Skip to content

Commit 98f3ca4

Browse files
FingerLeaderroot
FingerLeader
and
root
authored
Store iptables when creating network attack (#215)
* store iptables Signed-off-by: root <[email protected]> * make check Signed-off-by: root <[email protected]> * update network test Signed-off-by: root <[email protected]> * move NeedApplyTC() at the begin of applying to the middle Signed-off-by: root <[email protected]> * remove NeedApplyIptables Signed-off-by: root <[email protected]> Signed-off-by: root <[email protected]> Co-authored-by: root <[email protected]>
1 parent 5ecc6c2 commit 98f3ca4

File tree

3 files changed

+55
-54
lines changed

3 files changed

+55
-54
lines changed

‎pkg/core/network.go‎

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"time"
2222

2323
"github.com/chaos-mesh/chaos-mesh/api/v1alpha1"
24+
"github.com/chaos-mesh/chaos-mesh/controllers/podnetworkchaos/netutils"
2425
"github.com/chaos-mesh/chaos-mesh/pkg/chaosdaemon/pb"
2526
"github.com/chaos-mesh/chaos-mesh/pkg/netem"
2627
"github.com/pingcap/errors"
@@ -510,10 +511,6 @@ func (n *NetworkCommand) NeedApplyIPSet() bool {
510511
return false
511512
}
512513

513-
func (n *NetworkCommand) NeedApplyIptables() bool {
514-
return true
515-
}
516-
517514
func (n *NetworkCommand) NeedApplyTC() bool {
518515
switch n.Action {
519516
case NetworkDelayAction, NetworkLossAction, NetworkCorruptAction, NetworkDuplicateAction, NetworkBandwidthAction:
@@ -523,20 +520,20 @@ func (n *NetworkCommand) NeedApplyTC() bool {
523520
}
524521
}
525522

526-
func (n *NetworkCommand) AdditionalChain(ipset string) ([]*pb.Chain, error) {
523+
func (n *NetworkCommand) AdditionalChain(ipset string, uid string) ([]*pb.Chain, error) {
527524
chains := make([]*pb.Chain, 0, 2)
528525
var toChains, fromChains []*pb.Chain
529526
var err error
530527

531528
if n.Direction == "to" || n.Direction == "both" {
532-
toChains, err = n.getAdditionalChain(ipset, "to")
529+
toChains, err = n.getAdditionalChain(ipset, "to", uid)
533530
if err != nil {
534531
return nil, err
535532
}
536533
}
537534

538535
if n.Direction == "from" || n.Direction == "both" {
539-
fromChains, err = n.getAdditionalChain(ipset, "from")
536+
fromChains, err = n.getAdditionalChain(ipset, "from", uid)
540537
if err != nil {
541538
return nil, err
542539
}
@@ -548,7 +545,7 @@ func (n *NetworkCommand) AdditionalChain(ipset string) ([]*pb.Chain, error) {
548545
return chains, nil
549546
}
550547

551-
func (n *NetworkCommand) getAdditionalChain(ipset, direction string) ([]*pb.Chain, error) {
548+
func (n *NetworkCommand) getAdditionalChain(ipset, direction string, uid string) ([]*pb.Chain, error) {
552549
var directionStr string
553550
var directionChain pb.Chain_Direction
554551
if direction == "to" {
@@ -562,9 +559,11 @@ func (n *NetworkCommand) getAdditionalChain(ipset, direction string) ([]*pb.Chai
562559
}
563560

564561
chains := make([]*pb.Chain, 0, 2)
562+
// The `targetLength`s in `netutils.CompressName()` are different because of
563+
// the need to distinguish between the different chains.
565564
if len(n.AcceptTCPFlags) > 0 {
566565
chains = append(chains, &pb.Chain{
567-
Name: fmt.Sprintf("%s/0", directionStr),
566+
Name: fmt.Sprintf("%s/%s", directionStr, netutils.CompressName(uid, 19, "")),
568567
Ipsets: []string{ipset},
569568
Direction: directionChain,
570569
Protocol: n.IPProtocol,
@@ -575,7 +574,7 @@ func (n *NetworkCommand) getAdditionalChain(ipset, direction string) ([]*pb.Chai
575574

576575
if n.Action == NetworkPartitionAction {
577576
chains = append(chains, &pb.Chain{
578-
Name: fmt.Sprintf("%s/1", directionStr),
577+
Name: fmt.Sprintf("%s/%s", directionStr, netutils.CompressName(uid, 20, "")),
579578
Ipsets: []string{ipset},
580579
Direction: directionChain,
581580
Protocol: n.IPProtocol,

