[ upstream commit cf6b203 ]

To let EGW traffic exit the gateway through the correct interface,
we've introduced FIB lookup-driven redirects in the to-netdev path
(#26215). This is needed for cases
where the traffic first hits one interface via the default route, but then
needs to bounce to some other interface that matches the actual egressIP.
In this approach we masquerade the packet on its first pass through
to-netdev, set the SNAT_DONE mark, and then redirect to the actual egress
interface. Due to the SNAT_DONE mark we then skip the SNAT logic in the
second pass through to-netdev.

#29379 then improved the situation for
any EGW traffic that enters the gateway from the overlay network (==
anything that's not by a pod on the gateway). We now redirect in
from-overlay, straight to the actual egress interface and masquerade the
packet there.

Now also harmonize the approach for local pods, and defer the masquerade
until the packet hits the actual egress interface. This simplifies the
overall picture. But it also allows us to raise TO_NETWORK datapath trace
events that are enriched with the packet's original source IP - this event
is raised on the *second* pass through to-netdev, so we need the SNAT to
happen at the same time.

Also add a comment to clarify the check to skip HostFW for SNATed traffic.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>

[ upstream commit ecadbf8 ]

[ backporter's notes: additionally configured the cm-auth-mode value
  in the third matrix entry (the one using the external kvstore) to
  workaround validation given that we enable the clustermesh-apiserver
  in that case in Cilium v1.14 (although with 0 replicas) to force
  the creation of the clustermesh configuration. ]

Additionally test the stricter authentication modes, to prevent
introducing possible regressions due to incompatibilities between
Cilium versions.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>

[ upstream commit 6ed0098 ]

When queried for the routes of an unknown IP family the
kernel return the routes for all IP families.

This end up returning the IPv4 routes when IPv6 is disabled
at boot time. Therefore calling DeleteRouteTable with
family = AF_INET6 will delete IPv4 routes too, breaking
the DNS proxy.

Fixes: #30744

Signed-off-by: Foyer Unix <foyerunix@foyer.lu>