procnet: replace iptables PREROUTING DNAT with userspace forwarder

[jandubois]

Summary

Replace procnet's PREROUTING DNAT rules with a userspace TCP/UDP forwarder bound on the namespace's tap-interface IP. Eliminates procnet's nat-table writes. Drops the coordination surface #10262 and #10280 worked to manage with CNI portmap and Docker. Removes the route_localnet sysctl write.

Supersedes #10280.

Problem

procnet exposes --network=host 127.0.0.1 listeners to the Windows host by writing a PREROUTING DNAT rule in the nat table. The rule lives in the same chain as CNI portmap (CNI-HOSTPORT-DNAT) and Docker (DOCKER). On iptables-nft kernels (current WSL2 default) DNAT terminates the chain, so the first matching rule wins: procnet shadows
the engine for bridge-network ports.

#10262 fixed the bug with a heuristic stack. #10280 reworked the fix behind a 665-line state machine (portStateTracker) plus 1187 lines of unit tests, probing CNI-HOSTPORT-DNAT and DOCKER before each Append, handling partial failures, append-retry races, and the transient OCI-hook reservation socket.

Approach

Replace the DNAT with a userspace TCP/UDP forwarder bound on the namespace's tap-interface IP. host-switch's gvisor-tap-vsock already routes Windows-side host-port traffic to tapInterfaceIP:HostPort (see src/go/guestagent/pkg/tracker/apitracker.go:106), so a userspace listener there receives Windows-side traffic directly. The forwarder dials 127.0.0.1:` locally.

A two-scan stability gate stays to filter out the transient OCI-hook reservation socket. The gate shrinks because it no longer distinguishes engine-managed from locally-managed ports.

Functional equivalence to the iptables path

Tracing a packet for a --network=host container listening on 127.0.0.1:8009:

1. host-switch's Expose request always sends Remote: tapInterfaceIP:HostPort. The destination IP inside the namespace is the tap IP, regardless of whether procnet observed 127.0.0.1 or 0.0.0.0 as the listener address.
2. determineHostIP (apitracker.go:255) only chooses the Windows-side bind IP: admin install binds the observed HostIP; non-admin always binds 127.0.0.1. In-namespace routing does not depend on this.
3. Existing DNAT path: packet arrives on eth0 with dst=tapInterfaceIP:8009; iptables rewrites to 127.0.0.1:8009; the route_localnet=1 sysctl lets the kernel route the rewritten loopback dst across eth0 → lo; the 127.0.0.1 listener accepts.
4. This PR's path: packet arrives on eth0 with dst=tapInterfaceIP:8009; the userspace listener bound on tapInterfaceIP:8009 accepts; the proxy dials 127.0.0.1:8009 from a fresh socket; the 127.0.0.1 listener accepts.

Same Windows-side bind IP, same in-namespace destination, same delivery to the 127.0.0.1 listener. The route_localnet sysctl is referenced only in scanner_linux.go on main, so dropping it is safe.

What gets deleted versus #10280

• port_state_tracker_linux.go (665 lines) — engine-chain probing, partial-failure handling, append-retry.
• port_state_tracker_linux_test.go (1187 lines).
• iptables helpers: applyLoopbackIPtablesRule, engineChainManagesPort, dnatChainContainsPort, preroutingHasLoopbackRule, isIptablesRuleAbsent, iptablesCommand, wrapExitError, engineDNATChains, dnatRuleRe.
• enableLocalnetRouting and the route_localnet sysctl write.

What's added

• loopback_forwarder_linux.go — TCP/UDP userspace proxy. TCP is a straight accept-and-pipe with a 30-second half-close drain deadline. UDP delegates to gvisor-tap-vsock's forwarder.UDPProxy, which keys flows by source address with a 90-second per-flow idle timeout (UDPConnTrackTimeout).
• scanner_linux.go is restructured around a Tick(scanned) method with the two-scan gate, making the reconciliation logic unit-testable.
• test:unit:guestagent yarn target so the procnet tests actually run in CI (matches a CI gap procnet: don't shadow CNI portmap with PREROUTING DNAT #10280 also flagged).

[Nino-K]

If I'm not mistaken, the code below does not "mirror the forwarder.Add rollback above" because of the continue; it mentions this could leak an entry, since tracker.Add already ran successfully before this loop. And then, after continue, the port is captured in p.published, but no forwarder listener is opened.

[Nino-K]

Would it make sense to replace the continue with something like

     if removeErr := p.tracker.Remove(id); removeErr != nil {
         p.logAddFailure(port, fmt.Sprintf("rollback after bad port: %s", removeErr))
     }
     return fmt.Errorf("/proc/net scanner: bad port %q: %s", b.HostPort, err)

[Nino-K]

Do we need the same check hasWildcardBinding as thepublish to make sure we are not removing published ports with both bindings 127.0.0.1 and 0.0.0.0.