fix: Capture in-cluster TCP egress in enforce-redirect (keep DNS direct)

enforce-redirect blanket-RETURNed all CLUSTER_CIDRS (default 10.0.0.0/8) egress, so agent->in-cluster TCP (e.g. agent->tool) bypassed the egress pipeline entirely: outbound policy / token-exchange (OBO) never ran for those hops. Only the cooperative HTTP_PROXY path captured them, so any client that ignores HTTP_PROXY escaped enforcement for in-cluster calls.

Narrow the in-cluster RETURN in the nat (TCP) chain to DNS-over-TCP (TCP/53) only: cluster name resolution stays direct while all other in-cluster TCP is REDIRECTed to the transparent listener and seen by the pipeline. The mangle (non-TCP) chain still RETURNs in-cluster CIDRs so DNS-over-UDP and other in-cluster UDP are untouched.

Mesh-agnostic: the proxy's re-originated egress (PROXY_UID, exempt) still falls through to ISTIO_OUTPUT -> ztunnel for transport mTLS under Istio ambient, and goes out plain without a mesh. ztunnel re-captures it because its OUTPUT redirect is mark-gated (! 0x539), not UID-gated.

Validation: structural test (test-enforce-redirect.sh) updated; full cluster validation (Istio ambient mTLS chaining + no-mesh) pending.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

authbridge/proxy-init/init-iptables.sh

@@ -178,11 +178,13 @@ SSH_PORT="${SSH_PORT:-22}"
 OUTBOUND_PORTS_EXCLUDE="${OUTBOUND_PORTS_EXCLUDE:-}"
 INBOUND_PORTS_EXCLUDE="${INBOUND_PORTS_EXCLUDE:-}"
 
-# enforce-redirect mode: in-cluster destinations the agent may reach directly
-# (pods / services / DNS) — external TCP is REDIRECTed to the transparent
-# listener and external non-TCP is dropped. Defaults to the RFC1918 10/8 block
-# which covers typical Kind pod (10.244/16) and service (10.96/16) CIDRs;
-# override with the cluster's actual ranges.
+# enforce-redirect mode: in-cluster CIDRs used to keep cluster DNS resolution
+# working — in-cluster DNS-over-TCP (TCP/53) and in-cluster non-TCP (UDP, incl.
+# DNS) are left direct, while all OTHER in-cluster TCP is now captured by the
+# egress pipeline so agent->in-cluster calls (e.g. agent->tool) are seen.
+# Defaults to the RFC1918 10/8 block (typical Kind pod 10.244/16 + service
+# 10.96/16); override with the cluster's actual ranges (e.g. OpenShift
+# 172.30.0.0/16) so cluster DNS is not captured.
 CLUSTER_CIDRS="${CLUSTER_CIDRS:-10.0.0.0/8}"
 CLUSTER_CIDRS6="${CLUSTER_CIDRS6:-}"   # IPv6 in-cluster CIDRs (dual-stack); empty = none
 
@@ -226,9 +228,11 @@ fi
 # Rule order: RETURN ztunnel's own sockets (fwmark 0x539, no-op without ambient)
 # -> RETURN the proxy's own re-originated egress (PROXY_UID, avoids the loop) ->
 # RETURN loopback (app -> forward proxy via HTTP_PROXY, and any loopback) ->
-# RETURN in-cluster CIDRs (mesh/DNS, left direct) -> REDIRECT external TCP to
-# TRANSPARENT_PORT -> DROP all other external egress (UDP/QUIC, so HTTP/3 can't
-# bypass; well-behaved clients fall back to TCP and get captured).
+# RETURN in-cluster DNS-over-TCP (TCP/53 to CLUSTER_CIDRS, left direct) ->
+# REDIRECT all remaining TCP -- external AND in-cluster -- to TRANSPARENT_PORT
+# (so agent->in-cluster calls are captured too) -> DROP all other external
+# egress (UDP/QUIC, so HTTP/3 can't bypass; clients fall back to TCP). In-cluster
+# non-TCP (UDP, incl. DNS) is left direct by the mangle chain below.
 #
 # The nat REDIRECT chain has no conntrack ESTABLISHED rule: nat only evaluates
 # the first packet of a flow, so replies and established connections are not
@@ -248,7 +252,7 @@ setup_enforce_redirect() {
 
