man > tc-tunnel_key(8)

Che Dong

Tunnel metadata manipulation action in tc(8) Linux Tunnel metadata manipulation action in tc(8)

NAME
tunnel_key - Tunnel metadata manipulation

SYNOPSIS
tc ... action tunnel_key { unset | SET }

SET := set src_ip ADDRESS dst_ip ADDRESS id KEY_ID dst_port UDP_PORT tos TOS ttl TTL [ csum |
nocsum ]

DESCRIPTION
The tunnel_key action combined with a shared IP tunnel device, allows one to perform IP tun‐
nel en- or decapsulation on a packet, reflected by the operation modes UNSET and SET. The
UNSET mode is optional - even without using it, the metadata information will be released au‐
tomatically when packet processing will be finished. UNSET function could be used in cases
when traffic is forwarded between two tunnels, where the metadata from the first tunnel will
be used for encapsulation done by the second tunnel. SET mode requires the source and desti‐
nation ip ADDRESS and the tunnel key id KEY_ID which will be used by the ip tunnel shared de‐
vice to create the tunnel header. The tunnel_key action is useful only in combination with a
mirred redirect action to a shared IP tunnel device which will use the metadata (for SET )
and unset the metadata created by it (for UNSET ).

OPTIONS
unset Unset the tunnel metadata created by the IP tunnel device. This function is not
mandatory and might be used only in some specific use cases (as explained above).

set Set tunnel metadata to be used by the IP tunnel device. Requires src_ip and dst_ip op‐
tions. id , dst_port , geneve_opts , vxlan_opts and erspan_opts are optional.

id Tunnel ID (for example VNI in VXLAN tunnel)

src_ip Outer header source IP address (IPv4 or IPv6)

dst_ip Outer header destination IP address (IPv4 or IPv6)

dst_port
Outer header destination UDP port

geneve_opts
Geneve variable length options. geneve_opts is specified in the form
CLASS:TYPE:DATA, where CLASS is represented as a 16bit hexadecimal value, TYPE
as an 8bit hexadecimal value and DATA as a variable length hexadecimal value.
Additionally multiple options may be listed using a comma delimiter.

vxlan_opts
Vxlan metadata options. vxlan_opts is specified in the form GBP, as a 32bit
number. Multiple options is not supported.

erspan_opts
Erspan metadata options. erspan_opts is specified in the form VERSION:IN‐
DEX:DIR:HWID, where VERSION is represented as a 8bit number, INDEX as an 32bit
number, DIR and HWID as a 8bit number. Multiple options is not supported. Note
INDEX is used when VERSION is 1, and DIR and HWID are used when VERSION is 2.

tos Outer header TOS

ttl Outer header TTL

[no]csum
Controls outer UDP checksum. When set to csum (which is default), the outer UDP
checksum is calculated and included in the packets. When set to nocsum, outer
UDP checksum is zero. Note that when using zero UDP checksums with IPv6, the
other tunnel endpoint must be configured to accept such packets. In Linux,
this would be the udp6zerocsumrx option for the VXLAN tunnel interface.

If using nocsum with IPv6, be sure you know what you are doing. Zero UDP check‐
sums provide weaker protection against corrupted packets. See RFC6935 for de‐
tails.

EXAMPLES
The following example encapsulates incoming ICMP packets on eth0 into a vxlan tunnel, by set‐
ting metadata to VNI 11, source IP 11.11.0.1 and destination IP 11.11.0.2, and by redirecting
the packet with the metadata to device vxlan0, which will do the actual encapsulation using
the metadata:

#tc qdisc add dev eth0 handle ffff: ingress
#tc filter add dev eth0 protocol ip parent ffff: \
flower \
ip_proto icmp \
action tunnel_key set \
src_ip 11.11.0.1 \
dst_ip 11.11.0.2 \
id 11 \
action mirred egress redirect dev vxlan0

Here is an example of the unset function: Incoming VXLAN traffic with outer IP's and VNI 11
is decapsulated by vxlan0 and metadata is unset before redirecting to tunl1 device:

#tc qdisc add dev eth0 handle ffff: ingress
#tc filter add dev vxlan0 protocol ip parent ffff: flower \
enc_src_ip 11.11.0.2 enc_dst_ip 11.11.0.1 enc_key_id 11 action tunnel_key unset action mirred egress redirect dev tunl1