cilium: encryption, set optional flag for fwd policy rules
cilium: encryption, set optional flag for fwd policy rules

The XFRM stack will check for fwd policies after a decrypt or encrypt
operation is done. We don't really need these for policy reasons
because Cilium BPF side is enforcing policy. We can't just delete
the rules though. If we did the decrypted traffic, which will still
have the xfrm context encoded in the skb, will fail policy match and
generate a NOPOLICY error. But as is in ENI modes the template lookup
is failing with an TMPL_MISMATCH error.

To fix make the fwd rules less strict by adding the optional bit
to the rule. This will skip the template lookup altogether on the
kernel side.

Although this is needed for ENI cases where the packet is handled
by the routing stack we can enable it in all cases. Making other
cases less strict is also OK.

Before this we had fwd `ip x p` like this,

root@ip-192-168-90-141:/home/cilium# ip x p
src 0.0.0.0/0 dst 192.168.0.0/16
	dir fwd priority 0 ptype main
	tmpl src 0.0.0.0 dst 192.168.0.0
		proto esp reqid 1 mode tunnel

Now we have a 'level use' included indicating the policy is not strict,

root@ip-192-168-90-141:/home/cilium# ip x p
src 0.0.0.0/0 dst 192.168.0.0/16
	dir fwd priority 0 ptype main
	tmpl src 0.0.0.0 dst 192.168.0.0
		proto esp reqid 1 mode tunnel
		level use

This corresponds to kernel code,

 static inline int
 xfrm_policy_ok(const struct xfrm_tmpl *tmpl, const struct sec_path *sp, int start,
	       unsigned short family)
 {
	int idx = start;

	if (tmpl->optional) {
		if (tmpl->mode == XFRM_MODE_TRANSPORT)
			return start;
	} else
		start = -1;
	for (; idx < sp->len; idx++) {
		if (xfrm_state_ok(tmpl, sp->xvec[idx], family))
			return ++idx;
		if (sp->xvec[idx]->props.mode != XFRM_MODE_TRANSPORT) {
			if (start == -1)
				start = -2-idx;
			break;
		}
	}
	return start;
 }

And with 'level use' we hit the first 'if (tmpl->optional)' so that the
subsequent xfrm_state_ok checks are skipped.

Signed-off-by: John Fastabend <ee461b60978bea1c76b3018c0b89685175b248e2@gmail.com>

michi-covalent/cilium,michi-covalent/cilium,tgraf/cilium,michi-covalent/cilium,michi-covalent/cilium,tklauser/cilium,tklauser/cilium,cilium/cilium,tklauser/cilium,tklauser/cilium,cilium/cilium,cilium/cilium,michi-covalent/cilium,tklauser/cilium,tgraf/cilium,cilium/cilium,tgraf/cilium,tgraf/cilium,cilium/cilium,tgraf/cilium,tgraf/cilium