Import vxlan(4), the virtual extensible local area network tunnel

interface.  VXLAN is a UDP-based tunnelling protocol for overlaying
virtualized layer 2 networks over layer 3 networks. The implementation
is based on draft-mahalingam-dutt-dcops-vxlan-04 and has been tested
with other implementations in the wild.

put it in deraadt@

5 files changed, 791 insertions, 16 deletions

diff --git a/sys/net/if.h b/sys/net/if.h
index a95ef74c2b1..508407cd6bd 100644
--- a/sys/net/if.h
+++ b/sys/net/if.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if.h,v 1.147 2013/10/12 12:13:10 henning Exp $	*/
+/*	$OpenBSD: if.h,v 1.148 2013/10/13 10:10:02 reyk Exp $	*/
 /*	$NetBSD: if.h,v 1.23 1996/05/07 02:40:27 thorpej Exp $	*/
 
 /*
@@ -641,6 +641,8 @@ struct	ifreq {
 #define	ifr_hardmtu	ifr_ifru.ifru_metric	/* hardmtu (overload) */
 #define	ifr_media	ifr_ifru.ifru_metric	/* media options (overload) */
 #define	ifr_rdomainid	ifr_ifru.ifru_metric	/* VRF instance (overload) */
+#define ifr_vnetid	ifr_ifru.ifru_metric	/* Virtual Net Id (overload) */
+#define ifr_ttl		ifr_ifru.ifru_metric	/* tunnel TTL (overload) */
 #define	ifr_data	ifr_ifru.ifru_data	/* for use by interface */
 };
 
diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c
index 9ea29ba1a3f..c1798b0371b 100644
--- a/sys/net/if_bridge.c
+++ b/sys/net/if_bridge.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_bridge.c,v 1.215 2013/10/12 11:55:45 henning Exp $	*/
+/*	$OpenBSD: if_bridge.c,v 1.216 2013/10/13 10:10:02 reyk Exp $	*/
 
 /*
  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
@@ -131,9 +131,9 @@ int	bridge_rtfind(struct bridge_softc *, struct ifbaconf *);
 void	bridge_rtage(struct bridge_softc *);
 int	bridge_rtdaddr(struct bridge_softc *, struct ether_addr *);
 void	bridge_rtflush(struct bridge_softc *, int);
-struct ifnet *	bridge_rtupdate(struct bridge_softc *,
-    struct ether_addr *, struct ifnet *ifp, int, u_int8_t);
-struct ifnet *	bridge_rtlookup(struct bridge_softc *,
+struct ifnet *bridge_rtupdate(struct bridge_softc *,
+    struct ether_addr *, struct ifnet *ifp, int, u_int8_t, struct mbuf *);
+struct bridge_rtnode *bridge_rtlookup(struct bridge_softc *,
     struct ether_addr *);
 u_int32_t	bridge_hash(struct bridge_softc *, struct ether_addr *);
 int bridge_blocknonip(struct ether_header *, struct mbuf *);
@@ -161,6 +161,7 @@ int bridge_ipsec(struct bridge_softc *, struct ifnet *,
 int     bridge_clone_create(struct if_clone *, int);
 int	bridge_clone_destroy(struct ifnet *ifp);
 int	bridge_delete(struct bridge_softc *, struct bridge_iflist *);
+void	bridge_tunnelupdate(struct sockaddr *, struct sockaddr *);
 
 #define	ETHERADDR_IS_IP_MCAST(a) \
 	/* struct etheraddr *a;	*/				\
@@ -550,7 +551,7 @@ bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 		}
 
 		ifs = bridge_rtupdate(sc, &bareq->ifba_dst, ifs, 1,
-		    bareq->ifba_flags);
+		    bareq->ifba_flags, NULL);
 		if (ifs == NULL)
 			error = ENOMEM;
 		break;
@@ -728,7 +729,7 @@ bridge_update(struct ifnet *ifp, struct ether_addr *ea, int delete)
 
 		if (!delete) {
 			/* Update the bridge table */
-			bridge_rtupdate(sc, ea, ifp, 0, IFBAF_DYNAMIC);
+			bridge_rtupdate(sc, ea, ifp, 0, IFBAF_DYNAMIC, NULL);
 		}
 	}
 }
@@ -946,7 +947,8 @@ bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa,
     struct rtentry *rt)
 {
 	struct ether_header *eh;
-	struct ifnet *dst_if;
+	struct ifnet *dst_if = NULL;
+	struct bridge_rtnode *dst_p = NULL;
 	struct ether_addr *dst;
 	struct bridge_softc *sc;
 	int s, error, len;
@@ -990,7 +992,8 @@ bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa,
 	 * If the packet is a broadcast or we don't know a better way to
 	 * get there, send to all interfaces.
 	 */
-	dst_if = bridge_rtlookup(sc, dst);
+	if ((dst_p = bridge_rtlookup(sc, dst)) != NULL)
+		dst_if = dst_p->brt_if;
 	if (dst_if == NULL || ETHER_IS_MULTICAST(eh->ether_dhost)) {
 		struct bridge_iflist *p;
 		struct mbuf *mc;
@@ -1083,6 +1086,10 @@ bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa,
 	}
 
