switch: one generic NAT implementation; blaze-switch becomes a wrapper
The Blaze switch was hardwired to 42130 and could not intercept the redirector.
Rather than clone it, the iptables logic now lives in one place:
openfut-switch.sh generic: --server-ip --intercept-port --target-port
--name [--client-ip] [--legacy-tag]
blaze-switch.sh thin wrapper, CLI and output UNCHANGED so the validated
gate runbook and sidecar.sh's cross-check keep working
No deployment IP or port literal in the generic tool; 42130 is supplied by the
wrapper, 42127 by the redirector experiment.
VERIFICATION IS INDEPENDENT OF REMOVAL. Rules are created and deleted by their
comment tag; they are verified by parsing the kernel's own FIELDS (chain,
destination, dport, to-ports) with no reference to the comment. Status detects
duplicates, incomplete pairs, conflicting targets under one name, and foreign
redirects on the same port -- which it reports but never deletes. `off` removes
only rules bearing this switch's exact tag, then re-reads the table to confirm.
THREE BUGS FOUND WHILE BUILDING IT, all in the same family as the original
lying rollback:
1. Renaming the tag ORPHANED live rules. Gate 10 deliberately ended with the
switch on, so rules carrying the old tag were still installed and the
renamed tool could not see them -- `off` would have reported success while
traffic stayed redirected. Hence --legacy-tag: a rename must not strand
rules it owns.
2. Deleting by re-feeding the raw `iptables-save` line through the shell fails
on this iptables, which prints `--comment "tag"` WITH quotes; word-splitting
leaves the quotes inside the value so nothing matches. Bare-comment rules
deleted fine, which is exactly what made it look like it worked. Deletes are
now rebuilt from parsed fields and passed as argv elements.
3. `IFS=$'\t' read` collapsed consecutive tabs because tab is IFS *whitespace*,
so an absent `-s` shifted every later field left and produced
`-s <dport> --dport <to_ports> --to-ports ''`. Harmless here, but a shifted
spec that matched a real rule would delete the wrong one. Now uses \x1f.
Mutation-tested against all seven required cases: wrong intercept port, wrong
target port, missing rule, duplicate rule, changed comment representation
(bare vs quoted), and a rollback that leaves a foreign redirect installed --
which exits non-zero rather than claiming success.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
