[ upstream commit 0666f53 ]

This change allows for daemon integration tests to run with mock DNS
proxy

Signed-off-by: Maciej Kwiek <maciej@isovalent.com>
Signed-off-by: Ilya Dmitrichenko <errordeveloper@gmail.com>

[ upstream commit 1433181 ]

When a client uses an egress gateway node, it forwards traffic via a
vxlan tunnel to the egress gateway node. If datapath is configured in
non-tunnel mode (direct routing), replies from the gateway to the client
do not go via the tunnel. This causes these replies to be dropped
by iptables because no Cilium's FORWARD rule matches them

This patch identifies above packets (i.e., from egress gw to client),
and steers them via the vlxan tunnel after rev-SNAT is performed even
when datapath is configured in non-tunnel mode.

A suggestion by Paul and Martynas (@brb) was to use the following
condition to identify said packets:
> if rev-SNATed IP ∈ native CIDR && rev-SNATed IP !∈ node pod CIDR => send to tunnel

This patch, instead, checks the egress gateway policy map. This seems
like a safer approach, because all packets that match contents of above
map in the forward direction will be forwarded to the gw node.

Fixes: cilium#17386

Signed-off-by: Kornilios Kourtis <kornilios@isovalent.com>
Signed-off-by: Ilya Dmitrichenko <errordeveloper@gmail.com>

[ upstream commit 0ed817c ]

The original patch
(cilium@06e1f1c)
for this test included an additional policy in test/k8sT/manifests/egress-nat-policy.yaml:

> apiVersion: cilium.io/v2alpha1
> kind: CiliumEgressNATPolicy
> metadata:
>   name: egress-to-black-hole
> spec:
>   egress:
>   - podSelector:
>       matchLabels:
>         zgroup: testDSClient
>     namespaceSelector:
>       matchLabels:
>         ns: cilium-test
>   # Route everything to a black hole.
>   # It shouldn't affect in-cluster traffic.
>   destinationCIDRs:
>   - 0.0.0.0/0
>   egressSourceIP: 1.1.1.1 # It's a black hole

which was meant to test
cilium@b8c757a,
which aimed to address cilium#16147.

The above patch, however, lead to a verification error so it was
excluded from this PR.

Signed-off-by: Yongkun Gui <ygui@google.com>
Signed-off-by: Kornlios Kourtis <kornilios@isovalent.com>
Signed-off-by: Ilya Dmitrichenko <errordeveloper@gmail.com>