bpf, svc: lift restriction from service side wrt ipip port matching
bpf, svc: lift restriction from service side wrt ipip port matching

Given the datapath now supports different frontend <-> backend ports, lift
the restriction from the agent's service handling side.

Example, agent:

  root@apoc:~/go/src/github.com/cilium/cilium# ./daemon/cilium-agent    \
     --enable-ipv4=true --enable-ipv6=true --datapath-mode=lb-only      \
     --bpf-lb-algorithm=maglev --bpf-lb-maglev-table-size=2039          \
     --bpf-lb-mode=dsr --bpf-lb-acceleration=native --devices=enp2s0np0 \
     --bpf-lb-dsr-dispatch=ipip --disable-envoy-version-check=true

-> N-S, v4:

  root@apoc:~/go/src/github.com/cilium/cilium# ./cilium/cilium service list
  ID   Frontend            Service Type   Backend
  1    192.168.180.29:88   ExternalIPs    1 => 192.168.180.28:8080

  root@tank:~# tcpdump -i enp2s0np0 -n
  [...]
  15:59:56.126155 IP 192.168.180.28.39532 > 192.168.180.29.88: Flags [S], seq 2852770339, win 42340, options [mss 1460,sackOK,TS val 2233248728 ecr 0,nop,wscale 9], length 0
  15:59:56.126278 IP 192.168.180.29 > 192.168.180.28: IP 192.168.180.28.39532 > 192.168.180.29.8080: Flags [S], seq 2852770339, win 42340, options [mss 1460,sackOK,TS val 2233248728 ecr 0,nop,wscale 9], length 0 (ipip-proto-4)
  [...]

  The above shows that the flow '192.168.180.28.39532 > 192.168.180.29.88'
  was DNAT'ed to '192.168.180.28.39532 > 192.168.180.29.8080' with the
  backend's L4 port. Then IPIP encap'ed with '192.168.180.29 > 192.168.180.28'
  as outer header, that is LoadBalancerIP -> BackendIP. Previously, both
  L4 ports had to be on 88.

-> N-S, v6:

  root@apoc:~/go/src/github.com/cilium/cilium# ./cilium/cilium service list
  ID   Frontend        Service Type   Backend
  2    [f00d::29]:88   ExternalIPs    1 => [f00d::28]:8080

  root@tank:~# tcpdump -i enp2s0np0 -n
  [...]
  16:12:48.440522 IP6 f00d::28.54158 > f00d::29.88: Flags [S], seq 627542695, win 43200, options [mss 1440,sackOK,TS val 747167239 ecr 0,nop,wscale 9], length 0
  16:12:48.440708 IP6 f00d::29 > f00d::28: IP6 f00d::28.54158 > f00d::29.8080: Flags [S], seq 627542695, win 43200, options [mss 1440,sackOK,TS val 747167239 ecr 0,nop,wscale 9], length 0
  [...]

  Same L4 port DNAT for IPv6 as shown above in case of IPv4.

-> Health, v4:

  We bound the backend to port 8080, whereas service connect call was
  against 88 in the health app.

  root@tank:~# tcpdump -i enp2s0np0 -n
  [...]
  16:48:36.033588 IP 192.168.180.29 > 192.168.180.28: IP 192.168.180.29.54513 > 192.168.180.28.8080: Flags [S], seq 958726300, win 42340, options [mss 1460,sackOK,TS val 2708053337 ecr 0,nop,wscale 9], length 0 (ipip-proto-4)
  [...]

-> Health, v6:

  Same proceedure as above:

  root@tank:~# tcpdump -i enp2s0np0 -n
  [...]
  16:58:06.661661 IP6 f00d::29 > f00d::28: IP6 f00d::29.37063 > f00d::28.8080: Flags [S], seq 1473137483, win 43200, options [mss 1440,sackOK,TS val 3909685100 ecr 0,nop,wscale 9], length 0
  [...]

Signed-off-by: Daniel Borkmann <3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@iogearbox.net>

tgraf/cilium,tgraf/cilium,tklauser/cilium,tgraf/cilium,tklauser/cilium,tgraf/cilium,tklauser/cilium,cilium/cilium,michi-covalent/cilium,michi-covalent/cilium,tgraf/cilium,michi-covalent/cilium,tklauser/cilium,tgraf/cilium,tklauser/cilium,michi-covalent/cilium,cilium/cilium,michi-covalent/cilium,cilium/cilium,cilium/cilium,cilium/cilium