 sendunicast:
+	if (dst_p != NULL && dst_p->brt_tunnel.sa.sa_family != AF_UNSPEC &&
+	    (sa = bridge_tunneltag(m, dst_p->brt_tunnel.sa.sa_family)) != NULL)
+		memcpy(sa, &dst_p->brt_tunnel.sa, dst_p->brt_tunnel.sa.sa_len);
+
 	bridge_span(sc, NULL, m);
 	if ((dst_if->if_flags & IFF_RUNNING) == 0) {
 		m_freem(m);
@@ -1133,6 +1140,7 @@ bridgeintr_frame(struct bridge_softc *sc, struct mbuf *m)
 	int s, len;
 	struct ifnet *src_if, *dst_if;
 	struct bridge_iflist *ifl;
+	struct bridge_rtnode *dst_p;
 	struct ether_addr *dst, *src;
 	struct ether_header eh;
 
@@ -1175,7 +1183,7 @@ bridgeintr_frame(struct bridge_softc *sc, struct mbuf *m)
 	    !(eh.ether_shost[0] == 0 && eh.ether_shost[1] == 0 &&
 	    eh.ether_shost[2] == 0 && eh.ether_shost[3] == 0 &&
 	    eh.ether_shost[4] == 0 && eh.ether_shost[5] == 0))
-		bridge_rtupdate(sc, src, src_if, 0, IFBAF_DYNAMIC);
+		bridge_rtupdate(sc, src, src_if, 0, IFBAF_DYNAMIC, m);
 
 	if ((ifl->bif_flags & IFBIF_STP) &&
 	    (ifl->bif_state == BSTP_IFSTATE_LEARNING)) {
@@ -1193,7 +1201,10 @@ bridgeintr_frame(struct bridge_softc *sc, struct mbuf *m)
 	 * side of the bridge, drop it.
 	 */
 	if ((m->m_flags & (M_BCAST | M_MCAST)) == 0) {
-		dst_if = bridge_rtlookup(sc, dst);
+		if ((dst_p = bridge_rtlookup(sc, dst)) != NULL)
+			dst_if = dst_p->brt_if;
+		else
+			dst_if = NULL;
 		if (dst_if == src_if) {
 			m_freem(m);
 			return;
@@ -1422,7 +1433,7 @@ bridge_input(struct ifnet *ifp, struct ether_header *eh, struct mbuf *m)
 			if (srcifl->bif_flags & IFBIF_LEARNING)
 				bridge_rtupdate(sc,
 				    (struct ether_addr *)&eh->ether_shost,
-				    ifp, 0, IFBAF_DYNAMIC);
+				    ifp, 0, IFBAF_DYNAMIC, m);
 			if (bridge_filterrule(&srcifl->bif_brlin, eh, m) ==
 			    BRL_ACTION_BLOCK) {
 				m_freem(m);
@@ -1685,12 +1696,18 @@ bridge_span(struct bridge_softc *sc, struct ether_header *eh,
 
 struct ifnet *
 bridge_rtupdate(struct bridge_softc *sc, struct ether_addr *ea,
-    struct ifnet *ifp, int setflags, u_int8_t flags)
+    struct ifnet *ifp, int setflags, u_int8_t flags, struct mbuf *m)
 {
 	struct bridge_rtnode *p, *q;
+	struct sockaddr *sa = NULL;
 	u_int32_t h;
 	int dir;
 
+	if (m != NULL) {
+		/* Check if the mbuf was tagged with a tunnel endpoint addr */
+		sa = bridge_tunnel(m);
+	}
+
 	h = bridge_hash(sc, ea);
 	p = LIST_FIRST(&sc->sc_rts[h]);
 	if (p == NULL) {
@@ -1703,6 +1720,7 @@ bridge_rtupdate(struct bridge_softc *sc, struct ether_addr *ea,
 		bcopy(ea, &p->brt_addr, sizeof(p->brt_addr));
 		p->brt_if = ifp;
 		p->brt_age = 1;
+		bridge_tunnelupdate(sa, (struct sockaddr *)&p->brt_tunnel);
 
 		if (setflags)
 			p->brt_flags = flags;
@@ -1729,6 +1747,9 @@ bridge_rtupdate(struct bridge_softc *sc, struct ether_addr *ea,
 			if (q->brt_if == ifp)
 				q->brt_age = 1;
 			ifp = q->brt_if;
+			bridge_tunnelupdate(sa,
+			     (struct sockaddr *)&q->brt_tunnel);
+
 			goto want;
 		}
 
