | Operators can ask runtimes to pass port mapping information to plugins, by setting the following in the CNI config <pre>"capabilities": {"portMappings": true} </pre> Runtimes should fill in the actual port mappings when the config is passed to plugins. It should be placed in a new section of the config "runtimeConfig" e.g. <pre>"runtimeConfig": {<br />  "portMappings" : [<br />    { "hostPort": 8080, "containerPort": 80, "protocol": "tcp" },<br />    { "hostPort": 8000, "containerPort": 8001, "protocol": "udp" }<br />  ]<br />}</pre> | none | none |
+Dynamic information (i.e. data that a runtime fills out) should be placed in a `runtimeConfig` section. Plugins can request
+that the runtime insert this dynamic configuration by explicitly listing their `capabilities` in the network configuration.
 
 For example, the configuration for a port mapping plugin might look like this to an operator (it should be included as part of a [network configuration list](https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration-lists).
 ```json
@@ -57,15 +54,23 @@ But the runtime would fill in the mappings so the plugin itself would receive so
 }
 ```
 
+### Well-known Capabilities
+| Area  | Purpose | Capability | Spec and Example | Runtime implementations | Plugin Implementations |
+| ----- | ------- | -----------| ---------------- | ----------------------- | ---------------------  |
+| port mappings | Pass mapping from ports on the host to ports in the container network namespace. | `portMappings` | A list of portmapping entries.<br/>  <pre>[<br/>  { "hostPort": 8080, "containerPort": 80, "protocol": "tcp" },<br />  { "hostPort": 8000, "containerPort": 8001, "protocol": "udp" }<br />  ]<br /></pre> | kubernetes | CNI `portmap` plugin |
+| ip ranges | Dynamically configure the IP range(s) for address allocation. Runtimes that manage IP pools, but not individual IP addresses, can pass these to plugins. | `ipRanges` | The same as the `ranges` key for `host-local` - a list of lists of subnets. The outer list is the number of IPs to allocate, and the inner list is a pool of subnets for each allocation. <br/><pre>[<br/> [<br/>  { "subnet": "10.1.2.0/24", "rangeStart": "10.1.2.3", "rangeEnd": 10.1.2.99", "gateway": "10.1.2.254" } <br/>  ]<br/>]</pre> | none | cni `host-local` plugin |
+| bandwidth limits | Dynamically configure interface bandwidth limits | `bandwidth` | Desired bandwidth limits. Rates are in bits per second, burst values are in bits. <pre> { "ingressRate": 2048, "ingressBurst": 1600, "egressRate": 4096, "egressBurst": 1600 } </pre> | none | cni `bandwidth` plugin |
+
+
 ## "args" in network config
-`args` in [network config](https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration) were introduced as an optional field into the `0.1.0` CNI spec. The first CNI code release that it appeared in was `v0.4.0`. 
+`args` in [network config](https://github.com/containernetworking/cni/blob/master/SPEC.md#network-configuration) were introduced as an optional field into the `0.2.0` release of the CNI spec. The first CNI code release that it appeared in was `v0.4.0`. 
 > args (dictionary): Optional additional arguments provided by the container runtime. For example a dictionary of labels could be passed to CNI plugins by adding them to a labels field under args.
 
 `args` provide a way of providing more structured data than the flat strings that CNI_ARGS can support.
 
 `args` should be used for _optional_ meta-data. Runtimes can place additional data in `args` and plugins that don't understand that data should just ignore it. Runtimes should not require that a plugin understands or consumes that data provided, and so a runtime should not expect to receive an error if the data could not be acted on.
 
-This method of passing information to a plugin is recommended when the information is optional and the plugin can choose to ignore it. It's often that case that such information is passed to all plugins by the runtime whithout regard for whether the plugin can understand it. 
+This method of passing information to a plugin is recommended when the information is optional and the plugin can choose to ignore it. It's often that case that such information is passed to all plugins by the runtime without regard for whether the plugin can understand it.
 
 The conventions documented here are all namepaced under `cni` so they don't conflict with any existing `args`.
 
@@ -87,8 +92,9 @@ For example:
 ```
 
 | Area  | Purpose| Spec and Example | Runtime implementations | Plugin Implementations |
-| ------ | ------ | ------             | ------  | ------                  | ------                 |  
+| ----- | ------ | ------------     | ----------------------- | ---------------------- |
 | labels | Pass`key=value` labels to plugins | <pre>"labels" : [<br />  { "key" : "app", "value" : "myapp" },<br />  { "key" : "env", "value" : "prod" }<br />] </pre> | none | none |
+| ips   | Request static IPs | <pre>"ips": ["10.2.2.42", "2001:db8::5"]</pre> | none | host-local |
 
 ## CNI_ARGS
 CNI_ARGS formed part of the original CNI spec and have been present since the initial release.
@@ -97,6 +103,12 @@ CNI_ARGS formed part of the original CNI spec and have been present since the in
 The use of `CNI_ARGS` is deprecated and "args" should be used instead.
 
 | Field  | Purpose| Spec and Example | Runtime implementations | Plugin Implementations |
-| ------ | ------ | ------             | ------  | ------                  | ------                 |  
+| ------ | ------ | ---------------- | ----------------------- | ---------------------- |
 | IP     | Request a specific IP from IPAM plugins | IP=192.168.10.4 | *rkt* supports passing additional arguments to plugins and the [documentation](https://coreos.com/rkt/docs/latest/networking/overriding-defaults.html) suggests IP can be used. | host-local (since version v0.2.0) supports the field for IPv4 only - [documentation](https://github.com/containernetworking/cni/blob/master/Documentation/host-local.md#supported-arguments).|
-                                                                                                                  
+
+## Chained Plugins
+If plugins are agnostic about the type of interface created, they SHOULD work in a chained mode and configure existing interfaces. Plugins MAY also create the desired interface when not run in a chain.
+
+For example, the `bridge` plugin adds the host-side interface to a bridge. So, it should accept any previous result that includes a host-side interface, including `tap` devices. If not called as a chained plugin, it creates a `veth` pair first.
+
+Plugins that meet this convention are usable by a larger set of runtimes and interfaces, including hypervisors and DPDK providers.

vendor/github.com/containernetworking/cni/Documentation/bridge.md

@@ -1,42 +0,0 @@
-# bridge plugin
-
-## Overview
-
-With bridge plugin, all containers (on the same host) are plugged into a bridge (virtual switch) that resides in the host network namespace.
-The containers receive one end of the veth pair with the other end connected to the bridge.
-An IP address is only assigned to one end of the veth pair -- one residing in the container.
-The bridge itself can also be assigned an IP address, turning it into a gateway for the containers.
-Alternatively, the bridge can function purely in L2 mode and would need to be bridged to the host network interface (if other than container-to-container communication on the same host is desired).
-
-The network configuration specifies the name of the bridge to be used.
-If the bridge is missing, the plugin will create one on first use and, if gateway mode is used, assign it an IP that was returned by IPAM plugin via the gateway field.
-
-## Example configuration
-```
-{
-	"name": "mynet",
-	"type": "bridge",
-	"bridge": "mynet0",
-	"isDefaultGateway": true,
-	"forceAddress": false,
-	"ipMasq": true,
-	"hairpinMode": true,
-	"ipam": {
-		"type": "host-local",
-		"subnet": "10.10.0.0/16"
-	}
-}
-```
-
-## Network configuration reference
-
-* `name` (string, required): the name of the network.
-* `type` (string, required): "bridge".
-* `bridge` (string, optional): name of the bridge to use/create. Defaults to "cni0".
-* `isGateway` (boolean, optional): assign an IP address to the bridge. Defaults to false.
-* `isDefaultGateway` (boolean, optional): Sets isGateway to true and makes the assigned IP the default route. Defaults to false.
-* `forceAddress` (boolean, optional): Indicates if a new IP address should be set if the previous value has been changed. Defaults to false.
-* `ipMasq` (boolean, optional): set up IP Masquerade on the host for traffic originating from this network and destined outside of it. Defaults to false.
-* `mtu` (integer, optional): explicitly set MTU to the specified value. Defaults to the value chosen by the kernel.
-* `hairpinMode` (boolean, optional): set hairpin mode for interfaces on the bridge. Defaults to false.
-* `ipam` (dictionary, required): IPAM configuration to be used for this network.

vendor/github.com/containernetworking/cni/Documentation/dhcp.md

@@ -1,35 +0,0 @@
-# dhcp plugin
-
-## Overview
-
-With dhcp plugin the containers can get an IP allocated by a DHCP server already running on your network.
-This can be especially useful with plugin types such as [macvlan](https://github.com/containernetworking/cni/blob/master/Documentation/macvlan.md).
-Because a DHCP lease must be periodically renewed for the duration of container lifetime, a separate daemon is required to be running.
-The same plugin binary can also be run in the daemon mode.
-
-## Operation
-To use the dhcp IPAM plugin, first launch the dhcp daemon:
-
-```
-# Make sure the unix socket has been removed
-$ rm -f /run/cni/dhcp.sock
-$ ./dhcp daemon
-```
-
-Alternatively, you can use systemd socket activation protocol.
-Be sure that the .socket file uses /run/cni/dhcp.sock as the socket path.
-
-With the daemon running, containers using the dhcp plugin can be launched.
-
-## Example configuration
-
-```
-{
-	"ipam": {
-		"type": "dhcp",
-	}
-}
-
-## Network configuration reference
-
-* `type` (string, required): "dhcp"

vendor/github.com/containernetworking/cni/Documentation/host-local.md

@@ -1,82 +0,0 @@
-# host-local IP address management plugin
-
-host-local IPAM allocates IPv4 and IPv6 addresses out of a specified address range. Optionally,
-it can include a DNS configuration from a `resolv.conf` file on the host.
-
-## Overview
-
-host-local IPAM plugin allocates IPv4 addresses out of a specified address range.
-It stores the state locally on the host filesystem, therefore ensuring uniqueness of IP addresses on a single host.
-
-## Example configurations
-
-IPv4:
-```json
-{
-	"ipam": {
-		"type": "host-local",
-		"subnet": "10.10.0.0/16",
-		"rangeStart": "10.10.1.20",
-		"rangeEnd": "10.10.3.50",
-		"gateway": "10.10.0.254",
-		"routes": [
-			{ "dst": "0.0.0.0/0" },
-			{ "dst": "192.168.0.0/16", "gw": "10.10.5.1" }
-		],
-		"dataDir": "/var/my-orchestrator/container-ipam-state"
-	}
-}
-```
-
-IPv6:
-```json
-{
-  "ipam": {
-		"type": "host-local",
-		"subnet": "3ffe:ffff:0:01ff::/64",
-		"rangeStart": "3ffe:ffff:0:01ff::0010",
-		"rangeEnd": "3ffe:ffff:0:01ff::0020",
-		"routes": [
-			{ "dst": "3ffe:ffff:0:01ff::1/64" }
-		],
-		"resolvConf": "/etc/resolv.conf"
-	}
-}
-```
-
-We can test it out on the command-line:
-
-```bash
-$ export CNI_COMMAND=ADD
-$ export CNI_CONTAINERID=f81d4fae-7dec-11d0-a765-00a0c91e6bf6
-$ echo '{ "name": "default", "ipam": { "type": "host-local", "subnet": "203.0.113.0/24" } }' | ./host-local
-```
-
-```json
-{
-    "ip4": {
-        "ip": "203.0.113.1/24"
-    }
-}
-```
-
-## Network configuration reference
-
-* `type` (string, required): "host-local".
-* `subnet` (string, required): CIDR block to allocate out of.
-* `rangeStart` (string, optional): IP inside of "subnet" from which to start allocating addresses. Defaults to ".2" IP inside of the "subnet" block.
-* `rangeEnd` (string, optional): IP inside of "subnet" with which to end allocating addresses. Defaults to ".254" IP inside of the "subnet" block.
-* `gateway` (string, optional): IP inside of "subnet" to designate as the gateway. Defaults to ".1" IP inside of the "subnet" block.
-* `routes` (string, optional): list of routes to add to the container namespace. Each route is a dictionary with "dst" and optional "gw" fields. If "gw" is omitted, value of "gateway" will be used.
-* `resolvConf` (string, optional): Path to a `resolv.conf` on the host to parse and return as the DNS configuration
-* `dataDir` (string, optional): Path to a directory to use for maintaining state, e.g. which IPs have been allocated to which containers
-
-
-## Supported arguments
-The following [CNI_ARGS](https://github.com/containernetworking/cni/blob/master/SPEC.md#parameters) are supported:
-
-* `ip`: request a specific IP address from the subnet. If it's not available, the plugin will exit with an error
-
-## Files
-
-Allocated IP addresses are stored as files in `/var/lib/cni/networks/$NETWORK_NAME`.  The prefix can be customized with the `dataDir` option listed above.

vendor/github.com/containernetworking/cni/Documentation/ipvlan.md

@@ -1,40 +0,0 @@
-# ipvlan plugin
-
-## Overview
-
-ipvlan is a new [addition](https://lwn.net/Articles/620087/) to the Linux kernel.
-Like its cousin macvlan, it virtualizes the host interface.
-However unlike macvlan which generates a new MAC address for each interface, ipvlan devices all share the same MAC.
-The kernel driver inspects the IP address of each packet when making a decision about which virtual interface should process the packet.
-
-Because all ipvlan interfaces share the MAC address with the host interface, DHCP can only be used in conjunction with ClientID (currently not supported by DHCP plugin).
-
-## Example configuration
-
-```
-{
-	"name": "mynet",
-	"type": "ipvlan",
-	"master": "eth0",
-	"ipam": {
-		"type": "host-local",
-		"subnet": "10.1.2.0/24"
-	}
-}
-```
-
-## Network configuration reference
-
-* `name` (string, required): the name of the network.
-* `type` (string, required): "ipvlan".
-* `master` (string, required): name of the host interface to enslave.
-* `mode` (string, optional): one of "l2", "l3". Defaults to "l2".
-* `mtu` (integer, optional): explicitly set MTU to the specified value. Defaults to the value chosen by the kernel.
-* `ipam` (dictionary, required): IPAM configuration to be used for this network.
-
-## Notes
-
-* `ipvlan` does not allow virtual interfaces to communicate with the master interface.
-Therefore the container will not be able to reach the host via `ipvlan` interface.
-Be sure to also have container join a network that provides connectivity to the host (e.g. `ptp`).
-* A single master interface can not be enslaved by both `macvlan` and `ipvlan`.

vendor/github.com/containernetworking/cni/Documentation/ptp.md

@@ -1,32 +0,0 @@
-# ptp plugin
-
-## Overview
-The ptp plugin creates a point-to-point link between a container and the host by using a veth device.
-One end of the veth pair is placed inside a container and the other end resides on the host.
-The host-local IPAM plugin can be used to allocate an IP address to the container.
-The traffic of the container interface will be routed through the interface of the host.
-
-## Example network configuration
-
-```
-{
-	"name": "mynet",
-	"type": "ptp",
-	"ipam": {
-		"type": "host-local",
-		"subnet": "10.1.1.0/24"
-	},
-	"dns": {
-		"nameservers": [ "10.1.1.1", "8.8.8.8" ]
-	}
-}
-```
-
-## Network configuration reference
-
-* `name` (string, required): the name of the network
-* `type` (string, required): "ptp"
-* `ipMasq` (boolean, optional): set up IP Masquerade on the host for traffic originating from this network and destined outside of it. Defaults to false.
-* `mtu` (integer, optional): explicitly set MTU to the specified value. Defaults to value chosen by the kernel.
-* `ipam` (dictionary, required): IPAM configuration to be used for this network.
-* `dns` (dictionary, optional): DNS information to return as described in the [Result](/SPEC.md#result).

vendor/github.com/containernetworking/cni/GOVERNANCE.md

@@ -0,0 +1,44 @@
+# CNI Governance
+
+This document defines project governance for the project.
+
+## Voting
+
+The CNI project employs "organization voting" to ensure no single organization can dominate the project.
+
+Individuals not associated with or employed by a company or organization are allowed one organization vote.
+Each company or organization (regardless of the number of maintainers associated with or employed by that company/organization) receives one organization vote.
+
+In other words, if two maintainers are employed by Company X, two by Company Y, two by Company Z, and one maintainer is an un-affiliated individual, a total of four "organization votes" are possible; one for X, one for Y, one for Z, and one for the un-affiliated individual.
+
+Any maintainer from an organization may cast the vote for that organization.
+
+For formal votes, a specific statement of what is being voted on should be added to the relevant github issue or PR, and a link to that issue or PR added to the maintainers meeting agenda document.
+Maintainers should indicate their yes/no vote on that issue or PR, and after a suitable period of time, the votes will be tallied and the outcome noted.
+
+## Changes in Maintainership
+
+New maintainers are proposed by an existing maintainer and are elected by a 2/3 majority organization vote.
+
+Maintainers can be removed by a 2/3 majority organization vote.
+
+## Approving PRs
+
+Non-specification-related PRs may be merged after receiving at least two organization votes.
+
+Changes to the CNI Specification also follow the normal PR approval process (eg, 2 organization votes), but any maintainer can request that the approval require a 2/3 majority organization vote.
+
+## Github Project Administration
+
+Maintainers will be added to the containernetworking GitHub organization and added to the GitHub cni-maintainers team, and made a GitHub maintainer of that team.
+
+After 6 months a maintainer will be made an "owner" of the GitHub organization.
+
+## Changes in Governance
+
+All changes in Governance require a 2/3 majority organization vote.
+
+## Other Changes
+
+Unless specified above, all other changes to the project require a 2/3 majority organization vote.
+Additionally, any maintainer may request that any change require a 2/3 majority organization vote.

vendor/github.com/containernetworking/cni/Godeps/Godeps.json

@@ -1,194 +0,0 @@
-{
-	"ImportPath": "github.com/containernetworking/cni",
-	"GoVersion": "go1.6",
-	"GodepVersion": "v79",
-	"Packages": [
-		"./..."
-	],
-	"Deps": [
-		{
-			"ImportPath": "github.com/coreos/go-iptables/iptables",
-			"Comment": "v0.1.0",
-			"Rev": "fbb73372b87f6e89951c2b6b31470c2c9d5cfae3"
-		},
-		{
-			"ImportPath": "github.com/coreos/go-systemd/activation",
-			"Comment": "v2-53-g2688e91",
-			"Rev": "2688e91251d9d8e404e86dd8f096e23b2f086958"
-		},
-		{
-			"ImportPath": "github.com/d2g/dhcp4",
-			"Rev": "f0e4d29ff0231dce36e250b2ed9ff08412584bca"
-		},
-		{
-			"ImportPath": "github.com/d2g/dhcp4client",
-			"Rev": "bed07e1bc5b85f69c6f0fd73393aa35ec68ed892"
-		},
-		{
-			"ImportPath": "github.com/onsi/ginkgo",
-			"Comment": "v1.2.0-29-g7f8ab55",
-			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
-		},
-		{
-			"ImportPath": "github.com/onsi/ginkgo/config",
-			"Comment": "v1.2.0-29-g7f8ab55",
-			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
-		},
-		{
-			"ImportPath": "github.com/onsi/ginkgo/extensions/table",
-			"Comment": "v1.2.0-29-g7f8ab55",
-			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
-		},
-		{
-			"ImportPath": "github.com/onsi/ginkgo/internal/codelocation",
-			"Comment": "v1.2.0-29-g7f8ab55",
-			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
-		},
-		{
-			"ImportPath": "github.com/onsi/ginkgo/internal/containernode",
-			"Comment": "v1.2.0-29-g7f8ab55",
-			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
-		},
-		{
-			"ImportPath": "github.com/onsi/ginkgo/internal/failer",
-			"Comment": "v1.2.0-29-g7f8ab55",
-			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
-		},
-		{
-			"ImportPath": "github.com/onsi/ginkgo/internal/leafnodes",
-			"Comment": "v1.2.0-29-g7f8ab55",
-			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
-		},
-		{
-			"ImportPath": "github.com/onsi/ginkgo/internal/remote",
-			"Comment": "v1.2.0-29-g7f8ab55",
-			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
-		},
-		{
-			"ImportPath": "github.com/onsi/ginkgo/internal/spec",
-			"Comment": "v1.2.0-29-g7f8ab55",
-			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
-		},
-		{
-			"ImportPath": "github.com/onsi/ginkgo/internal/specrunner",
-			"Comment": "v1.2.0-29-g7f8ab55",
-			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
-		},
-		{
-			"ImportPath": "github.com/onsi/ginkgo/internal/suite",
-			"Comment": "v1.2.0-29-g7f8ab55",
-			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
-		},
-		{
-			"ImportPath": "github.com/onsi/ginkgo/internal/testingtproxy",
-			"Comment": "v1.2.0-29-g7f8ab55",
-			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
-		},
-		{
-			"ImportPath": "github.com/onsi/ginkgo/internal/writer",
-			"Comment": "v1.2.0-29-g7f8ab55",
-			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
-		},
-		{
-			"ImportPath": "github.com/onsi/ginkgo/reporters",
-			"Comment": "v1.2.0-29-g7f8ab55",
-			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
-		},
-		{
-			"ImportPath": "github.com/onsi/ginkgo/reporters/stenographer",
-			"Comment": "v1.2.0-29-g7f8ab55",
-			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
-		},
-		{
-			"ImportPath": "github.com/onsi/ginkgo/types",
-			"Comment": "v1.2.0-29-g7f8ab55",
-			"Rev": "7f8ab55aaf3b86885aa55b762e803744d1674700"
-		},
-		{
-			"ImportPath": "github.com/onsi/gomega",
-			"Comment": "v1.0-71-g2152b45",
-			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
-		},
-		{
-			"ImportPath": "github.com/onsi/gomega/format",
-			"Comment": "v1.0-71-g2152b45",
-			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
-		},
-		{
-			"ImportPath": "github.com/onsi/gomega/gbytes",
-			"Comment": "v1.0-71-g2152b45",
-			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
-		},
-		{
-			"ImportPath": "github.com/onsi/gomega/gexec",
-			"Comment": "v1.0-71-g2152b45",
-			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
-		},
-		{
-			"ImportPath": "github.com/onsi/gomega/internal/assertion",
-			"Comment": "v1.0-71-g2152b45",
-			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
-		},
-		{
-			"ImportPath": "github.com/onsi/gomega/internal/asyncassertion",
-			"Comment": "v1.0-71-g2152b45",
-			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
-		},
-		{
-			"ImportPath": "github.com/onsi/gomega/internal/oraclematcher",
-			"Comment": "v1.0-71-g2152b45",
-			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
-		},
-		{
-			"ImportPath": "github.com/onsi/gomega/internal/testingtsupport",
-			"Comment": "v1.0-71-g2152b45",
-			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
-		},
-		{
-			"ImportPath": "github.com/onsi/gomega/matchers",
-			"Comment": "v1.0-71-g2152b45",
-			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
-		},
-		{
-			"ImportPath": "github.com/onsi/gomega/matchers/support/goraph/bipartitegraph",
-			"Comment": "v1.0-71-g2152b45",
-			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
-		},
-		{
-			"ImportPath": "github.com/onsi/gomega/matchers/support/goraph/edge",
-			"Comment": "v1.0-71-g2152b45",
-			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
-		},
-		{
-			"ImportPath": "github.com/onsi/gomega/matchers/support/goraph/node",
-			"Comment": "v1.0-71-g2152b45",
-			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
-		},
-		{
-			"ImportPath": "github.com/onsi/gomega/matchers/support/goraph/util",
-			"Comment": "v1.0-71-g2152b45",
-			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
-		},
-		{
-			"ImportPath": "github.com/onsi/gomega/types",
-			"Comment": "v1.0-71-g2152b45",
-			"Rev": "2152b45fa28a361beba9aab0885972323a444e28"
-		},
-		{
-			"ImportPath": "github.com/vishvananda/netlink",
-			"Rev": "fe3b5664d23a11b52ba59bece4ff29c52772a56b"
-		},
-		{
-			"ImportPath": "github.com/vishvananda/netlink/nl",
-			"Rev": "fe3b5664d23a11b52ba59bece4ff29c52772a56b"
-		},
-		{
-			"ImportPath": "github.com/vishvananda/netns",
-			"Rev": "8ba1072b58e0c2a240eb5f6120165c7776c3e7b8"
-		},
-		{
-			"ImportPath": "golang.org/x/sys/unix",
-			"Rev": "076b546753157f758b316e59bcb51e6807c04057"
-		}
-	]
-}

vendor/github.com/containernetworking/cni/MAINTAINERS

@@ -2,5 +2,5 @@ Bryan Boreham <bryan@weave.works> (@bboreham)
 Casey Callendrello <casey.callendrello@coreos.com> (@squeed)
 Dan Williams <dcbw@redhat.com> (@dcbw)
 Gabe Rosenhouse <grosenhouse@pivotal.io> (@rosenhouse)
+Matt Dupre <matt@tigera.io> (@matthewdupre)
 Stefan Junker <stefan.junker@coreos.com> (@steveeJ)
-Tom Denham <tom@tigera.io> (@tomdee)

vendor/github.com/containernetworking/cni/README.md

@@ -1,12 +1,17 @@
-[![Build Status](https://travis-ci.org/containernetworking/cni.svg?branch=master)](https://travis-ci.org/containernetworking/cni)
+[![Linux Build Status](https://travis-ci.org/containernetworking/cni.svg?branch=master)](https://travis-ci.org/containernetworking/cni)
+[![Windows Build Status](https://ci.appveyor.com/api/projects/status/wtrkou8oow7x533e/branch/master?svg=true)](https://ci.appveyor.com/project/cni-bot/cni/branch/master)
 [![Coverage Status](https://coveralls.io/repos/github/containernetworking/cni/badge.svg?branch=master)](https://coveralls.io/github/containernetworking/cni?branch=master)
 [![Slack Status](https://cryptic-tundra-43194.herokuapp.com/badge.svg)](https://cryptic-tundra-43194.herokuapp.com/)
 
+![CNI Logo](logo.png)
+
 ---
 
 # Community Sync Meeting
 
-There is a community sync meeting for users and developers every 1-2 months. The next meeting will help on a Google Hangout and the link is in the [agenda](https://docs.google.com/document/d/10ECyT2mBGewsJUcmYmS8QNo1AcNgy2ZIe2xS7lShYhE/edit?usp=sharing) (Notes from previous meeting are also in this doc). The next meeting will be held on *April 12th* at *3:00pm UTC* [Add to Calendar](https://www.worldtimebuddy.com/?qm=1&lid=100,5,2643743,5391959&h=100&date=2017-4-12&sln=15-16).
+There is a community sync meeting for users and developers every 1-2 months. The next meeting will help on a Google Hangout and the link is in the [agenda](https://docs.google.com/document/d/10ECyT2mBGewsJUcmYmS8QNo1AcNgy2ZIe2xS7lShYhE/edit?usp=sharing) (Notes from previous meeting are also in this doc). 
+
+The next meeting will be held on *Wednesday, October 4th* at *3:00pm UTC / 11:00am EDT / 8:00am PDT* [Add to Calendar](https://www.worldtimebuddy.com/?qm=1&lid=100,5,2643743,5391959&h=100&date=2017-10-04&sln=15-16).
 
 ---
 
@@ -14,11 +19,11 @@ There is a community sync meeting for users and developers every 1-2 months. The
 
 ## What is CNI?
 
-The CNI (_Container Network Interface_) project consists of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins.
+CNI (_Container Network Interface_), a [Cloud Native Computing Foundation](https://cncf.io) project, consists of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins.
 CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted.
 Because of this focus, CNI has a wide range of support and the specification is simple to implement.
 
-As well as the [specification](SPEC.md), this repository contains the Go source code of a library for integrating CNI into applications, an example command-line tool, a template for making new plugins, and the supported plugins.
+As well as the [specification](SPEC.md), this repository contains the Go source code of a [library for integrating CNI into applications](libcni) and an [example command-line tool](cnitool) for executing CNI plugins.  A [separate repository contains reference plugins](https://github.com/containernetworking/plugins) and a template for making new plugins.
 
 The template code makes it straight-forward to create a CNI plugin for an existing container networking project.
 CNI also makes a good framework for creating a new container networking project from scratch.
@@ -33,10 +38,11 @@ To avoid duplication, we think it is prudent to define a common interface betwee
 ## Who is using CNI?
 ### Container runtimes
 - [rkt - container engine](https://coreos.com/blog/rkt-cni-networking.html)
-- [Kurma - container runtime](http://kurma.io/)
 - [Kubernetes - a system to simplify container operations](http://kubernetes.io/docs/admin/network-plugins/)
-- [Cloud Foundry - a platform for cloud applications](https://github.com/cloudfoundry-incubator/netman-release)
-- [Mesos - a distributed systems kernel](https://github.com/apache/mesos/blob/master/docs/cni.md)
+- [OpenShift - Kubernetes with additional enterprise features](https://github.com/openshift/origin/blob/master/docs/openshift_networking_requirements.md)
+- [Cloud Foundry - a platform for cloud applications](https://github.com/cloudfoundry-incubator/cf-networking-release)
+- [Apache Mesos - a distributed systems kernel](https://github.com/apache/mesos/blob/master/docs/cni.md)
+- [Amazon ECS - a highly scalable, high performance container management service](https://aws.amazon.com/ecs/)
 
 ### 3rd party plugins
 - [Project Calico - a layer 3 virtual network](https://github.com/projectcalico/calico-cni)
@@ -48,8 +54,15 @@ To avoid duplication, we think it is prudent to define a common interface betwee
 - [Multus - a Multi plugin](https://github.com/Intel-Corp/multus-cni)
 - [Romana - Layer 3 CNI plugin supporting network policy for Kubernetes](https://github.com/romana/kube)
 - [CNI-Genie - generic CNI network plugin](https://github.com/Huawei-PaaS/CNI-Genie)
+- [Nuage CNI - Nuage Networks SDN plugin for network policy kubernetes support ](https://github.com/nuagenetworks/nuage-cni)
+- [Silk - a CNI plugin designed for Cloud Foundry](https://github.com/cloudfoundry-incubator/silk)
+- [Linen - a CNI plugin designed for overlay networks with Open vSwitch and fit in SDN/OpenFlow network environment](https://github.com/John-Lin/linen-cni)
+- [Vhostuser - a Dataplane network plugin - Supports OVS-DPDK & VPP](https://github.com/intel/vhost-user-net-plugin)
+- [Amazon ECS CNI Plugins - a collection of CNI Plugins to configure containers with Amazon EC2 elastic network interfaces (ENIs)](https://github.com/aws/amazon-ecs-cni-plugins)
+- [Bonding CNI - a Link aggregating plugin to address failover and high availability network](https://github.com/Intel-Corp/bond-cni)
+- [ovn-kubernetes - an container network plugin built on Open vSwitch (OVS) and Open Virtual Networking (OVN) with support for both Linux and Windows](https://github.com/openvswitch/ovn-kubernetes)
 
-The CNI team also maintains some [core plugins](plugins).
+The CNI team also maintains some [core plugins in a separate repository](https://github.com/containernetworking/plugins).
 
 
 ## Contributing to CNI
@@ -61,19 +74,16 @@ If you intend to contribute to code or documentation, please read [CONTRIBUTING.
 
 ### Requirements
 
-CNI requires Go 1.5+ to build.
+The CNI spec is language agnostic.  To use the Go language libraries in this repository, you'll need a recent version of Go.  Our [automated tests](https://travis-ci.org/containernetworking/cni/builds) cover Go versions 1.7 and 1.8.
 
-Go 1.5 users will need to set GO15VENDOREXPERIMENT=1 to get vendored
-dependencies. This flag is set by default in 1.6.
+### Reference Plugins
 
-### Included Plugins
-
-This repository includes a number of common plugins in the `plugins/` directory.
-Please see the [Documentation/](Documentation/) directory for documentation about particular plugins.
+The CNI project maintains a set of [reference plugins](https://github.com/containernetworking/plugins) that implement the CNI specification.
+NOTE: the reference plugins used to live in this repository but have been split out into a [separate repository](https://github.com/containernetworking/plugins) as of May 2017.
 
 ### Running the plugins
 
-The scripts/ directory contains two scripts, `priv-net-run.sh` and `docker-run.sh`, that can be used to exercise the plugins.
+After building and installing the [reference plugins](https://github.com/containernetworking/plugins), you can use the `priv-net-run.sh` and `docker-run.sh` scripts in the `scripts/` directory to exercise the plugins.
 
 **note - priv-net-run.sh depends on `jq`**
 
@@ -111,14 +121,15 @@ The directory `/etc/cni/net.d` is the default location in which the scripts will
 Next, build the plugins:
 
