From patchwork Thu Aug 16 14:51:41 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ahmed Abdelsalam X-Patchwork-Id: 958332 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="F0imUwA2"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 41rq6f2xfJz9s4s for ; Fri, 17 Aug 2018 00:51:54 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2403959AbeHPRux (ORCPT ); Thu, 16 Aug 2018 13:50:53 -0400 Received: from mail-wr1-f67.google.com ([209.85.221.67]:34866 "EHLO mail-wr1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726039AbeHPRuw (ORCPT ); Thu, 16 Aug 2018 13:50:52 -0400 Received: by mail-wr1-f67.google.com with SMTP id g1-v6so4434150wru.2 for ; Thu, 16 Aug 2018 07:51:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=0EYMSt5JjnAPORGjsKItheECE0VDZMjOZBVC2yYhTco=; b=F0imUwA2Sroj8Xhy42ExigUj7ZWxArvZq/Dxd044kG4drJt6VmgTz0iv3u83kB3hJA bXtun8bYx3Rudnmip+VrK+CzjOn57vnUj/btpkNP6ls2f2UwFnmBVBED3EVVEJfOluIw sn9+4WxqMhr7LTi0ZIVetCaDWeB7p0ijx/fpTOx8mE5ux8XFM1702VDj0Nog3GCZi7zy cwC+JR3UAPKTAmV+6nSzInqmCkndWiHLp59d1hj2Sov/B5CrAvidWEtj5KWptSi7FG+X MqL03IHFuDKi8xvBdN4M40gmskVasN1molDsLJm/MC+VPZdPQwQAt87CZh58CTX6jduu 1KiA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=0EYMSt5JjnAPORGjsKItheECE0VDZMjOZBVC2yYhTco=; b=irHU4lDSwMH6RorTNhJg7GQs8E4z4dON+aDdTbxiYjQa+8E0pnn8YEiJGT3S97+UkI VGH4tMlWy0QsymROtLqvaqjvfcCK2yJqhyNLrcxueqt1UThpSHMlsqXLcQJA0IyaUpi1 zBztjo1QM3a8It7WU7gc0vpGuKjGooeTbh5kj75eQIlvUiYE0jrF7HtpVuDxutcm5G3S zs3P2NMDGn5eDFi/GC2PRfO9Guoaw0ki7iOR3Vh1yoNwDLPFVi0XoW746YsmkCerrHam 3XiheEomQ9vRriRIAAGceuKwqU4D2lH+wZH+rE7MBgix9OBkJDnVYFSbvfl+ivCRb6fI lQuw== X-Gm-Message-State: AOUpUlFV9nvLEPDZRumu2A5+dtqgGUNhLeSA/nlP3cl61+VBF1SNwJOP bK3bx6P1ybbILBpk/6gWQpw= X-Google-Smtp-Source: AA+uWPw19rE8SA1Mh8i32dO7GQN8mdr5/GDbjQ9PNxiZxVOa2FMEMlkIR2KAoyqr/czYKKCdOmwWCQ== X-Received: by 2002:adf:de84:: with SMTP id w4-v6mr20453499wrl.270.1534431110715; Thu, 16 Aug 2018 07:51:50 -0700 (PDT) Received: from localhost.localdomain ([192.135.27.140]) by smtp.gmail.com with ESMTPSA id p89-v6sm2279734wrc.97.2018.08.16.07.51.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Aug 2018 07:51:50 -0700 (PDT) From: Ahmed Abdelsalam To: pablo@netfilter.org, fw@strlen.de, netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, coreteam@netfilter.org, amsalam20@gmail.com Subject: [nf-next 1/3] netfilter: export SRH processing functions from seg6local Date: Thu, 16 Aug 2018 16:51:41 +0200 Message-Id: <20180816145143.12963-1-amsalam20@gmail.com> X-Mailer: git-send-email 2.11.0 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Some functions of seg6local are very useful to process SRv6 encapsulated packets This patch exports some functions of seg6local that we use for implementing our new ip6atbles target (SEG6). They can also be used at different parts of the kernel. The exported functions are: (1) seg6_get_srh() (2) seg6_advance_nextseg() (3) seg6_lookup_nexthop Signed-off-by: Ahmed Abdelsalam --- include/net/seg6.h | 3 +++ net/ipv6/seg6_local.c | 21 ++++++++++++--------- 2 files changed, 15 insertions(+), 9 deletions(-) diff --git a/include/net/seg6.h b/include/net/seg6.h index 2567941a2f32..09a35787aa0d 100644 --- a/include/net/seg6.h +++ b/include/net/seg6.h @@ -69,4 +69,7 @@ extern int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, extern int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh); extern