fix(network): preserve pre-existing root qdisc on tc-based attacks#207
Draft
joshiste wants to merge 1 commit into
Draft
fix(network): preserve pre-existing root qdisc on tc-based attacks#207joshiste wants to merge 1 commit into
joshiste wants to merge 1 commit into
Conversation
joshiste
force-pushed
the
fix/preserve-root-qdisc
branch
2 times, most recently
from
a043a6d to
d8f766d
Compare
Network attacks (delay, loss, corruption, bandwidth) on hosts where the kernel had already attached a root qdisc to the target interface (e.g. `mq` on GKE COS / EKS / AKS / RHCOS) previously failed with `NLM_F_REPLACE needed to override`. Bump action_kit_commons to pick up the `tc qdisc replace`-based apply path. Propagate the preflight warnings returned by `netfault.Apply` to the action Start result as Warn-level messages. The user sees a warning when an interface has a user-installed root qdisc (htb, cake, ...) that the kernel will not auto-restore on revert. Add an e2e test (`network delay preserves pre-existing root qdisc`) covering the two preflight branches: a veth interface with the kernel-default `noqueue` (no warning expected) and a dummy with a user-installed `htb` (warning expected). The apply path is kind- agnostic so a single case per branch is enough; parser coverage across qdisc kinds lives in netfault/preflight_test.go fixtures. Note: the test deliberately does not assert which kind the kernel attaches after `qdisc del root` — that's a kernel property dependent on device flags (IFF_NO_QUEUE) and net.core.default_qdisc, not this extension's behavior. We only assert that our injected `prio` is gone.
joshiste
force-pushed
the
fix/preserve-root-qdisc
branch
from
d8f766d to
f63e458
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
action_kit_commonsto the newtc qdisc replace-based apply path. Network attacks (delay/loss/corruption/bandwidth) now succeed on hosts where the kernel already has a root qdisc attached (mqon GKE COS / EKS / AKS / RHCOS, where the attack previously failed withNLM_F_REPLACE needed to override).netfault.Applypreflight warnings to the action Start result asWarn-level messages. Users see a warning when an interface has a user-installed root qdisc (htb, cake, …) that the kernel won't auto-restore on revert.network delay preserves pre-existing root qdisc) that creates dummy interfaces with each of the kernel-auto-restored qdisc kinds (mq,fq_codel,pfifo_fast,noqueue,fq) plus a user-installedhtb, and verifies the apply/revert cycle restores state.Related ticket: https://steadybitgmbh.kanbanize.com/ctrl_board/9/cards/18920/details/
Depends on steadybit/action-kit#442 — the go.mod currently pins a pseudo-version from that branch. Will be re-pinned to v1.8.0 before merge — see checklist.
Pre-merge checklist
go/action_kit_commons/v1.8.0tag pushedgo get github.com/steadybit/action-kit/go/action_kit_commons@v1.8.0 && go mod tidyTest plan
go build ./...cleango vet ./...cleannetwork delay preserves pre-existing root qdiscruns green across containerd/cri-o/docker (CI)Notes
action_kit_commonsis tagged.