 ```bash
-$ ./build
+$ cd $GOPATH/src/github.com/containernetworking/plugins
+$ ./build.sh
 ```
 
 Finally, execute a command (`ifconfig` in this example) in a private network namespace that has joined the `mynet` network:
 
 ```bash
-$ CNI_PATH=`pwd`/bin
-$ cd scripts
+$ CNI_PATH=$GOPATH/src/github.com/containernetworking/plugins/bin
+$ cd $GOPATH/src/github.com/containernetworking/cni/scripts
 $ sudo CNI_PATH=$CNI_PATH ./priv-net-run.sh ifconfig
 eth0      Link encap:Ethernet  HWaddr f2:c2:6f:54:b8:2b  
           inet addr:10.22.0.2  Bcast:0.0.0.0  Mask:255.255.0.0
@@ -126,7 +137,7 @@ eth0      Link encap:Ethernet  HWaddr f2:c2:6f:54:b8:2b
           UP BROADCAST MULTICAST  MTU:1500  Metric:1
           RX packets:1 errors:0 dropped:0 overruns:0 frame:0
           TX packets:0 errors:0 dropped:1 overruns:0 carrier:0
-          collisions:0 txqueuelen:0 
+          collisions:0 txqueuelen:0
           RX bytes:90 (90.0 B)  TX bytes:0 (0.0 B)
 
 lo        Link encap:Local Loopback  
@@ -135,7 +146,7 @@ lo        Link encap:Local Loopback
           UP LOOPBACK RUNNING  MTU:65536  Metric:1
           RX packets:0 errors:0 dropped:0 overruns:0 frame:0
           TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
-          collisions:0 txqueuelen:0 
+          collisions:0 txqueuelen:0
           RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
 ```
 
@@ -147,8 +158,8 @@ Use the instructions in the previous section to define a netconf and build the p
 Next, docker-run.sh script wraps `docker run`, to execute the plugins prior to entering the container:
 
 ```bash
-$ CNI_PATH=`pwd`/bin
-$ cd scripts
+$ CNI_PATH=$GOPATH/src/github.com/containernetworking/plugins/bin
+$ cd $GOPATH/src/github.com/containernetworking/cni/scripts
 $ sudo CNI_PATH=$CNI_PATH ./docker-run.sh --rm busybox:latest ifconfig
 eth0      Link encap:Ethernet  HWaddr fa:60:70:aa:07:d1  
           inet addr:10.22.0.2  Bcast:0.0.0.0  Mask:255.255.0.0
@@ -156,7 +167,7 @@ eth0      Link encap:Ethernet  HWaddr fa:60:70:aa:07:d1
           UP BROADCAST MULTICAST  MTU:1500  Metric:1
           RX packets:1 errors:0 dropped:0 overruns:0 frame:0
           TX packets:0 errors:0 dropped:1 overruns:0 carrier:0
-          collisions:0 txqueuelen:0 
+          collisions:0 txqueuelen:0
           RX bytes:90 (90.0 B)  TX bytes:0 (0.0 B)
 
 lo        Link encap:Local Loopback  
@@ -165,7 +176,7 @@ lo        Link encap:Local Loopback
           UP LOOPBACK RUNNING  MTU:65536  Metric:1
           RX packets:0 errors:0 dropped:0 overruns:0 frame:0
           TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
-          collisions:0 txqueuelen:0 
+          collisions:0 txqueuelen:0
           RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
 ```
 

vendor/github.com/containernetworking/cni/RELEASING.md

@@ -0,0 +1,34 @@
+# Release process
+
+## Resulting artifacts
+Creating a new release produces the following artifacts:
+
+- Binaries (stored in the `release-<TAG>` directory) :
+  - `cni-<PLATFORM>-<VERSION>.tgz` binaries
+  - `cni-<VERSION>.tgz` binary (copy of amd64 platform binary)
+  - `sha1`, `sha256` and `sha512` files for the above files.
+
+## Preparing for a release
+1. Releases are performed by maintainers and should usually be discussed and planned at a maintainer meeting.
+  - Choose the version number. It should be prefixed with `v`, e.g. `v1.2.3`
+  - Take a quick scan through the PRs and issues to make sure there isn't anything crucial that _must_ be in the next release.
+  - Create a draft of the release note
+  - Discuss the level of testing that's needed and create a test plan if sensible
+  - Check what version of `go` is used in the build container, updating it if there's a new stable release.
+
+## Creating the release artifacts
+1. Make sure you are on the master branch and don't have any local uncommitted changes.
+1. Create a signed tag for the release `git tag -s $VERSION` (Ensure that GPG keys are created and added to GitHub)
+1. Run the release script from the root of the repository
+  - `scripts/release.sh`
+  - The script requires Docker and ensures that a consistent environment is used.
+  - The artifacts will now be present in the `release-<TAG>` directory.
+1. Test these binaries according to the test plan.
+
+## Publishing the release
+1. Push the tag to git `git push origin <TAG>`
+1. Create a release on Github, using the tag which was just pushed.
+1. Attach all the artifacts from the release directory.
+1. Add the release note to the release.
+1. Announce the release on at least the CNI mailing, IRC and Slack.
+

vendor/github.com/containernetworking/cni/ROADMAP.md

@@ -5,29 +5,19 @@ The list below is not complete, and we advise to get the current project state f
 
 ## CNI Milestones
 
-### [v0.2.0](https://github.com/containernetworking/cni/milestones/v0.2.0)
-
-* Signed release binaries
-* Introduction of a testing strategy/framework
-
-### [v0.3.0](https://github.com/containernetworking/cni/milestones/v0.3.0)
-
-* Further increase test coverage
-* Simpler default route handling in bridge plugin
-* Clarify project description, documentation and contribution guidelines
-
-### [v0.4.0](https://github.com/containernetworking/cni/milestones/v0.4.0)
-
-* Further increase test coverage
-* Simpler bridging of host interface
-* Improve IPAM allocator predictability
-* Allow in- and output of arbitrary K/V pairs for plugins
-
-### [v1.0.0](https://github.com/containernetworking/cni/milestones/v1.0.0)
+### [v0.6.0](https://github.com/containernetworking/cni/milestones/v0.6.0)
 
 - Plugin composition functionality
 - IPv6 support
-- Stable SPEC
 - Strategy and tooling for backwards compatibility
-- Complete test coverage
 - Integrate build artefact generation with CI
+
+### [v1.0.0](https://github.com/containernetworking/cni/milestones/v1.0.0)
+
+- More precise specification language
+- GET action
+- Conformance test suite for CNI plugins (both reference and 3rd party)
+- Stable SPEC
+- Complete test coverage
+- Signed release binaries
+

vendor/github.com/containernetworking/cni/SPEC.md

@@ -1,10 +1,23 @@
-# Container Networking Interface Proposal
+# Container Network Interface Specification
 
 ## Version
-This is CNI **spec** version **0.3.1**.
+This is CNI **spec** version **0.4.0-dev**. This spec contains **unreleased** changes.
 
 Note that this is **independent from the version of the CNI library and plugins** in this repository (e.g. the versions of [releases](https://github.com/containernetworking/cni/releases)).
 
+#### Released versions
+Released versions of the spec are available as Git tags.
+
+| tag                                                                                  | spec permalink                                                                        | major changes                     |
+| ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | --------------------------------- |
+| [`spec-v0.3.1`](https://github.com/containernetworking/cni/releases/tag/spec-v0.3.1) | [spec at v0.3.1](https://github.com/containernetworking/cni/blob/spec-v0.3.1/SPEC.md) | none (typo fix only)              |
+| [`spec-v0.3.0`](https://github.com/containernetworking/cni/releases/tag/spec-v0.3.0) | [spec at v0.3.0](https://github.com/containernetworking/cni/blob/spec-v0.3.0/SPEC.md) | rich result type, plugin chaining |
+| [`spec-v0.2.0`](https://github.com/containernetworking/cni/releases/tag/spec-v0.2.0) | [spec at v0.2.0](https://github.com/containernetworking/cni/blob/spec-v0.2.0/SPEC.md) | VERSION command                   |
+| [`spec-v0.1.0`](https://github.com/containernetworking/cni/releases/tag/spec-v0.1.0) | [spec at v0.1.0](https://github.com/containernetworking/cni/blob/spec-v0.1.0/SPEC.md) | initial version                   |
+
+*Do not rely on these tags being stable.  In the future, we may change our mind about which particular commit is the right marker for a given historical spec version.*
+
+
 ## Overview
 
 This document proposes a generic plugin-based networking solution for application containers on Linux, the _Container Networking Interface_, or _CNI_.
@@ -14,44 +27,45 @@ For the purposes of this proposal, we define two terms very specifically:
 - _container_ can be considered synonymous with a [Linux _network namespace_][namespaces]. What unit this corresponds to depends on a particular container runtime implementation: for example, in implementations of the [App Container Spec][appc-github] like rkt, each _pod_ runs in a unique network namespace. In [Docker][docker], on the other hand, network namespaces generally exist for each separate Docker container.
 - _network_ refers to a group of entities that are uniquely addressable that can communicate amongst each other. This could be either an individual container (as specified above), a machine, or some other network device (e.g. a router). Containers can be conceptually _added to_ or _removed from_ one or more networks.
 
+This document aims to specify the interface between "runtimes" and "plugins". Whilst there are certain well known fields, runtimes may wish to pass additional information to plugins. These extentions are not part of this specification but are documented as [conventions](CONVENTIONS.md). The key words "must", "must not", "required", "shall", "shall not", "should", "should not", "recommended", "may" and "optional" are used as specified in [RFC 2119][rfc-2119].
+
 [rkt-networking-proposal]: https://docs.google.com/a/coreos.com/document/d/1PUeV68q9muEmkHmRuW10HQ6cHgd4819_67pIxDRVNlM/edit#heading=h.ievko3xsjwxd
 [rkt-networking-design]: 
 https://docs.google.com/a/coreos.com/document/d/1CTAL4gwqRofjxyp4tTkbgHtAwb2YCcP14UEbHNizd8g
 [rkt-github]: https://github.com/coreos/rkt
 [namespaces]: http://man7.org/linux/man-pages/man7/namespaces.7.html 
 [appc-github]: https://github.com/appc/spec
-[docker]: https://docker.com 
-
-This document aims to specify the interface between "runtimes" and "plugins". Whilst there are certain well known fields, runtimes may wish to pass additional information to plugins. These extentions are not part of this specification but are documented as [conventions](CONVENTIONS.md).
+[docker]: https://docker.com
+[rfc-2119]: https://www.ietf.org/rfc/rfc2119.txt
 
 ## General considerations
 
-The intention is for the container runtime to first create a new network namespace for the container.
-It then determines which networks this container should belong to and for each network, which plugin must be executed.
-The network configuration is in JSON format and can easily be stored in a file.
-The network configuration includes mandatory fields such as "name" and "type" as well as plugin (type) specific ones.
-The network configuration allows for fields to change values between invocations. For this purpose there is an optional field "args" which should contain the varying information.
-The container runtime sequentially sets up the networks by executing the corresponding plugin for each network.
-Upon completion of the container lifecycle, the runtime executes the plugins in reverse order (relative to the order in which they were added) to disconnect them from the networks.
+- The container runtime must create a new network namespace for the container before invoking any plugins.
+- The runtime must then determine which networks this container should belong to, and for each network, which plugins must be executed.
+- The network configuration is in JSON format and can easily be stored in a file. The network configuration includes mandatory fields such as "name" and "type" as well as plugin (type) specific ones. The network configuration allows for fields to change values between invocations. For this purpose there is an optional field "args" which must contain the varying information.
+- The container runtime must add the container to each network by executing the corresponding plugins for each network sequentially.
+- Upon completion of the container lifecycle, the runtime must execute the plugins in reverse order (relative to the order in which they were executed to add the container) to disconnect the container from the networks.
+- The container runtime must not invoke parallel operations for the same container, but is allowed to invoke parallel operations for different containers.
+- The container runtime must order ADD and DEL operations for a container, such that ADD is always eventually followed by a corresponding DEL. DEL may be followed by additional DELs but plugins should handle multiple DELs permissively (i.e. plugin DEL should be idempotent).
+- A container must be uniquely identified by a ContainerID. Plugins that store state should do so using a primary key of `(network name, CNI_CONTAINERID, CNI_IFNAME)`.
+- A runtime must not call ADD twice (without a corresponding DEL) for the same `(network name, container id, name of the interface inside the container)`. This implies that a given container ID may be added to a specific network more than once only if each addition is done with a different interface name.
 
 ## CNI Plugin
 
 ### Overview
 
-Each CNI plugin is implemented as an executable that is invoked by the container management system (e.g. rkt or Docker).
+Each CNI plugin must be implemented as an executable that is invoked by the container management system (e.g. rkt or Kubernetes).
 
-A CNI plugin is responsible for inserting a network interface into the container network namespace (e.g. one end of a veth pair) and making any necessary changes on the host (e.g. attaching other end of veth into a bridge).
-It should then assign the IP to the interface and setup the routes consistent with IP Address Management section by invoking appropriate IPAM plugin.
+A CNI plugin is responsible for inserting a network interface into the container network namespace (e.g. one end of a veth pair) and making any necessary changes on the host (e.g. attaching the other end of the veth into a bridge).
+It should then assign the IP to the interface and setup the routes consistent with the IP Address Management section by invoking appropriate IPAM plugin.
 
 ### Parameters
 
-The operations that the CNI plugin needs to support are:
+The operations that CNI plugins must support are:
 
-
-- Add container to network
+- `ADD`: Add container to network
   - Parameters:
-    - **Version**. The version of CNI spec that the caller is using (container management system or the invoking plugin).
-    - **Container ID**. This is optional but recommended, and should be unique across an administrative domain while the container is live (it may be reused in the future). For example, an environment with an IPAM system may require that each container is allocated a unique ID and that each IP allocation can thus be correlated back to a particular container. As another example, in appc implementations this would be the _pod ID_.
+    - **Container ID**. A unique plaintext identifier for a container, allocated by the runtime. Must not be empty.
     - **Network namespace path**. This represents the path to the network namespace to be added, i.e. /proc/[pid]/ns/net or a bind-mount/link to it.
     - **Network configuration**. This is a JSON document describing a network to which a container can be joined. The schema is described below.
     - **Extra arguments**. This provides an alternative mechanism to allow simple configuration of CNI plugins on a per-container basis.
@@ -61,47 +75,69 @@ The operations that the CNI plugin needs to support are:
     - **IP configuration assigned to each interface**. The IPv4 and/or IPv6 addresses, gateways, and routes assigned to sandbox and/or host interfaces.
     - **DNS information**. Dictionary that includes DNS information for nameservers, domain, search domains and options.
 
-- Delete container from network
+- `DEL`: Delete container from network
   - Parameters:
-    - **Version**. The version of CNI spec that the caller is using (container management system or the invoking plugin).
     - **Container ID**, as defined above.
     - **Network namespace path**, as defined above.
     - **Network configuration**, as defined above.
     - **Extra arguments**, as defined above.
     - **Name of the interface inside the container**, as defined above.
+  - All parameters should be the same as those passed to the corresponding add operation.
+  - A delete operation should release all resources held by the supplied containerid in the configured network.
+  - If there was a known previous `ADD` or `GET` action for the container, the runtime MUST add a `prevResult` field to the configuration JSON of the plugin (or all plugins in a chain), which MUST be the `Result` of the immediately previous `ADD` or `GET` action in JSON format ([see below](#network-configuration-list-runtime-examples)).
+  - When `CNI_NETNS` and/or `prevResult` are not provided, the plugin should clean up as many resources as possible (e.g. releasing IPAM allocations) and return a successful response.
+  - If the runtime cached the `Result` of a previous `ADD` or `GET` response for a given container, it must delete that cached response on a successful `DEL` for that container.
 
-- Report version
+- `GET`: Get container network configuration
+  - Parameters:
+    - **Container ID**, as defined for `ADD`.
+    - **Network namespace path**, as defined for `ADD`.
+    - **Network configuration**, as defined for `ADD`.
+    - **Extra arguments**, as defined for `ADD`.
+    - **Name of the interface inside the container**, as defined for `ADD`.
+  - Result:
+    - The plugin should return the same result as an `ADD` action for the same inputs.
+    - **Interfaces list**, as defined for `ADD`
+    - **IP configuration assigned to each interface**, as defined for `ADD`
+    - **DNS information**, as defined for `ADD`
+  - This action should return the same `Result` object as an `ADD` action for the same inputs. The result should not change over the lifetime of the container.
+  - The plugin should return an error if any general internal state is unexpected. For example, if the plugin's data storage is missing or corrupt, or its control plane is unavailable, it should return an error.
+  - The plugin should NOT return an error if its expected sandbox state (eg interfaces, IP addresses, routes, etc) is not found, as subsequent elements in the plugin's chain may alter sandbox state.
+  - A runtime may call `GET` at any time; but if `GET` is called for a container before an `ADD` or after a `DEL` for that container, the plugin should return error 3 to indicate the container is unknown (see [Well-known Error Codes](#well-known-error-codes) section).
+  - If the previous action for the container was `ADD` or `GET`, the runtime must add a `prevResult` field to the configuration JSON of the plugin (or all plugins in the chain), which must be the `Result` of that previous `ADD` or `GET` action in JSON format ([see below](#network-configuration-list-runtime-examples)).
+
+- `VERSION`: Report version
   - Parameters: NONE.
   - Result: information about the CNI spec versions supported by the plugin
 
       ```
       {
-        "cniVersion": "0.3.1", // the version of the CNI spec in use for this output
-        "supportedVersions": [ "0.1.0", "0.2.0", "0.3.0", "0.3.1" ] // the list of CNI spec versions that this plugin supports
+        "cniVersion": "0.4.0", // the version of the CNI spec in use for this output
+        "supportedVersions": [ "0.1.0", "0.2.0", "0.3.0", "0.3.1", "0.4.0" ] // the list of CNI spec versions that this plugin supports
       }
       ```
 
-The executable command-line API uses the type of network (see [Network Configuration](#network-configuration) below) as the name of the executable to invoke.
-It will then look for this executable in a list of predefined directories. Once found, it will invoke the executable using the following environment variables for argument passing:
-- `CNI_COMMAND`: indicates the desired operation; `ADD`, `DEL` or `VERSION`.
+Runtimes must use the type of network (see [Network Configuration](#network-configuration) below) as the name of the executable to invoke.
+Runtimes should then look for this executable in a list of predefined directories (the list of directories is not prescribed by this specification). Once found, it must invoke the executable using the following environment variables for argument passing:
+- `CNI_COMMAND`: indicates the desired operation; `ADD`, `DEL`, `GET`, or `VERSION`.
 - `CNI_CONTAINERID`: Container ID
 - `CNI_NETNS`: Path to network namespace file
-- `CNI_IFNAME`: Interface name to set up; plugin must honor this interface name or return an error
+- `CNI_IFNAME`: Interface name to set up; if the plugin is unable to use this interface name it must return an error
 - `CNI_ARGS`: Extra arguments passed in by the user at invocation time. Alphanumeric key-value pairs separated by semicolons; for example, "FOO=BAR;ABC=123"
 - `CNI_PATH`: List of paths to search for CNI plugin executables. Paths are separated by an OS-specific list separator; for example ':' on Linux and ';' on Windows
 
-Network configuration in JSON format is streamed to the plugin through stdin. This means it is not tied to a particular file on disk and can contain information which changes between invocations.
+Network configuration in JSON format must be streamed to the plugin through stdin. This means it is not tied to a particular file on disk and may contain information which changes between invocations.
 
 
 ### Result
 
-Note that IPAM plugins return an abbreviated `Result` structure as described in [IP Allocation](#ip-allocation).
+Note that IPAM plugins should return an abbreviated `Result` structure as described in [IP Allocation](#ip-allocation).
 
-Success is indicated by a return code of zero and the following JSON printed to stdout in the case of the ADD command. The `ips` and `dns` items should be the same output as was returned by the IPAM plugin (see [IP Allocation](#ip-allocation) for details) except that the plugin should fill in the `interface` indexes appropriately, which are missing from IPAM plugin output since IPAM plugins should be unaware of interfaces.
+Plugins must indicate success with a return code of zero and the following JSON printed to stdout in the case of the ADD command. The `ips` and `dns` items should be the same output as was returned by the IPAM plugin (see [IP Allocation](#ip-allocation) for details) except that the plugin should fill in the `interface` indexes appropriately, which are missing from IPAM plugin output since IPAM plugins should be unaware of interfaces.
 
 ```
 {
-  "cniVersion": "0.3.1",
+  "cniVersion": "0.4.0",
   "interfaces": [                                            (this key omitted by IPAM plugins)
       {
           "name": "<name>",
@@ -134,7 +170,8 @@ Success is indicated by a return code of zero and the following JSON printed to
 }
 ```
 
-`cniVersion` specifies a [Semantic Version 2.0](http://semver.org) of CNI specification used by the plugin.
+`cniVersion` specifies a [Semantic Version 2.0](http://semver.org) of CNI specification used by the plugin. A plugin may support multiple CNI spec versions (as it reports via the `VERSION` command), here the `cniVersion` returned by the plugin in the result must be consistent with the `cniVersion` specified in [Network Configuration](#network-configuration). If the `cniVersion` in the network configuration is not supported by the plugin, the plugin should return an error code 1 (see [Well-known Error Codes](#well-known-error-codes) for details).
+
 `interfaces` describes specific network interfaces the plugin created.
 If the `CNI_IFNAME` variable exists the plugin must use that name for the sandbox/hypervisor interface or return an error if it cannot.
 - `mac` (string): the hardware address of the interface.
@@ -152,10 +189,10 @@ See the [DNS well-known structure](#dns) section for more information.
 The specification does not declare how this information must be processed by CNI consumers.
 Examples include generating an `/etc/resolv.conf` file to be injected into the container filesystem or running a DNS forwarder on the host.
 
-Errors are indicated by a non-zero return code and the following JSON being printed to stdout:
+Errors must be indicated by a non-zero return code and the following JSON being printed to stdout:
 ```
 {
-  "cniVersion": "0.3.1",
+  "cniVersion": "0.4.0",
   "code": <numeric-error-code>,
   "msg": <short-error-message>,
   "details": <long-error-message> (optional)
@@ -170,7 +207,7 @@ In addition, stderr can be used for unstructured output such as logs.
 
 ### Network Configuration
 
-The network configuration is described in JSON form. The configuration can be stored on disk or generated from other sources by the container runtime. The following fields are well-known and have the following meaning:
+The network configuration is described in JSON form. The configuration may be stored on disk or generated from other sources by the container runtime. The following fields are well-known and have the following meaning:
 - `cniVersion` (string): [Semantic Version 2.0](http://semver.org) of CNI specification to which this configuration conforms.
 - `name` (string): Network name. This should be unique across all containers on the host (or other administrative domain).
 - `type` (string): Refers to the filename of the CNI plugin executable.
@@ -184,13 +221,13 @@ The network configuration is described in JSON form. The configuration can be st
   - `search` (list of strings): list of priority ordered search domains for short hostname lookups. Will be preferred over `domain` by most resolvers.
   - `options` (list of strings): list of options that can be passed to the resolver
 
-Plugins may define additional fields that they accept and may generate an error if called with unknown fields. The exception to this is the `args` field may be used to pass arbitrary data which may be ignored by plugins.
+Plugins may define additional fields that they accept and may generate an error if called with unknown fields. The exception to this is the `args` field may be used to pass arbitrary data which should be ignored by plugins if not understood.
 
