This change modifies the behaviour of lbXX_lookup_service() such that if an external
service lookup does not find an entry, we undertake an additional lookup with DPort=0
and Protocol=0. This will facilitate a wildcard lookup that, when programmed with a
suitable wildcard entry by the control plane, will trigger the data path to drop
unmatched ingress traffic.

This change modifies the semantics of said routines such that they no longer propagate
changes to the key protocol field, unless a wildcard service entry was found in the
external scope, and returned. In this case, the dport and protocol field will be zero.

Signed-off-by: Alasdair McWilliam <alasdair.mcwilliam@isovalent.com>
Signed-off-by: Mikael Knutsson <mikael.knutsson@gmail.com>

…paths.

Previously, lbX_lookup_service() would zeroise the key protocol field,
such that callers would	need to	reinstate the key protocol field if their
logic re-used the key.

Following the previous commit, the lbX_lookup_service()	routines will now
only zeroise the key protocol (and dport) fields if an external	wild-card
entry is returned. Thus, the restoration of key values can be removed.

This commit also removes lbX_key_set_protocol() helpers as they became
broadly unnecessary.

Signed-off-by: Alasdair McWilliam <alasdair.mcwilliam@isovalent.com>

This set of tests verifies that if we receive a packet towards a VIP on either
an unknown destination port, or unknown protocol, the data plane will correctly
drop if a wildcard entry is present in the service map.

Signed-off-by: Alasdair McWilliam <alasdair.mcwilliam@isovalent.com>

This change extends the nodePortAddrKey structure to include the L4 Protocol
number of an address, such that addresses with differing addresses will be
better distributed in the nodePortAddrByPort map.

This required the introduction of a helper routine to translate the L4Addr
protocol field into the real IANA number.

Signed-off-by: Alasdair McWilliam <alasdair.mcwilliam@isovalent.com>

Introduce logic in bpf_reconciler to map frontend service entries to wildcard
service entries, and program them in the data path, for LoadBalancer and ClusterIP
frontends of external scope. This will ensure the data path drops traffic towards
unknown destination ports and/or protocols.

Wildcard state is tracked as a map (indexed by IP Address) that contains a slice
of Frontend ServiceIDs. The first entry that requires a wildcard will trigger
programming of the data path entry. The last entry that depends on a wildcard
entry to be removed will trigger removal of the wildcard entry.

Signed-off-by: Alasdair McWilliam <alasdair.mcwilliam@isovalent.com>
Signed-off-by: Mikael Knutsson <mikael.knutsson@gmail.com>

Update the unit tests for loadbalancer and ciliumenvoyconfig to include
wildcard entries.

Signed-off-by: Alasdair McWilliam <alasdair.mcwilliam@isovalent.com>

Remove lb_v4_add_mixed_proto_service_with_flags() as it no longer makes sense.

Signed-off-by: Alasdair McWilliam <alasdair.mcwilliam@isovalent.com>