Tunnel metadata manipulation actioTunnelumetadata manipulation action in tc(8)
NAME
tunnel_key - Tunnel metadata manipulation
SYNOPSIS
tc ... action tunnel_key { unset | SET }
SET := set src_ip ADDRESS dst_ip ADDRESS id KEY_ID dst_port UDP_PORT
tos TOS ttl TTL [ csum | nocsum ]
DESCRIPTION
The tunnel_key action combined with a shared IP tunnel device, allows
to perform IP tunnel en- or decapsulation on a packet, reflected by the
operation modes UNSET and SET. The UNSET mode is optional - even with-
out using it, the metadata information will be released automatically
when packet processing will be finished. UNSET function could be used
in cases when traffic is forwarded between two tunnels, where the meta-
data from the first tunnel will be used for encapsulation done by the
second tunnel. SET mode requires the source and destination ip ADDRESS
and the tunnel key id KEY_ID which will be used by the ip tunnel shared
device to create the tunnel header. The tunnel_key action is useful
only in combination with a mirred redirect action to a shared IP tunnel
device which will use the metadata (for SET ) and unset the metadata
created by it (for UNSET ).
OPTIONS
unset Unset the tunnel metadata created by the IP tunnel device. This
function is not mandatory and might be used only in some spe-
cific use cases (as explained above).
set Set tunnel metadata to be used by the IP tunnel device. Requires
src_ip and dst_ip options. id , dst_port is optional.
id Tunnel ID (for example VNI in VXLAN tunnel)
src_ip Outer header source IP address (IPv4 or IPv6)
dst_ip Outer header destination IP address (IPv4 or IPv6)
dst_port
Outer header destination UDP port
tos Outer header TOS
ttl Outer header TTL
[no]csum
Controlls outer UDP checksum. When set to csum (which is
default), the outer UDP checksum is calculated and
included in the packets. When set to nocsum, outer UDP
checksum is zero. Note that when using zero UDP checksums
with IPv6, the other tunnel endpoint must be configured
to accept such packets. In Linux, this would be the
udp6zerocsumrx option for the VXLAN tunnel interface.
If using nocsum with IPv6, be sure you know what you are
doing. Zero UDP checksums provide weaker protection
against corrupted packets. See RFC6935 for details.
EXAMPLES
The following example encapsulates incoming ICMP packets on eth0 into a
vxlan tunnel, by setting metadata to VNI 11, source IP 11.11.0.1 and
destination IP 11.11.0.2, and by redirecting the packet with the meta-
data to device vxlan0, which will do the actual encapsulation using the
metadata:
#tc qdisc add dev eth0 handle ffff: ingress
#tc filter add dev eth0 protocol ip parent ffff: \
flower \
ip_proto icmp \
action tunnel_key set \
src_ip 11.11.0.1 \
dst_ip 11.11.0.2 \
id 11 \
action mirred egress redirect dev vxlan0
Here is an example of the unset function: Incoming VXLAN traffic with
outer IP's and VNI 11 is decapsulated by vxlan0 and metadata is unset
before redirecting to tunl1 device:
#tc qdisc add dev eth0 handle ffff: ingress
#tc filter add dev vxlan0 protocol ip parent ffff: flower \
enc_src_ip 11.11.0.2 enc_dst_ip 11.11.0.1 enc_key_id 11 action tunnel_key unset action mirred egress redirect dev tunl1
SEE ALSO
tc(8)
iproute2 Tunnel metadata manipulation action in tc(8)