funman300
0d576a14b7
The Blaze switch was hardwired to 42130 and could not intercept the redirector.
Rather than clone it, the iptables logic now lives in one place:
openfut-switch.sh generic: --server-ip --intercept-port --target-port
--name [--client-ip] [--legacy-tag]
blaze-switch.sh thin wrapper, CLI and output UNCHANGED so the validated
gate runbook and sidecar.sh's cross-check keep working
No deployment IP or port literal in the generic tool; 42130 is supplied by the
wrapper, 42127 by the redirector experiment.
VERIFICATION IS INDEPENDENT OF REMOVAL. Rules are created and deleted by their
comment tag; they are verified by parsing the kernel's own FIELDS (chain,
destination, dport, to-ports) with no reference to the comment. Status detects
duplicates, incomplete pairs, conflicting targets under one name, and foreign
redirects on the same port -- which it reports but never deletes. `off` removes
only rules bearing this switch's exact tag, then re-reads the table to confirm.
THREE BUGS FOUND WHILE BUILDING IT, all in the same family as the original
lying rollback:
1. Renaming the tag ORPHANED live rules. Gate 10 deliberately ended with the
switch on, so rules carrying the old tag were still installed and the
renamed tool could not see them -- `off` would have reported success while
traffic stayed redirected. Hence --legacy-tag: a rename must not strand
rules it owns.
2. Deleting by re-feeding the raw `iptables-save` line through the shell fails
on this iptables, which prints `--comment "tag"` WITH quotes; word-splitting
leaves the quotes inside the value so nothing matches. Bare-comment rules
deleted fine, which is exactly what made it look like it worked. Deletes are
now rebuilt from parsed fields and passed as argv elements.
3. `IFS=$'\t' read` collapsed consecutive tabs because tab is IFS *whitespace*,
so an absent `-s` shifted every later field left and produced
`-s <dport> --dport <to_ports> --to-ports ''`. Harmless here, but a shifted
spec that matched a real rule would delete the wrong one. Now uses \x1f.
Mutation-tested against all seven required cases: wrong intercept port, wrong
target port, missing rule, duplicate rule, changed comment representation
(bare vs quoted), and a rollback that leaves a foreign redirect installed --
which exits non-zero rather than claiming success.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
74 lines
2.9 KiB
Bash
Executable File
74 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
# Blaze switch — COMPATIBILITY WRAPPER over openfut-switch.sh.
|
||
#
|
||
# blaze-switch.sh status
|
||
# blaze-switch.sh on <LAN_IP> <RUST_PORT> Blaze -> Rust sidecar
|
||
# blaze-switch.sh off Blaze -> Python (rollback)
|
||
#
|
||
# The CLI and output are unchanged from the version used for gates 5–10, so the
|
||
# validated Blaze runbook and `sidecar.sh`'s cross-check keep working exactly as
|
||
# before. All iptables logic now lives in `openfut-switch.sh`: one
|
||
# implementation, because two scripts editing the same table diverge and then
|
||
# disagree about what is installed.
|
||
#
|
||
# The only Blaze-specific knowledge left here is the intercepted port, 42130,
|
||
# which the generic tool never assumes.
|
||
set -uo pipefail
|
||
|
||
HERE="$(cd "$(dirname "$(readlink -f "$0")")" && pwd)"
|
||
GENERIC="$HERE/openfut-switch.sh"
|
||
BLAZE_PORT=42130
|
||
NAME=blaze
|
||
# Tag used before the switch was generalised. Rules installed by the gate 5-10
|
||
# tooling still carry it, so they must remain removable — a rename that orphans
|
||
# live NAT rules is worse than no rename at all.
|
||
LEGACY_TAG=openfut-blaze-switch
|
||
|
||
[[ -x "$GENERIC" ]] || { echo "blaze-switch: missing $GENERIC" >&2; exit 2; }
|
||
|
||
case "${1:-}" in
|
||
status)
|
||
# Translate the generic report into the wording the Blaze runbook and
|
||
# sidecar.sh already match on ("redirected to the RUST" / "served by
|
||
# PYTHON"). Kept verbatim so the proven tooling does not change.
|
||
out="$("$GENERIC" status --name "$NAME" --legacy-tag "$LEGACY_TAG" --intercept-port "$BLAZE_PORT" 2>&1)"
|
||
rc=$?
|
||
if grep -q '^INACTIVE' <<<"$out"; then
|
||
echo "Blaze is served by PYTHON (no switch rules)"
|
||
else
|
||
echo "Blaze is redirected to the RUST sidecar:"
|
||
grep -E '^\s+(blaze|openfut-switch)' <<<"$out" | sed 's/^/ /'
|
||
grep -E '^\s+!!|\?\?' <<<"$out" >&2 || true
|
||
fi
|
||
exit $rc
|
||
;;
|
||
on)
|
||
shift
|
||
ip="${1:-}"; port="${2:-}"
|
||
[[ -n "$ip" && -n "$port" ]] || {
|
||
echo "usage: blaze-switch.sh on <LAN_IP> <RUST_PORT>" >&2; exit 2; }
|
||
"$GENERIC" on --name "$NAME" --legacy-tag "$LEGACY_TAG" --server-ip "$ip" \
|
||
--intercept-port "$BLAZE_PORT" --target-port "$port" >/dev/null || exit 1
|
||
echo "Blaze -> RUST: $ip:$BLAZE_PORT now lands on local port $port"
|
||
echo " 127.0.0.1:$BLAZE_PORT still reaches PYTHON (unmatched by design)"
|
||
echo " roll back with: $0 off"
|
||
echo
|
||
echo " NOTE: while this is on, the sidecar MUST stay up. Stopping it without"
|
||
echo " switching off leaves Blaze pointing at a dead port."
|
||
;;
|
||
off)
|
||
out="$("$GENERIC" off --name "$NAME" --legacy-tag "$LEGACY_TAG" --intercept-port "$BLAZE_PORT" 2>&1)"
|
||
rc=$?
|
||
if [[ $rc -ne 0 ]]; then
|
||
echo "$out" >&2
|
||
exit $rc
|
||
fi
|
||
n="$(sed -nE 's/.*removed ([0-9]+) rule.*/\1/p' <<<"$out")"
|
||
echo "Blaze -> PYTHON: removed ${n:-0} rule(s), verified none remain"
|
||
;;
|
||
*)
|
||
sed -n '2,8p' "$0" | sed 's/^# \?//'
|
||
exit 2
|
||
;;
|
||
esac
|