 ### Example configurations
 
 ```json
 {
-  "cniVersion": "0.3.1",
+  "cniVersion": "0.4.0",
   "name": "dbnet",
   "type": "bridge",
   // type (plugin) specific
@@ -209,7 +246,7 @@ Plugins may define additional fields that they accept and may generate an error
 
 ```json
 {
-  "cniVersion": "0.3.1",
+  "cniVersion": "0.4.0",
   "name": "pci",
   "type": "ovs",
   // type (plugin) specific
@@ -230,7 +267,7 @@ Plugins may define additional fields that they accept and may generate an error
 
 ```json
 {
-  "cniVersion": "0.3.1",
+  "cniVersion": "0.4.0",
   "name": "wan",
   "type": "macvlan",
   // ipam specific
@@ -257,8 +294,9 @@ The list is described in JSON form, and can be stored on disk or generated from
 When executing a plugin list, the runtime MUST replace the `name` and `cniVersion` fields in each individual network configuration in the list with the `name` and `cniVersion` field of the list itself. This ensures that the name and CNI version is the same for all plugin executions in the list, preventing versioning conflicts between plugins.
 The runtime may also pass capability-based keys as a map in the top-level `runtimeConfig` key of the plugin's config JSON if a plugin advertises it supports a specific capability via the `capabilities` key of its network configuration.  The key passed in `runtimeConfig` MUST match the name of the specific capability from the `capabilities` key of the plugins network configuration. See CONVENTIONS.md for more information on capabilities and how they are sent to plugins via the `runtimeConfig` key.
 
-For the ADD action, the runtime MUST also add a `prevResult` field to the configuration JSON of any plugin after the first one, which MUST be the Result of the previous plugin (if any) in JSON format ([see below](#network-configuration-list-runtime-examples)).
-For the ADD action, plugins SHOULD echo the contents of the `prevResult` field to their stdout to allow subsequent plugins (and the runtime) to receive the result, unless they wish to modify or suppress a previous result.
+For the `ADD` action, the runtime MUST also add a `prevResult` field to the configuration JSON of any plugin after the first one, which MUST be the `Result` of the previous plugin (if any) in JSON format ([see below](#network-configuration-list-runtime-examples)).
+For the `GET` and `DEL` actions, the runtime MUST (if available) add a `prevResult` field to the configuration JSON of each plugin, which MUST be the `Result` of the immediately previous `ADD` or `GET` action in JSON format ([see below](#network-configuration-list-runtime-examples)).
+For the `ADD` and `GET` actions, plugins SHOULD echo the contents of the `prevResult` field to their stdout to allow subsequent plugins (and the runtime) to receive the result, unless they wish to modify or suppress a previous result.
 Plugins are allowed to modify or suppress all or part of a `prevResult`.
 However, plugins that support a version of the CNI specification that includes the `prevResult` field MUST handle `prevResult` by either passing it through, modifying it, or suppressing it explicitly.
 It is a violation of this specification to be unaware of the `prevResult` field.
@@ -279,7 +317,7 @@ Plugins should generally complete a DEL action without error even if some resour
 
 ```json
 {
-  "cniVersion": "0.3.1",
+  "cniVersion": "0.4.0",
   "name": "dbnet",
   "plugins": [
     {
@@ -314,14 +352,14 @@ Plugins should generally complete a DEL action without error even if some resour
 
 #### Network configuration list runtime examples
 
-Given the network configuration list JSON [shown above](#example-network-configuration-lists) the container runtime would perform the following steps for the ADD action.
+Given the network configuration list JSON [shown above](#example-network-configuration-lists) the container runtime would perform the following steps for the `ADD` action.
 Note that the runtime adds the `cniVersion` and `name` fields from configuration list to the configuration JSON passed to each plugin, to ensure consistent versioning and names for all plugins in the list.
 
 1) first call the `bridge` plugin with the following JSON:
 
 ```json
 {
-  "cniVersion": "0.3.1",
+  "cniVersion": "0.4.0",
   "name": "dbnet",
   "type": "bridge",
   "bridge": "cni0",
@@ -346,17 +384,35 @@ Note that the runtime adds the `cniVersion` and `name` fields from configuration
 
 ```json
 {
-  "cniVersion": "0.3.1",
+  "cniVersion": "0.4.0",
   "name": "dbnet",
   "type": "tuning",
   "sysctl": {
     "net.core.somaxconn": "500"
   },
   "prevResult": {
-    "ip4": {
-      "ip": "10.1.0.3/16",
-      "gateway": "10.1.0.1",
-    },
+    "ips": [
+        {
+          "version": "4",
+          "address": "10.0.0.5/32",
+          "interface": 2
+        }
+    ],
+    "interfaces": [
+        {
+            "name": "cni0",
+            "mac": "00:11:22:33:44:55",
+        },
+        {
+            "name": "veth3243",
+            "mac": "55:44:33:22:11:11",
+        },
+        {
+            "name": "eth0",
+            "mac": "99:88:77:66:55:44",
+            "sandbox": "/var/run/netns/blue",
+        }
+    ],
     "dns": {
       "nameservers": [ "10.1.0.1" ]
     }
@@ -364,28 +420,13 @@ Note that the runtime adds the `cniVersion` and `name` fields from configuration
 }
 ```
 
-Given the same network configuration JSON list, the container runtime would perform the following steps for the DEL action.
-Note that no `prevResult` field is required as the DEL action does not return any result.
-Also note that plugins are executed in reverse order from the ADD action.
+Given the same network configuration JSON list, the container runtime would perform the following steps for the `GET` action.
 
-1) first call the `tuning` plugin with the following JSON:
+1) first call the `bridge` plugin with the following JSON, including the `prevResult` field containing the JSON response from the `ADD` operation:
 
 ```json
 {
-  "cniVersion": "0.3.1",
-  "name": "dbnet",
-  "type": "tuning",
-  "sysctl": {
-    "net.core.somaxconn": "500"
-  }
-}
-```
-
-2) next call the `bridge` plugin with the following JSON:
-
-```json
-{
-  "cniVersion": "0.3.1",
+  "cniVersion": "0.4.0",
   "name": "dbnet",
   "type": "bridge",
   "bridge": "cni0",
@@ -403,6 +444,168 @@ Also note that plugins are executed in reverse order from the ADD action.
   "dns": {
     "nameservers": [ "10.1.0.1" ]
   }
+  "prevResult": {
+    "ips": [
+        {
+          "version": "4",
+          "address": "10.0.0.5/32",
+          "interface": 2
+        }
+    ],
+    "interfaces": [
+        {
+            "name": "cni0",
+            "mac": "00:11:22:33:44:55",
+        },
+        {
+            "name": "veth3243",
+            "mac": "55:44:33:22:11:11",
+        },
+        {
+            "name": "eth0",
+            "mac": "99:88:77:66:55:44",
+            "sandbox": "/var/run/netns/blue",
+        }
+    ],
+    "dns": {
+      "nameservers": [ "10.1.0.1" ]
+    }
+  }
+}
+```
+
+2) next call the `tuning` plugin with the following JSON, including the `prevResult` field containing the JSON response from the `bridge` plugin:
+
+```json
+{
+  "cniVersion": "0.4.0",
+  "name": "dbnet",
+  "type": "tuning",
+  "sysctl": {
+    "net.core.somaxconn": "500"
+  },
+  "prevResult": {
+    "ips": [
+        {
+          "version": "4",
+          "address": "10.0.0.5/32",
+          "interface": 2
+        }
+    ],
+    "interfaces": [
+        {
+            "name": "cni0",
+            "mac": "00:11:22:33:44:55",
+        },
+        {
+            "name": "veth3243",
+            "mac": "55:44:33:22:11:11",
+        },
+        {
+            "name": "eth0",
+            "mac": "99:88:77:66:55:44",
+            "sandbox": "/var/run/netns/blue",
+        }
+    ],
+    "dns": {
+      "nameservers": [ "10.1.0.1" ]
+    }
+  }
+}
+```
+
+Given the same network configuration JSON list, the container runtime would perform the following steps for the DEL action.
+Note that plugins are executed in reverse order from the `ADD` and `GET` actions.
+
+1) first call the `tuning` plugin with the following JSON, including the `prevResult` field containing the JSON response from the `GET` action:
+
+```json
+{
+  "cniVersion": "0.4.0",
+  "name": "dbnet",
+  "type": "tuning",
+  "sysctl": {
+    "net.core.somaxconn": "500"
+  },
+  "prevResult": {
+    "ips": [
+        {
+          "version": "4",
+          "address": "10.0.0.5/32",
+          "interface": 2
+        }
+    ],
+    "interfaces": [
+        {
+            "name": "cni0",
+            "mac": "00:11:22:33:44:55",
+        },
+        {
+            "name": "veth3243",
+            "mac": "55:44:33:22:11:11",
+        },
+        {
+            "name": "eth0",
+            "mac": "99:88:77:66:55:44",
+            "sandbox": "/var/run/netns/blue",
+        }
+    ],
+    "dns": {
+      "nameservers": [ "10.1.0.1" ]
+    }
+  }
+}
+```
+
+2) next call the `bridge` plugin with the following JSON, including the `prevResult` field containing the JSON response from the `GET` action:
+
+```json
+{
+  "cniVersion": "0.4.0",
+  "name": "dbnet",
+  "type": "bridge",
+  "bridge": "cni0",
+  "args": {
+    "labels" : {
+        "appVersion" : "1.0"
+    }
+  },
+  "ipam": {
+    "type": "host-local",
+    // ipam specific
+    "subnet": "10.1.0.0/16",
+    "gateway": "10.1.0.1"
+  },
+  "dns": {
+    "nameservers": [ "10.1.0.1" ]
+  },
+  "prevResult": {
+    "ips": [
+        {
+          "version": "4",
+          "address": "10.0.0.5/32",
+          "interface": 2
+        }
+    ],
+    "interfaces": [
+        {
+            "name": "cni0",
+            "mac": "00:11:22:33:44:55",
+        },
+        {
+            "name": "veth3243",
+            "mac": "55:44:33:22:11:11",
+        },
+        {
+            "name": "eth0",
+            "mac": "99:88:77:66:55:44",
+            "sandbox": "/var/run/netns/blue",
+        }
+    ],
+    "dns": {
+      "nameservers": [ "10.1.0.1" ]
+    }
+  }
 }
 ```
 
@@ -410,17 +613,17 @@ Also note that plugins are executed in reverse order from the ADD action.
 
 As part of its operation, a CNI plugin is expected to assign (and maintain) an IP address to the interface and install any necessary routes relevant for that interface. This gives the CNI plugin great flexibility but also places a large burden on it. Many CNI plugins would need to have the same code to support several IP management schemes that users may desire (e.g. dhcp, host-local). 
 
-To lessen the burden and make IP management strategy be orthogonal to the type of CNI plugin, we define a second type of plugin -- IP Address Management Plugin (IPAM plugin). It is however the responsibility of the CNI plugin to invoke the IPAM plugin at the proper moment in its execution. The IPAM plugin is expected to determine the interface IP/subnet, Gateway and Routes and return this information to the "main" plugin to apply. The IPAM plugin may obtain the information via a protocol (e.g. dhcp), data stored on a local filesystem, the "ipam" section of the Network Configuration file or a combination of the above.
+To lessen the burden and make IP management strategy be orthogonal to the type of CNI plugin, we define a second type of plugin -- IP Address Management Plugin (IPAM plugin). It is however the responsibility of the CNI plugin to invoke the IPAM plugin at the proper moment in its execution. The IPAM plugin must determine the interface IP/subnet, Gateway and Routes and return this information to the "main" plugin to apply. The IPAM plugin may obtain the information via a protocol (e.g. dhcp), data stored on a local filesystem, the "ipam" section of the Network Configuration file or a combination of the above.
 
 #### IP Address Management (IPAM) Interface
 
-Like CNI plugins, the IPAM plugins are invoked by running an executable. The executable is searched for in a predefined list of paths, indicated to the CNI plugin via `CNI_PATH`. The IPAM Plugin receives all the same environment variables that were passed in to the CNI plugin. Just like the CNI plugin, IPAM receives the network configuration via stdin.
+Like CNI plugins, the IPAM plugins are invoked by running an executable. The executable is searched for in a predefined list of paths, indicated to the CNI plugin via `CNI_PATH`. The IPAM Plugin must receive all the same environment variables that were passed in to the CNI plugin. Just like the CNI plugin, IPAM plugins receive the network configuration via stdin.
 
-Success is indicated by a zero return code and the following JSON being printed to stdout (in the case of the ADD command):
+Success must be indicated by a zero return code and the following JSON being printed to stdout (in the case of the ADD command):
 
