[ upstream commit 42ecbb1 ]

This is to clarify the naming and distinguish with the new tests we are
going to introduce in subsequent commits.

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>

[ upstream commit ea17ed8 ]

[ backporter's notes:
  * using macro CILIUM_HOST_IFINDEX instead of CONFIG(cilium_host_ifindex) as it was not backported.
  * fixed conflicts in bpf_lxc.c, as #43226, #42926 and others haven't been backported.
]

In commit d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB"),
we enabled support for re-entering the LXC egress path after a packet is
processed by a L7 LB. This allows us to correctly apply egress policies to
packets sent by a L7 LB to local backends.

Without per-endpoint routes, the pod policies are checked from the tail
call in bpf_host. We reach this code from cilium_host (ctx->ifindex).

With per-endpoint routes, the packet is handled directly in the
local backend pod `cil_to_container` path, completely skipping ingress
policies. Returning CTX_ACT_OK at this point would bypass policies.
To fix this, we need to hairpin the packet back to cil_to_container
(the ctx->mark is already cleared at the beginning of the codepath).
This would allow us to correctly apply ingress policies on the local
backend ingress path, restoring the expected behavior.

Fixes: d1d8e7a ("datapath: Add support for re-entering LXC egress path after L7 LB")

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>