‎pkg/core/network_test.go‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ func TestPatitionChain(t *testing.T) {
3535
},
3636
chains: []*pb.Chain{
3737
{
38-
Name: "OUTPUT/1",
38+
Name: "OUTPUT/3c552_e0172bc4fd046_",
3939
Ipsets: []string{"test"},
4040
Direction: pb.Chain_OUTPUT,
4141
Protocol: "tcp",
@@ -53,7 +53,7 @@ func TestPatitionChain(t *testing.T) {
5353
},
5454
chains: []*pb.Chain{
5555
{
56-
Name: "INPUT/1",
56+
Name: "INPUT/3c552_e0172bc4fd046_",
5757
Ipsets: []string{"test"},
5858
Direction: pb.Chain_INPUT,
5959
Protocol: "tcp",
@@ -71,14 +71,14 @@ func TestPatitionChain(t *testing.T) {
7171
},
7272
chains: []*pb.Chain{
7373
{
74-
Name: "OUTPUT/1",
74+
Name: "OUTPUT/3c552_e0172bc4fd046_",
7575
Ipsets: []string{"test"},
7676
Direction: pb.Chain_OUTPUT,
7777
Protocol: "tcp",
7878
Target: "DROP",
7979
},
8080
{
81-
Name: "INPUT/1",
81+
Name: "INPUT/3c552_e0172bc4fd046_",
8282
Ipsets: []string{"test"},
8383
Direction: pb.Chain_INPUT,
8484
Protocol: "tcp",
@@ -97,30 +97,30 @@ func TestPatitionChain(t *testing.T) {
9797
},
9898
chains: []*pb.Chain{
9999
{
100-
Name: "OUTPUT/0",
100+
Name: "OUTPUT/3c552_e0172bc4fd04_",
101101
Ipsets: []string{"test"},
102102
Direction: pb.Chain_OUTPUT,
103103
Protocol: "tcp",
104104
TcpFlags: "SYN,ACK SYN,ACK",
105105
Target: "ACCEPT",
106106
},
107107
{
108-
Name: "OUTPUT/1",
108+
Name: "OUTPUT/3c552_e0172bc4fd046_",
109109
Ipsets: []string{"test"},
110110
Direction: pb.Chain_OUTPUT,
111111
Protocol: "tcp",
112112
Target: "DROP",
113113
},
114114
{
115-
Name: "INPUT/0",
115+
Name: "INPUT/3c552_e0172bc4fd04_",
116116
Ipsets: []string{"test"},
117117
Direction: pb.Chain_INPUT,
118118
Protocol: "tcp",
119119
TcpFlags: "SYN,ACK SYN,ACK",
120120
Target: "ACCEPT",
121121
},
122122
{
123-
Name: "INPUT/1",
123+
Name: "INPUT/3c552_e0172bc4fd046_",
124124
Ipsets: []string{"test"},
125125
Direction: pb.Chain_INPUT,
126126
Protocol: "tcp",
@@ -130,7 +130,7 @@ func TestPatitionChain(t *testing.T) {
130130
},
131131
}
132132
for _, tc := range testCases {
133-
chains, err := tc.cmd.AdditionalChain("test")
133+
chains, err := tc.cmd.AdditionalChain("test", "3c5528e1-4c32-4f80-983c-913ad7e860e2")
134134
if err != nil {
135135
t.Errorf("failed to partition chain: %v", err)
136136
}

‎pkg/server/chaosd/network.go‎

Lines changed: 37 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -74,16 +74,13 @@ func (networkAttack) Attack(options core.AttackConfig, env Environment) (err err
7474
}
7575
}
7676

77-
if attack.NeedApplyIptables() {
78-
if err = env.Chaos.applyIptables(attack, ipsetName, env.AttackUid); err != nil {
79-
return perrors.WithStack(err)
80-
}
77+
if err = env.Chaos.applyIptables(attack, ipsetName, env.AttackUid); err != nil {
78+
return perrors.WithStack(err)
8179
}
8280

83-
if attack.NeedApplyTC() {
84-
if err = env.Chaos.applyTC(attack, ipsetName, env.AttackUid); err != nil {
85-
return perrors.WithStack(err)
86-
}
81+
// Because some tcs add filter iptables which will not be stored in the DB, we must re-apply these tcs to add the iptables.
82+
if err = env.Chaos.applyTC(attack, ipsetName, env.AttackUid); err != nil {
83+
return perrors.WithStack(err)
8784
}
8885

