fix network attack panic

Signed-off-by: cwen0 <cwenyin0@gmail.com>
This commit is contained in:
cwen0 2020-11-11 15:11:16 +08:00
parent 37a0db167f
commit 6072e9b6e9
5 changed files with 19 additions and 10 deletions

View File

@ -54,10 +54,11 @@ func NewNetworkDelayCommand() *cobra.Command {
cmd.Flags().StringVarP(&nFlag.SourcePort, "source-port", "s", "",
"only impact egress traffic from these source ports, use a ',' to separate or to indicate the range, such as 80, 8001:8010. It can only be used in conjunction with -p tcp or -p udp")
cmd.Flags().StringVarP(&nFlag.IPAddress, "ip", "i", "", "only impact egress traffic to these IP addresses")
cmd.Flags().StringVarP(&nFlag.Hostname, "hostname", "h", "", "only impact traffic to these hostnames")
cmd.Flags().StringVarP(&nFlag.Hostname, "hostname", "H", "", "only impact traffic to these hostnames")
cmd.Flags().StringVarP(&nFlag.IPProtocol, "protocol", "p", "",
"only impact traffic using this IP protocol, supported: tcp, udp, icmp, all")
nFlag.Action = core.NetworkDelayAction
nFlag.SetDefault()
return cmd
}

View File

@ -80,6 +80,16 @@ func (n *NetworkCommand) validNetworkDelay() error {
return checkProtocolAndPorts(n.IPProtocol, n.SourcePort, n.EgressPort)
}
func (n *NetworkCommand) SetDefault() {
if len(n.Jitter) == 0 {
n.Jitter = "0ms"
}
if len(n.Correlation) == 0 {
n.Correlation = "0"
}
}
func checkProtocolAndPorts(p string, sports string, dports string) error {
if !utils.CheckPorts(sports) {
return errors.Errorf("source ports %s not valid", sports)

View File

@ -61,19 +61,17 @@ func flushIPSet(ctx context.Context, nsPath string, set *pb.IPSet) error {
// the ipset while existing iptables rules are using them can not be deleted,.
// so we creates an temp ipset and swap it with existing one.
if err := createIPSet(ctx, nsPath, tmpName); err != nil {
return err
return errors.WithStack(err)
}
// add ips to the temp ipset
if err := addCIDRsToIPSet(ctx, nsPath, tmpName, set.Cidrs); err != nil {
return err
return errors.WithStack(err)
}
// rename the temp ipset with the target name of ipset if the taget ipset not exists,
// otherwise swap them with each other.
err := renameIPSet(ctx, nsPath, tmpName, name)
return err
return renameIPSet(ctx, nsPath, tmpName, name)
}
func createIPSet(ctx context.Context, nsPath string, name string) error {
@ -147,7 +145,7 @@ func renameIPSet(ctx context.Context, nsPath string, oldName string, newName str
if !strings.Contains(output, ipsetNewNameExistErr) {
log.Error("rename ipset failed",
zap.String("command", cmd.String()), zap.String("output", output), zap.Error(err))
return err
return errors.WithStack(err)
}
// swap the old ipset and the new ipset if the new ipset already exist.
@ -159,7 +157,7 @@ func renameIPSet(ctx context.Context, nsPath string, oldName string, newName str
if err != nil {
log.Error("swap ipset failed",
zap.String("command", cmd.String()), zap.String("output", string(out)), zap.Error(err))
return err
return errors.WithStack(err)
}
}
return nil

View File

@ -28,7 +28,7 @@ func (s *Server) NetworkAttack(attack *core.NetworkCommand) (string, error) {
uid := uuid.New()
ipsetName := ""
if attack.NeedApplyIPSet() {
ipset, err := attack.ToIPSet(fmt.Sprintf("chaos-%s", uid.String()))
ipset, err := attack.ToIPSet(fmt.Sprintf("chaos-%s", uid.String()[:16]))
if err != nil {
return "", errors.WithStack(err)
}

View File

@ -184,7 +184,7 @@ func applyTCRules(ctx context.Context, tcClient *tcClient, iptables *iptablesCli
Target: fmt.Sprintf("CLASSIFY --set-class %d:%d", parent, index+4),
}
// TODO: refactor this
// TODO: refactor this logic
tc := tcs[0]
if len(tc.Protocol) > 0 {
ch.Protocol = fmt.Sprintf("--protocol %s", tc.Protocol)