Update ip_ecn to RFC 6040

[p.mousavizadeh_protonmail.com]

Summary

Update ecn tunneling functions to follow RFC 6040.
Add ECN_COMPLETE to support dangerous packet reporting
without causing extra cost to existing caller functions.

Update ECN_ALLOWED updated to follow the MUST requirements of RFC 6040.

Consumers can choose between ECN_COMPLETE and ECN_ALLOWED
based on their requirements.

Update IPv6 wrappers to use IPV6_FLOWLABEL_LEN to guide other developers.

Finally, return values are specified as macro to reduce
confusion, considering extra return values for ECN_WARN
and ECN_ALARM were added.

Note: these changes are necessary for the geneve (RFC 8926)
implementation.

Test Plan

I used scapy to verify expected results.
Below is a sample Scapy packet creation for ECN_DROP:

"IPv6(src='SRC_TUNNEL', dst='DST_TUNNEL', tc=3)/UDP(dport=6081,
    sport=54123)/GENEVE(proto=2048, vni=23)/IP(src='SRC_HOST',
    dst='DST_HOST', tos=0)/ICMP(type=8)"

You can test it with existing tunnel drivers that support ECN
such as gif(4) by applying IFF_LINK1 to make it ECN friendly.

[glebius]

sys/netinet/ip_ecn.h

47–51

Since these are return values for kernel function should be under _KERNEL. Also, I would suggest to make it a enum and function return type to also be this enum.

[p.mousavizadeh_protonmail.com]

• Update ip_ecn to RFC6040

[p.mousavizadeh_protonmail.com]

sys/netinet/ip_ecn.h

47–51

I would suggest to make it a enum and function return type to also be this enum.

I prefer to do this in another revision since it may require changes to its consumers.

[rscheff]

sys/netinet/ip_ecn.c

201

While I like the removal of these magic numbers, and this only being tangential to the goal - I wonder if it is or ever was a good idea to move the flow label from inner to outer header, and expose this... If not in this Diff, IMHO only the ECN bits should be exposed, not the full flow label as a subsequent Diff.

[p.mousavizadeh_protonmail.com]

• Replace panic with KASSERT

[p.mousavizadeh_protonmail.com]

sys/netinet/ip_ecn.c

201

I wonder if it is or ever was a good idea to move the flow label from inner to outer header, and expose this... If not in this Diff, IMHO only the ECN bits should be exposed, not the full flow label as a subsequent Diff.

Agree, I created a separate revision at D53742 for this because it affects if_stf, if_gif, and ipsec.

[tuexen]

Please rebase to main.

[p.mousavizadeh_protonmail.com]

Rebase to main. @tuexen Done. From now on, I'll always create commits from the base. Thank you.