It's going to be used by multiple packages.

Also, add GoArray2CNoSpaces.

Signed-off-by: Martynas Pumputis <m@lambda.lt>

This commit makes it possible to attach bpf_netdev.o to multiple
network devices. Hence, BPF NodePort, BPF MASQ, etc can be exposed
to multiple devices.

Each device can be specified via cilium-agent's --device which accepts
list of strings (e.g. `--device="eth0,eth1"`). The first device in the
list is used to determine a node IP addrs and pod allocation ranges.

With this change, we are no longer able to set some macros such
IPV{4,6}_NODEPORT, NATIVE_DEV_IFINDEX, NATIVE_DEV_MAC in node_config.h.

The first two we pass via -D to bpf_netdev.c during the compile time.
While the third one is retrieved via the NATIVE_DEV_MAC_BY_IFINDEX() macro
which is generated by cilium-agent and stored in node_config.h.

Finally, NATIVE_DEV_IFINDEX,, when bpf_lxc.c does a tail call for the
NodePort rev-DNAT xlation, is retrieved from a related CT entry.

Signed-off-by: Martynas Pumputis <m@lambda.lt>

In the direct routing mode, when exposing NodePort services on multiple
native devices, we should forward a request to a node running a service
endpoint via a device which is used for direct routing. To make this
happen, we need to know the ifindex of the device (otherwise,
fib_lookup will fail), ipv{4,6} addr of the device for SNAT.

Signed-off-by: Martynas Pumputis <m@lambda.lt>

Instead of relying on NATIVE_DEV_IFINDEX from node_config.h which no
longer exists, filter all devices and check whether they have TC
ingress/egress BPF filter which name is bpf_netdev.o.

Signed-off-by: Martynas Pumputis <m@lambda.lt>

Check that ifindex of a given device does not overflow uin16, and that
the device name does not contain special symbols used to parse in
bpf/init.sh.

The first restriction will go away once we introduce the surrogate id =>
ifindex BPF map. While the second - when we migrate bpf/init.sh to Go.

Signed-off-by: Martynas Pumputis <m@lambda.lt>

The example of output:

```
$ cilium status | grep KubeProxyReplacement

KubeProxyReplacement:   Strict   (eth0, eth1)   [NodePort (HYBRID, 30000-32767, XDP: NONE), ExternalIPs, HostReachableServices (TCP, UDP)]
```

Signed-off-by: Martynas Pumputis <m@lambda.lt>

In the direct routing mode, in order for DSR to work via non-direct
routing iface, a user should set rp_filter either to 0 or to 2 for the
direct routing iface.

Otherwise, the kernel might drop a forwarded packet due to the strict
source IP addr check.

Signed-off-by: Martynas Pumputis <m@lambda.lt>

The network is reachable via enp0s9 in VMs, and it's going to be used
to test NodePort when bpf_netdev.o is attached to multiple devices.

Signed-off-by: Martynas Pumputis <m@lambda.lt>

Also, move echoserver-hostnetns into DaemonSet (previously, in k8s v1.11
the echoserver pod could not be scheduled on the node which didn't run cilium,
regardless that the pod was tolerating all taints).

Moving pod into the DaemonSet fixes the problem.

Signed-off-by: Martynas Pumputis <m@lambda.lt>

The test cases are skipped when running in other CNI integrations
(EKS,GKE) as the secondary device might not be available.

Signed-off-by: Martynas Pumputis <m@lambda.lt>

Extend the test function to accept a param which indicates whether
tests from a third (aka node w/o cilium) node should be performed.

As a reminder, the third node is used for NodePort testing to avoid
bpf_sock.c optimizations which happen when a request is sent to
a NodePort svc from a node which runs cilium.

Signed-off-by: Martynas Pumputis <m@lambda.lt>

Re-using the same port might lead to curl failing to bind, as the port
might be still not released (exit code 45).

Therefore, allow to specify a custom source port.

Signed-off-by: Martynas Pumputis <m@lambda.lt>

Signed-off-by: Martynas Pumputis <m@lambda.lt>