@@ -1742,6 +1763,8 @@ bridge_rtupdate(struct bridge_softc *sc, struct ether_addr *ea,
 			bcopy(ea, &p->brt_addr, sizeof(p->brt_addr));
 			p->brt_if = ifp;
 			p->brt_age = 1;
+			bridge_tunnelupdate(sa,
+			    (struct sockaddr *)&p->brt_tunnel);
 
 			if (setflags)
 				p->brt_flags = flags;
@@ -1763,6 +1786,8 @@ bridge_rtupdate(struct bridge_softc *sc, struct ether_addr *ea,
 			bcopy(ea, &p->brt_addr, sizeof(p->brt_addr));
 			p->brt_if = ifp;
 			p->brt_age = 1;
+			bridge_tunnelupdate(sa,
+			    (struct sockaddr *)&p->brt_tunnel);
 
 			if (setflags)
 				p->brt_flags = flags;
@@ -1780,7 +1805,7 @@ want:
 	return (ifp);
 }
 
-struct ifnet *
+struct bridge_rtnode *
 bridge_rtlookup(struct bridge_softc *sc, struct ether_addr *ea)
 {
 	struct bridge_rtnode *p;
@@ -1791,7 +1816,7 @@ bridge_rtlookup(struct bridge_softc *sc, struct ether_addr *ea)
 	LIST_FOREACH(p, &sc->sc_rts[h], brt_next) {
 		dir = memcmp(ea, &p->brt_addr, sizeof(p->brt_addr));
 		if (dir == 0)
-			return (p->brt_if);
+			return (p);
 		if (dir > 0)
 			goto fail;
 	}
@@ -2018,6 +2043,12 @@ bridge_rtfind(struct bridge_softc *sc, struct ifbaconf *baconf)
 				    sizeof(bareq.ifba_ifsname));
 				bcopy(&n->brt_addr, &bareq.ifba_dst,
 				    sizeof(bareq.ifba_dst));
+				if (n->brt_tunnel.sa.sa_family != AF_UNSPEC)
+					bcopy(&n->brt_tunnel.sa,
+					    &bareq.ifba_dstsa,
+					    n->brt_tunnel.sa.sa_len);
+				else
+					bareq.ifba_dstsa.ss_family = AF_UNSPEC;
 				bareq.ifba_age = n->brt_age;
 				bareq.ifba_flags = n->brt_flags;
 				error = copyout((caddr_t)&bareq,
@@ -2823,3 +2854,65 @@ bridge_send_icmp_err(struct bridge_softc *sc, struct ifnet *ifp,
 	m_freem(n);
 }
 #endif
+
+struct sockaddr *
+bridge_tunnel(struct mbuf *m)
+{
+	struct m_tag    *mtag;
+
+	if ((mtag = m_tag_find(m, PACKET_TAG_TUNNEL, NULL)) == NULL)
+		return (NULL);
+
+	return ((struct sockaddr *)(mtag + 1));
+}
+
+struct sockaddr *
+bridge_tunneltag(struct mbuf *m, int af)
+{
+	struct m_tag    *mtag;
+	size_t		 len;
+	struct sockaddr	*sa;
+
+	if ((mtag = m_tag_find(m, PACKET_TAG_TUNNEL, NULL)) != NULL) {
+		sa = (struct sockaddr *)(mtag + 1);
+		if (sa->sa_family != af) {
+			m_tag_delete(m, mtag);
+			mtag = NULL;
+		}
+	}
+	if (mtag == NULL) {
+		if (af == AF_INET)
+			len = sizeof(struct sockaddr_in);
+		else if (af == AF_INET6)
+			len = sizeof(struct sockaddr_in6);
+		else
+			return (NULL);
+		mtag = m_tag_get(PACKET_TAG_TUNNEL, len, M_NOWAIT);
+		if (mtag == NULL)
+			return (NULL);
+		bzero(mtag + 1, len);
+		sa = (struct sockaddr *)(mtag + 1);
+		sa->sa_family = af;
+		sa->sa_len = len;
+		m_tag_prepend(m, mtag);
+	}
+
+	return ((struct sockaddr *)(mtag + 1));
+}
+
+void
+bridge_tunneluntag(struct mbuf *m)
+{
+	struct m_tag    *mtag;
+	if ((mtag = m_tag_find(m, PACKET_TAG_TUNNEL, NULL)) != NULL)
+		m_tag_delete(m, mtag);
+}
+
+void
+bridge_tunnelupdate(struct sockaddr *sa, struct sockaddr *tunnel)
+{
+	if (sa != NULL && sa->sa_family != AF_UNSPEC)
+		memcpy(tunnel, sa, sa->sa_len);
+	else
+		tunnel->sa_family = AF_UNSPEC;
+}
diff --git a/sys/net/if_bridge.h b/sys/net/if_bridge.h
index 3fb604dba6e..db956d960cd 100644
--- a/sys/net/if_bridge.h
+++ b/sys/net/if_bridge.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_bridge.h,v 1.37 2013/01/23 13:28:36 camield Exp $	*/
+/*	$OpenBSD: if_bridge.h,v 1.38 2013/10/13 10:10:03 reyk Exp $	*/
 
 /*
  * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net)
@@ -122,6 +122,7 @@ struct ifbareq {
 	u_int8_t		ifba_age;		/* address age */
 	u_int8_t		ifba_flags;		/* address flags */
 	struct ether_addr	ifba_dst;		/* destination addr */
+	struct sockaddr_storage	ifba_dstsa;		/* tunnel endpoint */
 };
 