int seg6_lookup_nexthop(struct sk_buff *skb, struct in6_addr *nhaddr, u32 tbl_id); +extern struct ipv6_sr_hdr *seg6_get_srh(struct sk_buff *skb); +extern void seg6_advance_nextseg(struct ipv6_sr_hdr *srh, + struct in6_addr *daddr); #endif diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c index 60325dbfe88b..dd072aed9d25 100644 --- a/net/ipv6/seg6_local.c +++ b/net/ipv6/seg6_local.c @@ -68,7 +68,7 @@ static struct seg6_local_lwt *seg6_local_lwtunnel(struct lwtunnel_state *lwt) return (struct seg6_local_lwt *)lwt->data; } -static struct ipv6_sr_hdr *get_srh(struct sk_buff *skb) +struct ipv6_sr_hdr *seg6_get_srh(struct sk_buff *skb) { struct ipv6_sr_hdr *srh; int len, srhoff = 0; @@ -91,12 +91,13 @@ static struct ipv6_sr_hdr *get_srh(struct sk_buff *skb) return srh; } +EXPORT_SYMBOL_GPL(seg6_get_srh); static struct ipv6_sr_hdr *get_and_validate_srh(struct sk_buff *skb) { struct ipv6_sr_hdr *srh; - srh = get_srh(skb); + srh = seg6_get_srh(skb); if (!srh) return NULL; @@ -116,7 +117,7 @@ static bool decap_and_validate(struct sk_buff *skb, int proto) struct ipv6_sr_hdr *srh; unsigned int off = 0; - srh = get_srh(skb); + srh = seg6_get_srh(skb); if (srh && srh->segments_left > 0) return false; @@ -140,7 +141,7 @@ static bool decap_and_validate(struct sk_buff *skb, int proto) return true; } -static void advance_nextseg(struct ipv6_sr_hdr *srh, struct in6_addr *daddr) +void seg6_advance_nextseg(struct ipv6_sr_hdr *srh, struct in6_addr *daddr) { struct in6_addr *addr; @@ -148,6 +149,7 @@ static void advance_nextseg(struct ipv6_sr_hdr *srh, struct in6_addr *daddr) addr = srh->segments + srh->segments_left; *daddr = *addr; } +EXPORT_SYMBOL_GPL(seg6_advance_nextseg); int seg6_lookup_nexthop(struct sk_buff *skb, struct in6_addr *nhaddr, u32 tbl_id) @@ -198,6 +200,7 @@ int seg6_lookup_nexthop(struct sk_buff *skb, struct in6_addr *nhaddr, skb_dst_set(skb, dst); return dst->error; } +EXPORT_SYMBOL_GPL(seg6_lookup_nexthop); /* regular endpoint function */ static int input_action_end(struct sk_buff *skb, struct seg6_local_lwt *slwt) @@ -208,7 +211,7 @@ static int input_action_end(struct sk_buff *skb, struct seg6_local_lwt *slwt) if (!srh) goto drop; - advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); seg6_lookup_nexthop(skb, NULL, 0); @@ -228,7 +231,7 @@ static int input_action_end_x(struct sk_buff *skb, struct seg6_local_lwt *slwt) if (!srh) goto drop; - advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); seg6_lookup_nexthop(skb, &slwt->nh6, 0); @@ -247,7 +250,7 @@ static int input_action_end_t(struct sk_buff *skb, struct seg6_local_lwt *slwt) if (!srh) goto drop; - advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); seg6_lookup_nexthop(skb, NULL, slwt->table); @@ -436,7 +439,7 @@ static int input_action_end_b6_encap(struct sk_buff *skb, if (!srh) goto drop; - advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); skb_reset_inner_headers(skb); skb->encapsulation = 1; @@ -495,7 +498,7 @@ static int input_action_end_bpf(struct sk_buff *skb, kfree_skb(skb); return -EINVAL; } - advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); /* preempt_disable is needed to protect the per-CPU buffer srh_state, * which is also accessed by the bpf_lwt_seg6_* helpers From patchwork Thu Aug 16 14:51:42 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ahmed