istio-iptables: Replace socket match with conntrack match (#280)
istio-iptables: Replace socket match with conntrack match (#280)

Some kernels, like COS on GKE, are configured without the 'xt_socket'
kernel module that implements the 'socket' match in iptables
rules. Replace the 'socket' match with a 'conntrack' state match that
diverts all established and related packets to the local stack.

Signed-off-by: Jarno Rajahalme <0f1ab0ac7dffd9db21aa539af2fd4bb04abc3ad4@covalent.io>
istio/cni,istio/cni,istio/cni