This commit introduces the trace TRACE_{FROM_TO}_CRYPTO observation point
to indicate whether a packet is coming/going through the encryption/decryption
path. This can turn useful for both WireGuard and IPSec, as showed in
subsequent commits.
These values differentiate from the current one as they will be used to
update different types of metrics REASON_{EN,DE}CRYPT that will refers to
different files/lines. This provides more information concerning the flow
of the packet when using `cilium-dbg bpf metrics list`,
`cilium-dbg monitor`, and `hubble observe.
The old TRACE_REASON_ENCRYPTED (along with the REASON_DECRYPT metric) is
still valid and refers to observed encrypted packets prior/after the
crypto process. This patch wants to provide additional metrics and does
not aim to replace those already existing.

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>

This commit adds send_trace_notify into the cil_to_wireguard.
With no monitor aggregations, the notification is logged using the new
TRACE_TO_CRYPTO observation point.
With monitor aggregation, the trace event will be displayed according to
the retrieved `monitor` value. In any case, the code updated the respective
bpf metric, and it shows up with `cilium bpf metrics list`, meaning that
packets are going through the WireGuard encryption hook.

Note that we attach the `cil_to_wireguard` program only given a set of
condition. In all the other cases, no metrics updates nor trace events
are expected from this program. Always-injecting wg-related program will
be considered for future enhancements.

An example of a trace event would look as follows:

```bash
-> crypto flow 0x0 , identity unknown->unknown state unknown ifindex cilium_wg0 orig-ip 0.0.0.0: 40:00:3f:01:48:2f -> 45:00:00:54:d9:f3 UnknownEthernetType
```

The bpf metrics map would contain also the following entry:

```bash
REASON                   DIRECTION   PACKETS   BYTES       LINE   FILE
...
Interface Encrypting     EGRESS      1218      103428      57    bpf_wireguard.c
...
```

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>

This commit introduces a new bpf test file to make sure that `cil_to_wireguard`
correctly updates the metrics map with REASON_ENCRYPTED.
Here we do not explicitly test the whole egress hook logic (red-DNAT in
handle_nat_fwd) as already covered in other test files. For this reason,
the remaining aspect to cover is the correct metric update.

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>

This commit modifies the tracing observation point in cil_from_netdev
in case the program is injected into the Wireguard device. We do that
to attach `cil_from_netdev` to the ingress hook of the wg device given
a set of conditions. In that case, the tracing system would still use
TRACE_FROM_NETWORK as observation point: let's update it with the new
TRACE_FROM_CRYPTO one (a from-network even would already be traced from
the native device).

This commit also adds the minimal logic in `trace.h` to handle
`{FROM,TO}_CRYPTO` events either coming from bpf_wireguard.c or bpf_host.c.
Using these observation points outside the expected code path
(ENABLE_WIREGUARD && (IS_BPF_HOST || IS_BPF_WIREGUARD)) would result in
a build bug.

An example of a trace event would look as follows:

```bash
<- crypto flow 0x0 , identity unknown->unknown state unknown ifindex cilium_wg0 orig-ip 0.0.0.0: 40:00:3f:01:48:2f -> 45:00:00:54:d9:f3 UnknownEthernetType
```

The bpf metrics map would contain also the following entry:

```bash
REASON                   DIRECTION   PACKETS   BYTES       LINE   FILE
...
Interface Decrypting     INGRESS     7303      470892      1199   bpf_host.c
...
```

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>

This commit modifies the current tc_nodeport_l3_dev logic to be executed
from the wireguard device (IS_BPF_WIREGUARD and ENABLE_WIREGUARD).
Unfortunately, our Wireguard ingress hook is represented by `cil_from_netdev`,
therefore here we cannot add such a check in the apposite wireguard_metrics.c
file. Once we'll move to a custom `cil_from_wireguard` then we can simply
test this logic there and restore the current file by decoupling-it from
IS_BPF_WIREGUARD.

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>

This commit adds to the current nodeport functions the possibility to
retrieve and use the src_sec_id while tracing packets. This only holds
true when the packet mark has the MARK_MAGIC_IDENTITY set. An example of
a trace before and after this patch is reported next.

Before:

```bash
-> crypto flow 0x0 , identity unknown->unknown state unknown ifindex cilium_wg0 orig-ip 0.0.0.0: 40:00:3f:01:48:2f -> 45:00:00:54:d9:f3 UnknownEthernetType
```

After:

```bash
-> crypto flow 0x0 , identity 21567->unknown state unknown ifindex cilium_wg0 orig-ip 0.0.0.0: 40:00:3f:01:48:2f -> 45:00:00:54:d9:f3 UnknownEthernetType
```

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>

This commit adds to the current nodeport functions the possibility to
retrieve and use the src_sec_id while tracing packets. This only holds
true when the packet mark has the MARK_MAGIC_OVERLAY set. An example of
a trace before and after this patch is reported next.

Before:

```bash
-> overlay flow 0x0 , identity unknown->unknown state unknown ifindex cilium_vxlan orig-ip 0.0.0.0: 10.244.3.84 -> 10.244.1.28 EchoRequest
```

After:

```bash
-> overlay flow 0x0 , identity 53498->unknown state unknown ifindex cilium_vxlan orig-ip 0.0.0.0: 10.244.3.84 -> 10.244.1.28 EchoRequest
```

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>