bpf: Fix broken remote-node identity classification

When Cilium resolves a src ID from ipcache with a remote node IP, the resolved ID
is ignored and returns the world ID. This is because the resolve_srcid_ipv[4,6]
function checks if the resolved src ID is a reserved ID, which includes
the remote node ID, and if it's true, then returns the world ID.
This PR fixes this problem by removing !identity_is_reserved check.

This issue occurs if BPF host routing is in use because Cilium stores the src ID
resolved by resolve_srcid_ipv[4,6] in ipv[4,6]_local_delivery and enforces the policy
using the stored src id. While Cilium uses the src ID resolved in bpx_lxc
tail_ipv4_to_endpoint if the legacy routing mode is enabled. There's no corresponding
!identity_is_reserved check in bpf_lxc side. Therefore it works with the legacy routing
mode.

According to cilium#4874 cilium#6703, this check was added when those introduced the fallback to use
the ipcache data if the packet info does not contain any useful information. As far as I
look it into those PR, there's no solid reason to keep the !identity_is_reserved check,
because resolve_srcid_ipv[4,6] works as follows without the check which is the same as
bpx_lxc tail_ipv4_to_endpoint side.

1. the packet info, ctx->mark, cotaints the identity, then return it
2. the packet info does not contain any useful information, then resolved from ipcache and return it
3. the identity is not resolved from both the packet info and ipcache then return the world ID

Fixes: cilium#18042

Signed-off-by: Yusuke Suzuki <yusuke-suzuki@cybozu.co.jp>

bpf/bpf_host.c

@@ -170,8 +170,7 @@ resolve_srcid_ipv6(struct __ctx_buff *ctx, __u32 srcid_from_proxy,
 	if (from_host)
 		src_id = srcid_from_ipcache;
 	else if (src_id == WORLD_ID &&
-		 identity_from_ipcache_ok() &&
-		 !identity_is_reserved(srcid_from_ipcache))
+		 identity_from_ipcache_ok())
 		src_id = srcid_from_ipcache;
 	return src_id;
 }
@@ -448,8 +447,7 @@ resolve_srcid_ipv4(struct __ctx_buff *ctx, __u32 srcid_from_proxy,
 	/* If we could not derive the secctx from the packet itself but
 	 * from the ipcache instead, then use the ipcache identity.
 	 */
-	else if (identity_from_ipcache_ok() &&
-		 !identity_is_reserved(srcid_from_ipcache))
+	else if (identity_from_ipcache_ok())
 		src_id = srcid_from_ipcache;
 	return src_id;
 }