bpf: Pass packets to host via stack instead of redirecting

Packets to a host IP are currently redirected via
cilium_host/cilium_net. The reason for this is mostly historic. For
other packets where routing by the kernel routing tables is desired,
packets are already passed on via TC_ACT_OK to the stack directly.

The two cases where this redirection is needed are:
* For proxy redirection due to a kernel limitation on passing the
  routing tables multiple times. This case is left untouched.
* For the HOST_REDIRECT_TO_INGRESS case, e.g. flannel integration. This
  case is left untouched. The IPv4 and IPv6 case is brought in line to
  not accidently lose this logic later on.

A side effect of this is that the skb gets scrubbed including the
skb->mark. The presence of the identity in the skb->mark is being relied
on in a follow-up fix however.

Therfore, pass packets via the stack using TC_ACT_OK. This is faster,
simpler, and allows for the identity to be carried in the mark.

Fixes: #9784

Signed-off-by: Thomas Graf <thomas@cilium.io>

bpf/bpf_lxc.c

@@ -319,7 +319,7 @@ static __always_inline int ipv6_l3_from_lxc(struct __ctx_buff *ctx,
 
 #ifdef ENABLE_ROUTING
 to_host:
-	if (is_defined(ENABLE_HOST_REDIRECT)) {
+	if (is_defined(HOST_REDIRECT_TO_INGRESS)) {
 		union macaddr host_mac = HOST_IFINDEX_MAC;
 
 		ret = ipv6_l3(ctx, l3_off, (__u8 *) &router_mac.addr, (__u8 *) &host_mac.addr, METRIC_EGRESS);
@@ -330,7 +330,7 @@ static __always_inline int ipv6_l3_from_lxc(struct __ctx_buff *ctx,
 				  HOST_IFINDEX, reason, monitor);
 
 		cilium_dbg_capture(ctx, DBG_CAPTURE_DELIVERY, HOST_IFINDEX);
-		return redirect(HOST_IFINDEX, 0);
+		return redirect(HOST_IFINDEX, BPF_F_INGRESS);
 	}
 #endif
 
@@ -671,7 +671,7 @@ static __always_inline int handle_ipv4_from_lxc(struct __ctx_buff *ctx,
 
 #ifdef ENABLE_ROUTING
 to_host:
-	if (is_defined(ENABLE_HOST_REDIRECT)) {
+	if (is_defined(HOST_REDIRECT_TO_INGRESS)) {
 		union macaddr host_mac = HOST_IFINDEX_MAC;
 
 		ret = ipv4_l3(ctx, l3_off, (__u8 *) &router_mac.addr, (__u8 *) &host_mac.addr, ip4);
@@ -682,11 +682,7 @@ static __always_inline int handle_ipv4_from_lxc(struct __ctx_buff *ctx,
 				  reason, monitor);
 
 		cilium_dbg_capture(ctx, DBG_CAPTURE_DELIVERY, HOST_IFINDEX);
-#ifdef HOST_REDIRECT_TO_INGRESS
 		return redirect(HOST_IFINDEX, BPF_F_INGRESS);
-#else
-		return redirect(HOST_IFINDEX, 0);
-#endif
 	}
 #endif