Abdelsalam X-Patchwork-Id: 958334 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="FtIzmTV3"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 41rq6j0rRJz9s4s for ; Fri, 17 Aug 2018 00:51:57 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2403960AbeHPRuz (ORCPT ); Thu, 16 Aug 2018 13:50:55 -0400 Received: from mail-wm0-f66.google.com ([74.125.82.66]:33943 "EHLO mail-wm0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2403957AbeHPRuz (ORCPT ); Thu, 16 Aug 2018 13:50:55 -0400 Received: by mail-wm0-f66.google.com with SMTP id l2-v6so15803613wme.1 for ; Thu, 16 Aug 2018 07:51:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=+O1isoOtpmflZUzdFfU/3e9pmeVqM/EthGoVobz5jDg=; b=FtIzmTV3+tl5AY/gHB3NSCEVNgay7RcUT5DEIbwEzyrSRk2T7bdMIb0lqrz0f0/8jZ apVXu5s4ZMHCuzJogKILuGLemy5G07QOjqbVPZcpv7AgTIndSKwV44QgXy0iHDjlhZXc idCVi6GbmM71bX0ez5mzI3ve4A2s7PHltI85yyyF+uQQ+mEk27QGpYYphfrJPXXkeXXv wzXJNiqQVOIVdIRplJORfnfsIJBVOaxIbGt6sNPLpD6zYNfLx1qdbB4Ew5veSs1ZOSah a7aASEKT6TvyRNb0o7bjioixC79ejKDTwhngDhz29iHZx7HX8kZvxqqqNNjqZnFkqOBp DJpA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=+O1isoOtpmflZUzdFfU/3e9pmeVqM/EthGoVobz5jDg=; b=BbhFqpdC8La9M902cImwhLKLd6CqoB8sO6OenC+Zb9DLHApwDQXaeoFCDYHNCMr+E1 8VQls6roOYSOP66AZpOzIcfElv/AMX0lYqEhZyqfD/M0LIfZrs/atFT2jd7RvbgZxBvB QsYDI0LM61Fm7uGHXb2HGFPoewZk3tVkb4Lp6kfUHRdioMtIOXHmb8BrMgsgc8owXpdS o4PyZQ+OtV6wFuAbVQEQF3/CnJnTcn/vj+0ODPwZ9C5OMCGTauimCSRCC3U+DFUDjcLk USZ2iZRcx45tbjUjd9EbV0veUHKnPRkSNGCj9H2R4RNyeqTpEvbKk3PzHWOK+AitmRHu sACw== X-Gm-Message-State: AOUpUlEWJ9QWeiT6WkOmQ3CeST1guMsUQ5+AzJ/gbHytuA7qInD90Ku5 Ip2ZvaV5VvoieSB1VA5G5SE= X-Google-Smtp-Source: AA+uWPz/aUMhUmVb+SPhLsQP9W3A/JSqqDEcgZkiHR8J8HGpcVZJ4I8V3TH1qHzxM3tg3c9e4F/DOA== X-Received: by 2002:a1c:ee9a:: with SMTP id j26-v6mr15925209wmi.116.1534431112241; Thu, 16 Aug 2018 07:51:52 -0700 (PDT) Received: from localhost.localdomain ([192.135.27.140]) by smtp.gmail.com with ESMTPSA id p89-v6sm2279734wrc.97.2018.08.16.07.51.50 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Aug 2018 07:51:51 -0700 (PDT) From: Ahmed Abdelsalam To: pablo@netfilter.org, fw@strlen.de, netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, coreteam@netfilter.org, amsalam20@gmail.com Subject: [nf-next 2/3] netfilter: Add support for IPv6 segment routing 'SEG6' target Date: Thu, 16 Aug 2018 16:51:42 +0200 Message-Id: <20180816145143.12963-2-amsalam20@gmail.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180816145143.12963-1-amsalam20@gmail.com> References: <20180816145143.12963-1-amsalam20@gmail.com> Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Service Function Chaining (SFC) is one of the main use-cases of IPv6 Segment Routing (SRv6) [1]. The Segment Routing Header (SRH) allows including a list of segments in the IPv6 packet. This segment list can be used to steer the packetthough a set of Virtual Network Functions (VNFS) e.g., Firewall, DPI, IDS. The edge node (SR ingress node) classifies the traffic and consequently includes the segment lists in the IPv6 packet. The matching of SRH previous, next and last SIDs has been added to ip6tables in kernel 4.16. Once a packet matches one of these options, we can perform some SR specific actions. The IPv6 segment routing 'SEG6' target supports a set of SR-specific actions. The first set of actions include those actions necessary to allow branching