funman300
@@ -1,167 +1,73 @@
|
||||
#!/usr/bin/env bash
|
||||
# Switch the Blaze hop between the Python backend and the Rust sidecar,
|
||||
# WITHOUT modifying the Python backend.
|
||||
# Blaze switch — COMPATIBILITY WRAPPER over openfut-switch.sh.
|
||||
#
|
||||
# blaze-switch.sh status
|
||||
# blaze-switch.sh on <LAN_IP> <RUST_PORT> Blaze -> Rust
|
||||
# blaze-switch.sh on <LAN_IP> <RUST_PORT> Blaze -> Rust sidecar
|
||||
# blaze-switch.sh off Blaze -> Python (rollback)
|
||||
#
|
||||
# WHY NAT RATHER THAN RECONFIGURING THE REDIRECTOR
|
||||
# The CLI and output are unchanged from the version used for gates 5–10, so the
|
||||
# validated Blaze runbook and `sidecar.sh`'s cross-check keep working exactly as
|
||||
# before. All iptables logic now lives in `openfut-switch.sh`: one
|
||||
# implementation, because two scripts editing the same table diverge and then
|
||||
# disagree about what is installed.
|
||||
#
|
||||
# The Python redirector advertises a hardcoded `BLAZE_PORT = 42130`
|
||||
# (blaze_responder_v3b.py:173), so pointing the client at another port would
|
||||
# mean editing the frozen oracle and rebuilding the container. A scoped NAT rule
|
||||
# changes nothing in Python, applies instantly, and rolls back with one command
|
||||
# — exactly the property the A/B needs.
|
||||
#
|
||||
# SCOPE, deliberately narrow
|
||||
#
|
||||
# Rules match ONLY traffic to <LAN_IP>:42130:
|
||||
# * PREROUTING — the FIFA client on the game machine (the real path)
|
||||
# * OUTPUT — this host's own connections, so the switch can be smoke
|
||||
# tested locally before FIFA is involved
|
||||
#
|
||||
# Traffic to 127.0.0.1:42130 is deliberately NOT matched, so Python stays
|
||||
# directly reachable on loopback while the switch is on. That is what lets
|
||||
# check-live-parity.sh compare real Python against real Rust rather than
|
||||
# accidentally comparing Rust against itself.
|
||||
#
|
||||
# MATCHING RULES BY THE BARE TAG, ON PURPOSE
|
||||
#
|
||||
# An earlier version matched `--comment "tag"` with quotes. This iptables emits
|
||||
# the comment unquoted, so removal silently found nothing — and because the
|
||||
# post-removal verification used the SAME matcher, it confirmed its own failure
|
||||
# and reported a successful rollback that had not happened. A rollback that lies
|
||||
# is worse than one that fails.
|
||||
#
|
||||
# Two lessons are baked in below: match the bare tag string so no output-format
|
||||
# assumption can be wrong, and verify with a predicate that does not share the
|
||||
# removal's failure mode.
|
||||
# The only Blaze-specific knowledge left here is the intercepted port, 42130,
|
||||
# which the generic tool never assumes.
|
||||
set -uo pipefail
|
||||
|
||||
TAG="openfut-blaze-switch"
|
||||
PY_PORT=42130
|
||||
SUDO=""
|
||||
[[ $EUID -eq 0 ]] || SUDO=sudo
|
||||
HERE="$(cd "$(dirname "$(readlink -f "$0")")" && pwd)"
|
||||
GENERIC="$HERE/openfut-switch.sh"
|
||||
BLAZE_PORT=42130
|
||||
NAME=blaze
|
||||
# Tag used before the switch was generalised. Rules installed by the gate 5-10
|
||||
# tooling still carry it, so they must remain removable — a rename that orphans
|
||||
# live NAT rules is worse than no rename at all.
|
||||
LEGACY_TAG=openfut-blaze-switch
|
||||
|
||||
die() { echo "blaze-switch: $*" >&2; exit 1; }
|
||||
|
||||
# Full rule specs carrying our tag, as `-A CHAIN ...` lines.
|
||||
tagged_specs() {
|
||||
$SUDO iptables -t nat -S 2>/dev/null | grep -F -- "$TAG" || true
|
||||
}
|
||||
|
||||
# Independent verifier: a different command and a different output format from
|
||||
# the one used to build delete commands, so a parsing bug cannot hide itself.
|
||||
count_tagged() {
|
||||
$SUDO iptables-save -t nat 2>/dev/null | grep -cF -- "$TAG" || true
|
||||
}
|
||||
|
||||
# Behavioural check: is anything still redirecting our port?
|
||||
redirects_to() {
|
||||
$SUDO iptables -t nat -S 2>/dev/null \
|
||||
| grep -E -- "--dport ${PY_PORT}\b" \
|
||||
| grep -F -- "REDIRECT" || true
|
||||
}
|
||||
|
||||
cmd_status() {
|
||||
local specs count
|
||||
specs="$(tagged_specs)"
|
||||
count="$(count_tagged)"
|
||||
|
||||
if [[ -z "$specs" && "$count" == "0" ]]; then
|
||||
echo "Blaze is served by PYTHON (no switch rules)"
|
||||
else
|
||||
echo "Blaze is redirected to the RUST sidecar:"
|
||||
[[ -n "$specs" ]] && echo "$specs" | sed 's/^/ /'
|
||||
fi
|
||||
|
||||
# Disagreement between the two views means one of them is parsing wrongly —
|
||||
# report it rather than trusting either.
|
||||
local n_specs
|
||||
n_specs="$(printf '%s' "$specs" | grep -c . || true)"
|
||||
if [[ "$n_specs" != "$count" ]]; then
|
||||
echo " WARNING: rule views disagree (specs=$n_specs, save=$count)" >&2
|
||||
fi
|
||||
|
||||
local other
|
||||
other="$(redirects_to | grep -vF -- "$TAG" || true)"
|
||||
if [[ -n "$other" ]]; then
|
||||
echo " note: other REDIRECT rules also touch port $PY_PORT:" >&2
|
||||
echo "$other" | sed 's/^/ /' >&2
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
remove_rules() {
|
||||
local removed=0 spec
|
||||
while IFS= read -r spec; do
|
||||
[[ -n "$spec" ]] || continue
|
||||
# `-A CHAIN args…` -> `-D CHAIN args…`
|
||||
# shellcheck disable=SC2086
|
||||
if $SUDO iptables -t nat -D ${spec#-A } 2>/dev/null; then
|
||||
removed=$((removed + 1))
|
||||
else
|
||||
echo "blaze-switch: failed to delete: $spec" >&2
|
||||
fi
|
||||
done < <(tagged_specs)
|
||||
echo "$removed"
|
||||
}
|
||||
|
||||
cmd_on() {
|
||||
local ip="${1:-}" port="${2:-}"
|
||||
[[ -n "$ip" && -n "$port" ]] || die "usage: blaze-switch.sh on <LAN_IP> <RUST_PORT>"
|
||||
|
||||
# Never stack rules: start from a known state.
|
||||
remove_rules >/dev/null
|
||||
|
||||
$SUDO iptables -t nat -I PREROUTING 1 -p tcp -d "$ip" --dport "$PY_PORT" \
|
||||
-m comment --comment "$TAG" -j REDIRECT --to-ports "$port" \
|
||||
|| die "failed to add PREROUTING rule"
|
||||
$SUDO iptables -t nat -I OUTPUT 1 -p tcp -d "$ip" --dport "$PY_PORT" \
|
||||
-m comment --comment "$TAG" -j REDIRECT --to-ports "$port" \
|
||||
|| die "failed to add OUTPUT rule"
|
||||
|
||||
local count
|
||||
count="$(count_tagged)"
|
||||
[[ "$count" == "2" ]] || die "expected 2 rules after 'on', found $count"
|
||||
|
||||
echo "Blaze -> RUST: $ip:$PY_PORT now lands on local port $port"
|
||||
echo " 127.0.0.1:$PY_PORT still reaches PYTHON (unmatched by design)"
|
||||
echo " roll back with: $0 off"
|
||||
echo
|
||||
echo " NOTE: while this is on, the sidecar MUST stay up. Stopping it without"
|
||||
echo " switching off leaves Blaze pointing at a dead port."