 ```
 {
-  "cniVersion": "0.3.1",
+  "cniVersion": "0.4.0",
   "ips": [
       {
           "version": "<4-or-6>",
@@ -445,9 +648,9 @@ Success is indicated by a zero return code and the following JSON being printed
 }
 ```
 
-Note that unlike regular CNI plugins, IPAM plugins return an abbreviated `Result` structure that does not include the `interfaces` key, since IPAM plugins should be unaware of interfaces configured by their parent plugin except those specifically required for IPAM (eg, like the `dhcp` IPAM plugin).
+Note that unlike regular CNI plugins, IPAM plugins should return an abbreviated `Result` structure that does not include the `interfaces` key, since IPAM plugins should be unaware of interfaces configured by their parent plugin except those specifically required for IPAM (eg, like the `dhcp` IPAM plugin).
 
-`cniVersion` specifies a [Semantic Version 2.0](http://semver.org) of CNI specification used by the plugin.
+`cniVersion` specifies a [Semantic Version 2.0](http://semver.org) of CNI specification used by the IPAM plugin. An IPAM plugin may support multiple CNI spec versions (as it reports via the `VERSION` command), here the `cniVersion` returned by the IPAM plugin in the result must be consistent with the `cniVersion` specified in [Network Configuration](#network-configuration). If the `cniVersion` in the network configuration is not supported by the IPAM plugin, the plugin should return an error code 1 (see [Well-known Error Codes](#well-known-error-codes) for details).
 
 The `ips` field is a list of IP configuration information.
 See the [IP well-known structure](#ips) section for more information.
@@ -526,7 +729,11 @@ The `dns` field contains a dictionary consisting of common DNS information.
 - `search` (list of strings): list of priority ordered search domains for short hostname lookups. Will be preferred over `domain` by most resolvers.
 - `options` (list of strings): list of options that can be passed to the resolver.
   See [CNI Plugin Result](#result) section for more information.
-
+  
 ## Well-known Error Codes
+
+Error codes 1-99 must not be used other than as specified here.
+
 - `1` - Incompatible CNI version
 - `2` - Unsupported field in network configuration. The error message must contain the key and value of the unsupported field.
+- `3` - Container unknown or does not exist. This error implies the runtime does not need to perform any container network cleanup (for example, calling the `DEL` action on the container).

vendor/github.com/containernetworking/cni/Vagrantfile

@@ -10,11 +10,13 @@ Vagrant.configure(2) do |config|
     set -e -x -u
 
     apt-get update -y || (sleep 40 && apt-get update -y)
-    apt-get install -y golang git
-    echo "export GOPATH=/go" >> /root/.bashrc
-    export GOPATH=/go
-    go get github.com/tools/godep
+    apt-get install -y git
+
+    wget -qO- https://storage.googleapis.com/golang/go1.10.linux-amd64.tar.gz | tar -C /usr/local -xz
+
+    echo 'export GOPATH=/go; export PATH=/usr/local/go/bin:$GOPATH/bin:$PATH' >> /root/.bashrc
+    eval `tail -n1 /root/.bashrc`
+
     cd /go/src/github.com/containernetworking/cni
-    /go/bin/godep restore
   SHELL
 end

vendor/github.com/containernetworking/cni/build.sh

@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-ORG_PATH="github.com/containernetworking"
-REPO_PATH="${ORG_PATH}/cni"
-
-if [ ! -h gopath/src/${REPO_PATH} ]; then
-	mkdir -p gopath/src/${ORG_PATH}
-	ln -s ../../../.. gopath/src/${REPO_PATH} || exit 255
-fi
-
-export GO15VENDOREXPERIMENT=1
-export GOPATH=${PWD}/gopath
-
-echo "Building API"
-go build "$@" ${REPO_PATH}/libcni
-
-echo "Building reference CLI"
-go build -o ${PWD}/bin/cnitool "$@" ${REPO_PATH}/cnitool
-
-echo "Building plugins"
-PLUGINS="plugins/meta/* plugins/main/* plugins/ipam/* plugins/test/*"
-for d in $PLUGINS; do
-	if [ -d $d ]; then
-		plugin=$(basename $d)
-		echo "  " $plugin
-		go build -o ${PWD}/bin/$plugin "$@" ${REPO_PATH}/$d
-	fi
-done

vendor/github.com/containernetworking/cni/cnitool/README.md

@@ -0,0 +1,47 @@
+# cnitool
+
+`cnitool` is a simple program that executes a CNI configuration. It will
+add or remove an interface in an already-created network namespace.
+
+## Example invocation
+First, install cnitool:
+
+```
+go install github.com/containernetworking/cni/cnitool
+```
+
+Then, check out and build the plugins. All commands should be run from this directory.
+```
+git clone https://github.com/containernetworking/plugins.git
+cd plugins
+./build.sh
+```
+
+Create a network configuration
+```
+echo '{"cniVersion":"0.3.1","name":"myptp","type":"ptp","ipMasq":true,"ipam":{"type":"host-local","subnet":"172.16.29.0/24","routes":[{"dst":"0.0.0.0/0"}]}}' | sudo tee /etc/cni/net.d/10-myptp.conf
+```
+
+Create a network namespace. This will be called `testing`:
+
+```
+sudo ip netns add testing
+```
+
+Add the container to the network:
+```
+sudo CNI_PATH=./bin cnitool add myptp /var/run/netns/testing
+```
+
+Test that it works:
+```
+sudo ip -n testing addr
+sudo ip netns exec testing ping -c 1 4.2.2.2
+```
+
+And clean up:
+```
+sudo CNI_PATH=./bin cnitool del myptp /var/run/netns/testing
+sudo ip netns del testing
+```
+

vendor/github.com/containernetworking/cni/cnitool/cni.go

@@ -1,89 +0,0 @@
-// Copyright 2015 CNI authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package main
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"github.com/containernetworking/cni/libcni"
-)
-
-const (
-	EnvCNIPath = "CNI_PATH"
-	EnvNetDir  = "NETCONFPATH"
-
-	DefaultNetDir = "/etc/cni/net.d"
-
-	CmdAdd = "add"
-	CmdDel = "del"
-)
-
-func main() {
-	if len(os.Args) < 3 {
-		usage()
-		return
-	}
-
-	netdir := os.Getenv(EnvNetDir)
-	if netdir == "" {
-		netdir = DefaultNetDir
-	}
-	netconf, err := libcni.LoadConfList(netdir, os.Args[2])
-	if err != nil {
-		exit(err)
-	}
-
-	netns := os.Args[3]
-
-	cninet := &libcni.CNIConfig{
-		Path: filepath.SplitList(os.Getenv(EnvCNIPath)),
-	}
-
-	rt := &libcni.RuntimeConf{
-		ContainerID: "cni",
-		NetNS:       netns,
-		IfName:      "eth0",
-	}
-
-	switch os.Args[1] {
-	case CmdAdd:
-		result, err := cninet.AddNetworkList(netconf, rt)
-		if result != nil {
-			_ = result.Print()
-		}
-		exit(err)
-	case CmdDel:
-		exit(cninet.DelNetworkList(netconf, rt))
-	}
-}
-
-func usage() {
-	exe := filepath.Base(os.Args[0])
-
-	fmt.Fprintf(os.Stderr, "%s: Add or remove network interfaces from a network namespace\n", exe)
-	fmt.Fprintf(os.Stderr, "  %s %s <net> <netns>\n", exe, CmdAdd)
-	fmt.Fprintf(os.Stderr, "  %s %s <net> <netns>\n", exe, CmdDel)
-	os.Exit(1)
-}
-
-func exit(err error) {
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "%s\n", err)
-		os.Exit(1)
-	}
-	os.Exit(0)
-}

vendor/github.com/containernetworking/cni/cnitool/cnitool.go

@@ -0,0 +1,135 @@
+// Copyright 2015 CNI authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"crypto/sha512"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/containernetworking/cni/libcni"
+)
+
+const (
+	EnvCNIPath        = "CNI_PATH"
+	EnvNetDir         = "NETCONFPATH"
+	EnvCapabilityArgs = "CAP_ARGS"
+	EnvCNIArgs        = "CNI_ARGS"
+
+	DefaultNetDir = "/etc/cni/net.d"
+
+	CmdAdd = "add"
+	CmdDel = "del"
+)
+
+func parseArgs(args string) ([][2]string, error) {
+	var result [][2]string
+
+	pairs := strings.Split(args, ";")
+	for _, pair := range pairs {
+		kv := strings.Split(pair, "=")
+		if len(kv) != 2 || kv[0] == "" || kv[1] == "" {
+			return nil, fmt.Errorf("invalid CNI_ARGS pair %q", pair)
+		}
+
+		result = append(result, [2]string{kv[0], kv[1]})
+	}
+
+	return result, nil
+}
+
+func main() {
+	if len(os.Args) < 3 {
+		usage()
+		return
+	}
+
+	netdir := os.Getenv(EnvNetDir)
+	if netdir == "" {
+		netdir = DefaultNetDir
+	}
+	netconf, err := libcni.LoadConfList(netdir, os.Args[2])
+	if err != nil {
+		exit(err)
+	}
+
+	var capabilityArgs map[string]interface{}
+	capabilityArgsValue := os.Getenv(EnvCapabilityArgs)
+	if len(capabilityArgsValue) > 0 {
+		if err = json.Unmarshal([]byte(capabilityArgsValue), &capabilityArgs); err != nil {
+			exit(err)
+		}
+	}
+
+	var cniArgs [][2]string
+	args := os.Getenv(EnvCNIArgs)
+	if len(args) > 0 {
+		cniArgs, err = parseArgs(args)
+		if err != nil {
+			exit(err)
+		}
+	}
+
+	netns := os.Args[3]
+	netns, err = filepath.Abs(netns)
+	if err != nil {
+		exit(err)
+	}
+
+	// Generate the containerid by hashing the netns path
+	s := sha512.Sum512([]byte(netns))
+	containerID := fmt.Sprintf("cnitool-%x", s[:10])
+
+	cninet := libcni.NewCNIConfig(filepath.SplitList(os.Getenv(EnvCNIPath)), nil)
+
+	rt := &libcni.RuntimeConf{
+		ContainerID:    containerID,
+		NetNS:          netns,
+		IfName:         "eth0",
+		Args:           cniArgs,
+		CapabilityArgs: capabilityArgs,
+	}
+
+	switch os.Args[1] {
+	case CmdAdd:
+		result, err := cninet.AddNetworkList(netconf, rt)
+		if result != nil {
+			_ = result.Print()
+		}
+		exit(err)
+	case CmdDel:
+		exit(cninet.DelNetworkList(netconf, rt))
+	}
+}
+
+func usage() {
+	exe := filepath.Base(os.Args[0])
+
+	fmt.Fprintf(os.Stderr, "%s: Add or remove network interfaces from a network namespace\n", exe)
+	fmt.Fprintf(os.Stderr, "  %s %s <net> <netns>\n", exe, CmdAdd)
+	fmt.Fprintf(os.Stderr, "  %s %s <net> <netns>\n", exe, CmdDel)
+	os.Exit(1)
+}
+
+func exit(err error) {
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "%s\n", err)
+		os.Exit(1)
+	}
+	os.Exit(0)
+}

vendor/github.com/containernetworking/cni/libcni/api.go

@@ -15,7 +15,11 @@
 package libcni
 
 import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
 	"os"
+	"path/filepath"
 	"strings"
 
 	"github.com/containernetworking/cni/pkg/invoke"
@@ -23,6 +27,14 @@ import (
 	"github.com/containernetworking/cni/pkg/version"
 )
 
+var (
+	CacheDir = "/var/lib/cni"
+)
+
+// A RuntimeConf holds the arguments to one invocation of a CNI plugin
+// excepting the network configuration, with the nested exception that
+// the `runtimeConfig` from the network configuration is included
+// here.
 type RuntimeConf struct {
 	ContainerID string
 	NetNS       string
@@ -34,6 +46,9 @@ type RuntimeConf struct {
 	// in this map which match the capabilities of the plugin are passed
 	// to the plugin
 	CapabilityArgs map[string]interface{}
+
+	// A cache directory in which to library data.  Defaults to CacheDir
+	CacheDir string
 }
 
 type NetworkConfig struct {
@@ -50,25 +65,38 @@ type NetworkConfigList struct {
 
 type CNI interface {
 	AddNetworkList(net *NetworkConfigList, rt *RuntimeConf) (types.Result, error)
+	GetNetworkList(net *NetworkConfigList, rt *RuntimeConf) (types.Result, error)
 	DelNetworkList(net *NetworkConfigList, rt *RuntimeConf) error
 
 	AddNetwork(net *NetworkConfig, rt *RuntimeConf) (types.Result, error)
+	GetNetwork(net *NetworkConfig, rt *RuntimeConf) (types.Result, error)
 	DelNetwork(net *NetworkConfig, rt *RuntimeConf) error
 }
 
 type CNIConfig struct {
 	Path []string
+	exec invoke.Exec
 }
 
 // CNIConfig implements the CNI interface
 var _ CNI = &CNIConfig{}
 
-func buildOneConfig(list *NetworkConfigList, orig *NetworkConfig, prevResult types.Result, rt *RuntimeConf) (*NetworkConfig, error) {
+// NewCNIConfig returns a new CNIConfig object that will search for plugins
+// in the given paths and use the given exec interface to run those plugins,
+// or if the exec interface is not given, will use a default exec handler.
+func NewCNIConfig(path []string, exec invoke.Exec) *CNIConfig {
+	return &CNIConfig{
+		Path: path,
+		exec: exec,
+	}
+}
+
+func buildOneConfig(name, cniVersion string, orig *NetworkConfig, prevResult types.Result, rt *RuntimeConf) (*NetworkConfig, error) {
 	var err error
 
 	inject := map[string]interface{}{
-		"name":       list.Name,
-		"cniVersion": list.CNIVersion,
+		"name":       name,
+		"cniVersion": cniVersion,
 	}
 	// Add previous plugin result
 	if prevResult != nil {
@@ -119,21 +147,37 @@ func injectRuntimeConfig(orig *NetworkConfig, rt *RuntimeConf) (*NetworkConfig,
 	return orig, nil
 }
 
-// AddNetworkList executes a sequence of plugins with the ADD command
-func (c *CNIConfig) AddNetworkList(list *NetworkConfigList, rt *RuntimeConf) (types.Result, error) {
-	var prevResult types.Result
+// ensure we have a usable exec if the CNIConfig was not given one
+func (c *CNIConfig) ensureExec() invoke.Exec {
+	if c.exec == nil {
+		c.exec = &invoke.DefaultExec{
+			RawExec:       &invoke.RawExec{Stderr: os.Stderr},
+			PluginDecoder: version.PluginDecoder{},
+		}
+	}
+	return c.exec
+}
+
+func (c *CNIConfig) addOrGetNetwork(command, name, cniVersion string, net *NetworkConfig, prevResult types.Result, rt *RuntimeConf) (types.Result, error) {
+	c.ensureExec()
+	pluginPath, err := c.exec.FindInPath(net.Network.Type, c.Path)
+	if err != nil {
+		return nil, err
+	}
+
+	newConf, err := buildOneConfig(name, cniVersion, net, prevResult, rt)
+	if err != nil {
+		return nil, err
+	}
+
+	return invoke.ExecPluginWithResult(pluginPath, newConf.Bytes, c.args(command, rt), c.exec)
+}
+
+// Note that only GET requests should pass an initial prevResult
+func (c *CNIConfig) addOrGetNetworkList(command string, prevResult types.Result, list *NetworkConfigList, rt *RuntimeConf) (types.Result, error) {
+	var err error
 	for _, net := range list.Plugins {
-		pluginPath, err := invoke.FindInPath(net.Network.Type, c.Path)
-		if err != nil {
-			return nil, err
-		}
-
-		newConf, err := buildOneConfig(list, net, prevResult, rt)
-		if err != nil {
-			return nil, err
-		}
-
-		prevResult, err = invoke.ExecPluginWithResult(pluginPath, newConf.Bytes, c.args("ADD", rt))
+		prevResult, err = c.addOrGetNetwork(command, list.Name, list.CNIVersion, net, prevResult, rt)
 		if err != nil {
 			return nil, err
 		}
@@ -142,68 +186,194 @@ func (c *CNIConfig) AddNetworkList(list *NetworkConfigList, rt *RuntimeConf) (ty
 	return prevResult, nil
 }
 
+func getResultCacheFilePath(netName string, rt *RuntimeConf) string {
+	cacheDir := rt.CacheDir
+	if cacheDir == "" {
+		cacheDir = CacheDir
+	}
+	return filepath.Join(cacheDir, "results", fmt.Sprintf("%s-%s", netName, rt.ContainerID))
+}
+
+func setCachedResult(result types.Result, netName string, rt *RuntimeConf) error {
+	data, err := json.Marshal(result)
+	if err != nil {
+		return err
+	}
+	fname := getResultCacheFilePath(netName, rt)
+	if err := os.MkdirAll(filepath.Dir(fname), 0700); err != nil {
+		return err
+	}
+	return ioutil.WriteFile(fname, data, 0600)
+}
+
+func delCachedResult(netName string, rt *RuntimeConf) error {
+	fname := getResultCacheFilePath(netName, rt)
+	return os.Remove(fname)
+}
+
+func getCachedResult(netName, cniVersion string, rt *RuntimeConf) (types.Result, error) {
+	fname := getResultCacheFilePath(netName, rt)
+	data, err := ioutil.ReadFile(fname)
+	if err != nil {
+		// Ignore read errors; the cached result may not exist on-disk
+		return nil, nil
+	}
+
+	// Read the version of the cached result
+	decoder := version.ConfigDecoder{}
+	resultCniVersion, err := decoder.Decode(data)
+	if err != nil {
+		return nil, err
+	}
+
+	// Ensure we can understand the result
+	result, err := version.NewResult(resultCniVersion, data)
+	if err != nil {
+		return nil, err
+	}
+
+	// Convert to the config version to ensure plugins get prevResult
+	// in the same version as the config.  The cached result version
+	// should match the config version unless the config was changed
+	// while the container was running.
+	result, err = result.GetAsVersion(cniVersion)
+	if err != nil && resultCniVersion != cniVersion {
+		return nil, fmt.Errorf("failed to convert cached result version %q to config version %q: %v", resultCniVersion, cniVersion, err)
+	}
+	return result, err
+}
+
+// AddNetworkList executes a sequence of plugins with the ADD command
+func (c *CNIConfig) AddNetworkList(list *NetworkConfigList, rt *RuntimeConf) (types.Result, error) {
+	result, err := c.addOrGetNetworkList("ADD", nil, list, rt)
+	if err != nil {
+		return nil, err
+	}
+
+	if err = setCachedResult(result, list.Name, rt); err != nil {
+		return nil, fmt.Errorf("failed to set network '%s' cached result: %v", list.Name, err)
+	}
+
+	return result, nil
+}
+
+// GetNetworkList executes a sequence of plugins with the GET command
+func (c *CNIConfig) GetNetworkList(list *NetworkConfigList, rt *RuntimeConf) (types.Result, error) {
+	// GET was added in CNI spec version 0.4.0 and higher
+	if gtet, err := version.GreaterThanOrEqualTo(list.CNIVersion, "0.4.0"); err != nil {
+		return nil, err
+	} else if !gtet {
+		return nil, fmt.Errorf("configuration version %q does not support the GET command", list.CNIVersion)
+	}
+
+	cachedResult, err := getCachedResult(list.Name, list.CNIVersion, rt)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get network '%s' cached result: %v", list.Name, err)
+	}
+	return c.addOrGetNetworkList("GET", cachedResult, list, rt)
+}
+
+func (c *CNIConfig) delNetwork(name, cniVersion string, net *NetworkConfig, prevResult types.Result, rt *RuntimeConf) error {
+	c.ensureExec()
+	pluginPath, err := c.exec.FindInPath(net.Network.Type, c.Path)
+	if err != nil {
+		return err
+	}
+
+	newConf, err := buildOneConfig(name, cniVersion, net, prevResult, rt)
+	if err != nil {
+		return err
+	}
+
+	return invoke.ExecPluginWithoutResult(pluginPath, newConf.Bytes, c.args("DEL", rt), c.exec)
+}
+
 // DelNetworkList executes a sequence of plugins with the DEL command
 func (c *CNIConfig) DelNetworkList(list *NetworkConfigList, rt *RuntimeConf) error {
+	var cachedResult types.Result
+
+	// Cached result on DEL was added in CNI spec version 0.4.0 and higher
+	if gtet, err := version.GreaterThanOrEqualTo(list.CNIVersion, "0.4.0"); err != nil {
+		return err
+	} else if gtet {
+		cachedResult, err = getCachedResult(list.Name, list.CNIVersion, rt)
+		if err != nil {
+			return fmt.Errorf("failed to get network '%s' cached result: %v", list.Name, err)
+		}
+	}
+
 	for i := len(list.Plugins) - 1; i >= 0; i-- {
 		net := list.Plugins[i]
-
-		pluginPath, err := invoke.FindInPath(net.Network.Type, c.Path)
-		if err != nil {
-			return err
-		}
-
-		newConf, err := buildOneConfig(list, net, nil, rt)
-		if err != nil {
-			return err
-		}
-
-		if err := invoke.ExecPluginWithoutResult(pluginPath, newConf.Bytes, c.args("DEL", rt)); err != nil {
+		if err := c.delNetwork(list.Name, list.CNIVersion, net, cachedResult, rt); err != nil {
 			return err
 		}
 	}
+	_ = delCachedResult(list.Name, rt)
 
 	return nil
 }
 
 // AddNetwork executes the plugin with the ADD command
 func (c *CNIConfig) AddNetwork(net *NetworkConfig, rt *RuntimeConf) (types.Result, error) {
-	pluginPath, err := invoke.FindInPath(net.Network.Type, c.Path)
+	result, err := c.addOrGetNetwork("ADD", net.Network.Name, net.Network.CNIVersion, net, nil, rt)
 	if err != nil {
 		return nil, err
 	}
 
-	net, err = injectRuntimeConfig(net, rt)
-	if err != nil {
-		return nil, err
+	if err = setCachedResult(result, net.Network.Name, rt); err != nil {
+		return nil, fmt.Errorf("failed to set network '%s' cached result: %v", net.Network.Name, err)
 	}
 
-	return invoke.ExecPluginWithResult(pluginPath, net.Bytes, c.args("ADD", rt))
+	return result, nil
+}
+
+// GetNetwork executes the plugin with the GET command
+func (c *CNIConfig) GetNetwork(net *NetworkConfig, rt *RuntimeConf) (types.Result, error) {
+	// GET was added in CNI spec version 0.4.0 and higher
+	if gtet, err := version.GreaterThanOrEqualTo(net.Network.CNIVersion, "0.4.0"); err != nil {
+		return nil, err
+	} else if !gtet {
+		return nil, fmt.Errorf("configuration version %q does not support the GET command", net.Network.CNIVersion)
+	}
+
+	cachedResult, err := getCachedResult(net.Network.Name, net.Network.CNIVersion, rt)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get network '%s' cached result: %v", net.Network.Name, err)
+	}
+	return c.addOrGetNetwork("GET", net.Network.Name, net.Network.CNIVersion, net, cachedResult, rt)
 }
 
 // DelNetwork executes the plugin with the DEL command
 func (c *CNIConfig) DelNetwork(net *NetworkConfig, rt *RuntimeConf) error {
-	pluginPath, err := invoke.FindInPath(net.Network.Type, c.Path)
-	if err != nil {
+	var cachedResult types.Result
+
+	// Cached result on DEL was added in CNI spec version 0.4.0 and higher
+	if gtet, err := version.GreaterThanOrEqualTo(net.Network.CNIVersion, "0.4.0"); err != nil {
 		return err
+	} else if gtet {
+		cachedResult, err = getCachedResult(net.Network.Name, net.Network.CNIVersion, rt)
+		if err != nil {
+			return fmt.Errorf("failed to get network '%s' cached result: %v", net.Network.Name, err)
+		}
 	}
 
-	net, err = injectRuntimeConfig(net, rt)
-	if err != nil {
+	if err := c.delNetwork(net.Network.Name, net.Network.CNIVersion, net, cachedResult, rt); err != nil {
 		return err
 	}
-
-	return invoke.ExecPluginWithoutResult(pluginPath, net.Bytes, c.args("DEL", rt))
+	_ = delCachedResult(net.Network.Name, rt)
+	return nil
 }
 
 // GetVersionInfo reports which versions of the CNI spec are supported by
 // the given plugin.
 func (c *CNIConfig) GetVersionInfo(pluginType string) (version.PluginInfo, error) {
-	pluginPath, err := invoke.FindInPath(pluginType, c.Path)
+	c.ensureExec()
+	pluginPath, err := c.exec.FindInPath(pluginType, c.Path)
 	if err != nil {
 		return nil, err
 	}
 
-	return invoke.GetVersionInfo(pluginPath)
+	return invoke.GetVersionInfo(pluginPath, c.exec)
 }
 
 // =====

vendor/github.com/containernetworking/cni/libcni/api_test.go

@@ -72,7 +72,7 @@ func newPluginInfo(configValue, prevResult string, injectDebugFilePath bool, res
 		config += fmt.Sprintf(`, "prevResult": %s`, prevResult)
 	}
 	if injectDebugFilePath {
-		config += fmt.Sprintf(`, "debugFile": "%s"`, debugFilePath)
+		config += fmt.Sprintf(`, "debugFile": %q`, debugFilePath)
 	}
 	if len(capabilities) > 0 {
 		config += `, "capabilities": {`
@@ -92,7 +92,7 @@ func newPluginInfo(configValue, prevResult string, injectDebugFilePath bool, res
 	err = json.Unmarshal([]byte(config), &newConfig)
 	Expect(err).NotTo(HaveOccurred())
 	newConfig["name"] = "some-list"
-	newConfig["cniVersion"] = "0.3.1"
+	newConfig["cniVersion"] = current.ImplementedSpecVersion
 
 	// Only include standard runtime config and capability args that this plugin advertises
 	newRuntimeConfig := make(map[string]interface{})
@@ -116,13 +116,29 @@ func newPluginInfo(configValue, prevResult string, injectDebugFilePath bool, res
 	}
 }
 
+func resultCacheFilePath(cacheDirPath, netName, containerID string) string {
+	return filepath.Join(cacheDirPath, "results", netName+"-"+containerID)
+}
+
 var _ = Describe("Invoking plugins", func() {
+	var cacheDirPath string
+
+	BeforeEach(func() {
+		var err error
+		cacheDirPath, err = ioutil.TempDir("", "cni_cachedir")
+		Expect(err).NotTo(HaveOccurred())
+	})
+
+	AfterEach(func() {
+		Expect(os.RemoveAll(cacheDirPath)).To(Succeed())
+	})
+
 	Describe("Capabilities", func() {
 		var (
 			debugFilePath string
 			debug         *noop_debug.Debug
 			pluginConfig  []byte
-			cniConfig     libcni.CNIConfig
+			cniConfig     *libcni.CNIConfig
 			runtimeConfig *libcni.RuntimeConf
 			netConfig     *libcni.NetworkConfig
 		)
@@ -136,11 +152,20 @@ var _ = Describe("Invoking plugins", func() {
 			debug = &noop_debug.Debug{}
 			Expect(debug.WriteDebug(debugFilePath)).To(Succeed())
 
-			pluginConfig = []byte(`{ "type": "noop", "cniVersion": "0.3.1", "capabilities": { "portMappings": true, "somethingElse": true, "noCapability": false } }`)
+			pluginConfig = []byte(fmt.Sprintf(`{
+				"type": "noop",
+				"name": "apitest",
+				"cniVersion": "%s",
+				"capabilities": {
+					"portMappings": true,
+					"somethingElse": true,
+					"noCapability": false
+				}
+			}`, current.ImplementedSpecVersion))
 			netConfig, err = libcni.ConfFromBytes(pluginConfig)
 			Expect(err).NotTo(HaveOccurred())
 
-			cniConfig = libcni.CNIConfig{Path: []string{filepath.Dir(pluginPaths["noop"])}}
+			cniConfig = libcni.NewCNIConfig([]string{filepath.Dir(pluginPaths["noop"])}, nil)
 
 			runtimeConfig = &libcni.RuntimeConf{
 				ContainerID: "some-container-id",
@@ -155,6 +180,7 @@ var _ = Describe("Invoking plugins", func() {
 					"noCapability":  true,
 					"notAdded":      []bool{true, false},
 				},
+				CacheDir: cacheDirPath,
 			}
 		})
 
@@ -220,7 +246,7 @@ var _ = Describe("Invoking plugins", func() {
 			debug         *noop_debug.Debug
 			cniBinPath    string
 			pluginConfig  string
-			cniConfig     libcni.CNIConfig
+			cniConfig     *libcni.CNIConfig
 			netConfig     *libcni.NetworkConfig
 			runtimeConfig *libcni.RuntimeConf
 
@@ -234,7 +260,11 @@ var _ = Describe("Invoking plugins", func() {
 			debugFilePath = debugFile.Name()
 
 			debug = &noop_debug.Debug{
-				ReportResult: `{ "ips": [{ "version": "4", "address": "10.1.2.3/24" }], "dns": {} }`,
+				ReportResult: `{
+					"cniVersion": "0.4.0",
+					"ips": [{"version": "4", "address": "10.1.2.3/24"}],
+					"dns": {}
+				}`,
 			}
 			Expect(debug.WriteDebug(debugFilePath)).To(Succeed())
 
@@ -243,21 +273,21 @@ var _ = Describe("Invoking plugins", func() {
 			}
 
 			cniBinPath = filepath.Dir(pluginPaths["noop"])
-			pluginConfig = `{ "type": "noop", "some-key": "some-value", "cniVersion": "0.3.1", "capabilities": { "portMappings": true } }`
-			cniConfig = libcni.CNIConfig{Path: []string{cniBinPath}}
-			netConfig = &libcni.NetworkConfig{
-				Network: &types.NetConf{
-					Type: "noop",
-					Capabilities: map[string]bool{
-						"portMappings": true,
-					},
-				},
-				Bytes: []byte(pluginConfig),
-			}
+			pluginConfig = fmt.Sprintf(`{
+				"type": "noop",
+				"name": "apitest",
+				"some-key": "some-value",
+				"cniVersion": "%s",
+				"capabilities": { "portMappings": true }
+			}`, current.ImplementedSpecVersion)
+			cniConfig = libcni.NewCNIConfig([]string{cniBinPath}, nil)
+			netConfig, err = libcni.ConfFromBytes([]byte(pluginConfig))
+			Expect(err).NotTo(HaveOccurred())
 			runtimeConfig = &libcni.RuntimeConf{
 				ContainerID: "some-container-id",
 				NetNS:       "/some/netns/path",
 				IfName:      "some-eth0",
+				CacheDir:    cacheDirPath,
 				Args:        [][2]string{{"DEBUG", debugFilePath}},
 				CapabilityArgs: map[string]interface{}{
 					"portMappings": portMappings,
@@ -297,6 +327,7 @@ var _ = Describe("Invoking plugins", func() {
 				Expect(err).NotTo(HaveOccurred())
 
 				Expect(result).To(Equal(&current.Result{
+					CNIVersion: current.ImplementedSpecVersion,
 					IPs: []*current.IPConfig{
 						{
 							Version: "4",
@@ -313,6 +344,16 @@ var _ = Describe("Invoking plugins", func() {
 				Expect(debug.Command).To(Equal("ADD"))
