minor nits fixes

Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com>

krkn/scenario_plugins/network_chaos_ng/models.py

@@ -30,6 +30,10 @@ class BaseNetworkChaosConfig:
             )
         if self.id == "node_network_filter" and self.label_selector is None:
             errors.append("label_selector cannot be None")
+        if not isinstance(self.wait_duration, int):
+            errors.append("wait_duration must be an int")
+        if not isinstance(self.test_duration, int):
+            errors.append("test_duration must be an int")
         return errors
 
 
@@ -41,8 +45,14 @@ class NetworkFilterConfig(BaseNetworkChaosConfig):
     target: str
     ports: list[int]
     image: str
+    protocols: list[str]
 
     def validate(self) -> list[str]:
         errors = super().validate()
         # here further validations
+        allowed_protocols = {"tcp", "udp"}
+        if not set(self.protocols).issubset(allowed_protocols):
+            errors.append(
+                f"{self.protocols} contains not allowed protocols only tcp and udp is allowed"
+            )
         return errors

krkn/scenario_plugins/network_chaos_ng/modules/node_network_filter.py

@@ -32,7 +32,7 @@ class NodeNetworkFilterModule(AbstractNetworkChaosModule):
             parallel = True
         try:
             log_info(
-                f"creating workload to filter node {self.config.target} network"
+                f"creating workload to filter node {target} network"
                 f"ports {','.join([str(port) for port in self.config.ports])}, "
                 f"ingress:{str(self.config.ingress)}, "
                 f"egress:{str(self.config.egress)}",

krkn/scenario_plugins/network_chaos_ng/modules/pod_network_filter.py

@@ -33,7 +33,7 @@ class PodNetworkFilterModule(AbstractNetworkChaosModule):
             pod_name = f"pod-filter-{get_random_string(5)}"
             container_name = f"fedora-container-{get_random_string(5)}"
             pod_info = self.kubecli.get_lib_kubernetes().get_pod_info(
-                self.config.target, self.config.namespace
+                target, self.config.namespace
             )
 
             log_info(
@@ -77,38 +77,36 @@ class PodNetworkFilterModule(AbstractNetworkChaosModule):
                 interfaces = self.config.interfaces
 
             container_ids = self.kubecli.get_lib_kubernetes().get_container_ids(
-                self.config.target, self.config.namespace
+                target, self.config.namespace
             )
 
             if len(container_ids) == 0:
                 raise Exception(
-                    f"impossible to resolve container id for pod {self.config.target} namespace {self.config.namespace}"
+                    f"impossible to resolve container id for pod {target} namespace {self.config.namespace}"
                 )
 
             log_info(f"targeting container {container_ids[0]}", parallel, pod_name)
 
-            pid = self.kubecli.get_lib_kubernetes().get_pod_pid(
+            pids = self.kubecli.get_lib_kubernetes().get_pod_pids(
                 base_pod_name=pod_name,
                 base_pod_namespace=self.config.namespace,
                 base_pod_container_name=container_name,
-                pod_name=self.config.target,
+                pod_name=target,
                 pod_namespace=self.config.namespace,
                 pod_container_id=container_ids[0],
             )
 
-            if not pid:
-                raise Exception(
-                    f"impossible to resolve pid for pod {self.config.target}"
-                )
+            if not pids:
+                raise Exception(f"impossible to resolve pid for pod {target}")
 
             log_info(
-                f"resolved pid {pid} in node {pod_info.nodeName} for pod {self.config.target}",
+                f"resolved pids {pids} in node {pod_info.nodeName} for pod {target}",
                 parallel,
                 pod_name,
             )
 
             input_rules, output_rules = generate_namespaced_rules(
-                interfaces, self.config, pid
+                interfaces, self.config, pids
             )
 
             apply_network_rules(
@@ -137,7 +135,7 @@ class PodNetworkFilterModule(AbstractNetworkChaosModule):
                 output_rules,
                 pod_name,
                 self.config.namespace,
-                pid,
+                pids,
             )
 
