Geneve DSR is broken when running w/o BPF masquerade

[brb]

Encountered on the latest main (stable branches might be affected too):

12:39:59.287274 IP 172.18.0.2.30851 > 172.18.0.1.44148: Flags [S.], seq 736152428, ack 72597045, win 32950, options [mss 1330,sackOK,TS val 1289060956 ecr 1762384254,nop,wscale 7], length 0
12:39:59.287471 IP 172.18.0.3.80 > 172.18.0.1.44148: Flags [.], ack 72597124, win 257, options [nop,nop,TS val 1289060956 ecr 1762384254], length 0
12:39:59.287486 IP 172.18.0.1.44148 > 172.18.0.3.80: Flags [R], seq 72597124, win 0, length 0
12:39:59.494078 IP 172.18.0.2.30851 > 172.18.0.1.44148: Flags [R], seq 736152429, win 0, length 01

The second reply gets wrong src port (should be 30851 instead of 80). Enabling BPF masq fixes the issue.

[julianwiedmann]

from-overlay is probably missing to consider what's described here for from-netdev traffic (ie where DSR with IP-option would get handled):

cilium/bpf/bpf_host.c

Line 719 in a206965

* second reply from the endpoint to be MASQUERADEd or to be

[julianwiedmann]

This should also cover the same scenario that @giorio94 described in #26407 (comment).