We're going to add dsr_external bit, so this is to better distinguish
the two in the CT state.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

Make space in our BPF CT. CONNTRACK_ACCOUNTING was recently disabled
by default. Shrink the stats from rx/tx packets/bytes to just packets/
bytes so that the freed up space can be reused for other meta data.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

Support IP6IP6 termination from the Cilium L4LB against a regular Cilium
cluster. This is the IPv6 side of 50f6fa8 ("bpf: Support external
IPv4 DSR").

Cilium L4LB node:

  # ./cilium-dbg/cilium-dbg service list
  ID   Frontend          Service Type   Backend
  [...]
  12   [face:b::1]:80    ExternalIPs    1 => [2a02:168:f656:0:1ac0:4dff:fe09:d5e6]:80 (active)

Cilium regular cluster with --enable-external-dsr=true:

  # ./cilium-dbg/cilium-dbg service list
  ID   Frontend                                   Service Type   Backend
  [...]
  12   [2a02:168:f656:0:1ac0:4dff:fe09:d5e6]:80   ExternalIPs    1 => [2a03:2880:f16d:81:face:b00c:0:25de]:80 (active)

tcpdump on Cilium regular node:

  [...]
  12:13:17.150875 IP6 2a02:168:f656::2 > 2a02:168:f656:0:1ac0:4dff:fe09:d5e6: IP6 2a02:168:f656:0:1ac0:4dff:fe0b:720e.36764 > face:b::1.80: Flags [S], seq 863958068, win 43200, options [mss 1440,sackOK,TS val 2302007970 ecr 0,nop,wscale 9], length 0
  12:13:17.150893 IP6 2a02:168:f656:0:1ac0:4dff:fe09:d5e6.36764 > 2a03:2880:f16d:81:face:b00c:0:25de.80: Flags [S], seq 863958068, win 43200, options [mss 1440,sackOK,TS val 2302007970 ecr 0,nop,wscale 9], length 0
  12:13:17.155619 IP6 2a03:2880:f16d:81:face:b00c:0:25de.80 > 2a02:168:f656:0:1ac0:4dff:fe09:d5e6.36764: Flags [S.], seq 1192141025, ack 863958069, win 65535, options [mss 1392,sackOK,TS val 1118681450 ecr 2302007970,nop,wscale 8], length 0
  12:13:17.155911 IP6 face:b::1.80 > 2a02:168:f656:0:1ac0:4dff:fe0b:720e.36764: Flags [S.], seq 1192141025, ack 863958069, win 65535, options [mss 1392,sackOK,TS val 1118681450 ecr 2302007970,nop,wscale 8], length 0
  12:13:17.156232 IP6 2a02:168:f656::2 > 2a02:168:f656:0:1ac0:4dff:fe09:d5e6: IP6 2a02:168:f656:0:1ac0:4dff:fe0b:720e.36764 > face:b::1.80: Flags [.], ack 1, win 85, options [nop,nop,TS val 2302007975 ecr 1118681450], length 0
  [...]

Note that CONNTRACK_ACCOUNTING is not compatible with the --enable-external-dsr
setting given the union in the CT value. There are other items broken as well
such as CONNTRACK_LOCAL. Perhaps it's time to deprecate / remove them entirely
at some point. The agent cannot block enablement of the latter two since it's
only done manually via cilium-dbg tool.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

Remove the custom IPIP decap program from the L4LB test case and instead
reuse the newly added Cilium-native implementation.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>