mtu

const (
	// MaxMTU is the highest MTU that can be used for devices and routes
	// handled by Cilium. It will typically be used to configure inbound
	// paths towards containers where it is guaranteed that the packet will
	// not be rerouted to another node, and therefore will not lead to
	// any form of IP fragmentation.
	// One might expect this to be 65535, however Linux seems to cap the
	// MTU of routes at 65520, so we use this value below.
	MaxMTU = 65520

	// EthernetMTU is the standard MTU for Ethernet devices. It is used
	// as the MTU for container devices when running direct routing mode.
	EthernetMTU = 1500

	// TunnelOverheadIPv{4,6} is an approximation for bytes used for tunnel
	// encapsulation. It accounts for:
	//                       IPv4  IPv6
	//    (Outer ethernet is not accounted against MTU size)
	//    Outer IP header:    20B  40B
	//    Outer UDP header:    8B   8B
	//    Outer VXLAN header:  8B   8B
	//    Original Ethernet:  14B  14B
	//                        ---  ---
	//    Total extra bytes:  50B  70B
	TunnelOverheadIPv4 = 50
	TunnelOverheadIPv6 = 70

	// DsrTunnelOverhead is about the GENEVE DSR option that gets inserted
	// by the LB, when addressing a Service in hs-ipcache mode
	DsrTunnelOverhead = 12

	// EncryptionIPsecOverhead is an approximation for bytes used for
	// encryption. Depending on key size and encryption type the actual
	// size may vary here we do calculations for 128B keys and Auth. The
	// overhead is accounted for as:
	//    Outer IP header:    20B
	//    SPI:		   4B
	//    Sequece Numbers:	   4B
	//    Next Header:         1B
	//    ICV:		  16B
	//    Padding:            16B
	//    128bit Auth:        16B
	//			  ---
	//    Total extra bytes:  77B
	EncryptionIPsecOverhead = 77

	// EncryptionDefaultAuthKeyLength is 16 representing 128B key recommended
	// size for GCM(AES*) in RFC4106. Users may input other lengths via
	// key secrets.
	EncryptionDefaultAuthKeyLength = 16

	// WireguardOverhead is an approximation for the overhead of WireGuard
	// encapsulation.
	//
	// https://github.com/torvalds/linux/blob/v5.12/drivers/net/wireguard/device.c#L262:
	// https://github.com/torvalds/linux/blob/v5.12/drivers/net/wireguard/send.c#L141
	//      MESSAGE_MINIMUM_LENGTH:    32B
	//      Outer IPv4 or IPv6 header: 40B
	//      Outer UDP header:           8B
	//      Maximum padding:           15B
	//                                 ---
	//      Total extra bytes:         80B
	WireguardOverhead = 95

	// IPv6MinMTU is the minimum MTU required for IPv6 to function on a
	// network interface, as defined in RFC 8200 section 5. The Linux kernel
	// refuses to initialize inet6_dev on interfaces with MTU below this
	// value, causing all IPv6 packet reception to be silently discarded.
	IPv6MinMTU = 1280

	// IPIPv4Overhead is the overhead for the IPv4 header used in IPIP devices.
	// sizeof(struct iphdr)
	IPIPv4Overhead = 20

	// IPIPv6Overhead is the overhead for the IPv6 header (40B) as well as tunnel
	// encap limit option used in IP6IP6 devices.
	// sizeof(struct ipv6hdr) + 8
	// See kernel commit 381601e5bbae ("Make the ip6_tunnel reflect the true mtu.")
	// for details.
	IPIPv6Overhead = 48
)