 				Expect(debug.CmdArgs).To(Equal(expectedCmdArgs))
 				Expect(string(debug.CmdArgs.StdinData)).To(ContainSubstring("\"portMappings\":"))
+
+				// Ensure the cached result matches the returned one
+				cacheFile := resultCacheFilePath(cacheDirPath, netConfig.Network.Name, runtimeConfig.ContainerID)
+				_, err = os.Stat(cacheFile)
+				Expect(err).NotTo(HaveOccurred())
+				cachedData, err := ioutil.ReadFile(cacheFile)
+				Expect(err).NotTo(HaveOccurred())
+				returnedData, err := json.Marshal(result)
+				Expect(err).NotTo(HaveOccurred())
+				Expect(cachedData).To(MatchJSON(returnedData))
 			})
 
 			Context("when finding the plugin fails", func() {
@@ -337,18 +378,231 @@ var _ = Describe("Invoking plugins", func() {
 					Expect(err).To(MatchError("plugin error: banana"))
 				})
 			})
+
+			Context("when the result cache directory cannot be accessed", func() {
+				It("returns an error", func() {
+					// Make the results directory inaccessble by making it a
+					// file instead of a directory
+					tmpPath := filepath.Join(cacheDirPath, "results")
+					err := ioutil.WriteFile(tmpPath, []byte("afdsasdfasdf"), 0600)
+					Expect(err).NotTo(HaveOccurred())
+
+					result, err := cniConfig.AddNetwork(netConfig, runtimeConfig)
+					Expect(result).To(BeNil())
+					Expect(err).To(HaveOccurred())
+				})
+			})
+		})
+
+		Describe("GetNetwork", func() {
+			It("executes the plugin with command GET", func() {
+				cacheFile := resultCacheFilePath(cacheDirPath, netConfig.Network.Name, runtimeConfig.ContainerID)
+				err := os.MkdirAll(filepath.Dir(cacheFile), 0700)
+				Expect(err).NotTo(HaveOccurred())
+				cachedJson := `{
+					"cniVersion": "0.4.0",
+					"ips": [{"version": "4", "address": "10.1.2.3/24"}],
+					"dns": {}
+				}`
+				err = ioutil.WriteFile(cacheFile, []byte(cachedJson), 0600)
+				Expect(err).NotTo(HaveOccurred())
+
+				r, err := cniConfig.GetNetwork(netConfig, runtimeConfig)
+				Expect(err).NotTo(HaveOccurred())
+
+				result, err := current.GetResult(r)
+				Expect(err).NotTo(HaveOccurred())
+
+				Expect(result).To(Equal(&current.Result{
+					CNIVersion: current.ImplementedSpecVersion,
+					IPs: []*current.IPConfig{
+						{
+							Version: "4",
+							Address: net.IPNet{
+								IP:   net.ParseIP("10.1.2.3"),
+								Mask: net.IPv4Mask(255, 255, 255, 0),
+							},
+						},
+					},
+				}))
+
+				debug, err := noop_debug.ReadDebug(debugFilePath)
+				Expect(err).NotTo(HaveOccurred())
+				Expect(debug.Command).To(Equal("GET"))
+				Expect(string(debug.CmdArgs.StdinData)).To(ContainSubstring("\"portMappings\":"))
+
+				// Explicitly match stdin data as json after
+				// inserting the expected prevResult
+				var data, data2 map[string]interface{}
+				err = json.Unmarshal(expectedCmdArgs.StdinData, &data)
+				Expect(err).NotTo(HaveOccurred())
+				err = json.Unmarshal([]byte(cachedJson), &data2)
+				Expect(err).NotTo(HaveOccurred())
+				data["prevResult"] = data2
+				expectedStdinJson, err := json.Marshal(data)
+				Expect(err).NotTo(HaveOccurred())
+				Expect(debug.CmdArgs.StdinData).To(MatchJSON(expectedStdinJson))
+
+				debug.CmdArgs.StdinData = nil
+				expectedCmdArgs.StdinData = nil
+				Expect(debug.CmdArgs).To(Equal(expectedCmdArgs))
+			})
+
+			Context("when finding the plugin fails", func() {
+				BeforeEach(func() {
+					netConfig.Network.Type = "does-not-exist"
+				})
+
+				It("returns the error", func() {
+					_, err := cniConfig.GetNetwork(netConfig, runtimeConfig)
+					Expect(err).To(MatchError(ContainSubstring(`failed to find plugin "does-not-exist"`)))
+				})
+			})
+
+			Context("when the plugin errors", func() {
+				BeforeEach(func() {
+					debug.ReportError = "plugin error: banana"
+					Expect(debug.WriteDebug(debugFilePath)).To(Succeed())
+				})
+				It("unmarshals and returns the error", func() {
+					result, err := cniConfig.GetNetwork(netConfig, runtimeConfig)
+					Expect(result).To(BeNil())
+					Expect(err).To(MatchError("plugin error: banana"))
+				})
+			})
+
+			Context("when GET is called with a configuration version", func() {
+				var cacheFile string
+
+				BeforeEach(func() {
+					cacheFile = resultCacheFilePath(cacheDirPath, netConfig.Network.Name, runtimeConfig.ContainerID)
+					err := os.MkdirAll(filepath.Dir(cacheFile), 0700)
+					Expect(err).NotTo(HaveOccurred())
+				})
+
+				Context("less than 0.4.0", func() {
+					It("fails as GET is not supported before 0.4.0", func() {
+						// Generate plugin config with older version
+						pluginConfig = `{
+							"type": "noop",
+							"name": "apitest",
+							"cniVersion": "0.3.1"
+						}`
+						var err error
+						netConfig, err = libcni.ConfFromBytes([]byte(pluginConfig))
+						Expect(err).NotTo(HaveOccurred())
+						_, err = cniConfig.GetNetwork(netConfig, runtimeConfig)
+						Expect(err).To(MatchError("configuration version \"0.3.1\" does not support the GET command"))
+
+						debug, err := noop_debug.ReadDebug(debugFilePath)
+						Expect(err).NotTo(HaveOccurred())
+						Expect(string(debug.CmdArgs.StdinData)).NotTo(ContainSubstring("\"prevResult\":"))
+					})
+				})
+
+				Context("equal to 0.4.0", func() {
+					It("passes a prevResult to the plugin", func() {
+						err := ioutil.WriteFile(cacheFile, []byte(`{
+							"cniVersion": "0.4.0",
+							"ips": [{"version": "4", "address": "10.1.2.3/24"}],
+							"dns": {}
+						}`), 0600)
+						Expect(err).NotTo(HaveOccurred())
+
+						_, err = cniConfig.GetNetwork(netConfig, runtimeConfig)
+						Expect(err).NotTo(HaveOccurred())
+						debug, err := noop_debug.ReadDebug(debugFilePath)
+						Expect(err).NotTo(HaveOccurred())
+						Expect(string(debug.CmdArgs.StdinData)).To(ContainSubstring("\"prevResult\":"))
+					})
+				})
+			})
+
+			Context("when the cached result", func() {
+				var cacheFile string
+
+				BeforeEach(func() {
+					cacheFile = resultCacheFilePath(cacheDirPath, netConfig.Network.Name, runtimeConfig.ContainerID)
+					err := os.MkdirAll(filepath.Dir(cacheFile), 0700)
+					Expect(err).NotTo(HaveOccurred())
+				})
+
+				Context("is invalid JSON", func() {
+					It("returns an error", func() {
+						err := ioutil.WriteFile(cacheFile, []byte("adfadsfasdfasfdsafaf"), 0600)
+						Expect(err).NotTo(HaveOccurred())
+
+						result, err := cniConfig.GetNetwork(netConfig, runtimeConfig)
+						Expect(result).To(BeNil())
+						Expect(err).To(MatchError("failed to get network 'apitest' cached result: decoding version from network config: invalid character 'a' looking for beginning of value"))
+					})
+				})
+
+				Context("version doesn't match the config version", func() {
+					It("succeeds when the cached result can be converted", func() {
+						err := ioutil.WriteFile(cacheFile, []byte(`{
+							"cniVersion": "0.3.1",
+							"ips": [{"version": "4", "address": "10.1.2.3/24"}],
+							"dns": {}
+						}`), 0600)
+						Expect(err).NotTo(HaveOccurred())
+
+						_, err = cniConfig.GetNetwork(netConfig, runtimeConfig)
+						Expect(err).NotTo(HaveOccurred())
+					})
+
+					It("returns an error when the cached result cannot be converted", func() {
+						err := ioutil.WriteFile(cacheFile, []byte(`{
+							"cniVersion": "0.4567.0",
+							"ips": [{"version": "4", "address": "10.1.2.3/24"}],
+							"dns": {}
+						}`), 0600)
+						Expect(err).NotTo(HaveOccurred())
+
+						result, err := cniConfig.GetNetwork(netConfig, runtimeConfig)
+						Expect(result).To(BeNil())
+						Expect(err).To(MatchError("failed to get network 'apitest' cached result: unsupported CNI result version \"0.4567.0\""))
+					})
+				})
+			})
 		})
 
 		Describe("DelNetwork", func() {
 			It("executes the plugin with command DEL", func() {
-				err := cniConfig.DelNetwork(netConfig, runtimeConfig)
+				cacheFile := resultCacheFilePath(cacheDirPath, netConfig.Network.Name, runtimeConfig.ContainerID)
+				err := os.MkdirAll(filepath.Dir(cacheFile), 0700)
+				Expect(err).NotTo(HaveOccurred())
+				cachedJson := `{
+					"cniVersion": "0.4.0",
+					"ips": [{"version": "4", "address": "10.1.2.3/24"}],
+					"dns": {}
+				}`
+				err = ioutil.WriteFile(cacheFile, []byte(cachedJson), 0600)
+				Expect(err).NotTo(HaveOccurred())
+
+				err = cniConfig.DelNetwork(netConfig, runtimeConfig)
 				Expect(err).NotTo(HaveOccurred())
 
 				debug, err := noop_debug.ReadDebug(debugFilePath)
 				Expect(err).NotTo(HaveOccurred())
 				Expect(debug.Command).To(Equal("DEL"))
-				Expect(debug.CmdArgs).To(Equal(expectedCmdArgs))
 				Expect(string(debug.CmdArgs.StdinData)).To(ContainSubstring("\"portMappings\":"))
+
+				// Explicitly match stdin data as json after
+				// inserting the expected prevResult
+				var data, data2 map[string]interface{}
+				err = json.Unmarshal(expectedCmdArgs.StdinData, &data)
+				Expect(err).NotTo(HaveOccurred())
+				err = json.Unmarshal([]byte(cachedJson), &data2)
+				Expect(err).NotTo(HaveOccurred())
+				data["prevResult"] = data2
+				expectedStdinJson, err := json.Marshal(data)
+				Expect(err).NotTo(HaveOccurred())
+				Expect(debug.CmdArgs.StdinData).To(MatchJSON(expectedStdinJson))
+
+				debug.CmdArgs.StdinData = nil
+				expectedCmdArgs.StdinData = nil
+				Expect(debug.CmdArgs).To(Equal(expectedCmdArgs))
 			})
 
 			Context("when finding the plugin fails", func() {
@@ -372,6 +626,135 @@ var _ = Describe("Invoking plugins", func() {
 					Expect(err).To(MatchError("plugin error: banana"))
 				})
 			})
+
+			Context("when DEL is called twice", func() {
+				var cacheFile string
+
+				BeforeEach(func() {
+					cacheFile = resultCacheFilePath(cacheDirPath, netConfig.Network.Name, runtimeConfig.ContainerID)
+					err := os.MkdirAll(filepath.Dir(cacheFile), 0700)
+					Expect(err).NotTo(HaveOccurred())
+				})
+
+				It("deletes the cached result after the first DEL", func() {
+					err := ioutil.WriteFile(cacheFile, []byte(`{
+						"cniVersion": "0.4.0",
+						"ips": [{"version": "4", "address": "10.1.2.3/24"}],
+						"dns": {}
+					}`), 0600)
+					Expect(err).NotTo(HaveOccurred())
+
+					err = cniConfig.DelNetwork(netConfig, runtimeConfig)
+					Expect(err).NotTo(HaveOccurred())
+					_, err = ioutil.ReadFile(cacheFile)
+					Expect(err).To(HaveOccurred())
+
+					err = cniConfig.DelNetwork(netConfig, runtimeConfig)
+					Expect(err).NotTo(HaveOccurred())
+				})
+			})
+
+			Context("when DEL is called with a configuration version", func() {
+				var cacheFile string
+
+				BeforeEach(func() {
+					cacheFile = resultCacheFilePath(cacheDirPath, netConfig.Network.Name, runtimeConfig.ContainerID)
+					err := os.MkdirAll(filepath.Dir(cacheFile), 0700)
+					Expect(err).NotTo(HaveOccurred())
+				})
+
+				Context("less than 0.4.0", func() {
+					It("does not pass a prevResult to the plugin", func() {
+						err := ioutil.WriteFile(cacheFile, []byte(`{
+							"cniVersion": "0.3.1",
+							"ips": [{"version": "4", "address": "10.1.2.3/24"}],
+							"dns": {}
+						}`), 0600)
+						Expect(err).NotTo(HaveOccurred())
+
+						// Generate plugin config with older version
+						pluginConfig = `{
+							"type": "noop",
+							"name": "apitest",
+							"cniVersion": "0.3.1"
+						}`
+						netConfig, err = libcni.ConfFromBytes([]byte(pluginConfig))
+						Expect(err).NotTo(HaveOccurred())
+						err = cniConfig.DelNetwork(netConfig, runtimeConfig)
+						Expect(err).NotTo(HaveOccurred())
+
+						debug, err := noop_debug.ReadDebug(debugFilePath)
+						Expect(err).NotTo(HaveOccurred())
+						Expect(debug.Command).To(Equal("DEL"))
+						Expect(string(debug.CmdArgs.StdinData)).NotTo(ContainSubstring("\"prevResult\":"))
+					})
+				})
+
+				Context("equal to 0.4.0", func() {
+					It("passes a prevResult to the plugin", func() {
+						err := ioutil.WriteFile(cacheFile, []byte(`{
+							"cniVersion": "0.4.0",
+							"ips": [{"version": "4", "address": "10.1.2.3/24"}],
+							"dns": {}
+						}`), 0600)
+						Expect(err).NotTo(HaveOccurred())
+
+						err = cniConfig.DelNetwork(netConfig, runtimeConfig)
+						Expect(err).NotTo(HaveOccurred())
+
+						debug, err := noop_debug.ReadDebug(debugFilePath)
+						Expect(err).NotTo(HaveOccurred())
+						Expect(debug.Command).To(Equal("DEL"))
+						Expect(string(debug.CmdArgs.StdinData)).To(ContainSubstring("\"prevResult\":"))
+					})
+				})
+			})
+
+			Context("when the cached result", func() {
+				var cacheFile string
+
+				BeforeEach(func() {
+					cacheFile = resultCacheFilePath(cacheDirPath, netConfig.Network.Name, runtimeConfig.ContainerID)
+					err := os.MkdirAll(filepath.Dir(cacheFile), 0700)
+					Expect(err).NotTo(HaveOccurred())
+				})
+
+				Context("is invalid JSON", func() {
+					It("returns an error", func() {
+						err := ioutil.WriteFile(cacheFile, []byte("adfadsfasdfasfdsafaf"), 0600)
+						Expect(err).NotTo(HaveOccurred())
+
+						err = cniConfig.DelNetwork(netConfig, runtimeConfig)
+						Expect(err).To(MatchError("failed to get network 'apitest' cached result: decoding version from network config: invalid character 'a' looking for beginning of value"))
+					})
+				})
+
+				Context("version doesn't match the config version", func() {
+					It("succeeds when the cached result can be converted", func() {
+						err := ioutil.WriteFile(cacheFile, []byte(`{
+							"cniVersion": "0.3.1",
+							"ips": [{"version": "4", "address": "10.1.2.3/24"}],
+							"dns": {}
+						}`), 0600)
+						Expect(err).NotTo(HaveOccurred())
+
+						err = cniConfig.DelNetwork(netConfig, runtimeConfig)
+						Expect(err).NotTo(HaveOccurred())
+					})
+
+					It("returns an error when the cached result cannot be converted", func() {
+						err := ioutil.WriteFile(cacheFile, []byte(`{
+							"cniVersion": "0.4567.0",
+							"ips": [{"version": "4", "address": "10.1.2.3/24"}],
+							"dns": {}
+						}`), 0600)
+						Expect(err).NotTo(HaveOccurred())
+
+						err = cniConfig.DelNetwork(netConfig, runtimeConfig)
+						Expect(err).To(MatchError("failed to get network 'apitest' cached result: unsupported CNI result version \"0.4567.0\""))
+					})
+				})
+			})
 		})
 
 		Describe("GetVersionInfo", func() {
@@ -381,7 +764,7 @@ var _ = Describe("Invoking plugins", func() {
 
 				Expect(versionInfo).NotTo(BeNil())
 				Expect(versionInfo.SupportedVersions()).To(Equal([]string{
-					"0.-42.0", "0.1.0", "0.2.0", "0.3.0", "0.3.1",
+					"0.-42.0", "0.1.0", "0.2.0", "0.3.0", "0.3.1", "0.4.0",
 				}))
 			})
 
@@ -398,7 +781,7 @@ var _ = Describe("Invoking plugins", func() {
 		var (
 			plugins       []pluginInfo
 			cniBinPath    string
-			cniConfig     libcni.CNIConfig
+			cniConfig     *libcni.CNIConfig
 			netConfigList *libcni.NetworkConfigList
 			runtimeConfig *libcni.RuntimeConf
 
@@ -416,13 +799,14 @@ var _ = Describe("Invoking plugins", func() {
 			}
 
 			cniBinPath = filepath.Dir(pluginPaths["noop"])
-			cniConfig = libcni.CNIConfig{Path: []string{cniBinPath}}
+			cniConfig = libcni.NewCNIConfig([]string{cniBinPath}, nil)
 			runtimeConfig = &libcni.RuntimeConf{
 				ContainerID:    "some-container-id",
 				NetNS:          "/some/netns/path",
 				IfName:         "some-eth0",
 				Args:           [][2]string{{"FOO", "BAR"}},
 				CapabilityArgs: capabilityArgs,
+				CacheDir:       cacheDirPath,
 			}
 
 			expectedCmdArgs = skel.CmdArgs{
@@ -444,7 +828,7 @@ var _ = Describe("Invoking plugins", func() {
 				"otherCapability": capabilityArgs["otherCapability"],
 			}
 
-			ipResult := `{"dns":{},"ips":[{"version": "4", "address": "10.1.2.3/24"}]}`
+			ipResult := fmt.Sprintf(`{"cniVersion": "%s", "dns":{},"ips":[{"version": "4", "address": "10.1.2.3/24"}]}`, current.ImplementedSpecVersion)
 			plugins = make([]pluginInfo, 3, 3)
 			plugins[0] = newPluginInfo("some-value", "", true, ipResult, rc, []string{"portMappings", "otherCapability"})
 			plugins[1] = newPluginInfo("some-other-value", ipResult, true, "PASSTHROUGH", rc, []string{"otherCapability"})
@@ -452,13 +836,13 @@ var _ = Describe("Invoking plugins", func() {
 
 			configList := []byte(fmt.Sprintf(`{
   "name": "some-list",
-  "cniVersion": "0.3.1",
+  "cniVersion": "%s",
   "plugins": [
     %s,
     %s,
     %s
   ]
-}`, plugins[0].config, plugins[1].config, plugins[2].config))
+}`, current.ImplementedSpecVersion, plugins[0].config, plugins[1].config, plugins[2].config))
 
 			netConfigList, err = libcni.ConfListFromBytes(configList)
 			Expect(err).NotTo(HaveOccurred())
@@ -479,6 +863,7 @@ var _ = Describe("Invoking plugins", func() {
 				Expect(err).NotTo(HaveOccurred())
 
 				Expect(result).To(Equal(&current.Result{
+					CNIVersion: current.ImplementedSpecVersion,
 					// IP4 added by first plugin
 					IPs: []*current.IPConfig{
 						{
@@ -507,6 +892,24 @@ var _ = Describe("Invoking plugins", func() {
 				}
 			})
 
+			It("writes the correct cached result", func() {
+				r, err := cniConfig.AddNetworkList(netConfigList, runtimeConfig)
+				Expect(err).NotTo(HaveOccurred())
+
+				result, err := current.GetResult(r)
+				Expect(err).NotTo(HaveOccurred())
+
+				// Ensure the cached result matches the returned one
+				cacheFile := resultCacheFilePath(cacheDirPath, netConfigList.Name, runtimeConfig.ContainerID)
+				_, err = os.Stat(cacheFile)
+				Expect(err).NotTo(HaveOccurred())
+				cachedData, err := ioutil.ReadFile(cacheFile)
+				Expect(err).NotTo(HaveOccurred())
+				returnedData, err := json.Marshal(result)
+				Expect(err).NotTo(HaveOccurred())
+				Expect(cachedData).To(MatchJSON(returnedData))
+			})
+
 			Context("when finding the plugin fails", func() {
 				BeforeEach(func() {
 					netConfigList.Plugins[1].Network.Type = "does-not-exist"
@@ -529,6 +932,149 @@ var _ = Describe("Invoking plugins", func() {
 					Expect(err).To(MatchError("plugin error: banana"))
 				})
 			})
+
+			Context("when the result cache directory cannot be accessed", func() {
+				It("returns an error", func() {
+					// Make the results directory inaccessble by making it a
+					// file instead of a directory
+					tmpPath := filepath.Join(cacheDirPath, "results")
+					err := ioutil.WriteFile(tmpPath, []byte("afdsasdfasdf"), 0600)
+					Expect(err).NotTo(HaveOccurred())
+
+					result, err := cniConfig.AddNetworkList(netConfigList, runtimeConfig)
+					Expect(result).To(BeNil())
+					Expect(err).To(HaveOccurred())
+				})
+			})
+		})
+
+		Describe("GetNetworkList", func() {
+			It("executes all plugins with command GET and returns an intermediate result", func() {
+				r, err := cniConfig.GetNetworkList(netConfigList, runtimeConfig)
+				Expect(err).NotTo(HaveOccurred())
+
+				result, err := current.GetResult(r)
+				Expect(err).NotTo(HaveOccurred())
+
+				Expect(result).To(Equal(&current.Result{
+					CNIVersion: current.ImplementedSpecVersion,
+					// IP4 added by first plugin
+					IPs: []*current.IPConfig{
+						{
+							Version: "4",
+							Address: net.IPNet{
+								IP:   net.ParseIP("10.1.2.3"),
+								Mask: net.IPv4Mask(255, 255, 255, 0),
+							},
+						},
+					},
+					// DNS injected by last plugin
+					DNS: types.DNS{
+						Nameservers: []string{"1.2.3.4"},
+					},
+				}))
+
+				for i := 0; i < len(plugins); i++ {
+					debug, err := noop_debug.ReadDebug(plugins[i].debugFilePath)
+					Expect(err).NotTo(HaveOccurred())
+					Expect(debug.Command).To(Equal("GET"))
+
+					// Must explicitly match JSON due to dict element ordering
+					Expect(debug.CmdArgs.StdinData).To(MatchJSON(plugins[i].stdinData))
+					debug.CmdArgs.StdinData = nil
+					Expect(debug.CmdArgs).To(Equal(expectedCmdArgs))
+				}
+			})
+
+			Context("when the configuration version", func() {
+				var cacheFile string
+
+				BeforeEach(func() {
+					cacheFile = resultCacheFilePath(cacheDirPath, netConfigList.Name, runtimeConfig.ContainerID)
+					err := os.MkdirAll(filepath.Dir(cacheFile), 0700)
+					Expect(err).NotTo(HaveOccurred())
+				})
+
+				Context("is 0.4.0", func() {
+					It("passes a cached result to the first plugin", func() {
+						cachedJson := `{
+							"cniVersion": "0.4.0",
+							"ips": [{"version": "4", "address": "10.1.2.3/24"}],
+							"dns": {}
+						}`
+						err := ioutil.WriteFile(cacheFile, []byte(cachedJson), 0600)
+						Expect(err).NotTo(HaveOccurred())
+
+						_, err = cniConfig.GetNetworkList(netConfigList, runtimeConfig)
+						Expect(err).NotTo(HaveOccurred())
+
+						// Match the first plugin's stdin config to the cached result JSON
+						debug, err := noop_debug.ReadDebug(plugins[0].debugFilePath)
+						Expect(err).NotTo(HaveOccurred())
+
+						var data map[string]interface{}
+						err = json.Unmarshal(debug.CmdArgs.StdinData, &data)
+						Expect(err).NotTo(HaveOccurred())
+						stdinPrevResult, err := json.Marshal(data["prevResult"])
+						Expect(err).NotTo(HaveOccurred())
+						Expect(stdinPrevResult).To(MatchJSON(cachedJson))
+					})
+				})
+
+				Context("is less than 0.4.0", func() {
+					It("fails as GET is not supported before 0.4.0", func() {
+						// Set an older CNI version
+						confList := make(map[string]interface{})
+						err := json.Unmarshal(netConfigList.Bytes, &confList)
+						Expect(err).NotTo(HaveOccurred())
+						confList["cniVersion"] = "0.3.1"
+						newBytes, err := json.Marshal(confList)
+						Expect(err).NotTo(HaveOccurred())
+
+						netConfigList, err = libcni.ConfListFromBytes(newBytes)
+						Expect(err).NotTo(HaveOccurred())
+						_, err = cniConfig.GetNetworkList(netConfigList, runtimeConfig)
+						Expect(err).To(MatchError("configuration version \"0.3.1\" does not support the GET command"))
+					})
+				})
+			})
+
+			Context("when finding the plugin fails", func() {
+				BeforeEach(func() {
+					netConfigList.Plugins[1].Network.Type = "does-not-exist"
+				})
+
+				It("returns the error", func() {
+					_, err := cniConfig.GetNetworkList(netConfigList, runtimeConfig)
+					Expect(err).To(MatchError(ContainSubstring(`failed to find plugin "does-not-exist"`)))
+				})
+			})
+
+			Context("when the second plugin errors", func() {
+				BeforeEach(func() {
+					plugins[1].debug.ReportError = "plugin error: banana"
+					Expect(plugins[1].debug.WriteDebug(plugins[1].debugFilePath)).To(Succeed())
+				})
+				It("unmarshals and returns the error", func() {
+					result, err := cniConfig.GetNetworkList(netConfigList, runtimeConfig)
+					Expect(result).To(BeNil())
+					Expect(err).To(MatchError("plugin error: banana"))
+				})
+			})
+
+			Context("when the cached result is invalid", func() {
+				It("returns an error", func() {
+					cacheFile := resultCacheFilePath(cacheDirPath, netConfigList.Name, runtimeConfig.ContainerID)
+					err := os.MkdirAll(filepath.Dir(cacheFile), 0700)
+					Expect(err).NotTo(HaveOccurred())
+					err = ioutil.WriteFile(cacheFile, []byte("adfadsfasdfasfdsafaf"), 0600)
+					Expect(err).NotTo(HaveOccurred())
+
+					result, err := cniConfig.GetNetworkList(netConfigList, runtimeConfig)
+					Expect(result).To(BeNil())
+					Expect(err).To(MatchError("failed to get network 'some-list' cached result: decoding version from network config: invalid character 'a' looking for beginning of value"))
+				})
+			})
 		})
 
 		Describe("DelNetworkList", func() {
@@ -548,6 +1094,71 @@ var _ = Describe("Invoking plugins", func() {
 				}
 			})
 
+			Context("when the configuration version", func() {
+				var cacheFile string
+
+				BeforeEach(func() {
+					cacheFile = resultCacheFilePath(cacheDirPath, netConfigList.Name, runtimeConfig.ContainerID)
+					err := os.MkdirAll(filepath.Dir(cacheFile), 0700)
+					Expect(err).NotTo(HaveOccurred())
+				})
+
+				Context("is 0.4.0", func() {
+					It("passes a cached result to the first plugin", func() {
+						cachedJson := `{
+							"cniVersion": "0.4.0",
+							"ips": [{"version": "4", "address": "10.1.2.3/24"}],
+							"dns": {}
+						}`
+						err := ioutil.WriteFile(cacheFile, []byte(cachedJson), 0600)
+						Expect(err).NotTo(HaveOccurred())
+
+						err = cniConfig.DelNetworkList(netConfigList, runtimeConfig)
+						Expect(err).NotTo(HaveOccurred())
+
+						// Match the first plugin's stdin config to the cached result JSON
+						debug, err := noop_debug.ReadDebug(plugins[0].debugFilePath)
+						Expect(err).NotTo(HaveOccurred())
+
+						var data map[string]interface{}
+						err = json.Unmarshal(debug.CmdArgs.StdinData, &data)
+						Expect(err).NotTo(HaveOccurred())
+						stdinPrevResult, err := json.Marshal(data["prevResult"])
+						Expect(err).NotTo(HaveOccurred())
+						Expect(stdinPrevResult).To(MatchJSON(cachedJson))
+					})
+				})
+
+				Context("is less than 0.4.0", func() {
+					It("does not pass a cached result to the first plugin", func() {
+						err := ioutil.WriteFile(cacheFile, []byte(`{
+							"cniVersion": "0.3.1",
+							"ips": [{"version": "4", "address": "10.1.2.3/24"}],
+							"dns": {}
+						}`), 0600)
+						Expect(err).NotTo(HaveOccurred())
+
+						// Set an older CNI version
+						confList := make(map[string]interface{})
+						err = json.Unmarshal(netConfigList.Bytes, &confList)
+						Expect(err).NotTo(HaveOccurred())
+						confList["cniVersion"] = "0.3.1"
+						newBytes, err := json.Marshal(confList)
+						Expect(err).NotTo(HaveOccurred())
+
+						netConfigList, err = libcni.ConfListFromBytes(newBytes)
+						Expect(err).NotTo(HaveOccurred())
+						err = cniConfig.DelNetworkList(netConfigList, runtimeConfig)
+						Expect(err).NotTo(HaveOccurred())
+
+						// Make sure first plugin does not receive a prevResult
+						debug, err := noop_debug.ReadDebug(plugins[0].debugFilePath)
+						Expect(err).NotTo(HaveOccurred())
+						Expect(string(debug.CmdArgs.StdinData)).NotTo(ContainSubstring("\"prevResult\":"))
+					})
+				})
+			})
+
 			Context("when finding the plugin fails", func() {
 				BeforeEach(func() {
 					netConfigList.Plugins[1].Network.Type = "does-not-exist"
@@ -569,6 +1180,19 @@ var _ = Describe("Invoking plugins", func() {
 					Expect(err).To(MatchError("plugin error: banana"))
 				})
 			})
+
+			Context("when the cached result is invalid", func() {
+				It("returns an error", func() {
+					cacheFile := resultCacheFilePath(cacheDirPath, netConfigList.Name, runtimeConfig.ContainerID)
+					err := os.MkdirAll(filepath.Dir(cacheFile), 0700)
+					Expect(err).NotTo(HaveOccurred())
+					err = ioutil.WriteFile(cacheFile, []byte("adfadsfasdfasfdsafaf"), 0600)
+					Expect(err).NotTo(HaveOccurred())
+
+					err = cniConfig.DelNetworkList(netConfigList, runtimeConfig)
+					Expect(err).To(MatchError("failed to get network 'some-list' cached result: decoding version from network config: invalid character 'a' looking for beginning of value"))