within a pre-defined SRv6 SFC policy instead of the usual linear exploration of the VNF chain. This patch implements the following SR-specific actions: (1) go-next: sends packets towards the next SID from SRH. (2) skip-next: skips the next SID in the SRH. (3) go-last: skips the remaining part of the segment list and send the packet towards the last segment. [1] https://tools.ietf.org/html/draft-xuclad-spring-sr-service-programming-00 Signed-off-by: Ahmed Abdelsalam --- include/uapi/linux/netfilter_ipv6/ip6t_SEG6.h | 22 +++++ net/ipv6/netfilter/Kconfig | 15 ++++ net/ipv6/netfilter/Makefile | 1 + net/ipv6/netfilter/ip6t_SEG6.c | 116 ++++++++++++++++++++++++++ 4 files changed, 154 insertions(+) create mode 100644 include/uapi/linux/netfilter_ipv6/ip6t_SEG6.h create mode 100644 net/ipv6/netfilter/ip6t_SEG6.c diff --git a/include/uapi/linux/netfilter_ipv6/ip6t_SEG6.h b/include/uapi/linux/netfilter_ipv6/ip6t_SEG6.h new file mode 100644 index 000000000000..443805d0d1b2 --- /dev/null +++ b/include/uapi/linux/netfilter_ipv6/ip6t_SEG6.h @@ -0,0 +1,22 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ + +#ifndef _IP6T_SEG6_H +#define _IP6T_SEG6_H + +#include + +/* SEG6 action options */ +enum ip6t_seg6_action { + IP6T_SEG6_GO_NEXT, + IP6T_SEG6_SKIP_NEXT, + IP6T_SEG6_GO_LAST, + IP6T_SEG6_BSID, +}; + +struct ip6t_seg6_info { + __u32 action; /* SEG6 action */ + struct in6_addr bsid; /* SRv6 Bind SID */ + unsigned int tbl; /* Routing table of bsid */ +}; + +#endif /*_IP6T_SEG6_H*/ diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig index 339d0762b027..a2502c54a837 100644 --- a/net/ipv6/netfilter/Kconfig +++ b/net/ipv6/netfilter/Kconfig @@ -344,6 +344,21 @@ config IP6_NF_TARGET_NPT endif # IP6_NF_NAT +if IPV6_SEG6_LWTUNNEL + +config IP6_NF_TARGET_SEG6 + tristate 'IPv6 Segment Routing "SEG6" target support' + depends on NETFILTER_ADVANCED + help + SEG6 is an ip6tables target for IPv6 Segment Routing encapsualted + packets. It supports a set of Segment Routing specific actions + that can be applied based on SRH information. It is useful for + SRv6 Service Function chaining use-cases. + + To compile it as a module, choose M here. If unsure, say N. + +endif # IPV6_SEG6_LWTUNNEL + endif # IP6_NF_IPTABLES endmenu diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile index 200c0c235565..68e86e18f15f 100644 --- a/net/ipv6/netfilter/Makefile +++ b/net/ipv6/netfilter/Makefile @@ -58,3 +58,4 @@ obj-$(CONFIG_IP6_NF_TARGET_MASQUERADE) += ip6t_MASQUERADE.o obj-$(CONFIG_IP6_NF_TARGET_NPT) += ip6t_NPT.o obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o obj-$(CONFIG_IP6_NF_TARGET_SYNPROXY) += ip6t_SYNPROXY.o +obj-$(CONFIG_IP6_NF_TARGET_SEG6) += ip6t_SEG6.o diff --git a/net/ipv6/netfilter/ip6t_SEG6.c b/net/ipv6/netfilter/ip6t_SEG6.c new file mode 100644 index 000000000000..03b5f1a1c8bf --- /dev/null +++ b/net/ipv6/netfilter/ip6t_SEG6.c @@ -0,0 +1,116 @@ +/** + * IPv6 Segment Routing target module (SEG6). + * + * Author: + * Ahmed Abdelsalam + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + */ + +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include +#include + +static int seg6_go_next(struct sk_buff *skb, struct ipv6_sr_hdr *srh) +{ + if (srh->segments_left == 0) + return NF_DROP; + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_lookup_nexthop(skb, NULL, 0); + dst_input(skb); + return