 #define	IFBAF_TYPEMASK		0x03		/* address type mask */
@@ -406,6 +407,15 @@ struct bridge_rtnode {
 	u_int8_t			brt_flags;	/* address flags */
 	u_int8_t			brt_age;	/* age counter */
 	struct				ether_addr brt_addr;	/* dst addr */
+	union {
+		struct sockaddr		sa;
+#ifdef INET
+		struct sockaddr_in	sin;
+#endif
+#ifdef INET6
+		struct sockaddr_in6	sin6;
+#endif
+	}				brt_tunnel;	/* tunnel endpoint */
 };
 
 #ifndef BRIDGE_RTABLE_SIZE
@@ -441,6 +451,9 @@ int	bridge_output(struct ifnet *, struct mbuf *, struct sockaddr *,
 void	bridge_update(struct ifnet *, struct ether_addr *, int);
 void	bridge_rtdelete(struct bridge_softc *, struct ifnet *, int);
 void	bridge_rtagenode(struct ifnet *, int);
+struct sockaddr *bridge_tunnel(struct mbuf *);
+struct sockaddr *bridge_tunneltag(struct mbuf *, int);
+void	bridge_tunneluntag(struct mbuf *);
 
 struct bstp_state *bstp_create(struct ifnet *);
 void	bstp_destroy(struct bstp_state *);
diff --git a/sys/net/if_vxlan.c b/sys/net/if_vxlan.c
new file mode 100644
index 00000000000..69323992ccf
--- /dev/null
+++ b/sys/net/if_vxlan.c
@@ -0,0 +1,590 @@
+/*	$OpenBSD: if_vxlan.c,v 1.1 2013/10/13 10:10:03 reyk Exp $	*/
+
+/*
+ * Copyright (c) 2013 Reyk Floeter <reyk@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "bpfilter.h"
+#include "vxlan.h"
+#include "vlan.h"
+#include "pf.h"
+#include "bridge.h"
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/mbuf.h>
+#include <sys/socket.h>
+#include <sys/sockio.h>
+#include <sys/ioctl.h>
+
+#include <net/if.h>
+#include <net/if_dl.h>
+#include <net/if_media.h>
+#include <net/route.h>
+
+#if NBPFILTER > 0
+#include <net/bpf.h>
+#endif
+
+#if NPF > 0
+#include <net/pfvar.h>
+#endif
+
+#include <netinet/in.h>
+#include <netinet/in_var.h>
+#include <netinet/in_systm.h>
+#include <netinet/if_ether.h>
+#include <netinet/ip.h>
+#include <netinet/ip_var.h>
+#include <netinet/udp.h>
+#include <netinet/udp_var.h>
+#include <netinet/in_pcb.h>
+
+#if NBRIDGE > 0
+#include <net/if_bridge.h>
+#endif
+
+#include <net/if_vxlan.h>
+
+void	 vxlanattach(int);
+int	 vxlanioctl(struct ifnet *, u_long, caddr_t);
+void	 vxlanstart(struct ifnet *);
+int	 vxlan_clone_create(struct if_clone *, int);
+int	 vxlan_clone_destroy(struct ifnet *);
+int	 vxlan_media_change(struct ifnet *);
+void	 vxlan_media_status(struct ifnet *, struct ifmediareq *);
+int	 vxlan_config(struct ifnet *, struct sockaddr *, struct sockaddr *);
+int	 vxlan_output(struct ifnet *, struct mbuf *);
+
+struct if_clone	vxlan_cloner =
+    IF_CLONE_INITIALIZER("vxlan", vxlan_clone_create, vxlan_clone_destroy);
+
+int	 vxlan_enable = 0;
+u_long	 vxlan_tagmask;
+
+#define VXLAN_TAGHASHSIZE		 32
+#define VXLAN_TAGHASH(tag)		 (tag & vxlan_tagmask)
+LIST_HEAD(vxlan_taghash, vxlan_softc)	*vxlan_tagh;
+
+void
+vxlanattach(int count)
+{
+	if ((vxlan_tagh = hashinit(VXLAN_TAGHASHSIZE, M_DEVBUF, M_NOWAIT,
+	    &vxlan_tagmask)) == NULL)
+		panic("vxlanattach: hashinit");
+
+	if_clone_attach(&vxlan_cloner);
+}
+
+int
+vxlan_clone_create(struct if_clone *ifc, int unit)
+{
+	struct ifnet		*ifp;
+	struct vxlan_softc	*sc;
+
+	if ((sc = malloc(sizeof(*sc),
+	    M_DEVBUF, M_NOWAIT|M_ZERO)) == NULL)
+		return (ENOMEM);
+
+	sc->sc_imo.imo_membership = malloc(
+	    (sizeof(struct in_multi *) * IP_MIN_MEMBERSHIPS), M_IPMOPTS,