+				})
+			})
 		})
 
 	})

vendor/github.com/containernetworking/cni/libcni/backwards_compatibility_test.go

@@ -16,9 +16,11 @@ package libcni_test
 
 import (
 	"fmt"
+	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"strings"
 
 	"github.com/containernetworking/cni/libcni"
@@ -29,6 +31,18 @@ import (
 )
 
 var _ = Describe("Backwards compatibility", func() {
+	var cacheDirPath string
+
+	BeforeEach(func() {
+		var err error
+		cacheDirPath, err = ioutil.TempDir("", "cni_cachedir")
+		Expect(err).NotTo(HaveOccurred())
+	})
+
+	AfterEach(func() {
+		Expect(os.RemoveAll(cacheDirPath)).To(Succeed())
+	})
+
 	It("correctly handles the response from a legacy plugin", func() {
 		example := legacy_examples.V010
 		pluginPath, err := example.Build()
@@ -42,9 +56,10 @@ var _ = Describe("Backwards compatibility", func() {
 			ContainerID: "some-container-id",
 			NetNS:       "/some/netns/path",
 			IfName:      "eth0",
+			CacheDir:    cacheDirPath,
 		}
 
-		cniConfig := &libcni.CNIConfig{Path: []string{filepath.Dir(pluginPath)}}
+		cniConfig := libcni.NewCNIConfig([]string{filepath.Dir(pluginPath)}, nil)
 
 		result, err := cniConfig.AddNetwork(netConf, runtimeConf)
 		Expect(err).NotTo(HaveOccurred())
@@ -55,24 +70,23 @@ var _ = Describe("Backwards compatibility", func() {
 	})
 
 	It("correctly handles the request from a runtime with an older libcni", func() {
-		// We need to be root (or have CAP_SYS_ADMIN...)
-		if os.Geteuid() != 0 {
-			Fail("must be run as root")
+		if runtime.GOOS == "windows" {
+			Skip("cannot build old runtime on windows")
 		}
-
 		example := legacy_examples.V010_Runtime
 
 		binPath, err := example.Build()
 		Expect(err).NotTo(HaveOccurred())
 
 		for _, configName := range example.NetConfs {
-			configStr, ok := legacy_examples.NetConfs[configName]
-			if !ok {
-				Fail("Invalid config name " + configName)
+			conf, err := example.GenerateNetConf(configName)
+			if err != nil {
+				Fail("Failed to generate config name " + configName + ": " + err.Error())
 			}
+			defer conf.Cleanup()
 
 			cmd := exec.Command(binPath, pluginDirs...)
-			cmd.Stdin = strings.NewReader(configStr)
+			cmd.Stdin = strings.NewReader(conf.Config)
 
 			session, err := gexec.Start(cmd, GinkgoWriter, GinkgoWriter)
 			Expect(err).NotTo(HaveOccurred())

vendor/github.com/containernetworking/cni/libcni/conf.go

@@ -45,6 +45,9 @@ func ConfFromBytes(bytes []byte) (*NetworkConfig, error) {
 	if err := json.Unmarshal(bytes, &conf.Network); err != nil {
 		return nil, fmt.Errorf("error parsing configuration: %s", err)
 	}
+	if conf.Network.Type == "" {
+		return nil, fmt.Errorf("error parsing configuration: missing 'type'")
+	}
 	return conf, nil
 }
 

vendor/github.com/containernetworking/cni/libcni/conf_test.go

@@ -37,7 +37,7 @@ var _ = Describe("Loading configuration from disk", func() {
 			configDir, err = ioutil.TempDir("", "plugin-conf")
 			Expect(err).NotTo(HaveOccurred())
 
-			pluginConfig = []byte(`{ "name": "some-plugin", "some-key": "some-value" }`)
+			pluginConfig = []byte(`{ "name": "some-plugin", "type": "foobar", "some-key": "some-value" }`)
 			Expect(ioutil.WriteFile(filepath.Join(configDir, "50-whatever.conf"), pluginConfig, 0600)).To(Succeed())
 		})
 
@@ -49,8 +49,11 @@ var _ = Describe("Loading configuration from disk", func() {
 			netConfig, err := libcni.LoadConf(configDir, "some-plugin")
 			Expect(err).NotTo(HaveOccurred())
 			Expect(netConfig).To(Equal(&libcni.NetworkConfig{
-				Network: &types.NetConf{Name: "some-plugin"},
-				Bytes:   pluginConfig,
+				Network: &types.NetConf{
+					Name: "some-plugin",
+					Type: "foobar",
+				},
+				Bytes: pluginConfig,
 			}))
 		})
 
@@ -68,15 +71,18 @@ var _ = Describe("Loading configuration from disk", func() {
 		Context("when the config file is .json extension instead of .conf", func() {
 			BeforeEach(func() {
 				Expect(os.Remove(configDir + "/50-whatever.conf")).To(Succeed())
-				pluginConfig = []byte(`{ "name": "some-plugin", "some-key": "some-value" }`)
+				pluginConfig = []byte(`{ "name": "some-plugin", "some-key": "some-value", "type": "foobar" }`)
 				Expect(ioutil.WriteFile(filepath.Join(configDir, "50-whatever.json"), pluginConfig, 0600)).To(Succeed())
 			})
 			It("finds the network config file for the plugin of the given type", func() {
 				netConfig, err := libcni.LoadConf(configDir, "some-plugin")
 				Expect(err).NotTo(HaveOccurred())
 				Expect(netConfig).To(Equal(&libcni.NetworkConfig{
-					Network: &types.NetConf{Name: "some-plugin"},
-					Bytes:   pluginConfig,
+					Network: &types.NetConf{
+						Name: "some-plugin",
+						Type: "foobar",
+					},
+					Bytes: pluginConfig,
 				}))
 			})
 		})
@@ -149,6 +155,37 @@ var _ = Describe("Loading configuration from disk", func() {
 				Expect(err).To(MatchError(HavePrefix(`error reading /tmp/nope/not-here: open /tmp/nope/not-here`)))
 			})
 		})
+
+		Context("when the file is missing 'type'", func() {
+			var fileName, configDir string
+			BeforeEach(func() {
+				var err error
+				configDir, err = ioutil.TempDir("", "plugin-conf")
+				Expect(err).NotTo(HaveOccurred())
+
+				fileName = filepath.Join(configDir, "50-whatever.conf")
+				pluginConfig := []byte(`{ "name": "some-plugin", "some-key": "some-value" }`)
+				Expect(ioutil.WriteFile(fileName, pluginConfig, 0600)).To(Succeed())
+			})
+
+			AfterEach(func() {
+				Expect(os.RemoveAll(configDir)).To(Succeed())
+			})
+
+			It("returns a useful error", func() {
+				_, err := libcni.ConfFromFile(fileName)
+				Expect(err).To(MatchError(`error parsing configuration: missing 'type'`))
+			})
+		})
+	})
+
+	Describe("ConfFromBytes", func() {
+		Context("when the config is missing 'type'", func() {
+			It("returns a useful error", func() {
+				_, err := libcni.ConfFromBytes([]byte(`{ "name": "some-plugin", "some-key": "some-value" }`))
+				Expect(err).To(MatchError(`error parsing configuration: missing 'type'`))
+			})
+		})
 	})
 
 	Describe("LoadConfList", func() {
@@ -251,7 +288,7 @@ var _ = Describe("Loading configuration from disk", func() {
 		Context("when there is no config for the desired plugin list", func() {
 			It("returns a useful error", func() {
 				_, err := libcni.LoadConfList(configDir, "some-other-plugin")
-				Expect(err).To(MatchError(libcni.NotFoundError{configDir, "some-other-plugin"}))
+				Expect(err).To(MatchError(libcni.NotFoundError{Dir: configDir, Name: "some-other-plugin"}))
 			})
 		})
 
@@ -304,8 +341,8 @@ var _ = Describe("Loading configuration from disk", func() {
 		var testNetConfig *libcni.NetworkConfig
 
 		BeforeEach(func() {
-			testNetConfig = &libcni.NetworkConfig{Network: &types.NetConf{Name: "some-plugin"},
-				Bytes: []byte(`{ "name": "some-plugin" }`)}
+			testNetConfig = &libcni.NetworkConfig{Network: &types.NetConf{Name: "some-plugin", Type: "foobar"},
+				Bytes: []byte(`{ "name": "some-plugin", "type": "foobar" }`)}
 		})
 
 		Context("when function parameters are incorrect", func() {
@@ -330,18 +367,21 @@ var _ = Describe("Loading configuration from disk", func() {
 
 		Context("when new string value added", func() {
 			It("adds the new key & value to the config", func() {
-				newPluginConfig := []byte(`{"name":"some-plugin","test":"test"}`)
+				newPluginConfig := []byte(`{"name":"some-plugin","test":"test","type":"foobar"}`)
 
 				resultConfig, err := libcni.InjectConf(testNetConfig, map[string]interface{}{"test": "test"})
 				Expect(err).NotTo(HaveOccurred())
 				Expect(resultConfig).To(Equal(&libcni.NetworkConfig{
-					Network: &types.NetConf{Name: "some-plugin"},
-					Bytes:   newPluginConfig,
+					Network: &types.NetConf{
+						Name: "some-plugin",
+						Type: "foobar",
+					},
+					Bytes: newPluginConfig,
 				}))
 			})
 
 			It("adds the new value for exiting key", func() {
-				newPluginConfig := []byte(`{"name":"some-plugin","test":"changedValue"}`)
+				newPluginConfig := []byte(`{"name":"some-plugin","test":"changedValue","type":"foobar"}`)
 
 				resultConfig, err := libcni.InjectConf(testNetConfig, map[string]interface{}{"test": "test"})
 				Expect(err).NotTo(HaveOccurred())
@@ -350,13 +390,16 @@ var _ = Describe("Loading configuration from disk", func() {
 				Expect(err).NotTo(HaveOccurred())
 
 				Expect(resultConfig).To(Equal(&libcni.NetworkConfig{
-					Network: &types.NetConf{Name: "some-plugin"},
-					Bytes:   newPluginConfig,
+					Network: &types.NetConf{
+						Name: "some-plugin",
+						Type: "foobar",
+					},
+					Bytes: newPluginConfig,
 				}))
 			})
 
 			It("adds existing key & value", func() {
-				newPluginConfig := []byte(`{"name":"some-plugin","test":"test"}`)
+				newPluginConfig := []byte(`{"name":"some-plugin","test":"test","type":"foobar"}`)
 
 				resultConfig, err := libcni.InjectConf(testNetConfig, map[string]interface{}{"test": "test"})
 				Expect(err).NotTo(HaveOccurred())
@@ -365,8 +408,11 @@ var _ = Describe("Loading configuration from disk", func() {
 				Expect(err).NotTo(HaveOccurred())
 
 				Expect(resultConfig).To(Equal(&libcni.NetworkConfig{
-					Network: &types.NetConf{Name: "some-plugin"},
-					Bytes:   newPluginConfig,
+					Network: &types.NetConf{
+						Name: "some-plugin",
+						Type: "foobar",
+					},
+					Bytes: newPluginConfig,
 				}))
 			})
 
@@ -397,7 +443,7 @@ var _ = Describe("ConfListFromConf", func() {
 	var testNetConfig *libcni.NetworkConfig
 
 	BeforeEach(func() {
-		pb := []byte(`{"name":"some-plugin","cniVersion":"0.3.1" }`)
+		pb := []byte(`{"name":"some-plugin","cniVersion":"0.3.1", "type":"foobar"}`)
 		tc, err := libcni.ConfFromBytes(pb)
 		Expect(err).NotTo(HaveOccurred())
 		testNetConfig = tc

vendor/github.com/containernetworking/cni/libcni/libcni_suite_test.go

@@ -15,9 +15,8 @@
 package libcni_test
 
 import (
-	"fmt"
+	"encoding/json"
 	"path/filepath"
-	"strings"
 
 	. "github.com/onsi/ginkgo"
 	. "github.com/onsi/gomega"
@@ -31,34 +30,29 @@ func TestLibcni(t *testing.T) {
 	RunSpecs(t, "Libcni Suite")
 }
 
-var plugins = map[string]string{
-	"noop":       "github.com/containernetworking/cni/plugins/test/noop",
-	"ptp":        "github.com/containernetworking/cni/plugins/main/ptp",
-	"host-local": "github.com/containernetworking/cni/plugins/ipam/host-local",
+var pluginPackages = map[string]string{
+	"noop": "github.com/containernetworking/cni/plugins/test/noop",
 }
 
 var pluginPaths map[string]string
 var pluginDirs []string // array of plugin dirs
 
 var _ = SynchronizedBeforeSuite(func() []byte {
-	dirs := make([]string, 0, len(plugins))
 
-	for name, packagePath := range plugins {
+	paths := map[string]string{}
+	for name, packagePath := range pluginPackages {
 		execPath, err := gexec.Build(packagePath)
 		Expect(err).NotTo(HaveOccurred())
-		dirs = append(dirs, fmt.Sprintf("%s=%s", name, execPath))
+		paths[name] = execPath
 	}
+	crossNodeData, err := json.Marshal(paths)
+	Expect(err).NotTo(HaveOccurred())
 
-	return []byte(strings.Join(dirs, ":"))
+	return crossNodeData
 }, func(crossNodeData []byte) {
-	pluginPaths = make(map[string]string)
-	for _, str := range strings.Split(string(crossNodeData), ":") {
-		kvs := strings.SplitN(str, "=", 2)
-		if len(kvs) != 2 {
-			Fail("Invalid inter-node data...")
-		}
-		pluginPaths[kvs[0]] = kvs[1]
-		pluginDirs = append(pluginDirs, filepath.Dir(kvs[1]))
+	Expect(json.Unmarshal(crossNodeData, &pluginPaths)).To(Succeed())
+	for _, pluginPath := range pluginPaths {
+		pluginDirs = append(pluginDirs, filepath.Dir(pluginPath))
 	}
 })
 

vendor/github.com/containernetworking/cni/pkg/invoke/args.go

@@ -57,13 +57,16 @@ func (args *Args) AsEnv() []string {
 		pluginArgsStr = stringify(args.PluginArgs)
 	}
 
-	env = append(env,
-		"CNI_COMMAND="+args.Command,
-		"CNI_CONTAINERID="+args.ContainerID,
-		"CNI_NETNS="+args.NetNS,
-		"CNI_ARGS="+pluginArgsStr,
-		"CNI_IFNAME="+args.IfName,
-		"CNI_PATH="+args.Path)
+	// Ensure that the custom values are first, so any value present in
+	// the process environment won't override them.
+	env = append([]string{
+		"CNI_COMMAND=" + args.Command,
+		"CNI_CONTAINERID=" + args.ContainerID,
+		"CNI_NETNS=" + args.NetNS,
+		"CNI_ARGS=" + pluginArgsStr,
+		"CNI_IFNAME=" + args.IfName,
+		"CNI_PATH=" + args.Path,
+	}, env...)
 	return env
 }
 

vendor/github.com/containernetworking/cni/pkg/invoke/args_test.go

@@ -0,0 +1,60 @@
+// Copyright 2017 CNI authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package invoke_test
+
+import (
+	"os"
+
+	"github.com/containernetworking/cni/pkg/invoke"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+var _ = Describe("Args", func() {
+	Describe("AsEnv", func() {
+		It("places the CNI_ environment variables ahead of any ambient variables", func() {
+			args := invoke.Args{
+				Command:     "ADD",
+				ContainerID: "some-container-id",
+				NetNS:       "/some/netns/path",
+				PluginArgs: [][2]string{
+					{"KEY1", "VALUE1"},
+					{"KEY2", "VALUE2"},
+				},
+				IfName: "eth7",
+				Path:   "/some/cni/path",
+			}
+			const numCNIEnvVars = 6
+
+			latentVars := os.Environ()
+
+			cniEnv := args.AsEnv()
+			Expect(cniEnv).To(HaveLen(len(latentVars) + numCNIEnvVars))
+			Expect(cniEnv[0:numCNIEnvVars]).To(Equal([]string{
+				"CNI_COMMAND=ADD",
+				"CNI_CONTAINERID=some-container-id",
+				"CNI_NETNS=/some/netns/path",
+				"CNI_ARGS=KEY1=VALUE1;KEY2=VALUE2",
+				"CNI_IFNAME=eth7",
+				"CNI_PATH=/some/cni/path",
+			}))
+
+			for i := range latentVars {
+				Expect(cniEnv[numCNIEnvVars+i]).To(Equal(latentVars[i]))
+			}
+		})
+	})
+})

vendor/github.com/containernetworking/cni/pkg/invoke/delegate.go

@@ -22,32 +22,54 @@ import (
 	"github.com/containernetworking/cni/pkg/types"
 )
 
-func DelegateAdd(delegatePlugin string, netconf []byte) (types.Result, error) {
-	if os.Getenv("CNI_COMMAND") != "ADD" {
-		return nil, fmt.Errorf("CNI_COMMAND is not ADD")
+func delegateAddOrGet(command, delegatePlugin string, netconf []byte, exec Exec) (types.Result, error) {
+	if exec == nil {
+		exec = defaultExec
 	}
 
 	paths := filepath.SplitList(os.Getenv("CNI_PATH"))
-
-	pluginPath, err := FindInPath(delegatePlugin, paths)
+	pluginPath, err := exec.FindInPath(delegatePlugin, paths)
 	if err != nil {
 		return nil, err
 	}
 
-	return ExecPluginWithResult(pluginPath, netconf, ArgsFromEnv())
+	return ExecPluginWithResult(pluginPath, netconf, ArgsFromEnv(), exec)
 }
 
-func DelegateDel(delegatePlugin string, netconf []byte) error {
+// DelegateAdd calls the given delegate plugin with the CNI ADD action and
+// JSON configuration
+func DelegateAdd(delegatePlugin string, netconf []byte, exec Exec) (types.Result, error) {
+	if os.Getenv("CNI_COMMAND") != "ADD" {
+		return nil, fmt.Errorf("CNI_COMMAND is not ADD")
+	}
+	return delegateAddOrGet("ADD", delegatePlugin, netconf, exec)
+}
+
+// DelegateGet calls the given delegate plugin with the CNI GET action and
+// JSON configuration
+func DelegateGet(delegatePlugin string, netconf []byte, exec Exec) (types.Result, error) {
+	if os.Getenv("CNI_COMMAND") != "GET" {
+		return nil, fmt.Errorf("CNI_COMMAND is not GET")
+	}
+	return delegateAddOrGet("GET", delegatePlugin, netconf, exec)
+}
+
+// DelegateDel calls the given delegate plugin with the CNI DEL action and
+// JSON configuration
+func DelegateDel(delegatePlugin string, netconf []byte, exec Exec) error {
+	if exec == nil {
+		exec = defaultExec
+	}
+
 	if os.Getenv("CNI_COMMAND") != "DEL" {
 		return fmt.Errorf("CNI_COMMAND is not DEL")
 	}
 
 	paths := filepath.SplitList(os.Getenv("CNI_PATH"))
-
-	pluginPath, err := FindInPath(delegatePlugin, paths)
+	pluginPath, err := exec.FindInPath(delegatePlugin, paths)
 	if err != nil {
 		return err
 	}
 
-	return ExecPluginWithoutResult(pluginPath, netconf, ArgsFromEnv())
+	return ExecPluginWithoutResult(pluginPath, netconf, ArgsFromEnv(), exec)
 }

vendor/github.com/containernetworking/cni/pkg/invoke/delegate_test.go

@@ -0,0 +1,201 @@
+// Copyright 2017 CNI authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package invoke_test
+
+import (
+	"encoding/json"
+	"io/ioutil"
+	"net"
+	"os"
+	"path/filepath"
+
+	"github.com/containernetworking/cni/pkg/invoke"
+	"github.com/containernetworking/cni/pkg/types/current"
+	"github.com/containernetworking/cni/plugins/test/noop/debug"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/gomega"
+)
+
+var _ = Describe("Delegate", func() {
+	var (
+		pluginName     string
+		netConf        []byte
+		debugFileName  string
+		debugBehavior  *debug.Debug
+		expectedResult *current.Result
+	)
+
+	BeforeEach(func() {
+		netConf, _ = json.Marshal(map[string]string{
+			"name":       "delegate-test",
+			"cniVersion": "0.4.0",
+		})
+
+		expectedResult = &current.Result{
+			CNIVersion: "0.4.0",
+			IPs: []*current.IPConfig{
+				{
+					Version: "4",
+					Address: net.IPNet{
+						IP:   net.ParseIP("10.1.2.3"),
+						Mask: net.CIDRMask(24, 32),
+					},
+				},
+			},
+		}
+		expectedResultBytes, _ := json.Marshal(expectedResult)
+
+		debugFile, err := ioutil.TempFile("", "cni_debug")
+		Expect(err).NotTo(HaveOccurred())
+		Expect(debugFile.Close()).To(Succeed())
+		debugFileName = debugFile.Name()
+		debugBehavior = &debug.Debug{
+			ReportResult: string(expectedResultBytes),
+		}
+		Expect(debugBehavior.WriteDebug(debugFileName)).To(Succeed())
+		pluginName = "noop"
+
+		os.Setenv("CNI_ARGS", "DEBUG="+debugFileName)
+		os.Setenv("CNI_PATH", filepath.Dir(pathToPlugin))
+		os.Setenv("CNI_NETNS", "/tmp/some/netns/path")
+		os.Setenv("CNI_IFNAME", "eth7")
+		os.Setenv("CNI_CONTAINERID", "container")
+	})
+
+	AfterEach(func() {
+		os.RemoveAll(debugFileName)
+
+		for _, k := range []string{"CNI_COMMAND", "CNI_ARGS", "CNI_PATH", "CNI_NETNS", "CNI_IFNAME"} {
+			os.Unsetenv(k)
+		}
+	})
+
+	Describe("DelegateAdd", func() {
+		BeforeEach(func() {
+			os.Setenv("CNI_COMMAND", "ADD")
+		})
+
+		It("finds and execs the named plugin", func() {
+			result, err := invoke.DelegateAdd(pluginName, netConf, nil)
+			Expect(err).NotTo(HaveOccurred())
+			Expect(result).To(Equal(expectedResult))
+
+			pluginInvocation, err := debug.ReadDebug(debugFileName)
+			Expect(err).NotTo(HaveOccurred())
+			Expect(pluginInvocation.Command).To(Equal("ADD"))
+			Expect(pluginInvocation.CmdArgs.IfName).To(Equal("eth7"))
+		})
+
+		Context("if the delegation isn't part of an existing ADD command", func() {
+			BeforeEach(func() {
+				os.Setenv("CNI_COMMAND", "NOPE")
+			})
+
+			It("aborts and returns a useful error", func() {
+				_, err := invoke.DelegateAdd(pluginName, netConf, nil)
+				Expect(err).To(MatchError("CNI_COMMAND is not ADD"))
+			})
+		})
+
+		Context("when the plugin cannot be found", func() {
+			BeforeEach(func() {
+				pluginName = "non-existent-plugin"
+			})
+
+			It("returns a useful error", func() {
+				_, err := invoke.DelegateAdd(pluginName, netConf, nil)
+				Expect(err).To(MatchError(HavePrefix("failed to find plugin")))
+			})
+		})
+	})
+
+	Describe("DelegateGet", func() {
+		BeforeEach(func() {
+			os.Setenv("CNI_COMMAND", "GET")
+		})
+
+		It("finds and execs the named plugin", func() {
+			result, err := invoke.DelegateGet(pluginName, netConf, nil)
+			Expect(err).NotTo(HaveOccurred())
+			Expect(result).To(Equal(expectedResult))
+
+			pluginInvocation, err := debug.ReadDebug(debugFileName)
+			Expect(err).NotTo(HaveOccurred())
+			Expect(pluginInvocation.Command).To(Equal("GET"))
+			Expect(pluginInvocation.CmdArgs.IfName).To(Equal("eth7"))
+		})
+
+		Context("if the delegation isn't part of an existing GET command", func() {
+			BeforeEach(func() {
+				os.Setenv("CNI_COMMAND", "NOPE")
+			})
+
+			It("aborts and returns a useful error", func() {
+				_, err := invoke.DelegateGet(pluginName, netConf, nil)
+				Expect(err).To(MatchError("CNI_COMMAND is not GET"))
+			})
+		})
+
+		Context("when the plugin cannot be found", func() {
+			BeforeEach(func() {
+				pluginName = "non-existent-plugin"
+			})
+
+			It("returns a useful error", func() {
+				_, err := invoke.DelegateGet(pluginName, netConf, nil)
+				Expect(err).To(MatchError(HavePrefix("failed to find plugin")))
+			})
+		})
+	})
+
+	Describe("DelegateDel", func() {
+		BeforeEach(func() {
+			os.Setenv("CNI_COMMAND", "DEL")
+		})
+
+		It("finds and execs the named plugin", func() {
+			err := invoke.DelegateDel(pluginName, netConf, nil)
+			Expect(err).NotTo(HaveOccurred())
+
+			pluginInvocation, err := debug.ReadDebug(debugFileName)
+			Expect(err).NotTo(HaveOccurred())
+			Expect(pluginInvocation.Command).To(Equal("DEL"))
+			Expect(pluginInvocation.CmdArgs.IfName).To(Equal("eth7"))
+		})
+
+		Context("if the delegation isn't part of an existing DEL command", func() {
+			BeforeEach(func() {
+				os.Setenv("CNI_COMMAND", "NOPE")
+			})
+
+			It("aborts and returns a useful error", func() {
+				err := invoke.DelegateDel(pluginName, netConf, nil)
+				Expect(err).To(MatchError("CNI_COMMAND is not DEL"))
+			})
+		})
+
+		Context("when the plugin cannot be found", func() {
+			BeforeEach(func() {
+				pluginName = "non-existent-plugin"
+			})
+
+			It("returns a useful error", func() {
+				err := invoke.DelegateDel(pluginName, netConf, nil)
+				Expect(err).To(MatchError(HavePrefix("failed to find plugin")))
+			})
+		})
+	})
+})

vendor/github.com/containernetworking/cni/pkg/invoke/exec.go

@@ -22,34 +22,62 @@ import (
 	"github.com/containernetworking/cni/pkg/version"
 )
 
-func ExecPluginWithResult(pluginPath string, netconf []byte, args CNIArgs) (types.Result, error) {
-	return defaultPluginExec.WithResult(pluginPath, netconf, args)
+// Exec is an interface encapsulates all operations that deal with finding
+// and executing a CNI plugin. Tests may provide a fake implementation
+// to avoid writing fake plugins to temporary directories during the test.
+type Exec interface {
+	ExecPlugin(pluginPath string, stdinData []byte, environ []string) ([]byte, error)
+	FindInPath(plugin string, paths []string) (string, error)
+	Decode(jsonBytes []byte) (version.PluginInfo, error)
 }
 
-func ExecPluginWithoutResult(pluginPath string, netconf []byte, args CNIArgs) error {
-	return defaultPluginExec.WithoutResult(pluginPath, netconf, args)
-}
+// For example, a testcase could pass an instance of the following fakeExec
+// object to ExecPluginWithResult() to verify the incoming stdin and environment
+// and provide a tailored response:
+//
+//import (
+//	"encoding/json"
+//	"path"
+//	"strings"
+//)
+//
+//type fakeExec struct {
+//	version.PluginDecoder
+//}
+//
+//func (f *fakeExec) ExecPlugin(pluginPath string, stdinData []byte, environ []string) ([]byte, error) {
+//	net := &types.NetConf{}
+//	err := json.Unmarshal(stdinData, net)
+//	if err != nil {
+//		return nil, fmt.Errorf("failed to unmarshal configuration: %v", err)
+//	}
+//	pluginName := path.Base(pluginPath)
+//	if pluginName != net.Type {
+//		return nil, fmt.Errorf("plugin name %q did not match config type %q", pluginName, net.Type)
+//	}
+//	for _, e := range environ {
+//		// Check environment for forced failure request
+//		parts := strings.Split(e, "=")
+//		if len(parts) > 0 && parts[0] == "FAIL" {
+//			return nil, fmt.Errorf("failed to execute plugin %s", pluginName)
+//		}
+//	}
+//	return []byte("{\"CNIVersion\":\"0.4.0\"}"), nil
+//}
+//
+//func (f *fakeExec) FindInPath(plugin string, paths []string) (string, error) {
+//	if len(paths) > 0 {
+//		return path.Join(paths[0], plugin), nil
+//	}
+//	return "", fmt.Errorf("failed to find plugin %s in paths %v", plugin, paths)
+//}
 
-func GetVersionInfo(pluginPath string) (version.PluginInfo, error) {
-	return defaultPluginExec.GetVersionInfo(pluginPath)
-}
-
-var defaultPluginExec = &PluginExec{
-	RawExec:        &RawExec{Stderr: os.Stderr},
-	VersionDecoder: &version.PluginDecoder{},
-}
-
-type PluginExec struct {
-	RawExec interface {
-		ExecPlugin(pluginPath string, stdinData []byte, environ []string) ([]byte, error)
+func ExecPluginWithResult(pluginPath string, netconf []byte, args CNIArgs, exec Exec) (types.Result, error) {
+	if exec == nil {
+		exec = defaultExec
 	}
-	VersionDecoder interface {
-		Decode(jsonBytes []byte) (version.PluginInfo, error)
-	}
-}
 
-func (e *PluginExec) WithResult(pluginPath string, netconf []byte, args CNIArgs) (types.Result, error) {
-	stdoutBytes, err := e.RawExec.ExecPlugin(pluginPath, netconf, args.AsEnv())
+	stdoutBytes, err := exec.ExecPlugin(pluginPath, netconf, args.AsEnv())
 	if err != nil {
 		return nil, err
 	}
@@ -64,8 +92,11 @@ func (e *PluginExec) WithResult(pluginPath string, netconf []byte, args CNIArgs)
 	return version.NewResult(confVersion, stdoutBytes)
 }
 
-func (e *PluginExec) WithoutResult(pluginPath string, netconf []byte, args CNIArgs) error {
-	_, err := e.RawExec.ExecPlugin(pluginPath, netconf, args.AsEnv())
+func ExecPluginWithoutResult(pluginPath string, netconf []byte, args CNIArgs, exec Exec) error {
+	if exec == nil {
+		exec = defaultExec
+	}
+	_, err := exec.ExecPlugin(pluginPath, netconf, args.AsEnv())
 	return err
 }
 
@@ -73,7 +104,10 @@ func (e *PluginExec) WithoutResult(pluginPath string, netconf []byte, args CNIAr
 // For recent-enough plugins, it uses the information returned by the VERSION
 // command.  For older plugins which do not recognize that command, it reports
 // version 0.1.0
-func (e *PluginExec) GetVersionInfo(pluginPath string) (version.PluginInfo, error) {
+func GetVersionInfo(pluginPath string, exec Exec) (version.PluginInfo, error) {
+	if exec == nil {
+		exec = defaultExec
+	}
 	args := &Args{
 		Command: "VERSION",
 
@@ -83,7 +117,7 @@ func (e *PluginExec) GetVersionInfo(pluginPath string) (version.PluginInfo, erro
 		Path:   "dummy",
 	}
 	stdin := []byte(fmt.Sprintf(`{"cniVersion":%q}`, version.Current()))
-	stdoutBytes, err := e.RawExec.ExecPlugin(pluginPath, stdin, args.AsEnv())
+	stdoutBytes, err := exec.ExecPlugin(pluginPath, stdin, args.AsEnv())
 	if err != nil {
 		if err.Error() == "unknown CNI_COMMAND: VERSION" {
 			return version.PluginSupports("0.1.0"), nil
@@ -91,5 +125,19 @@ func (e *PluginExec) GetVersionInfo(pluginPath string) (version.PluginInfo, erro
 		return nil, err
 	}
 
-	return e.VersionDecoder.Decode(stdoutBytes)
+	return exec.Decode(stdoutBytes)
+}
+
+// DefaultExec is an object that implements the Exec interface which looks
+// for and executes plugins from disk.
+type DefaultExec struct {
+	*RawExec
+	version.PluginDecoder
+}
+
+// DefaultExec implements the Exec interface
+var _ Exec = &DefaultExec{}
+
+var defaultExec = &DefaultExec{
+	RawExec: &RawExec{Stderr: os.Stderr},
 }