NF_STOLEN; +} + +static int seg6_skip_next(struct sk_buff *skb, struct ipv6_sr_hdr *srh) +{ + if (srh->segments_left < 2) + return NF_DROP; + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_lookup_nexthop(skb, NULL, 0); + dst_input(skb); + return NF_STOLEN; +} + +static int seg6_go_last(struct sk_buff *skb, struct ipv6_sr_hdr *srh) +{ + if (srh->segments_left == 0) + return NF_DROP; + srh->segments_left = 1; + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_lookup_nexthop(skb, NULL, 0); + dst_input(skb); + return NF_STOLEN; +} + +static unsigned int +seg6_tg6(struct sk_buff *skb, const struct xt_action_param *par) +{ + struct ipv6_sr_hdr *srh; + const struct ip6t_seg6_info *seg6 = par->targinfo; + + srh = seg6_get_srh(skb); + if (!srh) + return NF_DROP; + + switch (seg6->action) { + case IP6T_SEG6_GO_NEXT: + return seg6_go_next(skb, srh); + case IP6T_SEG6_SKIP_NEXT: + return seg6_skip_next(skb, srh); + case IP6T_SEG6_GO_LAST: + return seg6_go_last(skb, srh); + } + + pr_err("Unknown SEG6 action\n"); + return NF_DROP; +} + +static int seg6_check(const struct xt_tgchk_param *par) +{ + /** + * In the future, some new action may require using + * this function for doing some checks + */ + return 0; +} + +static struct xt_target seg6_tg6_reg __read_mostly = { + .name = "SEG6", + .family = NFPROTO_IPV6, + .target = seg6_tg6, + .targetsize = sizeof(struct ip6t_seg6_info), + .checkentry = seg6_check, + .me = THIS_MODULE +}; + +static int __init seg6_tg6_init(void) +{ + return xt_register_target(&seg6_tg6_reg); +} + +static void __exit seg6_tg6_exit(void) +{ + xt_unregister_target(&seg6_tg6_reg); +} + +module_init(seg6_tg6_init); +module_exit(seg6_tg6_exit); + +MODULE_LICENSE("GPL"); +MODULE_DESCRIPTION("Xtables: IPv6 Segment Routing Target (SEG6)"); +MODULE_AUTHOR("Ahmed Abdelsalam "); From patchwork Thu Aug 16 14:51:43 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ahmed Abdelsalam X-Patchwork-Id: 958333 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="Uez6bBs0"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 41rq6h2HWXz9s3x for ; Fri, 17 Aug 2018 00:51:56 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2403962AbeHPRuz (ORCPT ); Thu, 16 Aug 2018 13:50:55 -0400 Received: from mail-wr1-f68.google.com ([209.85.221.68]:46664 "EHLO mail-wr1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726039AbeHPRuz (ORCPT ); Thu, 16 Aug 2018 13:50:55 -0400 Received: by mail-wr1-f68.google.com with SMTP id a108-v6so1758322wrc.13 for ; Thu, 16 Aug 2018 07:51:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=KwUS1gWU/NGkzp4Am79PKdxJkdXKPwcZB6bMcGyQyK4=; b=Uez6bBs0duizaQpl/oSfXXHlUUM9FjcIWMgWV/cb1InhbPJ5wttxoZ+JvsaqfU4dYy TduFr+Wa21sz/P0Esab9fPjrWaEJZ43+3TswfNvufTq/QNJ3mTRC1kawTpdcoLJo0IDW kCKZzhTGB5D/8lXMf8mc/yMIjMZpTtv8f2J9MZX91VIewLMMh4ojxky9YJNfAxZ1tOZe me/afV0nKkjAiUowQr1067LHv1cdYYBNC48gLYWGXExe+ogFCjgeq5enTSLcgAY6af/z mvIQRfhujLb7rAY6uKMFP7mLgEXMayH1AJiJhuiff1tiXqHqagyabjEfDnikv8upigJA Z+3A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=KwUS1gWU/NGkzp4Am79PKdxJkdXKPwcZB6bMcGyQyK4=; b=PtXfjYKZpsYw9KPKxEintuwCfiKuSV/zZHgLwrVnb5ohonbqHuGxxm9GNrriR3gzr6 2UBZGxIOwlBk06k0biOjZAPzMJbXxtbaBbtQOmCl4/WJsk0BkmirjwZAkyTJHwErytvo LsqjzbFzep72qec0ZacBcTuoEt8jh/z5JyWNpE44VVCto+GfOyPtpCTr8S+G7DYu6K70 MEAqwYtvqbsr0nA3moPWyZF7rcwWtD/uAZ9+94IpCaP5c8Hgq30S7qMFQGsYzCa3cyvt