+	    M_WAITOK|M_ZERO);
+	sc->sc_imo.imo_max_memberships = IP_MIN_MEMBERSHIPS;
+	sc->sc_dstport = htons(VXLAN_PORT);
+	sc->sc_vnetid = 0;
+
+	ifp = &sc->sc_ac.ac_if;
+	snprintf(ifp->if_xname, sizeof ifp->if_xname, "vxlan%d", unit);
+	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
+	ether_fakeaddr(ifp);
+
+	ifp->if_softc = sc;
+	ifp->if_ioctl = vxlanioctl;
+	ifp->if_start = vxlanstart;
+	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
+	IFQ_SET_READY(&ifp->if_snd);
+
+	ifp->if_hardmtu = 0xffff;
+	ifp->if_capabilities = IFCAP_VLAN_MTU;
+
+	ifmedia_init(&sc->sc_media, 0, vxlan_media_change,
+	    vxlan_media_status);
+	ifmedia_add(&sc->sc_media, IFM_ETHER | IFM_AUTO, 0, NULL);
+	ifmedia_set(&sc->sc_media, IFM_ETHER | IFM_AUTO);
+
+	if_attach(ifp);
+	ether_ifattach(ifp);
+
+	/* XXX should we allow IP fragments? */
+	ifp->if_mtu = ETHERMTU - sizeof(struct ether_header);
+#ifdef INET
+	ifp->if_mtu -= sizeof(struct vxlanudpiphdr);
+#endif
+
+	LIST_INSERT_HEAD(&vxlan_tagh[VXLAN_TAGHASH(0)], sc, sc_entry);
+	vxlan_enable++;
+
+	return (0);
+}
+
+int
+vxlan_clone_destroy(struct ifnet *ifp)
+{
+	struct vxlan_softc	*sc = ifp->if_softc;
+
+	vxlan_enable--;
+	LIST_REMOVE(sc, sc_entry);
+
+	ifmedia_delete_instance(&sc->sc_media, IFM_INST_ANY);
+	ether_ifdetach(ifp);
+	if_detach(ifp);
+	free(sc->sc_imo.imo_membership, M_IPMOPTS);
+	free(sc, M_DEVBUF);
+
+	return (0);
+}
+
+void
+vxlanstart(struct ifnet *ifp)
+{
+	struct mbuf		*m;
+	int			 s;
+
+	for (;;) {
+		s = splnet();
+		IFQ_DEQUEUE(&ifp->if_snd, m);
+		splx(s);
+
+		if (m == NULL)
+			return;
+		ifp->if_opackets++;
+
+#if NBPFILTER > 0
+		if (ifp->if_bpf)
+			bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
+#endif
+
+		vxlan_output(ifp, m);		
+	}
+}
+
+int
+vxlan_config(struct ifnet *ifp, struct sockaddr *src, struct sockaddr *dst)
+{
+	struct vxlan_softc	*sc = (struct vxlan_softc *)ifp->if_softc;
+	struct ip_moptions	*imo = &sc->sc_imo;
+#ifdef INET
+	struct sockaddr_in	*src4, *dst4;
+	struct ifaddr		*ifa;
+#endif
+	int			 reset = 0;
+
+	if (src != NULL && dst != NULL) {
+		/* XXX inet6 is not supported */
+		if (src->sa_family != AF_INET || dst->sa_family != AF_INET)
+			return (EAFNOSUPPORT);
+	} else {
+		/* Reset current configuration */
+		src = (struct sockaddr *)&sc->sc_src;
+		dst = (struct sockaddr *)&sc->sc_dst;
+		reset = 1;
+	}
+
+#ifdef INET
+	src4 = (struct sockaddr_in *)src;
+	dst4 = (struct sockaddr_in *)dst;
+
+	if (src4->sin_len != sizeof(*src4) || dst4->sin_len != sizeof(*dst4))
+		return (EINVAL);
+
+	if (IN_MULTICAST(dst4->sin_addr.s_addr)) {
+		if (src4->sin_addr.s_addr == INADDR_ANY ||
+		    IN_MULTICAST(src4->sin_addr.s_addr))
+			return (EINVAL);
+		if ((ifa = ifa_ifwithaddr((struct sockaddr *)src4,
+		    sc->sc_rtableid)) == NULL ||
+		    ifa->ifa_ifp == NULL ||
+		    (ifa->ifa_ifp->if_flags & IFF_MULTICAST) == 0)
+			return (EADDRNOTAVAIL);
+	}
+#endif
+
+	if (imo->imo_num_memberships > 0) {
+		in_delmulti(imo->imo_membership[
+		    --imo->imo_num_memberships]);
+		imo->imo_multicast_ifp = NULL;
+	}
+
+#ifdef INET
+	if (IN_MULTICAST(dst4->sin_addr.s_addr)) {
+		if ((imo->imo_membership[0] =
+		    in_addmulti(&dst4->sin_addr, ifa->ifa_ifp)) == NULL)
+			return (ENOBUFS);
+		imo->imo_num_memberships++;
