vxlan: Group Policy extension

Implements supports for the group policy VXLAN extension [0] to provide
a lightweight and simple security label mechanism across network peers
based on VXLAN. The security context and associated metadata is mapped
to/from skb->mark. This allows further mapping to a SELinux context
using SECMARK or to implement ACLs directly with nftables, iptables,
OVS, tc, etc. Group membership is achived by setting the lower 16 bits
of skb->mark, therefore classification may occur through nftables,
iptables, cgroup, SO_MARK, tc, OVS, ...

This was typically achieved by matching on L2-L4 fields to identify the
original sender on the reciving host side. Given a trusted underlay
network and host environment, the group policy extension allows for
each host to enforce group based ACLs decoupled from any network
topology and addressing details.

	 Grp A         Grp B           Grp B      Grp A
	+-----+   +-------------+    +-------+   +-----+
	| lxc |   | SELinux CTX |    | httpd |   | VM  |
	+--+--+   +--+----------+    +---+---+   +--+--+
	    \---+---/                     \----+---/
		|                              |
	    +---+---+                      +---+---+
	    | vxlan |                      | vxlan |
	    +---+---+                      +---+---+
		+------------------------------+

-I OUTPUT -o veth_lxc0 -j MARK --set-mark 0x100

-I INPUT -i veth_lxc0 -m mark --mark 0x200 -j ACCEPT

the security context of the sender

[0] https://tools.ietf.org/html/draft-smith-vxlan-group-policy

Signed-off-by: Thomas Graf <tgraf@suug.ch>
vxlan: Only bind to sockets with correct extensions enabled

A VXLAN net_device looking for an appropriate socket may only
consider a socket which has the exact set of extensions enabled.
If none can be found, a new socket must be created.

The OVS VXLAN port is kept unaware of extensions at this point.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
vxlan: Fail build if VXLAN header is misdefined

Signed-off-by: Thomas Graf <tgraf@suug.ch>