   echo "enforce-redirect: installing fail-closed egress capture"
   echo "enforce-redirect: external TCP -> 127.0.0.1:${TRANSPARENT_PORT} (nat REDIRECT); external non-TCP -> DROP (mangle)"
-  echo "enforce-redirect: exempt proxy UID=${PROXY_UID}; direct in-cluster CIDRs=${CLUSTER_CIDRS}"
+  echo "enforce-redirect: exempt proxy UID=${PROXY_UID}; in-cluster TCP captured (DNS/53 + non-TCP left direct; CIDRs=${CLUSTER_CIDRS})"
 
   # --- IPv4: nat REDIRECT for TCP ---
   ${IPT} -t nat -N "${REDIR_CHAIN}" 2>/dev/null || true
@@ -261,11 +265,15 @@ setup_enforce_redirect() {
   # app -> forward proxy over loopback (HTTP_PROXY target), and any loopback.
   ${IPT} -t nat -A "${REDIR_CHAIN}" -o lo -j RETURN
   ${IPT} -t nat -A "${REDIR_CHAIN}" -d 127.0.0.0/8 -j RETURN
-  # in-cluster traffic (pods / services / DNS) — left direct, carried by the mesh.
+  # in-cluster DNS-over-TCP (TCP/53) — left direct so cluster name resolution is
+  # not captured. All OTHER in-cluster TCP falls through to the REDIRECT below,
+  # so the egress pipeline sees agent->in-cluster calls (e.g. agent->tool). The
+  # proxy's re-originated egress (PROXY_UID, RETURNed above) is exempt, and in an
+  # Istio ambient mesh it falls through to ISTIO_OUTPUT -> ztunnel for mTLS.
   for cidr in $(echo "${CLUSTER_CIDRS}" | tr ',' ' '); do
-    [ -n "${cidr}" ] && ${IPT} -t nat -A "${REDIR_CHAIN}" -d "${cidr}" -j RETURN
+    [ -n "${cidr}" ] && ${IPT} -t nat -A "${REDIR_CHAIN}" -p tcp --dport 53 -d "${cidr}" -j RETURN
   done
-  # external TCP that bypassed the forward proxy — capture it transparently.
+  # all remaining TCP (external + in-cluster, minus in-cluster DNS) — capture it transparently.
   ${IPT} -t nat -A "${REDIR_CHAIN}" -p tcp -j REDIRECT --to-port "${TRANSPARENT_PORT}"
   if ! ${IPT} -t nat -C OUTPUT -j "${REDIR_CHAIN}" 2>/dev/null; then
     ${IPT} -t nat -I OUTPUT 1 -j "${REDIR_CHAIN}"
@@ -280,6 +288,9 @@ setup_enforce_redirect() {
   ${IPT} -t mangle -A "${NOTCP_CHAIN}" -m owner --uid-owner "${PROXY_UID}" -j RETURN
   ${IPT} -t mangle -A "${NOTCP_CHAIN}" -o lo -j RETURN
   ${IPT} -t mangle -A "${NOTCP_CHAIN}" -d 127.0.0.0/8 -j RETURN
+  # in-cluster non-TCP (UDP, incl. DNS) — left direct. In-cluster TCP is now
+  # captured by the nat chain above; only in-cluster UDP relies on this RETURN
+  # (notably DNS-over-UDP, which the terminal DROP below would otherwise kill).
   for cidr in $(echo "${CLUSTER_CIDRS}" | tr ',' ' '); do
     [ -n "${cidr}" ] && ${IPT} -t mangle -A "${NOTCP_CHAIN}" -d "${cidr}" -j RETURN
   done
@@ -305,8 +316,10 @@ setup_enforce_redirect() {
     ${IP6T} -t nat -A "${REDIR_CHAIN}" -d ::1/128 -j RETURN
     ${IP6T} -t nat -A "${REDIR_CHAIN}" -d fe80::/10 -j RETURN
     ${IP6T} -t nat -A "${REDIR_CHAIN}" -d ff02::/16 -j RETURN
+    # in-cluster DNS-over-TCP (TCP/53) only — mirror of IPv4; all other in-cluster
+    # v6 TCP is captured below.
     for cidr in $(echo "${CLUSTER_CIDRS6}" | tr ',' ' '); do
-      [ -n "${cidr}" ] && ${IP6T} -t nat -A "${REDIR_CHAIN}" -d "${cidr}" -j RETURN
+      [ -n "${cidr}" ] && ${IP6T} -t nat -A "${REDIR_CHAIN}" -p tcp --dport 53 -d "${cidr}" -j RETURN
     done
     ${IP6T} -t nat -A "${REDIR_CHAIN}" -p tcp -j REDIRECT --to-port "${TRANSPARENT_PORT}"
     if ! ${IP6T} -t nat -C OUTPUT -j "${REDIR_CHAIN}" 2>/dev/null; then