+		imo->imo_multicast_ifp = ifa->ifa_ifp;
+		if (sc->sc_ttl > 0)
+			imo->imo_multicast_ttl = sc->sc_ttl;
+		else
+			imo->imo_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
+		imo->imo_multicast_loop = 0;
+	}
+	if (dst4->sin_port)
+		sc->sc_dstport = dst4->sin_port;
+#endif
+
+	if (!reset) {
+		bzero(&sc->sc_src, sizeof(sc->sc_src));
+		bzero(&sc->sc_dst, sizeof(sc->sc_dst));
+		memcpy(&sc->sc_src, src, src->sa_len);
+		memcpy(&sc->sc_dst, dst, dst->sa_len);
+	}
+
+	LIST_REMOVE(sc, sc_entry);
+	LIST_INSERT_HEAD(&vxlan_tagh[VXLAN_TAGHASH(sc->sc_vnetid)],
+	    sc, sc_entry);
+
+	return (0);
+}
+
+/* ARGSUSED */
+int
+vxlanioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
+{
+	struct vxlan_softc	*sc = (struct vxlan_softc *)ifp->if_softc;
+#ifdef INET
+	struct ifaddr		*ifa = (struct ifaddr *)data;
+#endif
+	struct ifreq		*ifr = (struct ifreq *)data;
+	struct if_laddrreq *lifr = (struct if_laddrreq *)data;
+	struct proc		*p = curproc;
+	int			 error = 0, s;
+	struct ip_moptions	*imo = &sc->sc_imo;
+
+	switch (cmd) {
+	case SIOCSIFADDR:
+		ifp->if_flags |= IFF_UP;
+#ifdef INET
+		if (ifa->ifa_addr->sa_family == AF_INET)
+			arp_ifinit(&sc->sc_ac, ifa);
+#endif
+		/* FALLTHROUGH */
+
+	case SIOCSIFFLAGS:
+		if (ifp->if_flags & IFF_UP) {
+			ifp->if_flags |= IFF_RUNNING;
+		} else {
+			ifp->if_flags &= ~IFF_RUNNING;
+		}
+		break;
+
+	case SIOCADDMULTI:
+	case SIOCDELMULTI:
+		if (ifr == 0) {
+			error = EAFNOSUPPORT;
+			break;
+		}
+		error = (cmd == SIOCADDMULTI) ?
+		    ether_addmulti(ifr, &sc->sc_ac) :
+		    ether_delmulti(ifr, &sc->sc_ac);
+		if (error == ENETRESET)
+			error = 0;
+		break;
+
+	case SIOCGIFMEDIA:
+	case SIOCSIFMEDIA:
+		error = ifmedia_ioctl(ifp, ifr, &sc->sc_media, cmd);
+		break;
+
+	case SIOCSLIFPHYADDR:
+		if ((error = suser(p, 0)) != 0)
+			break;
+		s = splnet();
+		error = vxlan_config(ifp,
+		    (struct sockaddr *)&lifr->addr,
+		    (struct sockaddr *)&lifr->dstaddr);
+		splx(s);
+		break;
+
+	case SIOCDIFPHYADDR:
+		if ((error = suser(p, 0)) != 0)
+			break;
+		s = splnet();
+		if (imo->imo_num_memberships > 0) {
+			in_delmulti(imo->imo_membership[
+			    --imo->imo_num_memberships]);
+			imo->imo_multicast_ifp = NULL;
+		}
+		bzero(&sc->sc_src, sizeof(sc->sc_src));
+		bzero(&sc->sc_dst, sizeof(sc->sc_dst));
+		sc->sc_dstport = htons(VXLAN_PORT);
+		splx(s);
+		break;
+
+	case SIOCGLIFPHYADDR:
+		if (sc->sc_dst.ss_family == AF_UNSPEC) {
+			error = EADDRNOTAVAIL;
+			break;
+		}
+		bzero(&lifr->addr, sizeof(lifr->addr));
+		bzero(&lifr->dstaddr, sizeof(lifr->dstaddr));
+		memcpy(&lifr->addr, &sc->sc_src, sc->sc_src.ss_len);
+		memcpy(&lifr->dstaddr, &sc->sc_dst, sc->sc_dst.ss_len);
+		break;
+
+	case SIOCSLIFPHYRTABLE:
+		if ((error = suser(p, 0)) != 0)
+			break;
+		if (ifr->ifr_rdomainid < 0 ||
+		    ifr->ifr_rdomainid > RT_TABLEID_MAX ||
+		    !rtable_exists(ifr->ifr_rdomainid)) {
+			error = EINVAL;
+			break;
+		}
+		s = splnet();
+		sc->sc_rtableid = ifr->ifr_rdomainid;
+		(void)vxlan_config(ifp, NULL, NULL);
+		splx(s);
+		break;
+
+	case SIOCGLIFPHYRTABLE:
+		ifr->ifr_rdomainid = sc->sc_rtableid;
+		break;
+
+	case SIOCSLIFPHYTTL:
+		if ((error = suser(p, 0)) != 0)
+			break;
+		if (ifr->ifr_ttl < 0 || ifr->ifr_ttl > 0xff) {
+			error = EINVAL;
+			break;
+		}
