Shiv Laser: Add destination IP/port matching to healthchecking BPF

Summary:
Stack of diffs to provide "Shiv Laser" functionality as library for Traffic Realtime's load testing.

## Context
Some historical context first. We've been using healthchicking BPF prog to send traffic directly to specific Shiv backend instance for multiple use cases beyond healthchecking. For historical reasons multiple places load BPF prog but not supporting C++ classes. To fix that issue we have implemented Encapsulator C++ wrapper, but didn't update existing usages to it.
Most users don't need fine grained control of so_marks allowing to redirect VIPs to many reals (like we need for healthchecking), but want all traffic to given VIP be direct to single real. For that during CoIn hackathon I stitched togather bash script "shiv-laser" that tied iptables to add so marks & encapsulator binary. This turned to be very popular script.

Now Traffic Realtime folks tested shiv-laser script with their Callagen load generator and it works well. Providing BPF functionality and C++ API they can call to setup encapsulated redirection from their service.

## Diff stack
The main feature of this diff stack is to match packets for encapsulation by dst IP and port. Expose it via Encapsulator library API and replace shiv-laser with single binary. Keeping "Shiv Laser" naming of the functionality for cooler branding :)

## This diff
BPF changes to match egress packets by dst IP/port. List of IP/ports in BPF map. If port value is 0, we'll match by dst IP only. Allows redirecting packets to VIP address regardless of VIP port.
Scoped by #ifdef since we don't need this feature in healtmon.

Reviewed By: nikhildl12

Differential Revision: D94374505

fbshipit-source-id: fe0e72cb77e2910c6f3c8d1eb3e509d970a1546c

Author: avasylev

katran/lib/KatranLb.cpp

@@ -2282,6 +2282,7 @@ HealthCheckProgStats KatranLb::getStatsForHealthCheckProgram() {
         total_stats.packetsSkipped += perCpuStat.packetsSkipped;
         total_stats.packetsDropped += perCpuStat.packetsDropped;
         total_stats.packetsTooBig += perCpuStat.packetsTooBig;
+        total_stats.packetsDstMatched += perCpuStat.packetsDstMatched;
       }
     }
   }

katran/lib/KatranLbStructs.h

@@ -275,6 +275,7 @@ struct HealthCheckProgStats {
   uint64_t packetsDropped{0};
   uint64_t packetsSkipped{0};
   uint64_t packetsTooBig{0};
+  uint64_t packetsDstMatched{0};
 };
 
 /**

katran/lib/bpf/healthchecking.bpf.c

@@ -53,14 +53,38 @@ int healthcheck_encap(struct __sk_buff* skb) {
     return TC_ACT_UNSPEC;
   }
 
-  if (somark == 0) {
-    prog_stats->pckts_skipped += 1;
-    return TC_ACT_UNSPEC;
+  if ((skb->data + sizeof(struct ethhdr)) > skb->data_end) {
+    prog_stats->pckts_dropped += 1;
+    return TC_ACT_SHOT;
+  }
+
+  ethh = (void*)(long)skb->data;
+  if (ethh->h_proto == BE_ETH_P_IPV6) {
+    is_ipv6 = true;
+  }
+
+  struct hc_real_definition* real = NULL;
+  if (somark != 0) {
+    real = bpf_map_lookup_elem(&hc_reals_map, &somark);
+  }
+
+#ifdef HC_DST_MATCH
+  if (!real) {
+    struct hc_dst_key dst_key = {};
+    if (set_hc_dst_key(skb, &dst_key, is_ipv6)) {
+      real = bpf_map_lookup_elem(&hc_dst_reals_map, &dst_key);
+      if (!real && dst_key.port != 0) {
+        dst_key.port = 0;
+        real = bpf_map_lookup_elem(&hc_dst_reals_map, &dst_key);
+      }
+      if (real) {
+        prog_stats->pckts_dst_matched += 1;
+      }
+    }
   }
+#endif // HC_DST_MATCH
 
-  struct hc_real_definition* real = bpf_map_lookup_elem(&hc_reals_map, &somark);
   if (!real) {
-    // some strange (w/ fwmark; but not a healthcheck) local packet
     prog_stats->pckts_skipped += 1;
     return TC_ACT_UNSPEC;
   }
@@ -98,16 +122,6 @@ int healthcheck_encap(struct __sk_buff* skb) {
   }
 #endif /* HC_WITH_REDIRECT */
 
