path: root/Documentation/networking
diff options
authorDavid S. Miller <>2015-01-15 01:12:13 -0500
committerDavid S. Miller <>2015-01-15 01:12:13 -0500
commit2e62fa699ffb3f5b3a6778c720818e95690e9faa (patch)
treed5442581624a3ff7f3b4d91d193ba5928cc98328 /Documentation/networking
parent3f3558bb512e0762d5a4573a4aaf038d7a616e92 (diff)
parent1dd144cf5b4b47e12438c2c6883925ce1a9b499f (diff)
Merge branch 'vxlan_group_policy_extension'
Thomas Graf says: ==================== VXLAN Group Policy Extension Implements supports for the Group Policy VXLAN extension [0] to provide a lightweight and simple security label mechanism across network peers based on VXLAN. The security context and associated metadata is mapped to/from skb->mark. This allows further mapping to a SELinux context using SECMARK, to implement ACLs directly with nftables, iptables, OVS, tc, etc. The extension is disabled by default and should be run on a distinct port in mixed Linux VXLAN VTEP environments. Liberal VXLAN VTEPs which ignore unknown reserved bits will be able to receive VXLAN-GBP frames. Simple usage example: # ip link add vxlan0 type vxlan id 10 remote gbp # iptables -I OUTPUT -m owner --uid-owner 101 -j MARK --set-mark 0x200 # ip link add vxlan0 type vxlan id 10 remote gbp # iptables -I INPUT -m mark --mark 0x200 -j DROP iproute2 [1] and OVS [2] support will be provided in separate patches. [0] [1] [2] ==================== Signed-off-by: David S. Miller <>
Diffstat (limited to 'Documentation/networking')
0 files changed, 0 insertions, 0 deletions