+		if (sc->sc_ttl == (u_int8_t)ifr->ifr_ttl)
+			break;
+		s = splnet();
+		sc->sc_ttl = (u_int8_t)(ifr->ifr_ttl);
+		(void)vxlan_config(ifp, NULL, NULL);
+		splx(s);
+		break;
+
+	case SIOCGLIFPHYTTL:
+		ifr->ifr_ttl = (int)sc->sc_ttl;
+		break;
+
+	case SIOCSVNETID:
+		if ((error = suser(p, 0)) != 0)
+			break;
+		if (ifr->ifr_vnetid < 0 ||
+		    ifr->ifr_vnetid > 0x00ffffff) {
+			error = EINVAL;
+			break;
+		}
+		s = splnet();
+		sc->sc_vnetid = (u_int32_t)ifr->ifr_vnetid;
+		(void)vxlan_config(ifp, NULL, NULL);
+		splx(s);
+		break;
+
+	case SIOCGVNETID:
+		ifr->ifr_vnetid = (int)sc->sc_vnetid;
+		break;
+
+	default:
+		error = ether_ioctl(ifp, &sc->sc_ac, cmd, data);
+		break;
+	}
+
+	return (error);
+}
+
+int
+vxlan_media_change(struct ifnet *ifp)
+{
+	return (0);
+}
+
+void
+vxlan_media_status(struct ifnet *ifp, struct ifmediareq *imr)
+{
+	imr->ifm_active = IFM_ETHER | IFM_AUTO;
+	imr->ifm_status = IFM_AVALID | IFM_ACTIVE;
+}
+
+int
+vxlan_lookup(struct mbuf *m, struct udphdr *uh, int iphlen,
+    struct sockaddr *srcsa)
+{
+	struct vxlan_softc	*sc = NULL;
+	struct vxlan_header	 v;
+	u_int32_t		 vni;
+	struct ifnet		*ifp;
+	int			 skip;
+	struct ether_header	*eh;
+#if NBRIDGE > 0
+	struct sockaddr		*sa;
+#endif
+
+	/* XXX Should verify the UDP port first before copying the packet */
+	skip = iphlen + sizeof(*uh);
+	if (m->m_pkthdr.len - skip < sizeof(v))
+		return (0);
+	m_copydata(m, skip, sizeof(v), (caddr_t)&v);
+	skip += sizeof(v);
+
+	vni = ntohl(v.vxlan_id);
+
+	/* Validate header */
+	if ((vni == 0) || (vni & VXLAN_RESERVED2) ||
+	    (ntohl(v.vxlan_flags) != VXLAN_FLAGS_VNI))
+		return (0);
+
+	vni >>= VXLAN_VNI_S;
+	LIST_FOREACH(sc, &vxlan_tagh[VXLAN_TAGHASH(vni)],
+	    sc_entry) {
+		if ((uh->uh_dport == sc->sc_dstport) &&
+		    vni == sc->sc_vnetid &&
+		    sc->sc_rtableid == rtable_l2(m->m_pkthdr.rdomain))
+			goto found;
+	}
+
+	/* not found */
+	return (0);
+
+ found:
+	m_adj(m, skip);
+	ifp = &sc->sc_ac.ac_if;
+	m->m_pkthdr.rcvif = ifp;
+
+	if ((eh = mtod(m, struct ether_header *)) == NULL)
+		return (EINVAL);
+
+#if NBRIDGE > 0
+	/* Store the peer IP address for the bridge */
+	if (ifp->if_bridgeport != NULL &&
+	    srcsa->sa_family != AF_UNSPEC &&
+	    (sa = bridge_tunneltag(m, srcsa->sa_family)) != NULL)
+		memcpy(sa, srcsa, sa->sa_len);
+#endif
+
+	/* Clear multicast flag from the outer packet */
+	if (sc->sc_imo.imo_num_memberships > 0 &&
+	    m->m_flags & (M_MCAST) &&
+	    !ETHER_IS_MULTICAST(eh->ether_dhost))
+		m->m_flags &= ~M_MCAST;
+
+#if NBPFILTER > 0
+	if (ifp->if_bpf)
+		bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_IN);
+#endif
+
+	m_adj(m, ETHER_HDR_LEN);
+
+#if NPF > 0
+	pf_pkt_addr_changed(m);
+#endif
+
+	ifp->if_ipackets++;
+	ether_input(ifp, eh, m);
+
+	/* success */
+	return (1);
+}
+
+int
+vxlan_output(struct ifnet *ifp, struct mbuf *m)
+{
+	struct vxlan_softc	*sc = (struct vxlan_softc *)ifp->if_softc;
+#ifdef INET
+	struct udpiphdr		*ui;
+	struct vxlanudpiphdr	*vi;
+	u_int16_t		 len = m->m_pkthdr.len;
+	struct ip		*ip;
+#if NBRIDGE > 0
+	struct sockaddr_in	*sin;
+#endif
+#endif
+	int			 error;
+
+#ifdef INET
+	/* VXLAN header */
+	M_PREPEND(m, sizeof(*vi), M_DONTWAIT);
+	if (m == NULL) {
+		ifp->if_oerrors++;
+		return (ENOBUFS);
+	}
+
