[ upstream commit ffdede7 ]

[ backporter's notes: changed node_config.h to support definition of
  CILIUM_NET_IFINDEX and CILIUM_HOST_IFINDEX macros, which are needed in
  the backported test. Unfortunately, CONFIG(cilium_host_ifindex) has not
  been backported, and re-defining the macro is not possible, so I hacked it ]

This commits adds IPv4/IPv6 tests for the case in which L7LB is enabled
and opens a connection on behalf of a pod destined to a local backend.
In case per-endpoint routes are not enabled, the packet will be handled
in the cil_from_host program, will tail call to the egress policy program,
and then return to stack.

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>

[ upstream commit ea17ed8 ]

[ backporter's notes: using macro CILIUM_HOST_IFINDEX instead of
  CONFIG(cilium_host_ifindex) as it was not backported. ]

In commit d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB"),
we enabled support for re-entering the LXC egress path after a packet is
processed by a L7 LB. This allows us to correctly apply egress policies to
packets sent by a L7 LB to local backends.

Without per-endpoint routes, the pod policies are checked from the tail
call in bpf_host. We reach this code from cilium_host (ctx->ifindex).

With per-endpoint routes, the packet is handled directly in the
local backend pod `cil_to_container` path, completely skipping ingress
policies. Returning CTX_ACT_OK at this point would bypass policies.
To fix this, we need to hairpin the packet back to cil_to_container
(the ctx->mark is already cleared at the beginning of the codepath).
This would allow us to correctly apply ingress policies on the local
backend ingress path, restoring the expected behavior.

Fixes: d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB")

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>