-  if ((skb->data + sizeof(struct ethhdr)) > skb->data_end) {
-    prog_stats->pckts_dropped += 1;
-    return TC_ACT_SHOT;
-  }
-
-  ethh = (void*)(long)skb->data;
-  if (ethh->h_proto == BE_ETH_P_IPV6) {
-    is_ipv6 = true;
-  }
-
   struct hc_key hckey = {};
   bool hc_key_parseable = set_hc_key(skb, &hckey, is_ipv6);
 

katran/lib/bpf/healthchecking_consts.h

@@ -53,4 +53,6 @@
 #define HC_SRC_MAC_POS 0
 #define HC_DST_MAC_POS 1
 
+#define HC_MAX_DST 100
+
 #endif // of __HEALTHCHECKING_CONSTS_H

katran/lib/bpf/healthchecking_helpers.h

@@ -76,6 +76,56 @@ set_hc_key(const struct __sk_buff* skb, struct hc_key* hckey, bool is_ipv6) {
   return true;
 }
 
+#ifdef HC_DST_MATCH
+__attribute__((__always_inline__)) static inline bool set_hc_dst_key(
+    const struct __sk_buff* skb,
+    struct hc_dst_key* key,
+    bool is_ipv6) {
+  void* iphdr = (void*)(long)skb->data + sizeof(struct ethhdr);
+  void* transport_hdr;
+  __u8 proto;
+
+  if (is_ipv6) {
+    struct ipv6hdr* ip6h = iphdr;
+    if (ip6h + 1 > (void*)(long)skb->data_end) {
+      return false;
+    }
+    transport_hdr = iphdr + sizeof(struct ipv6hdr);
+    memcpy(key->addrv6, ip6h->daddr.s6_addr32, 16);
+    key->flags = V6DADDR;
+    proto = ip6h->nexthdr;
+  } else {
+    struct iphdr* iph = iphdr;
+    if (iph + 1 > (void*)(long)skb->data_end) {
+      return false;
+    }
+    transport_hdr = iphdr + sizeof(struct iphdr);
+    key->addr = iph->daddr;
+    key->flags = 0;
+    proto = iph->protocol;
+  }
+
+  if (proto == IPPROTO_TCP) {
+    struct tcphdr* tcp = transport_hdr;
+    if (tcp + 1 > (void*)(long)skb->data_end) {
+      return false;
+    }
+    key->port = tcp->dest;
+  } else if (proto == IPPROTO_UDP) {
+    struct udphdr* udp = transport_hdr;
+    if (udp + 1 > (void*)(long)skb->data_end) {
+      return false;
+    }
+    key->port = udp->dest;
+  } else {
+    key->port = 0;
+  }
+
+  key->pad = 0;
+  return true;
+}
+#endif // HC_DST_MATCH
+
 __attribute__((__always_inline__)) static inline bool hc_encap_ipip(
     struct __sk_buff* skb,
     struct hc_real_definition* real,

katran/lib/bpf/healthchecking_ipip.c

@@ -60,6 +60,7 @@ struct hc_stats {
   __u64 pckts_dropped;
   __u64 pckts_skipped;
   __u64 pckts_too_big;
+  __u64 pckts_dst_matched;
 };
 
 struct {

katran/lib/bpf/healthchecking_maps.h

@@ -79,4 +79,14 @@ struct {
   __uint(map_flags, NO_FLAGS);
 } hc_key_map SEC(".maps");
 
+#ifdef HC_DST_MATCH
+struct {
+  __uint(type, BPF_MAP_TYPE_HASH);
+  __type(key, struct hc_dst_key);
+  __type(value, struct hc_real_definition);
+  __uint(max_entries, HC_MAX_DST);
+  __uint(map_flags, NO_FLAGS);
+} hc_dst_reals_map SEC(".maps");
+#endif // HC_DST_MATCH
+
 #endif // of __HEALTHCHECKING_MAPS_H

katran/lib/bpf/healthchecking_structs.h

@@ -31,6 +31,7 @@ struct hc_stats {
   __u64 pckts_dropped;
   __u64 pckts_skipped;
   __u64 pckts_too_big;
+  __u64 pckts_dst_matched;
 };
 
 // hc_key's definition
@@ -48,4 +49,18 @@ struct hc_mac {
   __u8 mac[6];
 };
 
+#ifdef HC_DST_MATCH
+// Key for destination-based healthcheck matching
+struct hc_dst_key {
+  union {
+    __be32 addr;
+    __be32 addrv6[4];
+  };
+  __be16 port; // destination port in network byte order;
+               // 0 = wildcard (match any port)
+  __u8 flags; // V6DADDR if IPv6
+  __u8 pad;
+};
+#endif // HC_DST_MATCH
+
 #endif // of __HEALTHCHECKING_STRUCTS_H