8986
case core.NetworkNICDownAction:
@@ -140,9 +137,11 @@ func (s *Server) applyIptables(attack *core.NetworkCommand, ipset, uid string) e
140137
return perrors.WithStack(err)
141138
}
142139
chains := core.IptablesRuleList(iptables).ToChains()
140+
141+
var newChains []*pb.Chain
143142
// Presently, only partition and delay with `accept-tcp-flags` need to add additional chains
144143
if attack.NeedAdditionalChains() {
145-
newChains, err := attack.AdditionalChain(ipset)
144+
newChains, err = attack.AdditionalChain(ipset, uid)
146145
if err != nil {
147146
return perrors.WithStack(err)
148147
}
@@ -156,15 +155,17 @@ func (s *Server) applyIptables(attack *core.NetworkCommand, ipset, uid string) e
156155
return perrors.WithStack(err)
157156
}
158157

159-
// TODO: cwen0
160-
//if err := s.iptablesRule.Set(context.Background(), &core.IptablesRule{
161-
// Name: newChain.Name,
162-
// IPSets: strings.Join(newChain.Ipsets, ","),
163-
// Direction: pb.Chain_Direction_name[int32(newChain.Direction)],
164-
// Experiment: uid,
165-
//}); err != nil {
166-
// return perrors.WithStack(err)
167-
//}
158+
for _, newChain := range newChains {
159+
if err := s.iptablesRule.Set(context.Background(), &core.IptablesRule{
160+
Name: newChain.Name,
161+
IPSets: strings.Join(newChain.Ipsets, ","),
162+
Direction: pb.Chain_Direction_name[int32(newChain.Direction)],
163+
Protocol: newChain.Protocol,
164+
Experiment: uid,
165+
}); err != nil {
166+
return perrors.WithStack(err)
167+
}
168+
}
168169

169170
return nil
170171
}
@@ -180,17 +181,24 @@ func (s *Server) applyTC(attack *core.NetworkCommand, ipset string, uid string)
180181
return perrors.WithStack(err)
181182
}
182183

183-
newTC, err := attack.ToTC(ipset)
184-
if err != nil {
185-
return perrors.WithStack(err)
186-
}
184+
var newTC *pb.Tc
185+
if attack.NeedApplyTC() {
186+
newTC, err = attack.ToTC(ipset)
187+
if err != nil {
188+
return perrors.WithStack(err)
189+
}
187190

188-
tcs = append(tcs, newTC)
191+
tcs = append(tcs, newTC)
192+
}
189193

190194
if _, err := s.svr.SetTcs(context.Background(), &pb.TcsRequest{Tcs: tcs, EnterNS: false}); err != nil {
191195
return perrors.WithStack(err)
192196
}
193197

198+
if !attack.NeedApplyTC() {
199+
return nil
200+
}
201+
194202
tc := &core.TcParameter{
195203
Device: attack.Device,
196204
}
@@ -380,22 +388,16 @@ func (networkAttack) Recover(exp core.Experiment, env Environment) error {
380388
case core.NetworkPortOccupiedAction:
381389
return env.Chaos.recoverPortOccupied(attack, env.AttackUid)
382390
case core.NetworkDelayAction, core.NetworkLossAction, core.NetworkCorruptAction, core.NetworkDuplicateAction, core.NetworkPartitionAction, core.NetworkBandwidthAction:
383-
if attack.NeedApplyIPSet() {
384-
if err := env.Chaos.recoverIPSet(env.AttackUid); err != nil {
385-
return perrors.WithStack(err)
386-
}
391+
if err := env.Chaos.recoverIPSet(env.AttackUid); err != nil {
392+
return perrors.WithStack(err)
387393
}
388394

389-
if attack.NeedApplyIptables() {
390-
if err := env.Chaos.recoverIptables(env.AttackUid); err != nil {
391-
return perrors.WithStack(err)
392-
}
395+
if err := env.Chaos.recoverIptables(env.AttackUid); err != nil {
396+
return perrors.WithStack(err)
393397
}
394398

395-
if attack.NeedApplyTC() {
396-
if err := env.Chaos.recoverTC(env.AttackUid, attack.Device); err != nil {
397-
return perrors.WithStack(err)
398-
}
399+
if err := env.Chaos.recoverTC(env.AttackUid, attack.Device); err != nil {
400+
return perrors.WithStack(err)
399401
}
400402
case core.NetworkNICDownAction:
401403
return env.Chaos.recoverNICDown(attack)

0 commit comments

Comments
 (0)