vxlan: Allow for VXLAN extensions to be implemented

The VXLAN receive code is currently conservative in what it accepts and
will reject any frame that uses any of the reserved VXLAN protocol fields.
The VXLAN draft specifies that "reserved fields MUST be set to zero on
transmit and ignored on receive.".

Retain the current conservative parsing behaviour by default but allows
these fields to be used by VXLAN extensions which are explicitly enabled
on the VXLAN socket respectively VXLAN net_device.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
vxlan: Group Policy extension

Implements supports for the group policy VXLAN extension [0] to provide
a lightweight and simple security label mechanism across network peers
based on VXLAN. The security context and associated metadata is mapped
to/from skb->mark. This allows further mapping to a SELinux context
using SECMARK or to implement ACLs directly with nftables, iptables,
OVS, tc, etc. Group membership is achived by setting the lower 16 bits
of skb->mark, therefore classification may occur through nftables,
iptables, cgroup, SO_MARK, tc, OVS, ...

This was typically achieved by matching on L2-L4 fields to identify the
original sender on the reciving host side. Given a trusted underlay
network and host environment, the group policy extension allows for
each host to enforce group based ACLs decoupled from any network
topology and addressing details.

	 Grp A         Grp B           Grp B      Grp A
	+-----+   +-------------+    +-------+   +-----+
	| lxc |   | SELinux CTX |    | httpd |   | VM  |
	+--+--+   +--+----------+    +---+---+   +--+--+
	    \---+---/                     \----+---/
		|                              |
	    +---+---+                      +---+---+
	    | vxlan |                      | vxlan |
	    +---+---+                      +---+---+
		+------------------------------+

-I OUTPUT -o veth_lxc0 -j MARK --set-mark 0x100

-I INPUT -i veth_lxc0 -m mark --mark 0x200 -j ACCEPT

the security context of the sender

[0] https://tools.ietf.org/html/draft-smith-vxlan-group-policy

Signed-off-by: Thomas Graf <tgraf@suug.ch>
vxlan: Only bind to sockets with correct extensions enabled

A VXLAN net_device looking for an appropriate socket may only
consider a socket which has the exact set of extensions enabled.
If none can be found, a new socket must be created.

The OVS VXLAN port is kept unaware of extensions at this point.

Signed-off-by: Thomas Graf <tgraf@suug.ch>