vendor/github.com/containernetworking/cni/pkg/invoke/exec_test.go

@@ -29,7 +29,7 @@ import (
 
 var _ = Describe("Executing a plugin, unit tests", func() {
 	var (
-		pluginExec     *invoke.PluginExec
+		pluginExec     invoke.Exec
 		rawExec        *fakes.RawExec
 		versionDecoder *fakes.VersionDecoder
 
@@ -45,7 +45,10 @@ var _ = Describe("Executing a plugin, unit tests", func() {
 		versionDecoder = &fakes.VersionDecoder{}
 		versionDecoder.DecodeCall.Returns.PluginInfo = version.PluginSupports("0.42.0")
 
-		pluginExec = &invoke.PluginExec{
+		pluginExec = &struct {
+			*fakes.RawExec
+			*fakes.VersionDecoder
+		}{
 			RawExec:        rawExec,
 			VersionDecoder: versionDecoder,
 		}
@@ -57,7 +60,7 @@ var _ = Describe("Executing a plugin, unit tests", func() {
 
 	Describe("returning a result", func() {
 		It("unmarshals the result bytes into the Result type", func() {
-			r, err := pluginExec.WithResult(pluginPath, netconf, cniargs)
+			r, err := invoke.ExecPluginWithResult(pluginPath, netconf, cniargs, pluginExec)
 			Expect(err).NotTo(HaveOccurred())
 
 			result, err := current.GetResult(r)
@@ -67,7 +70,7 @@ var _ = Describe("Executing a plugin, unit tests", func() {
 		})
 
 		It("passes its arguments through to the rawExec", func() {
-			pluginExec.WithResult(pluginPath, netconf, cniargs)
+			invoke.ExecPluginWithResult(pluginPath, netconf, cniargs, pluginExec)
 			Expect(rawExec.ExecPluginCall.Received.PluginPath).To(Equal(pluginPath))
 			Expect(rawExec.ExecPluginCall.Received.StdinData).To(Equal(netconf))
 			Expect(rawExec.ExecPluginCall.Received.Environ).To(Equal([]string{"SOME=ENV"}))
@@ -78,15 +81,23 @@ var _ = Describe("Executing a plugin, unit tests", func() {
 				rawExec.ExecPluginCall.Returns.Error = errors.New("banana")
 			})
 			It("returns the error", func() {
-				_, err := pluginExec.WithResult(pluginPath, netconf, cniargs)
+				_, err := invoke.ExecPluginWithResult(pluginPath, netconf, cniargs, pluginExec)
 				Expect(err).To(MatchError("banana"))
 			})
 		})
+
+		It("returns an error using the default exec interface", func() {
+			// pluginPath should not exist on-disk so we expect an error.
+			// This test simply tests that the default exec handler
+			// is run when the exec interface is nil.
+			_, err := invoke.ExecPluginWithResult(pluginPath, netconf, cniargs, nil)
+			Expect(err).To(HaveOccurred())
+		})
 	})
 
 	Describe("without returning a result", func() {
 		It("passes its arguments through to the rawExec", func() {
-			pluginExec.WithoutResult(pluginPath, netconf, cniargs)
+			invoke.ExecPluginWithoutResult(pluginPath, netconf, cniargs, pluginExec)
 			Expect(rawExec.ExecPluginCall.Received.PluginPath).To(Equal(pluginPath))
 			Expect(rawExec.ExecPluginCall.Received.StdinData).To(Equal(netconf))
 			Expect(rawExec.ExecPluginCall.Received.Environ).To(Equal([]string{"SOME=ENV"}))
@@ -97,10 +108,18 @@ var _ = Describe("Executing a plugin, unit tests", func() {
 				rawExec.ExecPluginCall.Returns.Error = errors.New("banana")
 			})
 			It("returns the error", func() {
-				err := pluginExec.WithoutResult(pluginPath, netconf, cniargs)
+				err := invoke.ExecPluginWithoutResult(pluginPath, netconf, cniargs, pluginExec)
 				Expect(err).To(MatchError("banana"))
 			})
 		})
+
+		It("returns an error using the default exec interface", func() {
+			// pluginPath should not exist on-disk so we expect an error.
+			// This test simply tests that the default exec handler
+			// is run when the exec interface is nil.
+			err := invoke.ExecPluginWithoutResult(pluginPath, netconf, cniargs, nil)
+			Expect(err).To(HaveOccurred())
+		})
 	})
 
 	Describe("discovering the plugin version", func() {
@@ -109,7 +128,7 @@ var _ = Describe("Executing a plugin, unit tests", func() {
 		})
 
 		It("execs the plugin with the command VERSION", func() {
-			pluginExec.GetVersionInfo(pluginPath)
+			invoke.GetVersionInfo(pluginPath, pluginExec)
 			Expect(rawExec.ExecPluginCall.Received.PluginPath).To(Equal(pluginPath))
 			Expect(rawExec.ExecPluginCall.Received.Environ).To(ContainElement("CNI_COMMAND=VERSION"))
 			expectedStdin, _ := json.Marshal(map[string]string{"cniVersion": version.Current()})
@@ -117,7 +136,7 @@ var _ = Describe("Executing a plugin, unit tests", func() {
 		})
 
 		It("decodes and returns the version info", func() {
-			versionInfo, err := pluginExec.GetVersionInfo(pluginPath)
+			versionInfo, err := invoke.GetVersionInfo(pluginPath, pluginExec)
 			Expect(err).NotTo(HaveOccurred())
 			Expect(versionInfo.SupportedVersions()).To(Equal([]string{"0.42.0"}))
 			Expect(versionDecoder.DecodeCall.Received.JSONBytes).To(MatchJSON(`{ "some": "version-info" }`))
@@ -128,7 +147,7 @@ var _ = Describe("Executing a plugin, unit tests", func() {
 				rawExec.ExecPluginCall.Returns.Error = errors.New("banana")
 			})
 			It("returns the error", func() {
-				_, err := pluginExec.GetVersionInfo(pluginPath)
+				_, err := invoke.GetVersionInfo(pluginPath, pluginExec)
 				Expect(err).To(MatchError("banana"))
 			})
 		})
@@ -139,13 +158,13 @@ var _ = Describe("Executing a plugin, unit tests", func() {
 			})
 
 			It("interprets the error as a 0.1.0 version", func() {
-				versionInfo, err := pluginExec.GetVersionInfo(pluginPath)
+				versionInfo, err := invoke.GetVersionInfo(pluginPath, pluginExec)
 				Expect(err).NotTo(HaveOccurred())
 				Expect(versionInfo.SupportedVersions()).To(ConsistOf("0.1.0"))
 			})
 
 			It("sets dummy values for env vars required by very old plugins", func() {
-				pluginExec.GetVersionInfo(pluginPath)
+				invoke.GetVersionInfo(pluginPath, pluginExec)
 
 				env := rawExec.ExecPluginCall.Received.Environ
 				Expect(env).To(ContainElement("CNI_NETNS=dummy"))

vendor/github.com/containernetworking/cni/pkg/invoke/fakes/raw_exec.go

@@ -26,6 +26,16 @@ type RawExec struct {
 			Error       error
 		}
 	}
+	FindInPathCall struct {
+		Received struct {
+			Plugin string
+			Paths  []string
+		}
+		Returns struct {
+			Path  string
+			Error error
+		}
+	}
 }
 
 func (e *RawExec) ExecPlugin(pluginPath string, stdinData []byte, environ []string) ([]byte, error) {
@@ -34,3 +44,9 @@ func (e *RawExec) ExecPlugin(pluginPath string, stdinData []byte, environ []stri
 	e.ExecPluginCall.Received.Environ = environ
 	return e.ExecPluginCall.Returns.ResultBytes, e.ExecPluginCall.Returns.Error
 }
+
+func (e *RawExec) FindInPath(plugin string, paths []string) (string, error) {
+	e.FindInPathCall.Received.Plugin = plugin
+	e.FindInPathCall.Received.Paths = paths
+	return e.FindInPathCall.Returns.Path, e.FindInPathCall.Returns.Error
+}

vendor/github.com/containernetworking/cni/pkg/invoke/get_version_integration_test.go

@@ -18,6 +18,7 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"runtime"
 
 	"github.com/containernetworking/cni/pkg/invoke"
 	"github.com/containernetworking/cni/pkg/version"
@@ -38,6 +39,9 @@ var _ = Describe("GetVersion, integration tests", func() {
 		pluginDir, err := ioutil.TempDir("", "plugins")
 		Expect(err).NotTo(HaveOccurred())
 		pluginPath = filepath.Join(pluginDir, "test-plugin")
+		if runtime.GOOS == "windows" {
+			pluginPath += ".exe"
+		}
 	})
 
 	AfterEach(func() {
@@ -47,7 +51,7 @@ var _ = Describe("GetVersion, integration tests", func() {
 	DescribeTable("correctly reporting plugin versions",
 		func(gitRef string, pluginSource string, expectedVersions version.PluginInfo) {
 			Expect(testhelpers.BuildAt([]byte(pluginSource), gitRef, pluginPath)).To(Succeed())
-			versionInfo, err := invoke.GetVersionInfo(pluginPath)
+			versionInfo, err := invoke.GetVersionInfo(pluginPath, nil)
 			Expect(err).NotTo(HaveOccurred())
 
 			Expect(versionInfo.SupportedVersions()).To(ConsistOf(expectedVersions.SupportedVersions()))
@@ -68,15 +72,36 @@ var _ = Describe("GetVersion, integration tests", func() {
 			version.PluginSupports("0.2.0", "0.999.0"),
 		),
 
+		Entry("historical: before GET was introduced",
+			git_ref_v031, plugin_source_v020_custom_versions,
+			version.PluginSupports("0.2.0", "0.999.0"),
+		),
+
 		// this entry tracks the current behavior.  Before you change it, ensure
 		// that its previous behavior is captured in the most recent "historical" entry
 		Entry("current",
-			"HEAD", plugin_source_v020_custom_versions,
-			version.PluginSupports("0.2.0", "0.999.0"),
+			"HEAD", plugin_source_v040_get,
+			version.PluginSupports("0.2.0", "0.4.0", "0.999.0"),
 		),
 	)
 })
 
+// A 0.4.0 plugin that supports GET
+const plugin_source_v040_get = `package main
+
+import (
+	"github.com/containernetworking/cni/pkg/skel"
+	"github.com/containernetworking/cni/pkg/version"
+	"fmt"
+)
+
+func c(_ *skel.CmdArgs) error { fmt.Println("{}"); return nil }
+
+func main() { skel.PluginMain(c, c, c, version.PluginSupports("0.2.0", "0.4.0", "0.999.0"), "") }
+`
+
+const git_ref_v031 = "909fe7d"
+
 // a 0.2.0 plugin that can report its own versions
 const plugin_source_v020_custom_versions = `package main
 

vendor/github.com/containernetworking/cni/pkg/invoke/raw_exec.go

@@ -50,14 +50,14 @@ func pluginErr(err error, output []byte) error {
 	if _, ok := err.(*exec.ExitError); ok {
 		emsg := types.Error{}
 		if perr := json.Unmarshal(output, &emsg); perr != nil {
-			return fmt.Errorf("netplugin failed but error parsing its diagnostic message %q: %v", string(output), perr)
+			emsg.Msg = fmt.Sprintf("netplugin failed but error parsing its diagnostic message %q: %v", string(output), perr)
 		}
-		details := ""
-		if emsg.Details != "" {
-			details = fmt.Sprintf("; %v", emsg.Details)
-		}
-		return fmt.Errorf("%v%v", emsg.Msg, details)
+		return &emsg
 	}
 
 	return err
 }
+
+func (e *RawExec) FindInPath(plugin string, paths []string) (string, error) {
+	return FindInPath(plugin, paths)
+}

vendor/github.com/containernetworking/cni/pkg/invoke/raw_exec_test.go

@@ -58,7 +58,7 @@ var _ = Describe("RawExec", func() {
 			"CNI_PATH=/some/bin/path",
 			"CNI_IFNAME=some-eth0",
 		}
-		stdin = []byte(`{"some":"stdin-json", "cniVersion": "0.3.1"}`)
+		stdin = []byte(`{"name": "raw-exec-test", "some":"stdin-json", "cniVersion": "0.3.1"}`)
 		execer = &invoke.RawExec{}
 	})
 

vendor/github.com/containernetworking/cni/pkg/ip/ipforward.go

@@ -1,31 +0,0 @@
-// Copyright 2015 CNI authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ip
-
-import (
-	"io/ioutil"
-)
-
-func EnableIP4Forward() error {
-	return echo1("/proc/sys/net/ipv4/ip_forward")
-}
-
-func EnableIP6Forward() error {
-	return echo1("/proc/sys/net/ipv6/conf/all/forwarding")
-}
-
-func echo1(f string) error {
-	return ioutil.WriteFile(f, []byte("1"), 0644)
-}

vendor/github.com/containernetworking/cni/pkg/ip/ipmasq.go

@@ -1,66 +0,0 @@
-// Copyright 2015 CNI authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ip
-
-import (
-	"fmt"
-	"net"
-
-	"github.com/coreos/go-iptables/iptables"
-)
-
-// SetupIPMasq installs iptables rules to masquerade traffic
-// coming from ipn and going outside of it
-func SetupIPMasq(ipn *net.IPNet, chain string, comment string) error {
-	ipt, err := iptables.New()
-	if err != nil {
-		return fmt.Errorf("failed to locate iptables: %v", err)
-	}
-
-	if err = ipt.NewChain("nat", chain); err != nil {
-		if err.(*iptables.Error).ExitStatus() != 1 {
-			// TODO(eyakubovich): assumes exit status 1 implies chain exists
-			return err
-		}
-	}
-
-	if err = ipt.AppendUnique("nat", chain, "-d", ipn.String(), "-j", "ACCEPT", "-m", "comment", "--comment", comment); err != nil {
-		return err
-	}
-
-	if err = ipt.AppendUnique("nat", chain, "!", "-d", "224.0.0.0/4", "-j", "MASQUERADE", "-m", "comment", "--comment", comment); err != nil {
-		return err
-	}
-
-	return ipt.AppendUnique("nat", "POSTROUTING", "-s", ipn.String(), "-j", chain, "-m", "comment", "--comment", comment)
-}
-
-// TeardownIPMasq undoes the effects of SetupIPMasq
-func TeardownIPMasq(ipn *net.IPNet, chain string, comment string) error {
-	ipt, err := iptables.New()
-	if err != nil {
-		return fmt.Errorf("failed to locate iptables: %v", err)
-	}
-
-	if err = ipt.Delete("nat", "POSTROUTING", "-s", ipn.String(), "-j", chain, "-m", "comment", "--comment", comment); err != nil {
-		return err
-	}
-
-	if err = ipt.ClearChain("nat", chain); err != nil {
-		return err
-	}
-
-	return ipt.DeleteChain("nat", chain)
-}

vendor/github.com/containernetworking/cni/pkg/ip/link.go

@@ -1,219 +0,0 @@
-// Copyright 2015 CNI authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ip
-
-import (
-	"crypto/rand"
-	"errors"
-	"fmt"
-	"net"
-	"os"
-
-	"github.com/containernetworking/cni/pkg/ns"
-	"github.com/containernetworking/cni/pkg/utils/hwaddr"
-	"github.com/vishvananda/netlink"
-)
-
-var (
-	ErrLinkNotFound = errors.New("link not found")
-)
-
-func makeVethPair(name, peer string, mtu int) (netlink.Link, error) {
-	veth := &netlink.Veth{
-		LinkAttrs: netlink.LinkAttrs{
-			Name:  name,
-			Flags: net.FlagUp,
-			MTU:   mtu,
-		},
-		PeerName: peer,
-	}
-	if err := netlink.LinkAdd(veth); err != nil {
-		return nil, err
-	}
-
-	return veth, nil
-}
-
-func peerExists(name string) bool {
-	if _, err := netlink.LinkByName(name); err != nil {
-		return false
-	}
-	return true
-}
-
-func makeVeth(name string, mtu int) (peerName string, veth netlink.Link, err error) {
-	for i := 0; i < 10; i++ {
-		peerName, err = RandomVethName()
-		if err != nil {
-			return
-		}
-
-		veth, err = makeVethPair(name, peerName, mtu)
-		switch {
-		case err == nil:
-			return
-
-		case os.IsExist(err):
-			if peerExists(peerName) {
-				continue
-			}
-			err = fmt.Errorf("container veth name provided (%v) already exists", name)
-			return
-
-		default:
-			err = fmt.Errorf("failed to make veth pair: %v", err)
-			return
-		}
-	}
-
-	// should really never be hit
-	err = fmt.Errorf("failed to find a unique veth name")
-	return
-}
-
-// RandomVethName returns string "veth" with random prefix (hashed from entropy)
-func RandomVethName() (string, error) {
-	entropy := make([]byte, 4)
-	_, err := rand.Reader.Read(entropy)
-	if err != nil {
-		return "", fmt.Errorf("failed to generate random veth name: %v", err)
-	}
-
-	// NetworkManager (recent versions) will ignore veth devices that start with "veth"
-	return fmt.Sprintf("veth%x", entropy), nil
-}
-
-func RenameLink(curName, newName string) error {
-	link, err := netlink.LinkByName(curName)
-	if err == nil {
-		err = netlink.LinkSetName(link, newName)
-	}
-	return err
-}
-
-func ifaceFromNetlinkLink(l netlink.Link) net.Interface {
-	a := l.Attrs()
-	return net.Interface{
-		Index:        a.Index,
-		MTU:          a.MTU,
-		Name:         a.Name,
-		HardwareAddr: a.HardwareAddr,
-		Flags:        a.Flags,
-	}
-}
-
-// SetupVeth sets up a pair of virtual ethernet devices.
-// Call SetupVeth from inside the container netns.  It will create both veth
-// devices and move the host-side veth into the provided hostNS namespace.
-// On success, SetupVeth returns (hostVeth, containerVeth, nil)
-func SetupVeth(contVethName string, mtu int, hostNS ns.NetNS) (net.Interface, net.Interface, error) {
-	hostVethName, contVeth, err := makeVeth(contVethName, mtu)
-	if err != nil {
-		return net.Interface{}, net.Interface{}, err
-	}
-
-	if err = netlink.LinkSetUp(contVeth); err != nil {
-		return net.Interface{}, net.Interface{}, fmt.Errorf("failed to set %q up: %v", contVethName, err)
-	}
-
-	hostVeth, err := netlink.LinkByName(hostVethName)
-	if err != nil {
-		return net.Interface{}, net.Interface{}, fmt.Errorf("failed to lookup %q: %v", hostVethName, err)
-	}
-
-	if err = netlink.LinkSetNsFd(hostVeth, int(hostNS.Fd())); err != nil {
-		return net.Interface{}, net.Interface{}, fmt.Errorf("failed to move veth to host netns: %v", err)
-	}
-
-	err = hostNS.Do(func(_ ns.NetNS) error {
-		hostVeth, err = netlink.LinkByName(hostVethName)
-		if err != nil {
-			return fmt.Errorf("failed to lookup %q in %q: %v", hostVethName, hostNS.Path(), err)
-		}
-
-		if err = netlink.LinkSetUp(hostVeth); err != nil {
-			return fmt.Errorf("failed to set %q up: %v", hostVethName, err)
-		}
-		return nil
-	})
-	if err != nil {
-		return net.Interface{}, net.Interface{}, err
-	}
-	return ifaceFromNetlinkLink(hostVeth), ifaceFromNetlinkLink(contVeth), nil
-}
-
-// DelLinkByName removes an interface link.
-func DelLinkByName(ifName string) error {
-	iface, err := netlink.LinkByName(ifName)
-	if err != nil {
-		return fmt.Errorf("failed to lookup %q: %v", ifName, err)
-	}
-
-	if err = netlink.LinkDel(iface); err != nil {
-		return fmt.Errorf("failed to delete %q: %v", ifName, err)
-	}
-
-	return nil
-}
-
-// DelLinkByNameAddr remove an interface returns its IP address
-// of the specified family
-func DelLinkByNameAddr(ifName string, family int) (*net.IPNet, error) {
-	iface, err := netlink.LinkByName(ifName)
-	if err != nil {
-		if err != nil && err.Error() == "Link not found" {
-			return nil, ErrLinkNotFound
-		}
-		return nil, fmt.Errorf("failed to lookup %q: %v", ifName, err)
-	}
-
-	addrs, err := netlink.AddrList(iface, family)
-	if err != nil || len(addrs) == 0 {
-		return nil, fmt.Errorf("failed to get IP addresses for %q: %v", ifName, err)
-	}
-
-	if err = netlink.LinkDel(iface); err != nil {
-		return nil, fmt.Errorf("failed to delete %q: %v", ifName, err)
-	}
-
-	return addrs[0].IPNet, nil
-}
-
-func SetHWAddrByIP(ifName string, ip4 net.IP, ip6 net.IP) error {
-	iface, err := netlink.LinkByName(ifName)
-	if err != nil {
-		return fmt.Errorf("failed to lookup %q: %v", ifName, err)
-	}
-
-	switch {
-	case ip4 == nil && ip6 == nil:
-		return fmt.Errorf("neither ip4 or ip6 specified")
-
-	case ip4 != nil:
-		{
-			hwAddr, err := hwaddr.GenerateHardwareAddr4(ip4, hwaddr.PrivateMACPrefix)
-			if err != nil {
-				return fmt.Errorf("failed to generate hardware addr: %v", err)
-			}
-			if err = netlink.LinkSetHardwareAddr(iface, hwAddr); err != nil {
-				return fmt.Errorf("failed to add hardware addr to %q: %v", ifName, err)
-			}
-		}
-	case ip6 != nil:
-		// TODO: IPv6
-	}
-
-	return nil
-}

vendor/github.com/containernetworking/cni/pkg/ip/link_test.go

@@ -1,273 +0,0 @@
-// Copyright 2016 CNI authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ip_test
-
-import (
-	"bytes"
-	"crypto/rand"
-	"fmt"
-	"net"
-
-	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
-
-	"github.com/containernetworking/cni/pkg/ip"
-	"github.com/containernetworking/cni/pkg/ns"
-
-	"github.com/vishvananda/netlink"
-	"github.com/vishvananda/netlink/nl"
-)
-
-func getHwAddr(linkname string) string {
-	veth, err := netlink.LinkByName(linkname)
-	Expect(err).NotTo(HaveOccurred())
-	return fmt.Sprintf("%s", veth.Attrs().HardwareAddr)
-}
-
-var _ = Describe("Link", func() {
-	const (
-		ifaceFormatString string = "i%d"
-		mtu               int    = 1400
-		ip4onehwaddr             = "0a:58:01:01:01:01"
-	)
-	var (
-		hostNetNS         ns.NetNS
-		containerNetNS    ns.NetNS
-		ifaceCounter      int = 0
-		hostVeth          net.Interface
-		containerVeth     net.Interface
-		hostVethName      string
-		containerVethName string
-
-		ip4one             = net.ParseIP("1.1.1.1")
-		ip4two             = net.ParseIP("1.1.1.2")
-		originalRandReader = rand.Reader
-	)
-
-	BeforeEach(func() {
-		var err error
-
-		hostNetNS, err = ns.NewNS()
-		Expect(err).NotTo(HaveOccurred())
-
-		containerNetNS, err = ns.NewNS()
-		Expect(err).NotTo(HaveOccurred())
-
-		fakeBytes := make([]byte, 20)
-		//to be reset in AfterEach block
-		rand.Reader = bytes.NewReader(fakeBytes)
-
-		_ = containerNetNS.Do(func(ns.NetNS) error {
-			defer GinkgoRecover()
-
-			hostVeth, containerVeth, err = ip.SetupVeth(fmt.Sprintf(ifaceFormatString, ifaceCounter), mtu, hostNetNS)
-			if err != nil {
-				return err
-			}
-			Expect(err).NotTo(HaveOccurred())
-
-			hostVethName = hostVeth.Name
-			containerVethName = containerVeth.Name
-
-			return nil
-		})
-	})
-
-	AfterEach(func() {
-		Expect(containerNetNS.Close()).To(Succeed())
-		Expect(hostNetNS.Close()).To(Succeed())
-		ifaceCounter++
-		rand.Reader = originalRandReader
-	})
-
-	It("SetupVeth must put the veth endpoints into the separate namespaces", func() {
-		_ = containerNetNS.Do(func(ns.NetNS) error {
-			defer GinkgoRecover()
-
-			containerVethFromName, err := netlink.LinkByName(containerVethName)
-			Expect(err).NotTo(HaveOccurred())
-			Expect(containerVethFromName.Attrs().Index).To(Equal(containerVeth.Index))
-
-			return nil
-		})
-
-		_ = hostNetNS.Do(func(ns.NetNS) error {
-			defer GinkgoRecover()
-
-			hostVethFromName, err := netlink.LinkByName(hostVethName)
-			Expect(err).NotTo(HaveOccurred())
-			Expect(hostVethFromName.Attrs().Index).To(Equal(hostVeth.Index))
-
-			return nil
-		})
-	})
-
-	Context("when container already has an interface with the same name", func() {
-		It("returns useful error", func() {
-			_ = containerNetNS.Do(func(ns.NetNS) error {
-				defer GinkgoRecover()
-
-				_, _, err := ip.SetupVeth(containerVethName, mtu, hostNetNS)
-				Expect(err.Error()).To(Equal(fmt.Sprintf("container veth name provided (%s) already exists", containerVethName)))
-
-				return nil
-			})
-		})
-	})
-
-	Context("deleting an non-existent device", func() {
-		It("returns known error", func() {
-			_ = containerNetNS.Do(func(ns.NetNS) error {
-				defer GinkgoRecover()
-
-				// This string should match the expected error codes in the cmdDel functions of some of the plugins
-				_, err := ip.DelLinkByNameAddr("THIS_DONT_EXIST", netlink.FAMILY_V4)
-				Expect(err).To(Equal(ip.ErrLinkNotFound))
-
-				return nil
-			})
-		})
-	})
-
-	Context("when there is no name available for the host-side", func() {
-		BeforeEach(func() {
-			//adding different interface to container ns
-			containerVethName += "0"
-		})
-		It("returns useful error", func() {
-			_ = containerNetNS.Do(func(ns.NetNS) error {
-				defer GinkgoRecover()
-
-				_, _, err := ip.SetupVeth(containerVethName, mtu, hostNetNS)
-				Expect(err.Error()).To(Equal("failed to move veth to host netns: file exists"))
-
-				return nil
-			})
-		})
-	})
-
-	Context("when there is no name conflict for the host or container interfaces", func() {
-		BeforeEach(func() {
-			//adding different interface to container and host ns
-			containerVethName += "0"
-			rand.Reader = originalRandReader
-		})
-		It("successfully creates the second veth pair", func() {
-			_ = containerNetNS.Do(func(ns.NetNS) error {
-				defer GinkgoRecover()
-
-				hostVeth, _, err := ip.SetupVeth(containerVethName, mtu, hostNetNS)
-				Expect(err).NotTo(HaveOccurred())
-				hostVethName = hostVeth.Name
-				return nil
-			})
-
-			//verify veths are in different namespaces
-			_ = containerNetNS.Do(func(ns.NetNS) error {
-				defer GinkgoRecover()
-
-				_, err := netlink.LinkByName(containerVethName)
-				Expect(err).NotTo(HaveOccurred())
-
-				return nil
-			})
-
-			_ = hostNetNS.Do(func(ns.NetNS) error {
-				defer GinkgoRecover()
-
-				_, err := netlink.LinkByName(hostVethName)
-				Expect(err).NotTo(HaveOccurred())
-
-				return nil
-			})
-		})
-
-	})
-
-	It("DelLinkByName must delete the veth endpoints", func() {
-		_ = containerNetNS.Do(func(ns.NetNS) error {
-			defer GinkgoRecover()
-
-			// this will delete the host endpoint too
-			err := ip.DelLinkByName(containerVethName)
-			Expect(err).NotTo(HaveOccurred())
-
-			_, err = netlink.LinkByName(containerVethName)
-			Expect(err).To(HaveOccurred())
-
-			return nil
-		})
-
-		_ = hostNetNS.Do(func(ns.NetNS) error {
-			defer GinkgoRecover()
-
-			_, err := netlink.LinkByName(hostVethName)
-			Expect(err).To(HaveOccurred())
-
-			return nil
-		})
-	})
-
-	It("DelLinkByNameAddr must throw an error for configured interfaces", func() {
-		_ = containerNetNS.Do(func(ns.NetNS) error {
-			defer GinkgoRecover()
-
-			// this will delete the host endpoint too
-			addr, err := ip.DelLinkByNameAddr(containerVethName, nl.FAMILY_V4)
-			Expect(err).To(HaveOccurred())
-
-			var ipNetNil *net.IPNet
-			Expect(addr).To(Equal(ipNetNil))
-			return nil
-		})
-	})
-
-	It("SetHWAddrByIP must change the interface hwaddr and be predictable", func() {
-
-		_ = containerNetNS.Do(func(ns.NetNS) error {
-			defer GinkgoRecover()
-
-			var err error
-			hwaddrBefore := getHwAddr(containerVethName)
-
-			err = ip.SetHWAddrByIP(containerVethName, ip4one, nil)
-			Expect(err).NotTo(HaveOccurred())
-			hwaddrAfter1 := getHwAddr(containerVethName)
-
-			Expect(hwaddrBefore).NotTo(Equal(hwaddrAfter1))
-			Expect(hwaddrAfter1).To(Equal(ip4onehwaddr))
-
-			return nil
-		})
-	})
-
-	It("SetHWAddrByIP must be injective", func() {
-
-		_ = containerNetNS.Do(func(ns.NetNS) error {
-			defer GinkgoRecover()
-
-			err := ip.SetHWAddrByIP(containerVethName, ip4one, nil)
-			Expect(err).NotTo(HaveOccurred())
-			hwaddrAfter1 := getHwAddr(containerVethName)
-
-			err = ip.SetHWAddrByIP(containerVethName, ip4two, nil)
-			Expect(err).NotTo(HaveOccurred())
-			hwaddrAfter2 := getHwAddr(containerVethName)
-
-			Expect(hwaddrAfter1).NotTo(Equal(hwaddrAfter2))
-			return nil
-		})
-	})
-})

vendor/github.com/containernetworking/cni/pkg/ip/route.go

@@ -1,27 +0,0 @@
-// Copyright 2015 CNI authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ip
-
-import (
-	"net"
-
-	"github.com/vishvananda/netlink"
-)
-
-// AddDefaultRoute sets the default route on the given gateway.
-func AddDefaultRoute(gw net.IP, dev netlink.Link) error {
-	_, defNet, _ := net.ParseCIDR("0.0.0.0/0")
-	return AddRoute(defNet, gw, dev)
-}

vendor/github.com/containernetworking/cni/pkg/ip/route_linux.go

@@ -1,41 +0,0 @@
-// Copyright 2015-2017 CNI authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ip
-
-import (
-	"net"
-
-	"github.com/vishvananda/netlink"
-)
-
-// AddRoute adds a universally-scoped route to a device.
-func AddRoute(ipn *net.IPNet, gw net.IP, dev netlink.Link) error {
-	return netlink.RouteAdd(&netlink.Route{
-		LinkIndex: dev.Attrs().Index,
-		Scope:     netlink.SCOPE_UNIVERSE,
-		Dst:       ipn,
-		Gw:        gw,
-	})
-}
-
-// AddHostRoute adds a host-scoped route to a device.
-func AddHostRoute(ipn *net.IPNet, gw net.IP, dev netlink.Link) error {
-	return netlink.RouteAdd(&netlink.Route{
-		LinkIndex: dev.Attrs().Index,
-		Scope:     netlink.SCOPE_HOST,
-		Dst:       ipn,
-		Gw:        gw,
-	})
-}

vendor/github.com/containernetworking/cni/pkg/ip/route_unspecified.go

@@ -1,34 +0,0 @@
-// Copyright 2015-2017 CNI authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// +build !linux
-
-package ip
-
-import (
-	"net"
-
-	"github.com/containernetworking/cni/pkg/types"
-	"github.com/vishvananda/netlink"
-)
-
-// AddRoute adds a universally-scoped route to a device.
-func AddRoute(ipn *net.IPNet, gw net.IP, dev netlink.Link) error {
