• Christian Ehrig's avatar
    ipip,ip_tunnel,sit: Add FOU support for externally controlled ipip devices · ac931d4c
    Christian Ehrig authored
    Today ipip devices in collect-metadata mode don't allow for sending FOU
    or GUE encapsulated packets. This patch lifts the restriction by adding
    a struct ip_tunnel_encap to the tunnel metadata.
    
    On the egress path, the members of this struct can be set by the
    bpf_skb_set_fou_encap kfunc via a BPF tc-hook. Instead of dropping packets
    wishing to use additional UDP encapsulation, ip_md_tunnel_xmit now
    evaluates the contents of this struct and adds the corresponding FOU or
    GUE header. Furthermore, it is making sure that additional header bytes
    are taken into account for PMTU discovery.
    
    On the ingress path, an ipip device in collect-metadata mode will fill this
    struct and a BPF tc-hook can obtain the information via a call to the
    bpf_skb_get_fou_encap kfunc.
    
    The minor change to ip_tunnel_encap, which now takes a pointer to
    struct ip_tunnel_encap instead of struct ip_tunnel, allows us to control
    FOU encap type and parameters on a per packet-level.
    Signed-off-by: default avatarChristian Ehrig <cehrig@cloudflare.com>
    Link: https://lore.kernel.org/r/cfea47de655d0f870248abf725932f851b53960a.1680874078.git.cehrig@cloudflare.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    ac931d4c
ipip.c 17.2 KB