injector: allow redirection of app traffic to itself (#4411)

This change allows an app to invoke itself by enabling
the necessary iptables rules. It allows an app to direct
traffic to itself when:
1. app directs traffic to its pod IP
2. app directs traffic to its k8s service IP
   which is then resolved to the local pod IP
   by Envoy.

Resolves #4340

Signed-off-by: Shashank Ram <[email protected]>

pkg/injector/init_container_test.go

@@ -52,6 +52,8 @@ var _ = Describe("Test functions creating Envoy bootstrap configuration", func()
 -A OSM_PROXY_OUT_REDIRECT -p tcp -j REDIRECT --to-port 15001
 -A OSM_PROXY_OUT_REDIRECT -p tcp --dport 15000 -j ACCEPT
 -A OUTPUT -p tcp -j OSM_PROXY_OUTBOUND
+-A OSM_PROXY_OUTBOUND -o lo ! -d 127.0.0.1/32 -m owner --uid-owner 1500 -j OSM_PROXY_IN_REDIRECT
+-A OSM_PROXY_OUTBOUND -o lo -m owner ! --uid-owner 1500 -j RETURN
 -A OSM_PROXY_OUTBOUND -m owner --uid-owner 1500 -j RETURN
 -A OSM_PROXY_OUTBOUND -d 127.0.0.1/32 -j RETURN
 -A OSM_PROXY_OUTBOUND -j OSM_PROXY_OUT_REDIRECT

pkg/injector/iptables.go

@@ -19,6 +19,15 @@ var iptablesOutboundStaticRules = []string{
 	// For outbound TCP traffic jump from OUTPUT chain to OSM_PROXY_OUTBOUND chain
 	"-A OUTPUT -p tcp -j OSM_PROXY_OUTBOUND",
 
+	// Outbound traffic from Envoy to the local app over the loopback interface should jump to the inbound proxy redirect chain.
+	// So when an app directs traffic to itself via the k8s service, traffic flows as follows:
+	// app -> local envoy's outbound listener -> iptables -> local envoy's inbound listener -> app
+	fmt.Sprintf("-A OSM_PROXY_OUTBOUND -o lo ! -d 127.0.0.1/32 -m owner --uid-owner %d -j OSM_PROXY_IN_REDIRECT", constants.EnvoyUID),
+
+	// Outbound traffic from the app to itself over the loopback interface is not be redirected via the proxy.
+	// E.g. when app sends traffic to itself via the pod IP.
+	fmt.Sprintf("-A OSM_PROXY_OUTBOUND -o lo -m owner ! --uid-owner %d -j RETURN", constants.EnvoyUID),
+
 	// Don't redirect Envoy traffic back to itself, return it to the next chain for processing
 	fmt.Sprintf("-A OSM_PROXY_OUTBOUND -m owner --uid-owner %d -j RETURN", constants.EnvoyUID),
 

pkg/injector/iptables_test.go

@@ -33,6 +33,8 @@ func TestGenerateIptablesCommands(t *testing.T) {
 -A OSM_PROXY_OUT_REDIRECT -p tcp -j REDIRECT --to-port 15001
 -A OSM_PROXY_OUT_REDIRECT -p tcp --dport 15000 -j ACCEPT
 -A OUTPUT -p tcp -j OSM_PROXY_OUTBOUND
+-A OSM_PROXY_OUTBOUND -o lo ! -d 127.0.0.1/32 -m owner --uid-owner 1500 -j OSM_PROXY_IN_REDIRECT
+-A OSM_PROXY_OUTBOUND -o lo -m owner ! --uid-owner 1500 -j RETURN
 -A OSM_PROXY_OUTBOUND -m owner --uid-owner 1500 -j RETURN
 -A OSM_PROXY_OUTBOUND -d 127.0.0.1/32 -j RETURN
 -A OSM_PROXY_OUTBOUND -j OSM_PROXY_OUT_REDIRECT