[v1.14] bpf: Fix identity determination in bpf_overlay.c

[ysksuzuki]

This PR is the manual backport of #29155 for v1.14.

When DSR with Geneve is enabled, Cilium identity is not determined by the client's IP address and requests from outside cluster are dropped even though they are permitted by CiliumNetworkPolicy using fromCIDR.

This commit inputs identity that is from the client IP address.

Fixes: #29153

Also, this PR backports the following PRs to reduce the divergence from the main to make it easier to backport later changes.

• bpf: dsr: merge Ingress tail-calls into nodeport_lb*()
• bpf: ct: simplify ct_action parameter for CT lookup
• bpf: ct: clean up tuple swapping for forward lookups

[julianwiedmann]

/test-backport-1.14

[ysksuzuki]

Need #29553 to run BPF complexity tests

[ysksuzuki]

There is a verifier complexity issue on kernel 6.1 with my branch. e3367b9 fixed it. (It doesn't occur with v1.14 branch with the same config)

level=fatal msg="Failed to compile XDP program" error="loading eBPF collection into the kernel: program tail_handle_snat_fwd_ipv6: load program: argument list too long: BPF program is too large. Processed 1000001 insn (1143 line(s) omitted)" subsys=datapath-loader

# Config
cilium install --wait \
    --chart-directory=/home/yusuke/go/src/github.com/cilium/cilium/install/kubernetes/cilium \
    --helm-set=debug.enabled=true \
    --helm-set=debug.verbose=envoy \
    --helm-set=hubble.eventBufferCapacity=65535 \
    --helm-set=bpf.monitorAggregation=none \
    --helm-set=cluster.name=default \
    --helm-set=authentication.mutual.spire.enabled=false \
    --nodes-without-cilium=kind-worker3 \
    --helm-set-string=kubeProxyReplacement=true \
    --helm-set=image.repository=localhost:5000/cilium/cilium-dev \
    --helm-set=image.useDigest=false \
    --helm-set=image.tag=local \
    --helm-set=image.pullPolicy=Never \
    --helm-set=operator.image.repository=localhost:5000/cilium/operator \
    --helm-set=operator.image.suffix= \
    --helm-set=operator.image.tag=local \
    --helm-set=operator.image.useDigest=false \
    --helm-set=operator.image.pullPolicy=Never \
    --helm-set-string=routingMode=native \
    --helm-set-string=tunnelProtocol=geneve \
    --helm-set-string=autoDirectNodeRoutes=true \
    --helm-set-string=ipv4NativeRoutingCIDR=10.244.0.0/16 \
    --helm-set-string=ipv6NativeRoutingCIDR=fd00:10:244::/56 \
    --helm-set=devices='eth0' \
    --helm-set-string=loadBalancer.mode=dsr \
    --helm-set-string=loadBalancer.dsrDispatch=geneve \
    --helm-set-string=endpointRoutes.enabled=false \
    --helm-set=ipv6.enabled=true \
    --helm-set=bpf.masquerade=true \
    --helm-set=egressGateway.enabled=true \
    --helm-set=loadBalancer.acceleration=testing-only 

[ysksuzuki]

/ci-verifier

[ysksuzuki]

The BPF complexity test is green. It seems that the issue only occurs with kernel 6.1
https://github.com/cilium/cilium/actions/runs/7101950048/job/19331222570

[julianwiedmann]

/test-backport-1.14

[julianwiedmann]

looks good, and bringing the additional CT changes doesn't feel too invasive. Thank you!

[ti-mo]

@ysksuzuki Looks like the commit messages are missing upstream commit references, see https://docs.cilium.io/en/latest/contributing/release/backports/#codecell6 for an example. If you're not using the backporting scripts/tools, you have to add them in by yourself. 🙂

[ysksuzuki]

/test-backport-1.14

[ysksuzuki]

@ti-mo I have added upstream commit references. PTAL. Thanks!