DNS Proxy: Adds UDP checksum for IPv6 Responses

[danehans]

Updates the DNS proxy to compute a UDP checksum over the IPv6 response packet and the pseudo-header. If the computation yields a result of zero, it changes the checksum to hex FFFF for placement in the UDP header.

Fixes #28678

The DNS proxy will now compute a UDP checksum over the IPv6 response packet and the pseudo-header.

[danehans]

@squeed @tklauser I'm new to this area of the Cilium code so I'm open to suggestions for computing the UDP checksum. I manually tested the changes but I can add unit tests if this approach is acceptable.

[danehans]

The Conformance K8s Kind / Installation and Conformance test is failing due to:

STEP: Checking if the Service forwards traffic to TCP only @ 11/29/23 21:30:24.379
  Nov 29 21:30:24.392: INFO: Running '/usr/local/bin/kubectl --server=https://127.0.0.1:35901/ --kubeconfig=/home/runner/work/cilium/cilium/_artifacts/kubeconfig.conf --namespace=services-7471 exec execpodmzmjh -- /bin/sh -x -c echo hostName | nc -v -t -w 2 10.96.129.16 80'
  Nov 29 21:30:24.685: INFO: stderr: "+ echo hostName\n+ nc -v -t -w 2 10.96.129.16 80\nConnection to 10.96.129.16 80 port [tcp/http] succeeded!\n"
  Nov 29 21:30:24.6[85](https://github.com/cilium/cilium/actions/runs/7038674807/job/19156089632?pr=29493#step:15:86): INFO: stdout: "HTTP/1.1 400 Bad Request\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n400 Bad Request"
  Nov 29 21:30:24.685: INFO: Running '/usr/local/bin/kubectl --server=https://127.0.0.1:35901/ --kubeconfig=/home/runner/work/cilium/cilium/_artifacts/kubeconfig.conf --namespace=services-7471 exec execpodmzmjh -- /bin/sh -x -c echo hostName | nc -v -u -w 2 10.96.129.16 80'
  Nov 29 21:30:29.093: INFO: stderr: "+ echo hostName\n+ nc -v -u -w 2 10.96.129.16 80\nConnection to 10.96.129.16 80 port [udp/*] succeeded!\n"
  Nov 29 21:30:29.093: INFO: stdout: "pod1"
  Nov 29 21:30:34.094: INFO: Running '/usr/local/bin/kubectl --server=https://127.0.0.1:35901/ --kubeconfig=/home/runner/work/cilium/cilium/_artifacts/kubeconfig.conf --namespace=services-7471 exec execpodmzmjh -- /bin/sh -x -c echo hostName | nc -v -u -w 2 10.96.129.16 80'
  Nov 29 21:30:38.321: INFO: stderr: "+ nc -v -u -w 2 10.96.129.16 80\n+ echo hostName\nConnection to 10.96.129.16 80 port [udp/*] succeeded!\n"
  Nov 29 21:30:38.321: INFO: stdout: "pod1"
  Nov 29 21:30:43.321: INFO: Running '/usr/local/bin/kubectl --server=https://127.0.0.1:35[90](https://github.com/cilium/cilium/actions/runs/7038674807/job/19156089632?pr=29493#step:15:91)1 --kubeconfig=/home/runner/work/cilium/cilium/_artifacts/kubeconfig.conf --namespace=services-7471 exec execpodmzmjh -- /bin/sh -x -c echo hostName | nc -v -u -w 2 10.96.129.16 80'
  Nov 29 21:30:47.762: INFO: stderr: "+ + nc -v -u -w 2 10.96.129.16 80\necho hostName\nConnection to 10.96.129.16 80 port [udp/*] succeeded!\n"
  Nov 29 21:30:47.762: INFO: stdout: "pod1"
  Nov 29 21:30:52.763: INFO: Running '/usr/local/bin/kubectl --server=https://127.0.0.1:35901/ --kubeconfig=/home/runner/work/cilium/cilium/_artifacts/kubeconfig.conf --namespace=services-7471 exec execpodmzmjh -- /bin/sh -x -c echo hostName | nc -v -u -w 2 10.[96](https://github.com/cilium/cilium/actions/runs/7038674807/job/19156089632?pr=29493#step:15:97).129.16 80'
  Nov 29 21:30:57.251: INFO: stderr: "+ nc -v -u -w 2 10.96.129.16 80\n+ echo hostName\nConnection to 10.96.129.16 80 port [udp/*] succeeded!\n"
  Nov 29 21:30:57.251: INFO: stdout: "pod1"
  [FAILED] in [It] - test/e2e/network/service.go:3730 @ 11/29/23 21:30:57.251

Similar to #29315 flake. Maybe the 30-second timeout is not long enough for the change in the service to take effect so I'm rerunning the tests.

[danehans]

/test

[squeed]

Great catch! Could you add a unit test for checksum calculation? Then we can get this merged.

[danehans]

/test

[squeed]

I manually added another test case with real-world addresses, it passed. Thanks!

[pippolo84]

LGTM, thanks! 💯

[tklauser]

LGTM, thanks