1Tunnel metadata manipulation actionTuinnLnietnlcu(xm8e)tadata manipulation action in tc(8)
2
6 tunnel_key - Tunnel metadata manipulation
7
9 tc ... action tunnel_key { unset | SET }
10 SET := set src_ip ADDRESS dst_ip ADDRESS id KEY_ID dst_port UDP_PORT
12 tos TOS ttl TTL [ csum | nocsum ]
13
16 The tunnel_key action combined with a shared IP tunnel device, allows
17 one to perform IP tunnel en- or decapsulation on a packet, reflected by
18 the operation modes UNSET and SET. The UNSET mode is optional - even
19 without using it, the metadata information will be released automati‐
20 cally when packet processing will be finished. UNSET function could be
21 used in cases when traffic is forwarded between two tunnels, where the
22 metadata from the first tunnel will be used for encapsulation done by
23 the second tunnel. SET mode requires the source and destination ip AD‐
24 DRESS and the tunnel key id KEY_ID which will be used by the ip tunnel
25 shared device to create the tunnel header. The tunnel_key action is
26 useful only in combination with a mirred redirect action to a shared IP
27 tunnel device which will use the metadata (for SET ) and unset the
28 metadata created by it (for UNSET ).
29
32 unset Unset the tunnel metadata created by the IP tunnel device. This
33 function is not mandatory and might be used only in some spe‐
34 cific use cases (as explained above).
35 set Set tunnel metadata to be used by the IP tunnel device. Requires
37 src_ip and dst_ip options. id , dst_port , geneve_opts ,
38 vxlan_opts and erspan_opts are optional.
39 id Tunnel ID (for example VNI in VXLAN tunnel)
41 src_ip Outer header source IP address (IPv4 or IPv6)
43 dst_ip Outer header destination IP address (IPv4 or IPv6)
45 dst_port
47 Outer header destination UDP port
48 geneve_opts
50 Geneve variable length options. geneve_opts is specified
51 in the form CLASS:TYPE:DATA, where CLASS is represented
52 as a 16bit hexadecimal value, TYPE as an 8bit hexadecimal
53 value and DATA as a variable length hexadecimal value.
54 Additionally multiple options may be listed using a comma
55 delimiter.
56 vxlan_opts
58 Vxlan metadata options. vxlan_opts is specified in the
59 form GBP, as a 32bit number. Multiple options is not sup‐
60 ported.
61 erspan_opts
63 Erspan metadata options. erspan_opts is specified in the
64 form VERSION:INDEX:DIR:HWID, where VERSION is represented
65 as a 8bit number, INDEX as an 32bit number, DIR and HWID
66 as a 8bit number. Multiple options is not supported.
67 Note INDEX is used when VERSION is 1, and DIR and HWID
68 are used when VERSION is 2.
69 tos Outer header TOS
71 ttl Outer header TTL
73 [no]csum
75 Controls outer UDP checksum. When set to csum (which is
76 default), the outer UDP checksum is calculated and in‐
77 cluded in the packets. When set to nocsum, outer UDP
78 checksum is zero. Note that when using zero UDP checksums
79 with IPv6, the other tunnel endpoint must be configured
80 to accept such packets. In Linux, this would be the
81 udp6zerocsumrx option for the VXLAN tunnel interface.
82 If using nocsum with IPv6, be sure you know what you are
84 doing. Zero UDP checksums provide weaker protection
85 against corrupted packets. See RFC6935 for details.
86
88 The following example encapsulates incoming ICMP packets on eth0 into a
89 vxlan tunnel, by setting metadata to VNI 11, source IP 11.11.0.1 and
90 destination IP 11.11.0.2, and by redirecting the packet with the meta‐
91 data to device vxlan0, which will do the actual encapsulation using the
92 metadata:
93 #tc qdisc add dev eth0 handle ffff: ingress
95 #tc filter add dev eth0 protocol ip parent ffff: \
96 flower \
97 ip_proto icmp \
98 action tunnel_key set \
99 src_ip 11.11.0.1 \
100 dst_ip 11.11.0.2 \
101 id 11 \
102 action mirred egress redirect dev vxlan0
103 Here is an example of the unset function: Incoming VXLAN traffic with
105 outer IP's and VNI 11 is decapsulated by vxlan0 and metadata is unset
106 before redirecting to tunl1 device:
107 #tc qdisc add dev eth0 handle ffff: ingress
109 #tc filter add dev vxlan0 protocol ip parent ffff: flower \
110 enc_src_ip 11.11.0.2 enc_dst_ip 11.11.0.1 enc_key_id 11 action tunnel_key unset action mirred egress redirect dev tunl1
111
114 tc(8)
115iproute2 1T0unNnoevl 2m0e1t6adata manipulation action in tc(8)