Move ct_lookup in bpf_host.c to a separate tailcall - #23831

To prepare for splitting ipv4_host_policy_ingress, move the
initialization of the is_untracked_fragment variable closer to its only
usage.

Signed-off-by: Maxim Mikityanskiy <[email protected]>

Split the conntrack lookup part of the host policy ingress handlers into
a separate function to prepare for making it a separate tailcall. Use
struct ct_buffer{4,6} for communication between two parts of the old
function to prepare for passing the lookup result via a BPF map, similar
to how it's done in bpf_lxc.c.

Signed-off-by: Maxim Mikityanskiy <[email protected]>

Currently, ipv{4,6}_host_policy_egress calls revalidate_data to get the
pointer to the IP header. However, if we analyze from which contexts
it's called, we realize that in most cases this pointer is already
available, and the call to revalidate_data can be optimized out:

1. handle_ipv{4,6} already have the pointer.

2. handle_to_netdev_ipv{4,6} also already have the pointer, moreover,
   handle_to_netdev_ipv4 calls revalidate_data and never uses its
   results - until this commit.

3. from_host_to_lxc doesn't have the pointer, but it always calls
   ipv{4,6}_host_policy_egress with src_id == HOST_ID, so this function
   will never return early before it would call revalidate_data. That
   means that the call to revalidate_data can be moved from
   ipv{4,6}_host_policy_egress to from_host_to_lxc without any
   performance penalty.

This commit essentially drops a few revalidate_data calls, no strings
attached.

Signed-off-by: Maxim Mikityanskiy <[email protected]>

ct_lookup4 is called by both ipv4_host_policy_egress_lookup and
whitelist_snated_egress_connections. Both lookups are the same and can
be replaced with ipv4_host_policy_egress_lookup. Remove the lookup part
from whitelist_snated_egress_connections and reuse the lookup that is
already present in ipv4_host_policy_egress.

While at it, also replace the error check after ct_create4 from IS_ERR
to ret < 0. ct_create4 only returns 0 or DROP_CT_CREATE_FAILED, and
having a mix of different error checks confuses the verifier when it
can't prove that CTX_ACT_DROP is not a possible outcome.

Signed-off-by: Maxim Mikityanskiy <[email protected]>

Split the conntrack lookup part of the host policy egress handlers into
a separate function to prepare for making it a separate tailcall. Use
struct ct_buffer{4,6} for communication between two parts of the old
function to prepare for passing the lookup result via a BPF map, similar
to how it's done in bpf_lxc.c.

Signed-off-by: Maxim Mikityanskiy <[email protected]>

In order to reduce verifier complexity, split handle_ipv4 into two
functions chained by a tailcall. The first part will stop after doing
ct_lookup4 of the host firewall, and the second part will pick up the
results from a BPF map and go on.

The tailcall is saved, and the map is not used if host firewall is
disabled, so the overhead is minimal in this case.

Also move the "verifier workaround" call to revalidate_data in
handle_ipv4 to the ENABLE_HOST_FIREWALL section, as its presence at the
previous location now makes clang miscompile code and generate 32-bit
zero extension on pkt and pkt_end pointers, which is not accepted by the
verifier. Removing the workaround altogether leads to another verifier
error: "R5 invalid mem access 'scalar'".

Signed-off-by: Maxim Mikityanskiy <[email protected]>

In order to reduce verifier complexity, split handle_ipv6 into two
functions chained by a tailcall. The first part will stop after doing
ct_lookup6 of the host firewall, and the second part will pick up the
results from a BPF map and go on.

The tailcall is saved, and the map is not used if host firewall is
disabled, so the overhead is minimal in this case.

Similar to the previous commit, also move the "verifier workaround"
call to revalidate_data in handle_ipv6 to the ENABLE_HOST_FIREWALL
section.

Signed-off-by: Maxim Mikityanskiy <[email protected]>