feat(gateway): add egress masquerade datapath to edgenat.c

internal/plumbing/ebpf/edgeprog/doc.go

@@ -10,6 +10,13 @@
 // /home/sprygada/.claude/datum/plans/merry-percolating-tulip.md for the
 // full rationale versus the earlier, rejected gwprog/Geneve approach).
 //
+// The same program also implements a second, direction-mirrored
+// personality (datum-cloud/enhancements#865): egress masquerade
+// (SNAT/PAT) for tenant VPC backends reaching arbitrary internet
+// destinations, reusing the ingress path's Full-NAT/PAT machinery rather
+// than a parallel subsystem -- see docs/plans/865-edge-gateway-nat66-egress.md
+// and edgenat.c's own header comment (points 4-5) for the full walkthrough.
+//
 // edgenat.c is the single source of truth for the packet path; see its
 // header comment for the full walkthrough. `go generate` (via bpf2go,
 // github.com/cilium/ebpf's code generator) compiles it with clang into a
@@ -52,4 +59,4 @@ package edgeprog
 // attribute, so there is no real unaligned-access risk to suppress
 // unsafely here.
 //
-//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cflags "-O2 -g -Wall -Wno-address-of-packed-member -idirafter /usr/include/x86_64-linux-gnu -idirafter /usr/include/aarch64-linux-gnu" -target bpfel,bpfeb -type rule_key -type backend -type rule_value -type conn_key -type conn_value -type gw_config Edgenat edgenat.c
+//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cflags "-O2 -g -Wall -Wno-address-of-packed-member -idirafter /usr/include/x86_64-linux-gnu -idirafter /usr/include/aarch64-linux-gnu" -target bpfel,bpfeb -type rule_key -type backend -type rule_value -type conn_key -type conn_value -type gw_config -type egress_config -type egress_conn_key -type egress_conn_value Edgenat edgenat.c

internal/plumbing/ebpf/edgeprog/dropreason.go

@@ -24,21 +24,47 @@ const (
 	DropReasonFibFragNeeded    uint32 = 7
 	DropReasonFibLookupFailed  uint32 = 8
 	DropReasonAdjustHeadFailed uint32 = 9
-	DropReasonCount            uint32 = 10
+
+	// Egress (masquerade) drop reasons (datum-cloud/enhancements#865) --
+	// see edgenat.c's handle_egress_forward/handle_egress_return.
+	DropReasonMalformedEgressForward uint32 = 10
+	DropReasonNoEgressConnNotSyn     uint32 = 11
+	DropReasonEgressPATExhausted     uint32 = 12
+	DropReasonMalformedEgressReturn  uint32 = 13
+	DropReasonNoEgressReturnConn     uint32 = 14
+
+	// ICMPv6 egress drop reasons (galactic#404) -- see edgenat.c's
+	// handle_egress_forward_icmp6/handle_egress_return_icmp6. Kept
+	// distinct from the TCP/UDP-specific reasons above (and from each
+	// other) so an operator reading drop counters can tell "this ICMPv6
+	// message didn't parse" apart from "it parsed fine but matched no
+	// flow" -- see edgenat.c's enum edge_drop_reason for the full
+	// rationale, including the #381 review comment this closes.
+	DropReasonMalformedEgressICMP uint32 = 15
+	DropReasonNoEgressICMPConn    uint32 = 16
+
+	DropReasonCount uint32 = 17
 )
 
 // DropReasonNames maps each DropReason* index to a short, stable,
 // metrics/log-friendly name, decoupling Prometheus label values and any
 // other external representation from edgenat.c's C identifier spelling.
 var DropReasonNames = map[uint32]string{
-	DropReasonNoBackends:       "no_backends",
-	DropReasonNoConnNotSyn:     "no_conn_not_syn",
-	DropReasonPATExhausted:     "pat_exhausted",
-	DropReasonMalformedReturn:  "malformed_return",
-	DropReasonNoReturnConn:     "no_return_conn",
-	DropReasonFibNoNeigh:       "fib_no_neigh",
-	DropReasonFibUnreachable:   "fib_unreachable",
-	DropReasonFibFragNeeded:    "fib_frag_needed",
-	DropReasonFibLookupFailed:  "fib_lookup_failed",
-	DropReasonAdjustHeadFailed: "adjust_head_failed",
+	DropReasonNoBackends:             "no_backends",
+	DropReasonNoConnNotSyn:           "no_conn_not_syn",
+	DropReasonPATExhausted:           "pat_exhausted",
+	DropReasonMalformedReturn:        "malformed_return",
+	DropReasonNoReturnConn:           "no_return_conn",
+	DropReasonFibNoNeigh:             "fib_no_neigh",
+	DropReasonFibUnreachable:         "fib_unreachable",
+	DropReasonFibFragNeeded:          "fib_frag_needed",
+	DropReasonFibLookupFailed:        "fib_lookup_failed",
+	DropReasonAdjustHeadFailed:       "adjust_head_failed",
+	DropReasonMalformedEgressForward: "malformed_egress_forward",
+	DropReasonNoEgressConnNotSyn:     "no_egress_conn_not_syn",
+	DropReasonEgressPATExhausted:     "egress_pat_exhausted",
+	DropReasonMalformedEgressReturn:  "malformed_egress_return",
+	DropReasonNoEgressReturnConn:     "no_egress_return_conn",
+	DropReasonMalformedEgressICMP:    "malformed_egress_icmp",
+	DropReasonNoEgressICMPConn:       "no_egress_icmp_conn",
 }