1Tunnel metadata manipulation actionTuinnLnietnlcu(xm8e)tadata manipulation action in tc(8)
2
3
4

NAME

6       tunnel_key - Tunnel metadata manipulation
7

SYNOPSIS

9       tc ... action tunnel_key { unset | SET }
10
11       SET  :=  set  src_ip ADDRESS dst_ip ADDRESS id KEY_ID dst_port UDP_PORT
12               tos TOS ttl TTL [ csum | nocsum ]
13
14

DESCRIPTION

16       The tunnel_key action combined with a shared IP tunnel  device,  allows
17       to perform IP tunnel en- or decapsulation on a packet, reflected by the
18       operation modes UNSET and SET.  The UNSET mode is optional - even with‐
19       out  using  it, the metadata information will be released automatically
20       when packet processing will be finished.  UNSET function could be  used
21       in cases when traffic is forwarded between two tunnels, where the meta‐
22       data from the first tunnel will be used for encapsulation done  by  the
23       second tunnel.  SET mode requires the source and destination ip ADDRESS
24       and the tunnel key id KEY_ID which will be used by the ip tunnel shared
25       device  to  create  the  tunnel header. The tunnel_key action is useful
26       only in combination with a mirred redirect action to a shared IP tunnel
27       device  which  will  use the metadata (for SET ) and unset the metadata
28       created by it (for UNSET ).
29
30

OPTIONS

32       unset  Unset the tunnel metadata created by the IP tunnel device.  This
33              function  is  not  mandatory and might be used only in some spe‐
34              cific use cases (as explained above).
35
36       set    Set tunnel metadata to be used by the IP tunnel device. Requires
37              src_ip  and  dst_ip  options.  id , dst_port and geneve_opts are
38              optional.
39
40              id     Tunnel ID (for example VNI in VXLAN tunnel)
41
42              src_ip Outer header source IP address (IPv4 or IPv6)
43
44              dst_ip Outer header destination IP address (IPv4 or IPv6)
45
46              dst_port
47                     Outer header destination UDP port
48
49              geneve_opts
50                     Geneve variable length options.  geneve_opts is specified
51                     in  the  form CLASS:TYPE:DATA, where CLASS is represented
52                     as a 16bit hexadecimal value, TYPE as an 8bit hexadecimal
53                     value  and  DATA  as a variable length hexadecimal value.
54                     Additionally multiple options may be listed using a comma
55                     delimiter.
56
57              tos    Outer header TOS
58
59              ttl    Outer header TTL
60
61              [no]csum
62                     Controls  outer  UDP checksum. When set to csum (which is
63                     default),  the  outer  UDP  checksum  is  calculated  and
64                     included  in  the  packets. When set to nocsum, outer UDP
65                     checksum is zero. Note that when using zero UDP checksums
66                     with  IPv6,  the other tunnel endpoint must be configured
67                     to accept such packets.  In  Linux,  this  would  be  the
68                     udp6zerocsumrx option for the VXLAN tunnel interface.
69
70                     If  using nocsum with IPv6, be sure you know what you are
71                     doing.  Zero  UDP  checksums  provide  weaker  protection
72                     against corrupted packets. See RFC6935 for details.
73

EXAMPLES

75       The following example encapsulates incoming ICMP packets on eth0 into a
76       vxlan tunnel, by setting metadata to VNI 11, source  IP  11.11.0.1  and
77       destination  IP 11.11.0.2, and by redirecting the packet with the meta‐
78       data to device vxlan0, which will do the actual encapsulation using the
79       metadata:
80
81              #tc qdisc add dev eth0 handle ffff: ingress
82              #tc filter add dev eth0 protocol ip parent ffff: \
83                flower \
84                  ip_proto icmp \
85                action tunnel_key set \
86                  src_ip 11.11.0.1 \
87                  dst_ip 11.11.0.2 \
88                  id 11 \
89                action mirred egress redirect dev vxlan0
90
91       Here  is  an example of the unset function: Incoming VXLAN traffic with
92       outer IP's and VNI 11 is decapsulated by vxlan0 and metadata  is  unset
93       before redirecting to tunl1 device:
94
95              #tc qdisc add dev eth0 handle ffff: ingress
96              #tc filter add dev vxlan0 protocol ip parent ffff:   flower \
97                     enc_src_ip 11.11.0.2 enc_dst_ip 11.11.0.1 enc_key_id 11   action tunnel_key unset  action mirred egress redirect dev tunl1
98
99

SEE ALSO

101       tc(8)
102
103
104
105iproute2                          1T0unNnoevl 2m0e1t6adata manipulation action in tc(8)
Impressum