Automated cherry pick of #3516: Use uplink MAC as source if packet is output to

pkg/agent/agent_windows.go

@@ -42,6 +42,10 @@ func (i *Initializer) prepareHostNetwork() error {
 		}
 		// Save the uplink adapter name to check if the OVS uplink port has been created in prepareOVSBridge stage.
 		i.nodeConfig.UplinkNetConfig.Name = hnsNetwork.NetworkAdapterName
+
+		// Save the uplink adapter MAC to modify Pod traffic source MAC if the packet is directly output to the uplink
+		// interface in OVS pipeline.
+		i.nodeConfig.UplinkNetConfig.MAC, _ = net.ParseMAC(hnsNetwork.SourceMac)
 		return nil
 	}
 	if _, ok := err.(hcsshim.NetworkNotFoundError); !ok {

pkg/agent/openflow/pipeline.go

@@ -1264,6 +1264,24 @@ func (c *client) l3FwdFlowToRemoteViaGW(
 		Done()
 }
 
+// l3FwdFlowToRemoteViaUplink generates the L3 forward flow to match the packets destined
+// for remote Pods via uplink. It is used when the cross-Node traffic does not require
+// encapsulation (in noEncap, networkPolicyOnly, or hybrid mode).
+func (c *client) l3FwdFlowToRemoteViaUplink(
+	remoteGatewayMAC net.HardwareAddr,
+	peerSubnet net.IPNet,
+	category cookie.Category) binding.Flow {
+	ipProto := getIPProtocol(peerSubnet.IP)
+	l3FwdTable := c.pipeline[l3ForwardingTable]
+	return l3FwdTable.BuildFlow(priorityNormal).MatchProtocol(ipProto).
+		MatchDstIPNet(peerSubnet).
+		Action().SetSrcMAC(c.nodeConfig.UplinkNetConfig.MAC).
+		Action().SetDstMAC(remoteGatewayMAC).
+		Action().GotoTable(l3FwdTable.GetNext()).
+		Cookie(c.cookieAllocator.Request(category).Raw()).
+		Done()
+}
+
 // arpResponderFlow generates the ARP responder flow entry that replies request comes from local gateway for peer
 // gateway MAC.
 func (c *client) arpResponderFlow(peerGatewayIP net.IP, category cookie.Category) binding.Flow {

pkg/agent/openflow/pipeline_windows.go

@@ -310,7 +310,7 @@ func (c *client) l3FwdFlowToRemoteViaRouting(localGatewayMAC net.HardwareAddr, r
 			Action().GotoTable(conntrackCommitTable).
 			Cookie(c.cookieAllocator.Request(category).Raw()).
 			Done()}
-		flows = append(flows, c.l3FwdFlowToRemoteViaGW(remoteGatewayMAC, *peerPodCIDR, category))
+		flows = append(flows, c.l3FwdFlowToRemoteViaUplink(remoteGatewayMAC, *peerPodCIDR, category))
 		return flows
 	}
 	return []binding.Flow{c.l3FwdFlowToRemoteViaGW(localGatewayMAC, *peerPodCIDR, category)}