Check CIDRs before attaching a container in proxy

If any cidr is invalid, a user will get the following error:
"docker: Error response from daemon: invalid CIDR: $CIDR",
where $CIDR is the first invalid cidr from the WEAVE_CIDR list.

proxy/proxy.go

@@ -20,6 +20,7 @@ import (
 	"github.com/weaveworks/weave/common"
 	weavedocker "github.com/weaveworks/weave/common/docker"
 	weavenet "github.com/weaveworks/weave/net"
+	"github.com/weaveworks/weave/net/address"
 )
 
 const (
@@ -506,6 +507,11 @@ func (proxy *Proxy) attach(containerID string) error {
 	}
 	Log.Infof("Attaching container %s with WEAVE_CIDR \"%s\" to weave network", container.ID, strings.Join(cidrs, " "))
 	args := []string{"attach"}
+
+	if err := validateCIDRs(cidrs); err != nil {
+		return err
+	}
+
 	args = append(args, cidrs...)
 	if !proxy.NoRewriteHosts {
 		args = append(args, "--rewrite-hosts")
@@ -533,6 +539,26 @@ func callWeaveAttach(container *docker.Container, args []string) error {
 	return nil
 }
 
+func validateCIDRs(cidrs []string) error {
+	check := func(cidr string, prefixes []string) bool {
+		for _, prefix := range prefixes {
+			if strings.HasPrefix(cidr, prefix) {
+				if _, err := address.ParseCIDR(strings.TrimPrefix(cidr, prefix)); err == nil {
+					return true
+				}
+			}
+		}
+		return false
+	}
+
+	for _, cidr := range cidrs {
+		if cidr != "net:default" && !check(cidr, []string{"ip:", "net:", ""}) {
+			return fmt.Errorf("invalid CIDR: %s", cidr)
+		}
+	}
+	return nil
+}
+
 func (proxy *Proxy) weaveCIDRs(networkMode string, env []string) ([]string, error) {
 	if networkMode == "host" || strings.HasPrefix(networkMode, "container:") ||
 		// Anything else, other than blank/none/default/bridge, is some sort of network plugin