wWMxz2/L4Muie3PSkW1F80/nqRvbND+8m8fs0i6U2juv4RfPR02FdQxiTKYOe55mHd4V nnkQ== X-Gm-Message-State: AOUpUlGTgs2/7mmpPS/Hab7///63OWzlULALxrucjBaZNEDGSYn4hE6s wZHw251xWI2ZJubZWk5BaDiwUBJNUMk= X-Google-Smtp-Source: AA+uWPxkZPYlvv3/iBDY2uPM3CmaZR9HQHK+CmZTrQ1TS3CtL2zT1opVI0IGS0FsJ4Bpgrp8Zbxr9w== X-Received: by 2002:adf:f58f:: with SMTP id f15-v6mr1097206wro.59.1534431113646; Thu, 16 Aug 2018 07:51:53 -0700 (PDT) Received: from localhost.localdomain ([192.135.27.140]) by smtp.gmail.com with ESMTPSA id p89-v6sm2279734wrc.97.2018.08.16.07.51.52 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Aug 2018 07:51:52 -0700 (PDT) From: Ahmed Abdelsalam To: pablo@netfilter.org, fw@strlen.de, netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, coreteam@netfilter.org, amsalam20@gmail.com Subject: [nf-next 3/3] netfilter: using ip6tables as L2/L3/L4 classifier for SRv6 Date: Thu, 16 Aug 2018 16:51:43 +0200 Message-Id: <20180816145143.12963-3-amsalam20@gmail.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180816145143.12963-1-amsalam20@gmail.com> References: <20180816145143.12963-1-amsalam20@gmail.com> Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org In Linux, SRv6 policies can be pushed based on packets destination address. However for many use-cases, it is needed to push SRv6 policies based on information from L2/L3/L4. Consider a use-case where you want to push SRv6 policies based on the application layer protocol (HTTP/DNS), which requires being able to match the destination port of a packet. In this patch, we use iptables a classifier for SRv6, hence we benefit from all of its matching capabilities. We added a new action to the SEG6 target, named "bind-sid", that takes the BSID and the SID table as arguments. Each packet that matches an iptables rule with SEG6 target that has the bind-sid action, will go through the SRv6 policies configured for that BSID. Example: We have an SRv6 policy configured in Linux as follows: ip -6 route add A99::1 encap seg6 mode encap segs F1::,F2::,F3:: dev eth1 We can steer traffic through this SRv6 policy using the matching power of iptables firewall as follows: ip6atbles -t raw -I PREROUTING -s -d \ -p --sport --dport \ -j SEG6 --seg6-action bind-sid --bsid A99::1 --bsid-tbl 0 This new SEG6 action should perfectly address all use-cases that require pushing SRv6 policies based information from Layer3/Layer4. Signed-off-by: Ahmed Abdelsalam --- net/ipv6/netfilter/ip6t_SEG6.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/net/ipv6/netfilter/ip6t_SEG6.c b/net/ipv6/netfilter/ip6t_SEG6.c index 03b5f1a1c8bf..0f6aec7ebefe 100644 --- a/net/ipv6/netfilter/ip6t_SEG6.c +++ b/net/ipv6/netfilter/ip6t_SEG6.c @@ -25,6 +25,14 @@ #include #include +static int seg6_bsid(struct sk_buff *skb, struct in6_addr bsid, + u32 tbl) +{ + seg6_lookup_nexthop(skb, &bsid, tbl); + dst_input(skb); + return NF_STOLEN; +} + static int seg6_go_next(struct sk_buff *skb, struct ipv6_sr_hdr *srh) { if (srh->segments_left == 0) @@ -63,6 +71,10 @@ seg6_tg6(struct sk_buff *skb, const struct xt_action_param *par) struct ipv6_sr_hdr *srh; const struct ip6t_seg6_info *seg6 = par->targinfo; + /* bind-sid action doesn't require packets with SRH */ + if (seg6->action == IP6T_SEG6_BSID) + return seg6_bsid(skb, seg6->bsid, seg6->tbl); + srh = seg6_get_srh(skb); if (!srh) return NF_DROP;