envoy: Pass 'non-redirect' http traffic through.
envoy: Pass 'non-redirect' http traffic through.

Cilium only creates a host proxy redirect when the relevant policy has
http rules. A sidecar proxy gets also traffic that would not have been
redirected with a host proxy. To emulate the host proxy behavior we
pass (allow) traffic through a sidecar if it is passed through by the
bpf datapath and would not have been redirected to a host proxy.

There are two cases in cilium network policy enforcement where we can
detect that the given packet would not have been forwarded to a host
proxy:

1. There is no port policy that covers this connection. Cilium always
configures a port policy for a redirect, and hence if we find that
there is no applicable port policy, the connection must have been
passed by the bpf datapath to a sidecar and the sidecar proxy should
pass it through, i.e., consider the decision made by the bpf datapath
final.

2. There is a port policy, but it does not have any http rules. Again,
in this case this request would not have been redirected to a host
proxy, and we must consider bpf datapath policy decision as final by
passing the request through the sidecar proxy.

There changes are marked with TODOs as they will need to be
reconsidered when a non-bpf datapaths are supported.

Suggested-by: Romain Lenglet <b8aabb4b95c817d9df69b6be95b2b94d6b1efe17@covalent.io>
Signed-off-by: Jarno Rajahalme <0f1ab0ac7dffd9db21aa539af2fd4bb04abc3ad4@covalent.io>
eloycoto/cilium,tgraf/cilium,michi-covalent/cilium,cilium/cilium,scanf/cilium,michi-covalent/cilium,tklauser/cilium,tklauser/cilium,michi-covalent/cilium,tgraf/cilium,scanf/cilium,tklauser/cilium,eloycoto/cilium,cilium/cilium,scanf/cilium,tklauser/cilium,eloycoto/cilium,tgraf/cilium,michi-covalent/cilium,tgraf/cilium,scanf/cilium,cilium/cilium,tgraf/cilium,scanf/cilium,cilium-team/cilium,cilium/cilium,eloycoto/cilium,scanf/cilium,tgraf/cilium,tklauser/cilium,michi-covalent/cilium,eloycoto/cilium,cilium/cilium,scanf/cilium,eloycoto/cilium,cilium-team/cilium,eloycoto/cilium