+	len += sizeof(struct vxlan_header);
+
+	ui = mtod(m, struct udpiphdr *);
+	ui->ui_pr = IPPROTO_UDP;
+	ui->ui_src = ((struct sockaddr_in *)&sc->sc_src)->sin_addr;
+	ui->ui_dst = ((struct sockaddr_in *)&sc->sc_dst)->sin_addr;
+	ui->ui_sport = sc->sc_dstport;
+	ui->ui_dport = sc->sc_dstport;
+	ui->ui_ulen = htons(sizeof(struct udphdr) + len);
+
+	ip = (struct ip *)ui;
+	ip->ip_v = IPVERSION;
+	ip->ip_hl = sizeof(struct ip) >> 2;
+	ip->ip_id = htons(ip_randomid());
+	ip->ip_off = 0; /* htons(IP_DF); XXX should we disallow IP fragments? */
+	ip->ip_tos = IPTOS_LOWDELAY;		
+	ip->ip_len = htons(sizeof(struct udpiphdr) + len);
+	if (sc->sc_ttl > 0)
+		ip->ip_ttl = sc->sc_ttl;
+	else
+		ip->ip_ttl = IPDEFTTL;
+
+#if NBRIDGE > 0
+	if ((sin = (struct sockaddr_in *)bridge_tunnel(m)) != NULL &&
+	    sin->sin_family == AF_INET) {
+		ui->ui_dst = sin->sin_addr;
+
+		/*
+		 * If the LINK0 flag is set, send the packet back to
+		 * the original source port of the endport, otherwise use
+		 * the configured VXLAN port.
+		 */
+		if (ifp->if_flags & IFF_LINK0)
+			ui->ui_dport = sin->sin_port;
+	}
+	if (sin != NULL)
+		bridge_tunneluntag(m);
+#endif
+
+	vi = (struct vxlanudpiphdr *)ui;
+	vi->ui_v.vxlan_flags = htonl(VXLAN_FLAGS_VNI);
+	vi->ui_v.vxlan_id = htonl(sc->sc_vnetid << VXLAN_VNI_S);
+
+	/* UDP checksum should be 0 */
+	ui->ui_sum = 0;	
+#endif
+
+	ifp->if_opackets++;
+	ifp->if_obytes += m->m_pkthdr.len;
+
+	m->m_pkthdr.rdomain = sc->sc_rtableid;
+
+#if NPF > 0
+	pf_pkt_addr_changed(m);
+#endif
+
+#ifdef INET
+	if ((error =
+	    ip_output(m, NULL, NULL, IP_RAWOUTPUT, &sc->sc_imo, NULL))) {
+		ifp->if_oerrors++;
+	}
+#endif
+
+	return (error);
+}
diff --git a/sys/net/if_vxlan.h b/sys/net/if_vxlan.h
new file mode 100644
index 00000000000..47518e47e91
--- /dev/null
+++ b/sys/net/if_vxlan.h
@@ -0,0 +1,77 @@
+/*	$OpenBSD: if_vxlan.h,v 1.1 2013/10/13 10:10:03 reyk Exp $	*/
+
+/*
+ * Copyright (c) 2013 Reyk Floeter <reyk@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _NET_VXLAN_H
+#define _NET_VXLAN_H
+
+#define VXLANMTU		1492
+#define VXLAN_HDRLEN		8
+#define VXLAN_PORT		4789
+
+struct vxlan_header {
+	u_int32_t		vxlan_flags;
+#define	VXLAN_FLAGS_VNI		0x08000000
+#define	VXLAN_RESERVED1		0xf7ffffff
+	u_int32_t		vxlan_id;
+#define VXLAN_VNI		0xffffff00
+#define VXLAN_VNI_S		8
+#define VXLAN_RESERVED2		0x000000ff
+} __packed;
+
+#ifdef INET
+struct vxlanudpiphdr {
+	struct ipovly		ui_i;
+	struct udphdr		ui_u;
+	struct vxlan_header	ui_v;
+} __packed;
+#endif
+
+#define SIOCGETVXLAN	SIOCGETPFLOW
+#define SIOCSETVXLAN	SIOCSETPFLOW
+
+/* from struct vxlanreq */
+struct vxlanreq {
+	u_int8_t		vxlan_reserved;
+};
+
+#ifdef _KERNEL
+struct vxlan_softc {
+	struct arpcom		 sc_ac;
+	struct ifmedia		 sc_media;
+	struct ip_moptions	 sc_imo;
+	struct sockaddr_storage	 sc_src;
+	struct sockaddr_storage	 sc_dst;
+	in_port_t		 sc_dstport;
+	u_int			 sc_rtableid;
+	u_int32_t		 sc_vnetid;
+	u_int8_t		 sc_ttl;
+
+	LIST_ENTRY(vxlan_softc)	 sc_entry;
+};
+
+extern int vxlan_enable;
+
+int		 vxlan_lookup(struct mbuf *, struct udphdr *, int,
+		    struct sockaddr *);
+struct sockaddr *vxlan_tag_find(struct mbuf *);
+struct sockaddr	*vxlan_tag_get(struct mbuf *, int);
+void		 vxlan_tag_delete(struct mbuf *);
+
+#endif /* _KERNEL */
+
+#endif /* _NET_VXLAN_H */