datapath: Recreate NodePort CT entries if existing is stale
datapath: Recreate NodePort CT entries if existing is stale

If a service endpoint is accessed via two different NodePort services
from the same source IP and port, a reply from the endpoint will be
wrongly rev-DNAT xlated.

E.g.:

0x6a60e2e6: Conntrack lookup 1/2: src=172.29.50.224:33632 dst=172.29.2.21:32532
0x6a60e2e6: Conntrack lookup 2/2: nexthdr=6 flags=4
0x6a60e2e6: CT verdict: New, revnat=0
0x6a60e2e6: Slave service lookup: slave=1, dport=32532
0x6a60e2e6: Conntrack create: proxy-port=0 revnat=8 src-identity=0 lb=0.0.0.0
0x6a60e2e6: Conntrack lookup 1/2: src=172.29.50.224:33632 dst=10.42.1.254:3306
0x6a60e2e6: Conntrack lookup 2/2: nexthdr=6 flags=1
0x6a60e2e6: CT entry found lifetime=501525, revnat=22
0x6a60e2e6: CT verdict: Established, revnat=22
0xa140b3a1: Conntrack lookup 1/2: src=10.42.1.254:3306 dst=172.29.50.224:33632
0xa140b3a1: Conntrack lookup 2/2: nexthdr=6 flags=0
0xa140b3a1: CT entry found lifetime=523408, revnat=22
0xa140b3a1: CT verdict: Reply, revnat=22
0xa140b3a1: Reverse NAT lookup, index=22
0xa140b3a1: Performing reverse NAT, address=192.168.58.0 port=3306

TCP OUT 172.29.2.21:32532 -> 172.29.50.224:33632 service expires=501869
RxPackets=0 RxBytes=28 RxFlagsSeen=0x00 LastRxReport=0 TxPackets=0
TxBytes=0 TxFlagsSeen=0x02 LastTxReport=501808 Flags=0x0000 [ ] RevNAT=8
SourceSecurityID=0
TCP OUT 192.168.58.0:3306 -> 172.29.50.224:33632 service expires=523409
RxPackets=0 RxBytes=28 RxFlagsSeen=0x00 LastRxReport=0 TxPackets=0
TxBytes=0 TxFlagsSeen=0x1f LastTxReport=501808 Flags=0x0012 [ TxClosing
SeenNonSyn ] RevNAT=22 SourceSecurityID=0
TCP OUT 172.29.50.224:33632 -> 10.42.1.254:3306 expires=523409
RxPackets=8 RxBytes=637 RxFlagsSeen=0x1b LastRxReport=501808
TxPackets=13 TxBytes=861 TxFlagsSeen=0x1f LastTxReport=501808
Flags=0x0032 [ TxClosing SeenNonSyn NodePort ] RevNAT=22
SourceSecurityID=2

First, the endpoint was accessed via 172.29.50.224:33632 ->
192.168.58.0:3306, and afterwards by 172.29.50.224:33632 ->
172.29.2.21:32532. In the second flow, the src IP and port of the
reply was wrongly xlated to 192.168.58.0:3306.

Fix this by recreating CT entries when stale (=of a different svc) entries
are detected.

Signed-off-by: Martynas Pumputis <6b0d31c0d563223024da45691584643ac78c96e8@lambda.lt>

tklauser/cilium,tgraf/cilium,cilium/cilium,tklauser/cilium,tgraf/cilium,cilium/cilium,michi-covalent/cilium,michi-covalent/cilium,cilium/cilium,cilium/cilium,michi-covalent/cilium,michi-covalent/cilium,tgraf/cilium,cilium-team/cilium,tklauser/cilium,tgraf/cilium,tgraf/cilium,tgraf/cilium,cilium-team/cilium,tklauser/cilium,cilium/cilium,tklauser/cilium,michi-covalent/cilium