authbridge/proxy-init/test-enforce-redirect.sh

@@ -8,7 +8,8 @@
 #      position 1 with the expected RETURN exemptions and a `-p tcp` REDIRECT to
 #      TRANSPARENT_PORT (no DROP — the nat table forbids it); and the AB_NOTCP
 #      chain is hooked from mangle OUTPUT with `-p tcp RETURN` then a terminal
-#      DROP for external non-TCP egress.
+#      DROP for external non-TCP egress. In-cluster DNS-over-TCP (TCP/53) is left
+#      direct; all OTHER in-cluster TCP is captured (no blanket in-cluster RETURN).
 #   2. CAPTURE (not drop) + AMBIENT ROBUSTNESS — external TCP egress is
 #      REDIRECTed to TRANSPARENT_PORT, preempting a simulated Istio ambient
 #      "nat OUTPUT REDIRECT" appended after our chain. Proven via packet
@@ -65,7 +66,13 @@ assert "nat ztunnel mark RETURN"            'AB_REDIRECT .*mark.*0x539.*-j RETUR
 assert "nat proxy UID RETURN"               'AB_REDIRECT .*--uid-owner 1337 -j RETURN' "${natdump}"
 assert "nat loopback iface RETURN"          'AB_REDIRECT -o lo -j RETURN' "${natdump}"
 assert "nat loopback cidr RETURN"           'AB_REDIRECT -d 127.0.0.0/8 -j RETURN' "${natdump}"
-assert "nat cluster cidr RETURN"            'AB_REDIRECT -d 10.0.0.0/8 -j RETURN' "${natdump}"
+# in-cluster DNS-over-TCP (TCP/53) is left direct so cluster name resolution is
+# not captured; all OTHER in-cluster TCP now falls through to the REDIRECT.
+assert "nat in-cluster DNS-over-TCP RETURN" 'AB_REDIRECT.*10\.0\.0\.0/8.*dport 53.*RETURN' "${natdump}"
+# the blanket in-cluster RETURN must be gone — in-cluster TCP is now captured.
+if echo "${natdump}" | grep -qE '^-A AB_REDIRECT -d 10\.0\.0\.0/8 -j RETURN$'; then
+  echo "FAIL: nat AB_REDIRECT still blanket-RETURNs in-cluster (in-cluster TCP not captured)"; fail=1
+else echo "PASS: no blanket in-cluster RETURN — in-cluster TCP captured, only DNS/53 left direct"; fi
 assert "nat tcp REDIRECT to transparent"    "AB_REDIRECT -p tcp -j REDIRECT --to-ports ${TPORT}" "${natdump}"
 if echo "${natdump}" | grep -qE 'AB_REDIRECT -j DROP'; then
   echo "FAIL: nat AB_REDIRECT must not contain DROP (nat table forbids it)"; fail=1