From ddedd6ea360b44f5f6ceb7b2bed9d858329e63bb Mon Sep 17 00:00:00 2001 From: Jarno Rajahalme Date: Thu, 26 Mar 2020 15:31:23 -0700 Subject: [PATCH] istio-iptables: Replace socket match with conntrack match Some kernels, like COS on GKE, are configured without the 'xt_socket' kernel module that implements the 'socket' match in iptables rules. Replace the 'socket' match with a 'conntrack' state match that diverts all established and related packets to the local stack. Signed-off-by: Jarno Rajahalme --- tools/packaging/common/istio-iptables.sh | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/tools/packaging/common/istio-iptables.sh b/tools/packaging/common/istio-iptables.sh index 30c673bd4..e10db5917 100755 --- a/tools/packaging/common/istio-iptables.sh +++ b/tools/packaging/common/istio-iptables.sh @@ -422,7 +422,7 @@ if [ -n "${INBOUND_PORTS_INCLUDE}" ]; then if [ "${INBOUND_INTERCEPTION_MODE}" = "TPROXY" ]; then # If an inbound packet belongs to an established socket, route it to the # loopback interface. - iptables -t mangle -A ISTIO_INBOUND -p tcp -m socket -j ISTIO_DIVERT || echo "No socket match support" + iptables -t mangle -A ISTIO_INBOUND -p tcp -m conntrack --ctstate RELATED,ESTABLISHED -j ISTIO_DIVERT || echo "No conntrack match support" # Otherwise, it's a new connection. Redirect it using TPROXY. iptables -t mangle -A ISTIO_INBOUND -p tcp -j ISTIO_TPROXY else @@ -432,8 +432,7 @@ if [ -n "${INBOUND_PORTS_INCLUDE}" ]; then # User has specified a non-empty list of ports to be redirected to Envoy. for port in ${INBOUND_PORTS_INCLUDE}; do if [ "${INBOUND_INTERCEPTION_MODE}" = "TPROXY" ]; then - iptables -t mangle -A ISTIO_INBOUND -p tcp --dport "${port}" -m socket -j ISTIO_DIVERT || echo "No socket match support" - iptables -t mangle -A ISTIO_INBOUND -p tcp --dport "${port}" -m socket -j ISTIO_DIVERT || echo "No socket match support" + iptables -t mangle -A ISTIO_INBOUND -p tcp --dport "${port}" -m conntrack --ctstate RELATED,ESTABLISHED -j ISTIO_DIVERT || echo "No conntrack match support" iptables -t mangle -A ISTIO_INBOUND -p tcp --dport "${port}" -j ISTIO_TPROXY else iptables -t nat -A ISTIO_INBOUND -p tcp --dport "${port}" -j ISTIO_IN_REDIRECT