1Tunnel metadata manipulation actionTuinnLnietnlcu(xm8e)tadata manipulation action in tc(8)
2
3
4

NAME

6       tunnel_key - Tunnel metadata manipulation
7

SYNOPSIS

9       tc ... action tunnel_key { unset | SET }
10
11       SET  :=  set  src_ip ADDRESS dst_ip ADDRESS id KEY_ID dst_port UDP_PORT
12               tos TOS ttl TTL [ csum | nocsum ]
13
14

DESCRIPTION

16       The tunnel_key action combined with a shared IP tunnel  device,  allows
17       one to perform IP tunnel en- or decapsulation on a packet, reflected by
18       the operation modes UNSET and SET.  The UNSET mode is optional  -  even
19       without  using  it, the metadata information will be released automati‐
20       cally when packet processing will be finished.  UNSET function could be
21       used  in cases when traffic is forwarded between two tunnels, where the
22       metadata from the first tunnel will be used for encapsulation  done  by
23       the second tunnel.  SET mode requires the source and destination ip AD‐
24       DRESS and the tunnel key id KEY_ID which will be used by the ip  tunnel
25       shared  device  to  create  the tunnel header. The tunnel_key action is
26       useful only in combination with a mirred redirect action to a shared IP
27       tunnel  device  which  will  use  the metadata (for SET ) and unset the
28       metadata created by it (for UNSET ).
29
30

OPTIONS

32       unset  Unset the tunnel metadata created by the IP tunnel device.  This
33              function  is  not  mandatory and might be used only in some spe‐
34              cific use cases (as explained above).
35
36       set    Set tunnel metadata to be used by the IP tunnel device. Requires
37              src_ip  and  dst_ip  options.   id  ,  dst_port  , geneve_opts ,
38              vxlan_opts and erspan_opts are optional.
39
40              id     Tunnel ID (for example VNI in VXLAN tunnel)
41
42              src_ip Outer header source IP address (IPv4 or IPv6)
43
44              dst_ip Outer header destination IP address (IPv4 or IPv6)
45
46              dst_port
47                     Outer header destination UDP port
48
49              geneve_opts
50                     Geneve variable length options.  geneve_opts is specified
51                     in  the  form CLASS:TYPE:DATA, where CLASS is represented
52                     as a 16bit hexadecimal value, TYPE as an 8bit hexadecimal
53                     value  and  DATA  as a variable length hexadecimal value.
54                     Additionally multiple options may be listed using a comma
55                     delimiter.
56
57              vxlan_opts
58                     Vxlan  metadata  options.  vxlan_opts is specified in the
59                     form GBP, as a 32bit number. Multiple options is not sup‐
60                     ported.
61
62              erspan_opts
63                     Erspan metadata options.  erspan_opts is specified in the
64                     form VERSION:INDEX:DIR:HWID, where VERSION is represented
65                     as  a 8bit number, INDEX as an 32bit number, DIR and HWID
66                     as a 8bit number.  Multiple  options  is  not  supported.
67                     Note  INDEX  is  used when VERSION is 1, and DIR and HWID
68                     are used when VERSION is 2.
69
70              tos    Outer header TOS
71
72              ttl    Outer header TTL
73
74              [no]csum
75                     Controls outer UDP checksum. When set to csum  (which  is
76                     default),  the  outer  UDP checksum is calculated and in‐
77                     cluded in the packets. When  set  to  nocsum,  outer  UDP
78                     checksum is zero. Note that when using zero UDP checksums
79                     with IPv6, the other tunnel endpoint must  be  configured
80                     to  accept  such  packets.   In  Linux, this would be the
81                     udp6zerocsumrx option for the VXLAN tunnel interface.
82
83                     If using nocsum with IPv6, be sure you know what you  are
84                     doing.  Zero  UDP  checksums  provide  weaker  protection
85                     against corrupted packets. See RFC6935 for details.
86
87              nofrag disallow IP fragmentation.
88

EXAMPLES

90       The following example encapsulates incoming ICMP packets on eth0 into a
91       vxlan  tunnel,  by  setting metadata to VNI 11, source IP 11.11.0.1 and
92       destination IP 11.11.0.2, and by redirecting the packet with the  meta‐
93       data to device vxlan0, which will do the actual encapsulation using the
94       metadata:
95
96              #tc qdisc add dev eth0 handle ffff: ingress
97              #tc filter add dev eth0 protocol ip parent ffff: \
98                flower \
99                  ip_proto icmp \
100                action tunnel_key set \
101                  src_ip 11.11.0.1 \
102                  dst_ip 11.11.0.2 \
103                  id 11 \
104                action mirred egress redirect dev vxlan0
105
106       Here is an example of the unset function: Incoming VXLAN  traffic  with
107       outer  IP's  and VNI 11 is decapsulated by vxlan0 and metadata is unset
108       before redirecting to tunl1 device:
109
110              #tc qdisc add dev eth0 handle ffff: ingress
111              #tc filter add dev vxlan0 protocol ip parent ffff:   flower \
112                     enc_src_ip 11.11.0.2 enc_dst_ip 11.11.0.1 enc_key_id 11   action tunnel_key unset  action mirred egress redirect dev tunl1
113
114

SEE ALSO

116       tc(8)
117
118
119
120iproute2                          1T0unNnoevl 2m0e1t6adata manipulation action in tc(8)
Impressum