fix(proxy-init): let established/related replies through enforce-drop

Address review on #484: the AB_EGRESS chain filtered purely on
dest/owner/mark, so reply packets for inbound connections (which also
traverse mangle OUTPUT) to an off-cluster peer would hit the terminal
DROP — e.g. kubelet health-probe responses to the Kind node IP
(172.18.0.0/16, outside the default CLUSTER_CIDRS=10.0.0.0/8), causing
probe failures and pod restarts once enforcement is enabled.

- Add `-m conntrack --ctstate ESTABLISHED,RELATED -j RETURN` as the
  first rule (IPv4 + IPv6). Only NEW app-initiated flows are gated;
  a reply is never a bypass.
- IPv6: also allow link-local multicast (ff02::/16) so NDP
  neighbor/router solicitations work, and correct the comment that
  overstated NDP preservation.
- README: clarify the enforce-drop injection lands in the follow-up
  operator PR rather than reading as already-available.
- test: assert the established/related RETURN exists and is the first
  rule in AB_EGRESS.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

authbridge/proxy-init/README.md

@@ -121,8 +121,9 @@ container automatically:
 - `redirect` mode (`MODE` unset) when the resolved AuthBridge mode is
   `envoy-sidecar`.
 - `enforce-drop` mode (`MODE=enforce-drop`) when `proxy-sidecar`
-  egress enforcement is enabled (opt-in; see the kagenti-operator
-  injector wiring).
+  egress enforcement is enabled (opt-in). _The operator wiring that
+  sets this lands in the follow-up kagenti-operator PR; this PR only
+  adds the mode to the image._
 
 See
 [`authbridge/demos/weather-agent/demo-ui-advanced.md`](../demos/weather-agent/demo-ui-advanced.md)

authbridge/proxy-init/init-iptables.sh

@@ -232,6 +232,12 @@ setup_enforce_drop() {
   # --- IPv4 ---
   ${IPT} -t mangle -N "${CHAIN}" 2>/dev/null || true
   ${IPT} -t mangle -F "${CHAIN}"
+  # Replies to inbound connections (and related flows) are locally generated and
+  # also traverse OUTPUT — a reply is never a "bypass". Let established/related
+  # traffic through FIRST, so e.g. kubelet health-probe responses to an
+  # off-cluster node IP (in Kind the node is 172.18.0.0/16, outside CLUSTER_CIDRS)
+  # are not caught by the terminal DROP. Only NEW app-initiated flows are gated.
+  ${IPT} -t mangle -A "${CHAIN}" -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
   # ztunnel's own sockets (ambient) carry fwmark 0x539 — let them through so the
   # mesh/HBONE path keeps working. No-op when ambient is not installed.
   ${IPT} -t mangle -A "${CHAIN}" -m mark --mark "${ZTUNNEL_MARK}" -j RETURN
@@ -256,16 +262,20 @@ setup_enforce_drop() {
 
   # --- IPv6 ---
   # Cluster is IPv4-only by default; until v6 cluster CIDRs are wired
-  # (CLUSTER_CIDRS6), drop all external v6 egress while allowing loopback,
-  # link-local (NDP), the proxy UID, and ztunnel's mark.
+  # (CLUSTER_CIDRS6), drop external v6 egress while allowing: established/related
+  # replies, loopback, link-local unicast (fe80::/10) and link-local multicast
+  # (ff02::/16, which carries NDP neighbor/router solicitations and MLD), the
+  # proxy UID, and ztunnel's mark.
   if command -v "${IP6T%% *}" >/dev/null 2>&1 && ${IP6T} -t mangle -L >/dev/null 2>&1; then
     ${IP6T} -t mangle -N "${CHAIN}" 2>/dev/null || true
     ${IP6T} -t mangle -F "${CHAIN}"
+    ${IP6T} -t mangle -A "${CHAIN}" -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
     ${IP6T} -t mangle -A "${CHAIN}" -m mark --mark "${ZTUNNEL_MARK}" -j RETURN
     ${IP6T} -t mangle -A "${CHAIN}" -m owner --uid-owner "${PROXY_UID}" -j RETURN
     ${IP6T} -t mangle -A "${CHAIN}" -o lo -j RETURN
     ${IP6T} -t mangle -A "${CHAIN}" -d ::1/128 -j RETURN
     ${IP6T} -t mangle -A "${CHAIN}" -d fe80::/10 -j RETURN
+    ${IP6T} -t mangle -A "${CHAIN}" -d ff02::/16 -j RETURN
     for cidr in $(echo "${CLUSTER_CIDRS6}" | tr ',' ' '); do
       [ -n "${cidr}" ] && ${IP6T} -t mangle -A "${CHAIN}" -d "${cidr}" -j RETURN
     done

authbridge/proxy-init/test-enforce-drop.sh

@@ -53,6 +53,7 @@ echo "--- mangle ruleset ---"; echo "${dump}"
 
 assert() { if echo "${dump}" | grep -qE "$2"; then echo "PASS: $1"; else echo "FAIL: $1"; fail=1; fi; }
 assert "AB_EGRESS hooked from OUTPUT"  '^-A OUTPUT -j AB_EGRESS'
+assert "established/related RETURN"    'AB_EGRESS -m conntrack --ctstate (ESTABLISHED,RELATED|RELATED,ESTABLISHED) -j RETURN'
 assert "ztunnel mark RETURN"           'AB_EGRESS .*mark.*0x539.*-j RETURN'
 assert "proxy UID RETURN"              'AB_EGRESS .*--uid-owner 1337 -j RETURN'
 assert "loopback iface RETURN"         'AB_EGRESS -o lo -j RETURN'
@@ -64,6 +65,12 @@ pos1=$("${IPT}" -t mangle -L OUTPUT --line-numbers -n | awk '$1=="1"{print $2}')
 if [ "${pos1}" = "AB_EGRESS" ]; then echo "PASS: AB_EGRESS at OUTPUT position 1"
 else echo "FAIL: AB_EGRESS not at OUTPUT position 1 (got '${pos1}')"; fail=1; fi
 
+# the established/related RETURN must be the first rule in the chain (replies
+# must be let through before any owner/dest evaluation).
+first_rule=$("${IPT}" -t mangle -S AB_EGRESS | grep '^-A AB_EGRESS' | head -1)
+if echo "${first_rule}" | grep -q 'conntrack'; then echo "PASS: established/related RETURN is first in AB_EGRESS"
+else echo "FAIL: first AB_EGRESS rule is not the conntrack RETURN (got: ${first_rule})"; fail=1; fi
+
 natcount=$("${IPT}" -t nat -S | grep -cE 'AB_EGRESS|REDIRECT|PROXY_' || true)
 if [ "${natcount:-0}" -eq 0 ]; then echo "PASS: no nat-table rules created"
 else echo "FAIL: enforce-drop created nat rules"; fail=1; fi