Fix behavior where packets leave node if there are no backends (v2)

[julianwiedmann]

This is a re-spin of #21539. Now with the complexity improvement from #22342 and passing the problematic test on 4.19.

Quoting from the original PR:

This PR resolves an issue where an outgoing packet destined for a service will not be dropped if it does not have any backends. Currently we will not return the service if there are no backends for it, causing

cilium/bpf/bpf_lxc.c

Lines 1254 to 1266 in 58e4081

	if (svc) {
	#if defined(ENABLE_L7_LB)
	if (lb4_svc_is_l7loadbalancer(svc)) {
	proxy_port = (__u16)svc->l7_lb_proxy_port;
	goto skip_service_lookup;
	}
	#endif /* ENABLE_L7_LB */
	ret = lb4_local(get_ct_map4(&tuple), ctx, ETH_HLEN, l4_off,
	&csum_off, &key, &tuple, svc, &ct_state_new,
	ip4->saddr, has_l4_header, false);
	if (IS_ERR(ret))
	return ret;
	}

To never be run, meaning we will never drop a packet in this case and instead simply route it through the kernels default routes.

Fixes: #21453

Traffic addressed to a service IP is dropped, if no backend is available.

[julianwiedmann]

/test

[aditighag]

@julianwiedmann Looks great! Great job in appeasing the verifier. 🚀 The unit tests look good too.
@michaelasp Did you test the changes manually with policy? The behavior should be same as policy enforcement happens after svc xlate, but it'll be good double check.

[michaelasp]

@julianwiedmann Looks great! Great job in appeasing the verifier. 🚀 The unit tests look good too. @michaelasp Did you test the changes manually with policy? The behavior should be same as policy enforcement happens after svc xlate, but it'll be good double check.

Hey Aditi! I think I only manually verified this without network policy with tcpdump, so it might be a good idea to check, even though I don't have reason to believe that it would impact anything there.

[julianwiedmann]

/test-1.24-5.4

[julianwiedmann]

/test-1.25-4.19

[julianwiedmann]

/test-1.26-net-next

[borkmann]

@michaelasp thanks for the PR. Just follow-up question, did you A/B test behavior against k8s / kube-proxy whether it's exactly in line what kube-proxy does if there's no backend on a node for a given svc?

[qmonnet]

Looks like the backport was handled in #23034.