Istio 1.18 iptable rules fail due to inverted destination port match

[Champ-Goblem]

Description

It was noticed on Istio 1.18 that the init-container, which configures the IP table rules, fails to start in gVisor. After examining the rules one-by-one, the following rule fails to validate in gVisor:

iptables-legacy -t nat -A ISTIO_OUTPUT ! -d 127.0.0.1/32 -o lo -p tcp -m tcp ! --dport 15008 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT

This rule can be reduced further to determine that the ! --dport flag causes issues:

iptables-legacy -t nat -A OUTPUT -o lo -p tcp -m tcp ! --dport 1234

Fails with the following error message:

iptables: Invalid argument. Run `dmesg' for more information.

However, removing the ! allows the rule to create:

iptables-legacy -t nat -A OUTPUT -o lo -p tcp -m tcp --dport 1234

Steps to reproduce

No response

runsc version

No response

docker version (if using docker)

No response

uname

No response

kubectl (if using Kubernetes)

No response

repo state (if built from source)

No response

runsc debug logs (if available)

No response

[kevinGC]

Thanks, I didn't know Istio wrote rules like this. Should be a straightforward change to support.

[Champ-Goblem]

Hey @kevinGC I have created a PR with the change already, if not seen