|
||||
}
|
||||
|
||||
cmd_off() {
|
||||
local before removed after
|
||||
before="$(count_tagged)"
|
||||
removed="$(remove_rules)"
|
||||
after="$(count_tagged)"
|
||||
|
||||
if [[ "$after" != "0" ]]; then
|
||||
echo "FAILED: $after switch rule(s) still present after removing $removed" >&2
|
||||
tagged_specs | sed 's/^/ /' >&2
|
||||
return 1
|
||||
fi
|
||||
# Independent of the tag entirely: nothing should still be redirecting the
|
||||
# Blaze port. Catches a rule that lost its comment somehow.
|
||||
local stray
|
||||
stray="$(redirects_to)"
|
||||
if [[ -n "$stray" ]]; then
|
||||
echo "FAILED: a REDIRECT rule still targets port $PY_PORT:" >&2
|
||||
echo "$stray" | sed 's/^/ /' >&2
|
||||
return 1
|
||||
fi
|
||||
|
||||
echo "Blaze -> PYTHON: removed $removed rule(s) (was $before), verified none remain"
|
||||
return 0
|
||||
}
|
||||
[[ -x "$GENERIC" ]] || { echo "blaze-switch: missing $GENERIC" >&2; exit 2; }
|
||||
|
||||
case "${1:-}" in
|
||||
status) shift; cmd_status "$@" ;;
|
||||
on) shift; cmd_on "$@" ;;
|
||||
off) shift; cmd_off "$@" ;;
|
||||
*) sed -n '2,10p' "$0" | sed 's/^# \?//'; exit 2 ;;
|
||||
status)
|
||||
# Translate the generic report into the wording the Blaze runbook and
|
||||
# sidecar.sh already match on ("redirected to the RUST" / "served by
|
||||
# PYTHON"). Kept verbatim so the proven tooling does not change.
|
||||
out="$("$GENERIC" status --name "$NAME" --legacy-tag "$LEGACY_TAG" --intercept-port "$BLAZE_PORT" 2>&1)"
|
||||
rc=$?
|
||||
if grep -q '^INACTIVE' <<<"$out"; then
|
||||
echo "Blaze is served by PYTHON (no switch rules)"
|
||||
else
|
||||
echo "Blaze is redirected to the RUST sidecar:"
|
||||
grep -E '^\s+(blaze|openfut-switch)' <<<"$out" | sed 's/^/ /'
|
||||
grep -E '^\s+!!|\?\?' <<<"$out" >&2 || true
|
||||
fi
|
||||
exit $rc
|
||||
;;
|
||||
on)
|
||||
shift
|
||||
ip="${1:-}"; port="${2:-}"
|
||||
[[ -n "$ip" && -n "$port" ]] || {
|
||||
echo "usage: blaze-switch.sh on <LAN_IP> <RUST_PORT>" >&2; exit 2; }
|
||||
"$GENERIC" on --name "$NAME" --legacy-tag "$LEGACY_TAG" --server-ip "$ip" \
|
||||
--intercept-port "$BLAZE_PORT" --target-port "$port" >/dev/null || exit 1
|
||||
echo "Blaze -> RUST: $ip:$BLAZE_PORT now lands on local port $port"
|
||||
echo " 127.0.0.1:$BLAZE_PORT still reaches PYTHON (unmatched by design)"
|
||||
echo " roll back with: $0 off"
|
||||
echo
|
||||
echo " NOTE: while this is on, the sidecar MUST stay up. Stopping it without"
|
||||
echo " switching off leaves Blaze pointing at a dead port."
|
||||
;;
|
||||
off)
|
||||
out="$("$GENERIC" off --name "$NAME" --legacy-tag "$LEGACY_TAG" --intercept-port "$BLAZE_PORT" 2>&1)"
|
||||
rc=$?
|
||||
if [[ $rc -ne 0 ]]; then
|
||||
echo "$out" >&2
|
||||
exit $rc
|
||||
fi
|
||||
n="$(sed -nE 's/.*removed ([0-9]+) rule.*/\1/p' <<<"$out")"
|
||||
echo "Blaze -> PYTHON: removed ${n:-0} rule(s), verified none remain"
|
||||
;;
|
||||
*)
|
||||
sed -n '2,8p' "$0" | sed 's/^# \?//'
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
|
||||
Reference in New Issue
Block a user