kubelet: block non-forwarded packets from crossing the localhost boundary

[squeed]

We set route_localnet so that host-network processes can connect to 127.0.0.1:NodePort and it still works. This, however, is too permissive.

So, block martians that are not already in conntrack.

What type of PR is this?
/kind bug

What this PR does / why we need it:
As outlined in #90259, blindly setting route_localnet is too permissive. We need to ensure that only packets we want can pass the martian boundary.

Which issue(s) this PR fixes:
Fixes #90259

Does this PR introduce a user-facing change?:

NONE

[squeed]

/sig network

[squeed]

/cc @danwinship

[squeed]

/test pull-kubernetes-e2e-kind

[bboreham]

lgtm

[squeed]

This is a bit of an awkward fix to wedge in.

Kubelet isn't actually responsible for setting this sysctl flag. Rather, it's set by kube-proxy and by the CNI port-forward plugin.

However, kubelet owns the KUBE-FIREWALL chain, so it's not unreasonable to add the rule here.

[matthyx]

/lgtm
/priority important-soon
/assign @derekwaynecarr

[danwinship]

However, kubelet owns the KUBE-FIREWALL chain, so it's not unreasonable to add the rule here.

I think @thockin said he wanted to have kubelet doing less networking setup. But as long as this is adding the new setup code to kubelet_network_linux.go rather than somewhere else, it can get cleaned up with the rest later when we figure out where to put it...

[derekwaynecarr]

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: derekwaynecarr, squeed

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/kubelet/OWNERS [derekwaynecarr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[champtar]

@squeed Isn't the merged commit allowing packets from say 127.127.127.127 or 127.0.0.1 to 127.0.0.1 to go through ? (if we want to attack a localhost udp service and don't care about the responses)
Don't we want something like:

iptables -A KUBE-FIREWALL ! -i lo --dst 127.0.0.0/8 -m conntrack ! --ctstate 'RELATED,ESTABLISHED,DNAT' -j DROP

[squeed]

@champtar that's a very good point. A quick test with cnitool and nping shows that your propsed rule has the desired effect.

I'll file a follow-up PR.

[joelsmith]

/cherrypick release-1.18
/cherrypick release-1.17
/cherrypick release-1.16