-	return types.NotImplementedError
-}
-
-// AddHostRoute adds a host-scoped route to a device.
-func AddHostRoute(ipn *net.IPNet, gw net.IP, dev netlink.Link) error {
-	return types.NotImplementedError
-}

vendor/github.com/containernetworking/cni/pkg/ipam/ipam.go

@@ -1,93 +0,0 @@
-// Copyright 2015 CNI authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ipam
-
-import (
-	"fmt"
-	"net"
-	"os"
-
-	"github.com/containernetworking/cni/pkg/invoke"
-	"github.com/containernetworking/cni/pkg/ip"
-	"github.com/containernetworking/cni/pkg/types"
-	"github.com/containernetworking/cni/pkg/types/current"
-
-	"github.com/vishvananda/netlink"
-)
-
-func ExecAdd(plugin string, netconf []byte) (types.Result, error) {
-	return invoke.DelegateAdd(plugin, netconf)
-}
-
-func ExecDel(plugin string, netconf []byte) error {
-	return invoke.DelegateDel(plugin, netconf)
-}
-
-// ConfigureIface takes the result of IPAM plugin and
-// applies to the ifName interface
-func ConfigureIface(ifName string, res *current.Result) error {
-	if len(res.Interfaces) == 0 {
-		return fmt.Errorf("no interfaces to configure")
-	}
-
-	link, err := netlink.LinkByName(ifName)
-	if err != nil {
-		return fmt.Errorf("failed to lookup %q: %v", ifName, err)
-	}
-
-	if err := netlink.LinkSetUp(link); err != nil {
-		return fmt.Errorf("failed to set %q UP: %v", ifName, err)
-	}
-
-	var v4gw, v6gw net.IP
-	for _, ipc := range res.IPs {
-		if int(ipc.Interface) >= len(res.Interfaces) || res.Interfaces[ipc.Interface].Name != ifName {
-			// IP address is for a different interface
-			return fmt.Errorf("failed to add IP addr %v to %q: invalid interface index", ipc, ifName)
-		}
-
-		addr := &netlink.Addr{IPNet: &ipc.Address, Label: ""}
-		if err = netlink.AddrAdd(link, addr); err != nil {
-			return fmt.Errorf("failed to add IP addr %v to %q: %v", ipc, ifName, err)
-		}
-
-		gwIsV4 := ipc.Gateway.To4() != nil
-		if gwIsV4 && v4gw == nil {
-			v4gw = ipc.Gateway
-		} else if !gwIsV4 && v6gw == nil {
-			v6gw = ipc.Gateway
-		}
-	}
-
-	for _, r := range res.Routes {
-		routeIsV4 := r.Dst.IP.To4() != nil
-		gw := r.GW
-		if gw == nil {
-			if routeIsV4 && v4gw != nil {
-				gw = v4gw
-			} else if !routeIsV4 && v6gw != nil {
-				gw = v6gw
-			}
-		}
-		if err = ip.AddRoute(&r.Dst, gw, link); err != nil {
-			// we skip over duplicate routes as we assume the first one wins
-			if !os.IsExist(err) {
-				return fmt.Errorf("failed to add route '%v via %v dev %v': %v", r.Dst, gw, ifName, err)
-			}
-		}
-	}
-
-	return nil
-}

vendor/github.com/containernetworking/cni/pkg/ipam/ipam_test.go

@@ -1,258 +0,0 @@
-// Copyright 2015 CNI authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ipam
-
-import (
-	"net"
-	"syscall"
-
-	"github.com/containernetworking/cni/pkg/ns"
-	"github.com/containernetworking/cni/pkg/types"
-	"github.com/containernetworking/cni/pkg/types/current"
-
-	"github.com/vishvananda/netlink"
-
-	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
-)
-
-const LINK_NAME = "eth0"
-
-func ipNetEqual(a, b *net.IPNet) bool {
-	aPrefix, aBits := a.Mask.Size()
-	bPrefix, bBits := b.Mask.Size()
-	if aPrefix != bPrefix || aBits != bBits {
-		return false
-	}
-	return a.IP.Equal(b.IP)
-}
-
-var _ = Describe("IPAM Operations", func() {
-	var originalNS ns.NetNS
-	var ipv4, ipv6, routev4, routev6 *net.IPNet
-	var ipgw4, ipgw6, routegwv4, routegwv6 net.IP
-	var result *current.Result
-
-	BeforeEach(func() {
-		// Create a new NetNS so we don't modify the host
-		var err error
-		originalNS, err = ns.NewNS()
-		Expect(err).NotTo(HaveOccurred())
-
-		err = originalNS.Do(func(ns.NetNS) error {
-			defer GinkgoRecover()
-
-			// Add master
-			err = netlink.LinkAdd(&netlink.Dummy{
-				LinkAttrs: netlink.LinkAttrs{
-					Name: LINK_NAME,
-				},
-			})
-			Expect(err).NotTo(HaveOccurred())
-			_, err = netlink.LinkByName(LINK_NAME)
-			Expect(err).NotTo(HaveOccurred())
-			return nil
-		})
-		Expect(err).NotTo(HaveOccurred())
-
-		ipv4, err = types.ParseCIDR("1.2.3.30/24")
-		Expect(err).NotTo(HaveOccurred())
-		Expect(ipv4).NotTo(BeNil())
-
-		_, routev4, err = net.ParseCIDR("15.5.6.8/24")
-		Expect(err).NotTo(HaveOccurred())
-		Expect(routev4).NotTo(BeNil())
-		routegwv4 = net.ParseIP("1.2.3.5")
-		Expect(routegwv4).NotTo(BeNil())
-
-		ipgw4 = net.ParseIP("1.2.3.1")
-		Expect(ipgw4).NotTo(BeNil())
-
-		ipv6, err = types.ParseCIDR("abcd:1234:ffff::cdde/64")
-		Expect(err).NotTo(HaveOccurred())
-		Expect(ipv6).NotTo(BeNil())
-
-		_, routev6, err = net.ParseCIDR("1111:dddd::aaaa/80")
-		Expect(err).NotTo(HaveOccurred())
-		Expect(routev6).NotTo(BeNil())
-		routegwv6 = net.ParseIP("abcd:1234:ffff::10")
-		Expect(routegwv6).NotTo(BeNil())
-
-		ipgw6 = net.ParseIP("abcd:1234:ffff::1")
-		Expect(ipgw6).NotTo(BeNil())
-
-		result = &current.Result{
-			Interfaces: []*current.Interface{
-				{
-					Name:    "eth0",
-					Mac:     "00:11:22:33:44:55",
-					Sandbox: "/proc/3553/ns/net",
-				},
-				{
-					Name:    "fake0",
-					Mac:     "00:33:44:55:66:77",
-					Sandbox: "/proc/1234/ns/net",
-				},
-			},
-			IPs: []*current.IPConfig{
-				{
-					Version:   "4",
-					Interface: 0,
-					Address:   *ipv4,
-					Gateway:   ipgw4,
-				},
-				{
-					Version:   "6",
-					Interface: 0,
-					Address:   *ipv6,
-					Gateway:   ipgw6,
-				},
-			},
-			Routes: []*types.Route{
-				{Dst: *routev4, GW: routegwv4},
-				{Dst: *routev6, GW: routegwv6},
-			},
-		}
-	})
-
-	AfterEach(func() {
-		Expect(originalNS.Close()).To(Succeed())
-	})
-
-	It("configures a link with addresses and routes", func() {
-		err := originalNS.Do(func(ns.NetNS) error {
-			defer GinkgoRecover()
-
-			err := ConfigureIface(LINK_NAME, result)
-			Expect(err).NotTo(HaveOccurred())
-
-			link, err := netlink.LinkByName(LINK_NAME)
-			Expect(err).NotTo(HaveOccurred())
-			Expect(link.Attrs().Name).To(Equal(LINK_NAME))
-
-			v4addrs, err := netlink.AddrList(link, syscall.AF_INET)
-			Expect(err).NotTo(HaveOccurred())
-			Expect(len(v4addrs)).To(Equal(1))
-			Expect(ipNetEqual(v4addrs[0].IPNet, ipv4)).To(Equal(true))
-
-			v6addrs, err := netlink.AddrList(link, syscall.AF_INET6)
-			Expect(err).NotTo(HaveOccurred())
-			Expect(len(v6addrs)).To(Equal(2))
-
-			var found bool
-			for _, a := range v6addrs {
-				if ipNetEqual(a.IPNet, ipv6) {
-					found = true
-					break
-				}
-			}
-			Expect(found).To(Equal(true))
-
-			// Ensure the v4 route, v6 route, and subnet route
-			routes, err := netlink.RouteList(link, 0)
-			Expect(err).NotTo(HaveOccurred())
-
-			var v4found, v6found bool
-			for _, route := range routes {
-				isv4 := route.Dst.IP.To4() != nil
-				if isv4 && ipNetEqual(route.Dst, routev4) && route.Gw.Equal(routegwv4) {
-					v4found = true
-				}
-				if !isv4 && ipNetEqual(route.Dst, routev6) && route.Gw.Equal(routegwv6) {
-					v6found = true
-				}
-
-				if v4found && v6found {
-					break
-				}
-			}
-			Expect(v4found).To(Equal(true))
-			Expect(v6found).To(Equal(true))
-
-			return nil
-		})
-		Expect(err).NotTo(HaveOccurred())
-	})
-
-	It("configures a link with routes using address gateways", func() {
-		result.Routes[0].GW = nil
-		result.Routes[1].GW = nil
-		err := originalNS.Do(func(ns.NetNS) error {
-			defer GinkgoRecover()
-
-			err := ConfigureIface(LINK_NAME, result)
-			Expect(err).NotTo(HaveOccurred())
-
-			link, err := netlink.LinkByName(LINK_NAME)
-			Expect(err).NotTo(HaveOccurred())
-			Expect(link.Attrs().Name).To(Equal(LINK_NAME))
-
-			// Ensure the v4 route, v6 route, and subnet route
-			routes, err := netlink.RouteList(link, 0)
-			Expect(err).NotTo(HaveOccurred())
-
-			var v4found, v6found bool
-			for _, route := range routes {
-				isv4 := route.Dst.IP.To4() != nil
-				if isv4 && ipNetEqual(route.Dst, routev4) && route.Gw.Equal(ipgw4) {
-					v4found = true
-				}
-				if !isv4 && ipNetEqual(route.Dst, routev6) && route.Gw.Equal(ipgw6) {
-					v6found = true
-				}
-
-				if v4found && v6found {
-					break
-				}
-			}
-			Expect(v4found).To(Equal(true))
-			Expect(v6found).To(Equal(true))
-
-			return nil
-		})
-		Expect(err).NotTo(HaveOccurred())
-	})
-
-	It("returns an error when the interface index doesn't match the link name", func() {
-		result.IPs[0].Interface = 1
-		err := originalNS.Do(func(ns.NetNS) error {
-			return ConfigureIface(LINK_NAME, result)
-		})
-		Expect(err).To(HaveOccurred())
-	})
-
-	It("returns an error when the interface index is too big", func() {
-		result.IPs[0].Interface = 2
-		err := originalNS.Do(func(ns.NetNS) error {
-			return ConfigureIface(LINK_NAME, result)
-		})
-		Expect(err).To(HaveOccurred())
-	})
-
-	It("returns an error when there are no interfaces to configure", func() {
-		result.Interfaces = []*current.Interface{}
-		err := originalNS.Do(func(ns.NetNS) error {
-			return ConfigureIface(LINK_NAME, result)
-		})
-		Expect(err).To(HaveOccurred())
-	})
-
-	It("returns an error when configuring the wrong interface", func() {
-		err := originalNS.Do(func(ns.NetNS) error {
-			return ConfigureIface("asdfasdf", result)
-		})
-		Expect(err).To(HaveOccurred())
-	})
-})

vendor/github.com/containernetworking/cni/pkg/ns/README.md

@@ -1,34 +0,0 @@
-### Namespaces, Threads, and Go
-On Linux each OS thread can have a different network namespace.  Go's thread scheduling model switches goroutines between OS threads based on OS thread load and whether the goroutine would block other goroutines.  This can result in a goroutine switching network namespaces without notice and lead to errors in your code.
-
-### Namespace Switching
-Switching namespaces with the `ns.Set()` method is not recommended without additional strategies to prevent unexpected namespace changes when your goroutines switch OS threads.
-
-Go provides the `runtime.LockOSThread()` function to ensure a specific goroutine executes on its current OS thread and prevents any other goroutine from running in that thread until the locked one exits.  Careful usage of `LockOSThread()` and goroutines can provide good control over which network namespace a given goroutine executes in.
-
-For example, you cannot rely on the `ns.Set()` namespace being the current namespace after the `Set()` call unless you do two things.  First, the goroutine calling `Set()` must have previously called `LockOSThread()`.  Second, you must ensure `runtime.UnlockOSThread()` is not called somewhere in-between.  You also cannot rely on the initial network namespace remaining the current network namespace if any other code in your program switches namespaces, unless you have already called `LockOSThread()` in that goroutine.  Note that `LockOSThread()` prevents the Go scheduler from optimally scheduling goroutines for best performance, so `LockOSThread()` should only be used in small, isolated goroutines that release the lock quickly.
-
-### Do() The Recommended Thing
-The `ns.Do()` method provides control over network namespaces for you by implementing these strategies. All code dependent on a particular network namespace (including the root namespace) should be wrapped in the `ns.Do()` method to ensure the correct namespace is selected for the duration of your code.  For example:
-
-```go
-targetNs, err := ns.NewNS()
-if err != nil {
-    return err
-}
-err = targetNs.Do(func(hostNs ns.NetNS) error {
-	dummy := &netlink.Dummy{
-		LinkAttrs: netlink.LinkAttrs{
-			Name: "dummy0",
-		},
-	}
-	return netlink.LinkAdd(dummy)
-})
-```
-
-Note this requirement to wrap every network call is very onerous - any libraries you call might call out to network services such as DNS, and all such calls need to be protected after you call `ns.Do()`. The CNI plugins all exit very soon after calling `ns.Do()` which helps to minimize the problem.
-
-### Further Reading
- - https://github.com/golang/go/wiki/LockOSThread
- - http://morsmachine.dk/go-scheduler
- - https://github.com/containernetworking/cni/issues/262

vendor/github.com/containernetworking/cni/pkg/ns/ns.go

@@ -1,178 +0,0 @@
-// Copyright 2015 CNI authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ns
-
-import (
-	"fmt"
-	"os"
-	"runtime"
-	"sync"
-	"syscall"
-)
-
-type NetNS interface {
-	// Executes the passed closure in this object's network namespace,
-	// attempting to restore the original namespace before returning.
-	// However, since each OS thread can have a different network namespace,
-	// and Go's thread scheduling is highly variable, callers cannot
-	// guarantee any specific namespace is set unless operations that
-	// require that namespace are wrapped with Do().  Also, no code called
-	// from Do() should call runtime.UnlockOSThread(), or the risk
-	// of executing code in an incorrect namespace will be greater.  See
-	// https://github.com/golang/go/wiki/LockOSThread for further details.
-	Do(toRun func(NetNS) error) error
-
-	// Sets the current network namespace to this object's network namespace.
-	// Note that since Go's thread scheduling is highly variable, callers
-	// cannot guarantee the requested namespace will be the current namespace
-	// after this function is called; to ensure this wrap operations that
-	// require the namespace with Do() instead.
-	Set() error
-
-	// Returns the filesystem path representing this object's network namespace
-	Path() string
-
-	// Returns a file descriptor representing this object's network namespace
-	Fd() uintptr
-
-	// Cleans up this instance of the network namespace; if this instance
-	// is the last user the namespace will be destroyed
-	Close() error
-}
-
-type netNS struct {
-	file    *os.File
-	mounted bool
-	closed  bool
-}
-
-// netNS implements the NetNS interface
-var _ NetNS = &netNS{}
-
-const (
-	// https://github.com/torvalds/linux/blob/master/include/uapi/linux/magic.h
-	NSFS_MAGIC   = 0x6e736673
-	PROCFS_MAGIC = 0x9fa0
-)
-
-type NSPathNotExistErr struct{ msg string }
-
-func (e NSPathNotExistErr) Error() string { return e.msg }
-
-type NSPathNotNSErr struct{ msg string }
-
-func (e NSPathNotNSErr) Error() string { return e.msg }
-
-func IsNSorErr(nspath string) error {
-	stat := syscall.Statfs_t{}
-	if err := syscall.Statfs(nspath, &stat); err != nil {
-		if os.IsNotExist(err) {
-			err = NSPathNotExistErr{msg: fmt.Sprintf("failed to Statfs %q: %v", nspath, err)}
-		} else {
-			err = fmt.Errorf("failed to Statfs %q: %v", nspath, err)
-		}
-		return err
-	}
-
-	switch stat.Type {
-	case PROCFS_MAGIC, NSFS_MAGIC:
-		return nil
-	default:
-		return NSPathNotNSErr{msg: fmt.Sprintf("unknown FS magic on %q: %x", nspath, stat.Type)}
-	}
-}
-
-// Returns an object representing the namespace referred to by @path
-func GetNS(nspath string) (NetNS, error) {
-	err := IsNSorErr(nspath)
-	if err != nil {
-		return nil, err
-	}
-
-	fd, err := os.Open(nspath)
-	if err != nil {
-		return nil, err
-	}
-
-	return &netNS{file: fd}, nil
-}
-
-func (ns *netNS) Path() string {
-	return ns.file.Name()
-}
-
-func (ns *netNS) Fd() uintptr {
-	return ns.file.Fd()
-}
-
-func (ns *netNS) errorIfClosed() error {
-	if ns.closed {
-		return fmt.Errorf("%q has already been closed", ns.file.Name())
-	}
-	return nil
-}
-
-func (ns *netNS) Do(toRun func(NetNS) error) error {
-	if err := ns.errorIfClosed(); err != nil {
-		return err
-	}
-
-	containedCall := func(hostNS NetNS) error {
-		threadNS, err := GetCurrentNS()
-		if err != nil {
-			return fmt.Errorf("failed to open current netns: %v", err)
-		}
-		defer threadNS.Close()
-
-		// switch to target namespace
-		if err = ns.Set(); err != nil {
-			return fmt.Errorf("error switching to ns %v: %v", ns.file.Name(), err)
-		}
-		defer threadNS.Set() // switch back
-
-		return toRun(hostNS)
-	}
-
-	// save a handle to current network namespace
-	hostNS, err := GetCurrentNS()
-	if err != nil {
-		return fmt.Errorf("Failed to open current namespace: %v", err)
-	}
-	defer hostNS.Close()
-
-	var wg sync.WaitGroup
-	wg.Add(1)
-
-	var innerError error
-	go func() {
-		defer wg.Done()
-		runtime.LockOSThread()
-		innerError = containedCall(hostNS)
-	}()
-	wg.Wait()
-
-	return innerError
-}
-
-// WithNetNSPath executes the passed closure under the given network
-// namespace, restoring the original namespace afterwards.
-func WithNetNSPath(nspath string, toRun func(NetNS) error) error {
-	ns, err := GetNS(nspath)
-	if err != nil {
-		return err
-	}
-	defer ns.Close()
-	return ns.Do(toRun)
-}

vendor/github.com/containernetworking/cni/pkg/ns/ns_linux.go

@@ -1,149 +0,0 @@
-// Copyright 2015-2017 CNI authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ns
-
-import (
-	"crypto/rand"
-	"fmt"
-	"os"
-	"path"
-	"runtime"
-	"sync"
-
-	"golang.org/x/sys/unix"
-)
-
-// Returns an object representing the current OS thread's network namespace
-func GetCurrentNS() (NetNS, error) {
-	return GetNS(getCurrentThreadNetNSPath())
-}
-
-func getCurrentThreadNetNSPath() string {
-	// /proc/self/ns/net returns the namespace of the main thread, not
-	// of whatever thread this goroutine is running on.  Make sure we
-	// use the thread's net namespace since the thread is switching around
-	return fmt.Sprintf("/proc/%d/task/%d/ns/net", os.Getpid(), unix.Gettid())
-}
-
-// Creates a new persistent network namespace and returns an object
-// representing that namespace, without switching to it
-func NewNS() (NetNS, error) {
-	const nsRunDir = "/var/run/netns"
-
-	b := make([]byte, 16)
-	_, err := rand.Reader.Read(b)
-	if err != nil {
-		return nil, fmt.Errorf("failed to generate random netns name: %v", err)
-	}
-
-	err = os.MkdirAll(nsRunDir, 0755)
-	if err != nil {
-		return nil, err
-	}
-
-	// create an empty file at the mount point
-	nsName := fmt.Sprintf("cni-%x-%x-%x-%x-%x", b[0:4], b[4:6], b[6:8], b[8:10], b[10:])
-	nsPath := path.Join(nsRunDir, nsName)
-	mountPointFd, err := os.Create(nsPath)
-	if err != nil {
-		return nil, err
-	}
-	mountPointFd.Close()
-
-	// Ensure the mount point is cleaned up on errors; if the namespace
-	// was successfully mounted this will have no effect because the file
-	// is in-use
-	defer os.RemoveAll(nsPath)
-
-	var wg sync.WaitGroup
-	wg.Add(1)
-
-	// do namespace work in a dedicated goroutine, so that we can safely
-	// Lock/Unlock OSThread without upsetting the lock/unlock state of
-	// the caller of this function
-	var fd *os.File
-	go (func() {
-		defer wg.Done()
-		runtime.LockOSThread()
-
-		var origNS NetNS
-		origNS, err = GetNS(getCurrentThreadNetNSPath())
-		if err != nil {
-			return
-		}
-		defer origNS.Close()
-
-		// create a new netns on the current thread
-		err = unix.Unshare(unix.CLONE_NEWNET)
-		if err != nil {
-			return
-		}
-		defer origNS.Set()
-
-		// bind mount the new netns from the current thread onto the mount point
-		err = unix.Mount(getCurrentThreadNetNSPath(), nsPath, "none", unix.MS_BIND, "")
-		if err != nil {
-			return
-		}
-
-		fd, err = os.Open(nsPath)
-		if err != nil {
-			return
-		}
-	})()
-	wg.Wait()
-
-	if err != nil {
-		unix.Unmount(nsPath, unix.MNT_DETACH)
-		return nil, fmt.Errorf("failed to create namespace: %v", err)
-	}
-
-	return &netNS{file: fd, mounted: true}, nil
-}
-
-func (ns *netNS) Close() error {
-	if err := ns.errorIfClosed(); err != nil {
-		return err
-	}
-
-	if err := ns.file.Close(); err != nil {
-		return fmt.Errorf("Failed to close %q: %v", ns.file.Name(), err)
-	}
-	ns.closed = true
-
-	if ns.mounted {
-		if err := unix.Unmount(ns.file.Name(), unix.MNT_DETACH); err != nil {
-			return fmt.Errorf("Failed to unmount namespace %s: %v", ns.file.Name(), err)
-		}
-		if err := os.RemoveAll(ns.file.Name()); err != nil {
-			return fmt.Errorf("Failed to clean up namespace %s: %v", ns.file.Name(), err)
-		}
-		ns.mounted = false
-	}
-
-	return nil
-}
-
-func (ns *netNS) Set() error {
-	if err := ns.errorIfClosed(); err != nil {
-		return err
-	}
-
-	if _, _, err := unix.Syscall(unix.SYS_SETNS, ns.Fd(), uintptr(unix.CLONE_NEWNET), 0); err != 0 {
-		return fmt.Errorf("Error switching to ns %v: %v", ns.file.Name(), err)
-	}
-
-	return nil
-}

vendor/github.com/containernetworking/cni/pkg/ns/ns_test.go

@@ -1,252 +0,0 @@
-// Copyright 2016 CNI authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ns_test
-
-import (
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-
-	"github.com/containernetworking/cni/pkg/ns"
-	. "github.com/onsi/ginkgo"
-	. "github.com/onsi/gomega"
-	"golang.org/x/sys/unix"
-)
-
-func getInodeCurNetNS() (uint64, error) {
-	curNS, err := ns.GetCurrentNS()
-	if err != nil {
-		return 0, err
-	}
-	defer curNS.Close()
-	return getInodeNS(curNS)
-}
-
-func getInodeNS(netns ns.NetNS) (uint64, error) {
-	return getInodeFd(int(netns.Fd()))
-}
-
-func getInode(path string) (uint64, error) {
-	file, err := os.Open(path)
-	if err != nil {
-		return 0, err
-	}
-	defer file.Close()
-	return getInodeFd(int(file.Fd()))
-}
-
-func getInodeFd(fd int) (uint64, error) {
-	stat := &unix.Stat_t{}
-	err := unix.Fstat(fd, stat)
-	return stat.Ino, err
-}
-
-var _ = Describe("Linux namespace operations", func() {
-	Describe("WithNetNS", func() {
-		var (
-			originalNetNS ns.NetNS
-			targetNetNS   ns.NetNS
-		)
-
-		BeforeEach(func() {
-			var err error
-
-			originalNetNS, err = ns.NewNS()
-			Expect(err).NotTo(HaveOccurred())
-
-			targetNetNS, err = ns.NewNS()
-			Expect(err).NotTo(HaveOccurred())
-		})
-
-		AfterEach(func() {
-			Expect(targetNetNS.Close()).To(Succeed())
-			Expect(originalNetNS.Close()).To(Succeed())
-		})
-
-		It("executes the callback within the target network namespace", func() {
-			expectedInode, err := getInodeNS(targetNetNS)
-			Expect(err).NotTo(HaveOccurred())
-
-			err = targetNetNS.Do(func(ns.NetNS) error {
-				defer GinkgoRecover()
-
-				actualInode, err := getInodeCurNetNS()
-				Expect(err).NotTo(HaveOccurred())
-				Expect(actualInode).To(Equal(expectedInode))
-				return nil
-			})
-			Expect(err).NotTo(HaveOccurred())
-		})
-
-		It("provides the original namespace as the argument to the callback", func() {
-			// Ensure we start in originalNetNS
-			err := originalNetNS.Do(func(ns.NetNS) error {
-				defer GinkgoRecover()
-
-				origNSInode, err := getInodeNS(originalNetNS)
-				Expect(err).NotTo(HaveOccurred())
-
-				err = targetNetNS.Do(func(hostNS ns.NetNS) error {
-					defer GinkgoRecover()
-
-					hostNSInode, err := getInodeNS(hostNS)
-					Expect(err).NotTo(HaveOccurred())
-					Expect(hostNSInode).To(Equal(origNSInode))
-					return nil
-				})
-				return nil
-			})
-			Expect(err).NotTo(HaveOccurred())
-		})
-
-		Context("when the callback returns an error", func() {
-			It("restores the calling thread to the original namespace before returning", func() {
-				err := originalNetNS.Do(func(ns.NetNS) error {
-					defer GinkgoRecover()
-
-					preTestInode, err := getInodeCurNetNS()
-					Expect(err).NotTo(HaveOccurred())
-
-					_ = targetNetNS.Do(func(ns.NetNS) error {
-						return errors.New("potato")
-					})
-
-					postTestInode, err := getInodeCurNetNS()
-					Expect(err).NotTo(HaveOccurred())
-					Expect(postTestInode).To(Equal(preTestInode))
-					return nil
-				})
-				Expect(err).NotTo(HaveOccurred())
-			})
-
-			It("returns the error from the callback", func() {
-				err := targetNetNS.Do(func(ns.NetNS) error {
-					return errors.New("potato")
-				})
-				Expect(err).To(MatchError("potato"))
-			})
-		})
-
-		Describe("validating inode mapping to namespaces", func() {
-			It("checks that different namespaces have different inodes", func() {
-				origNSInode, err := getInodeNS(originalNetNS)
-				Expect(err).NotTo(HaveOccurred())
-
-				testNsInode, err := getInodeNS(targetNetNS)
-				Expect(err).NotTo(HaveOccurred())
-
-				Expect(testNsInode).NotTo(Equal(0))
-				Expect(testNsInode).NotTo(Equal(origNSInode))
-			})
-
-			It("should not leak a closed netns onto any threads in the process", func() {
-				By("creating a new netns")
-				createdNetNS, err := ns.NewNS()
-				Expect(err).NotTo(HaveOccurred())
-
-				By("discovering the inode of the created netns")
-				createdNetNSInode, err := getInodeNS(createdNetNS)
-				Expect(err).NotTo(HaveOccurred())
-				createdNetNS.Close()
-
-				By("comparing against the netns inode of every thread in the process")
-				for _, netnsPath := range allNetNSInCurrentProcess() {
-					netnsInode, err := getInode(netnsPath)
-					Expect(err).NotTo(HaveOccurred())
-					Expect(netnsInode).NotTo(Equal(createdNetNSInode))
-				}
-			})
-
-			It("fails when the path is not a namespace", func() {
-				tempFile, err := ioutil.TempFile("", "nstest")
-				Expect(err).NotTo(HaveOccurred())
-				defer tempFile.Close()
-
-				nspath := tempFile.Name()
-				defer os.Remove(nspath)
-
-				_, err = ns.GetNS(nspath)
-				Expect(err).To(HaveOccurred())
-				Expect(err).To(BeAssignableToTypeOf(ns.NSPathNotNSErr{}))
-				Expect(err).NotTo(BeAssignableToTypeOf(ns.NSPathNotExistErr{}))
-			})
-		})
-
-		Describe("closing a network namespace", func() {
-			It("should prevent further operations", func() {
-				createdNetNS, err := ns.NewNS()
-				Expect(err).NotTo(HaveOccurred())
-
-				err = createdNetNS.Close()
-				Expect(err).NotTo(HaveOccurred())
-
-				err = createdNetNS.Do(func(ns.NetNS) error { return nil })
-				Expect(err).To(HaveOccurred())
-
-				err = createdNetNS.Set()
-				Expect(err).To(HaveOccurred())
-			})
-
-			It("should only work once", func() {
-				createdNetNS, err := ns.NewNS()
-				Expect(err).NotTo(HaveOccurred())
-
-				err = createdNetNS.Close()
-				Expect(err).NotTo(HaveOccurred())
-
-				err = createdNetNS.Close()
-				Expect(err).To(HaveOccurred())
-			})
-		})
-	})
-
-	Describe("IsNSorErr", func() {
-		It("should detect a namespace", func() {
-			createdNetNS, err := ns.NewNS()
-			err = ns.IsNSorErr(createdNetNS.Path())
-			Expect(err).NotTo(HaveOccurred())
-		})
-
-		It("should refuse other paths", func() {
-			tempFile, err := ioutil.TempFile("", "nstest")
-			Expect(err).NotTo(HaveOccurred())
-			defer tempFile.Close()
-
-			nspath := tempFile.Name()
-			defer os.Remove(nspath)
-
-			err = ns.IsNSorErr(nspath)
-			Expect(err).To(HaveOccurred())
-			Expect(err).To(BeAssignableToTypeOf(ns.NSPathNotNSErr{}))
-			Expect(err).NotTo(BeAssignableToTypeOf(ns.NSPathNotExistErr{}))
-		})
-
-		It("should error on non-existing paths", func() {
-			err := ns.IsNSorErr("/tmp/IDoNotExist")
-			Expect(err).To(HaveOccurred())
-			Expect(err).To(BeAssignableToTypeOf(ns.NSPathNotExistErr{}))
-			Expect(err).NotTo(BeAssignableToTypeOf(ns.NSPathNotNSErr{}))
-		})
-	})
-})
-
-func allNetNSInCurrentProcess() []string {
-	pid := unix.Getpid()
-	paths, err := filepath.Glob(fmt.Sprintf("/proc/%d/task/*/ns/net", pid))
-	Expect(err).NotTo(HaveOccurred())
-	return paths
-}