[ upstream commit f1ac9a2 ]

Store current DNS rules with the Endpoint and use them in the DNS
proxy during initial regeneration of the restrored endpoints.

DNS proxy starts with restored DNS rules based on allowed IP
addresses. These rules are removed for each endpoint as soon as the
first regeneration completes. Such restored rules should allow DNS
requests to be served, but for new DNS resolutions to be added to the
Endpoint's policy the restored endpoint's must still have their first
regeneration completed.

Signed-off-by: Jarno Rajahalme <jarno@covalent.io>

[ upstream commit 8c7b980 ]

Normally the number of DNS proxy rules should be very small. To guard
against pathological cases, limit the number of IPs processed to 1000
per port.

Signed-off-by: Jarno Rajahalme <jarno@covalent.io>

[ upstream commit bdf15d4 ]

Use restored Endpoints during Cilium restart when Endpoints are no yet available.

Do not error out if the destination IP can not be found from ipcache,
but default to WORLD destination security identity instead.  This
allows IP-based restored rules to be processed before ipcache is fully
updated.

Signed-off-by: Jarno Rajahalme <jarno@covalent.io>

[ upstream commit 3c2996b ]

"Proxy stats not found when updating" warnigns are currently issued if
stats updates are received for a proxy redirect that can not be
found. There are two common scenarios where this can happen as part of
normal operation:

1. A policy change removed a proxy redirect, and stats updates from
  requests that were redirected to the proxy before the datapath
  redirect entry was removed are received.

2. DNS proxy issues stats for requests that have been forwarded on the
  basis of a restored DNS policy while the Endpoint policy has not yet
  been computed.

Demote this log message to debug level to avoid these false warnings.

Signed-off-by: Jarno Rajahalme <jarno@covalent.io>

[ upstream commit 78daa53 ]

removeRestoredRules() requires locking, better reflect that in the
function name.

Signed-off-by: Jarno Rajahalme <jarno@covalent.io>

[ upstream commit 6173e1c ]

Re-run connectivity test while Cilium is still restarting. This should
succeed as the same DNS names were used in a connectivity test before
the restart.

Signed-off-by: Jarno Rajahalme <jarno@covalent.io>