bpf: do not drop unknown protos in nat handling
bpf: do not drop unknown protos in nat handling

Filip reported:

  We are trying Cilium for the first time and we have run into bit of an issue, we
  have keepalived for floating master IP. But when the master is down, and slaves
  try to communicate to obtain the IP via VRRP they get blocked by BPF. I'm not sure
  why this traffic is even caught by BPF as it's not Kubernetes internal traffic.
  The message I extracted from Cilium monitor is this:

  [...]
  CPU 14: MARK 0x28b025e7 FROM 0 DROP: 54 bytes, reason Unsupported protocol for NAT masquerade
  Ethernet	{Contents=[..14..] Payload=[..46..] SrcMAC=ac:1f:6b:9e:c6:4c DstMAC=01:00:5e:00:02:05 EthernetType=IPv4 Length=0}
  IPv4	{Contents=[..20..] Payload=[..20..] Version=4 IHL=5 TOS=192 Length=40 Id=3406 Flags= FragOffset=0 TTL=255 Protocol=VRRP Checksum=22473 SrcIP=100.125.14.12 DstIP=225.0.2.5 Options=[] Padding=[]}
  [...]

A workaround was to deploy via helm --set global.kubeProxyReplacement=partial with
--set global.hostServices.enabled=true, but simply the NAT code should not drop the
protocols it doesn't know and just let the stack handle the rest. Given we use it
mainly for service xlation, TCP and UDP handling is sufficient, partially ICMP for
cases we support (wrt plain masquerading). For completely unknown protocols, just
return NAT_PUNT_TO_STACK.

Reported-by: Filip Dobrovolny (via Slack)
Signed-off-by: Daniel Borkmann <3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@iogearbox.net>

tgraf/cilium,michi-covalent/cilium,tgraf/cilium,tgraf/cilium,michi-covalent/cilium,cilium-team/cilium,tgraf/cilium,tgraf/cilium,tklauser/cilium,cilium/cilium,tklauser/cilium,cilium-team/cilium,cilium/cilium,cilium/cilium,cilium/cilium,michi-covalent/cilium,tgraf/cilium,michi-covalent/cilium,tklauser/cilium,tklauser/cilium,michi-covalent/cilium,cilium/cilium,tklauser/cilium