             self.kubecli.get_lib_kubernetes().delete_pod(

krkn/scenario_plugins/network_chaos_ng/modules/utils_network_filter.py

@@ -16,29 +16,34 @@ def generate_rules(
     for interface in interfaces:
         for port in config.ports:
             if config.egress:
-                output_rules.append(
-                    f"iptables -I OUTPUT 1 -p tcp --dport {port} -m state --state NEW,RELATED,ESTABLISHED -j DROP"
-                )
+                for protocol in set(config.protocols):
+                    output_rules.append(
+                        f"iptables -I OUTPUT 1 -p {protocol} --dport {port} -m state --state NEW,RELATED,ESTABLISHED -j DROP"
+                    )
 
             if config.ingress:
-                input_rules.append(
-                    f"iptables -I INPUT 1 -i {interface} -p tcp --dport {port} -m state --state NEW,RELATED,ESTABLISHED -j DROP"
-                )
+                for protocol in set(config.protocols):
+                    input_rules.append(
+                        f"iptables -I INPUT 1 -i {interface} -p {protocol} --dport {port} -m state --state NEW,RELATED,ESTABLISHED -j DROP"
+                    )
     return input_rules, output_rules
 
 
 def generate_namespaced_rules(
-    interfaces: list[str], config: NetworkFilterConfig, pid: str
+    interfaces: list[str], config: NetworkFilterConfig, pids: list[str]
 ) -> (list[str], list[str]):
-
+    namespaced_input_rules: list[str] = []
+    namespaced_output_rules: list[str] = []
     input_rules, output_rules = generate_rules(interfaces, config)
-
-    namespaced_input_rules = [
-        f"nsenter --target {pid} --net -- {rule}" for rule in input_rules
-    ]
-    namespaced_output_rules = [
-        f"nsenter --target {pid} --net -- {rule}" for rule in output_rules
-    ]
+    for pid in pids:
+        ns_input_rules = [
+            f"nsenter --target {pid} --net -- {rule}" for rule in input_rules
+        ]
+        ns_output_rules = [
+            f"nsenter --target {pid} --net -- {rule}" for rule in output_rules
+        ]
+        namespaced_input_rules.extend(ns_input_rules)
+        namespaced_output_rules.extend(ns_output_rules)
 
     return namespaced_input_rules, namespaced_output_rules
 
@@ -105,22 +110,24 @@ def clean_network_rules_namespaced(
     output_rules: list[str],
     pod_name: str,
     namespace: str,
-    pid: str,
+    pids: list[str],
 ):
     for _ in input_rules:
-        # always deleting the first rule since has been inserted from the top
-        kubecli.exec_cmd_in_pod(
-            [f"nsenter --target {pid} --net -- iptables -D INPUT 1"],
-            pod_name,
-            namespace,
-        )
+        for pid in pids:
+            # always deleting the first rule since has been inserted from the top
+            kubecli.exec_cmd_in_pod(
+                [f"nsenter --target {pid} --net -- iptables -D INPUT 1"],
+                pod_name,
+                namespace,
+            )
     for _ in output_rules:
-        # always deleting the first rule since has been inserted from the top
-        kubecli.exec_cmd_in_pod(
-            [f"nsenter --target {pid} --net -- iptables -D OUTPUT 1"],
-            pod_name,
-            namespace,
-        )
+        for pid in pids:
+            # always deleting the first rule since has been inserted from the top
+            kubecli.exec_cmd_in_pod(
+                [f"nsenter --target {pid} --net -- iptables -D OUTPUT 1"],
+                pod_name,
+                namespace,
+            )
 
 
 def get_default_interface(

scenarios/kube/pod-network-filter.yml

@@ -1,14 +1,17 @@
 - id: pod_network_filter
   image: "quay.io/krkn-chaos/krkn-network-chaos:latest"
   wait_duration: 1
-  test_duration: 60ipt
-  label_selector: ""
+  test_duration: 60
+  label_selector: "app=network-attacked"
   namespace: 'default'
   instance_count: 1
   execution: parallel
   ingress: false
   egress: true
-  target: "network-victim"
+  target: ""
   interfaces: []
+  protocols:
+    - tcp
+    - udp
   ports:
-    - 80
+    - 53