Prevent network-blackhole-port from affecting TMDS access

[amogh09]

Summary

Network blackhole port fault with {"Port": 80, "Protocol": "tcp", "TrafficType": "egress"} configuration currently breaks task's access to TMDS since the fault affects all TCP destinations on port 80 which includes TMDS for the task. This is undesirable as TMDS access is needed to interact with Fault Injection APIs.

This PR prevents this issue by adding an additional rule to the fault's iptables chain that accepts all tcp traffic destined for TMDS.

Implementation details

The fault injection handler now appends an additional rule to accept TMDS traffic using the command below.

iptables -A <chain-name> -p tcp -d 169.254.170.2 --dport 80 -j ACCEPT

The fault chain looks like below after the fault has been injected.

Chain egress-tcp-80 (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            169.254.170.2        tcp dpt:80
DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80

Testing

Ran a host mode and awsvpc mode task and then ran the following commands from the task container. The second command below does not work without the changes in this PR.

# Inject network-blackhole-port fault that blocks all TCP traffic destined to port 80
bash-5.2# curl -XPOST --data '{"Port": 80, "Protocol": "tcp", "TrafficType": "ingress"}' ${ECS_AGENT_URI}/fault/v1/network-blackhole-port/start
{"Status":"running"}bash-5.2#

# Now verify that TMDS is still reachable 
bash-5.2# curl -XPOST --data '{"Port": 80, "Protocol": "tcp", "TrafficType": "ingress"}' ${ECS_AGENT_URI}/fault/v1/network-blackhole-port/status
{"Status":"running"}bash-5.2#

New tests cover the changes: yes

Description for the changelog

bugfix: Prevent TMDS access from being impacted by network-blackhole-port fault.

Additional Information

Does this PR include breaking model changes? If so, Have you added transformation functions?

Does this PR include the addition of new environment variables in the README?

Licensing

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.