daemon: implicitly enable host services when node port is enabled
daemon: implicitly enable host services when node port is enabled

Given we share the same services table, we can reuse all of the host
services load balancing facility to get connectivity working from a
Cilium host:

  # ./daemon/cilium-agent --auto-direct-node-routes=true --ipv4-range 10.11.0.0/16 --kvstore-opt consul.address=192.168.1.125:8500 --kvstore consul --tunnel=disabled --device=eno1 --enable-ipv6=false --disable-envoy-version-check=true --masquerade=false --enable-node-port=true

  # cilium endpoint list
  ENDPOINT   POLICY (ingress)   POLICY (egress)   IDENTITY   LABELS (source:key[=value])                                              IPv6   IPv4            STATUS
             ENFORCEMENT        ENFORCEMENT
  868        Disabled           Disabled          17521      container:maintainer=NGINX Docker Maintainers <docker-maint@nginx.com>          10.11.9.146     ready
  3486       Disabled           Disabled          4          reserved:health                                                                 10.11.134.107   ready

  # cilium service list
  ID     Frontend              Backend
  3000   192.168.1.125:31000   1 => 10.12.111.220:80   <-- node port service on remote node
  3001   192.168.1.125:31001   1 => 10.11.9.146:80     <-- node port service on local node

  # curl 192.168.1.125:31000
  <!DOCTYPE html>
  <html>
  <head>
  <title>Welcome to nginx!</title>
  [...]

  # curl 192.168.1.125:31001
  <!DOCTYPE html>
  <html>
  <head>
  <title>Welcome to nginx!</title>
  [...]

tcpdump for the remote node:

  # tcpdump -i any port 80 or port 31000 -n
  tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
  listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
  14:45:08.951028 IP 192.168.1.125.45096 > 10.12.111.220.80: Flags [S], seq 427343062, win 64240, options [mss 1460,sackOK,TS val 788775526 ecr 0,nop,wscale 7], length 0
  14:45:08.951284 IP 10.12.111.220.80 > 192.168.1.125.45096: Flags [S.], seq 3138813364, ack 427343063, win 65160, options [mss 1460,sackOK,TS val 884710867 ecr 788775526,nop,wscale 7], length 0
  14:45:08.951327 IP 192.168.1.125.45096 > 10.12.111.220.80: Flags [.], ack 1, win 502, options [nop,nop,TS val 788775526 ecr 884710867], length 0
  14:45:08.951388 IP 192.168.1.125.45096 > 10.12.111.220.80: Flags [P.], seq 1:84, ack 1, win 502, options [nop,nop,TS val 788775526 ecr 884710867], length 83: HTTP: GET / HTTP/1.1
  14:45:08.951636 IP 10.12.111.220.80 > 192.168.1.125.45096: Flags [.], ack 84, win 509, options [nop,nop,TS val 884710867 ecr 788775526], length 0
  14:45:08.951659 IP 10.12.111.220.80 > 192.168.1.125.45096: Flags [P.], seq 1:239, ack 84, win 509, options [nop,nop,TS val 884710868 ecr 788775526], length 238: HTTP: HTTP/1.1 200 OK
  14:45:08.951673 IP 192.168.1.125.45096 > 10.12.111.220.80: Flags [.], ack 239, win 501, options [nop,nop,TS val 788775527 ecr 884710868], length 0
  14:45:08.951678 IP 10.12.111.220.80 > 192.168.1.125.45096: Flags [P.], seq 239:851, ack 84, win 509, options [nop,nop,TS val 884710868 ecr 788775526], length 612: HTTP
  14:45:08.951688 IP 192.168.1.125.45096 > 10.12.111.220.80: Flags [.], ack 851, win 501, options [nop,nop,TS val 788775527 ecr 884710868], length 0
  14:45:08.951863 IP 192.168.1.125.45096 > 10.12.111.220.80: Flags [F.], seq 84, ack 851, win 501, options [nop,nop,TS val 788775527 ecr 884710868], length 0
  14:45:08.952061 IP 10.12.111.220.80 > 192.168.1.125.45096: Flags [F.], seq 851, ack 85, win 509, options [nop,nop,TS val 884710868 ecr 788775527], length 0
  14:45:08.952083 IP 192.168.1.125.45096 > 10.12.111.220.80: Flags [.], ack 852, win 501, options [nop,nop,TS val 788775527 ecr 884710868], length 0

One thing that still needs to be resolved for this case is that the node
port must be published for all local addresses, e.g. also 127.0.0.1.

Signed-off-by: Daniel Borkmann <3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@iogearbox.net>

cilium-team/cilium,cilium/cilium,michi-covalent/cilium,tklauser/cilium,tklauser/cilium,tgraf/cilium,michi-covalent/cilium,cilium/cilium,tgraf/cilium,tgraf/cilium,michi-covalent/cilium,tgraf/cilium,cilium/cilium,tklauser/cilium,cilium/cilium,tgraf/cilium,cilium/cilium,cilium-team/cilium,michi-covalent/cilium,michi-covalent/cilium,tgraf/cilium,tklauser/cilium,tklauser/cilium