From patchwork Wed Aug 22 13:10:16 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ahmed Abdelsalam X-Patchwork-Id: 960954 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="biGJ2RwC"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 41wSZw39F1z9rvt for ; Wed, 22 Aug 2018 23:10:31 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728789AbeHVQfW (ORCPT ); Wed, 22 Aug 2018 12:35:22 -0400 Received: from mail-wr1-f66.google.com ([209.85.221.66]:43325 "EHLO mail-wr1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728057AbeHVQfV (ORCPT ); Wed, 22 Aug 2018 12:35:21 -0400 Received: by mail-wr1-f66.google.com with SMTP id k5-v6so1557797wre.10 for ; Wed, 22 Aug 2018 06:10:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=0EYMSt5JjnAPORGjsKItheECE0VDZMjOZBVC2yYhTco=; b=biGJ2RwCipMumGDJucnSUL08TSQJnrdCUV4kCT59ermzU1KgSRNFPM8M+6UldZ2Ymm rOUHHhdsqG5n0p3p5g7/RebXyAORarG9071xpEi6hpkpvuYvMIdr6/Zgm0YDAZZFpqFs SbcNQgTWHyetd5hjk3g4qdV4i4qJmoYUCwlnNYw5XtqH4o8l8Q/XHna56cMOkee3dFJK fD+wRWPt/UQ4Dc0gzy/N8wumNuT8ouzvvEACTvPzH+jaoYeTzRGtZHZpe5DBjzDyk/0t bciLRMRc/AMaYSq7cLWDQuTFCpKLvHKFIVfuSUVVO/nW6iiQT45b2ZKMweFiCQE8xkUs xgmQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=0EYMSt5JjnAPORGjsKItheECE0VDZMjOZBVC2yYhTco=; b=cXL+i/tA8sswIX3aCZzq2o1FQww8tzQzFEStehuKXQ09vWbKw85Gyue69SQV2qvGA5 Dohompkq+ufXeXT7a/7cFiWYZZgV6lLZakneezUZIpnXuiKIImV6ewaQuUKygIP9hv21 cLXq3RODqmQwXzuqw825OFvzhDSFTdmZ7XoxCkEcdo8GpaXiFDvj0gvqaHY3ndy2mla2 W9pAqSlFUKVwz/WgcaRbDC+rNbgXEF0ay7KNNMkXZ0E03k8/z3OSJ+fNNbYgFIDaQB4G znZv51kKqDDv1bui+Jp922yQ5qVg6aQyVZWNa5sp687/DLRLV+Tt0Mi/NxeEeiqwtz/I Ud6g== X-Gm-Message-State: AOUpUlHB4OwO2fWprBs/KLRXHOlEOCvRuZoYxAhlWljzzy1JYiJxSM0p hbMpSbWeQXPDi0F3YjbiepUAFMwRAFc= X-Google-Smtp-Source: AA+uWPwN7HbPHORgHsWuqjCGZIPAzxWmQFSzwJNw6/5e12Vj9d3BCAZGfjYrRmrBs7PBieCLIL5HFA== X-Received: by 2002:adf:97d3:: with SMTP id t19-v6mr16773603wrb.283.1534943427935; Wed, 22 Aug 2018 06:10:27 -0700 (PDT) Received: from localhost.localdomain ([192.135.27.140]) by smtp.gmail.com with ESMTPSA id 200-v6sm2862429wmv.6.2018.08.22.06.10.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 22 Aug 2018 06:10:27 -0700 (PDT) From: Ahmed Abdelsalam To: pablo@netfilter.org, fw@strlen.de, netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, dlebrun@google.com, coreteam@netfilter.org, amsalam20@gmail.com Subject: [nf-next v2 1/3] netfilter: export SRH processing functions from seg6local Date: Wed, 22 Aug 2018 15:10:16 +0200 Message-Id: <20180822131018.11286-1-amsalam20@gmail.com> X-Mailer: git-send-email 2.11.0 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Some functions of seg6local are very useful to process SRv6 encapsulated packets This patch exports some functions of seg6local that we use for implementing our new ip6atbles target (SEG6). They can also be used at different parts of the kernel. The exported functions are: (1) seg6_get_srh() (2) seg6_advance_nextseg() (3) seg6_lookup_nexthop Signed-off-by: Ahmed Abdelsalam --- include/net/seg6.h | 3 +++ net/ipv6/seg6_local.c | 21 ++++++++++++--------- 2 files changed, 15 insertions(+), 9 deletions(-) diff --git a/include/net/seg6.h b/include/net/seg6.h index 2567941a2f32..09a35787aa0d 100644 --- a/include/net/seg6.h +++ b/include/net/seg6.h @@ -69,4 +69,7 @@ extern int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, extern int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh); extern int seg6_lookup_nexthop(struct sk_buff *skb, struct in6_addr *nhaddr, u32 tbl_id); +extern struct ipv6_sr_hdr *seg6_get_srh(struct sk_buff *skb); +extern void seg6_advance_nextseg(struct ipv6_sr_hdr *srh, + struct in6_addr *daddr); #endif diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c index 60325dbfe88b..dd072aed9d25 100644 --- a/net/ipv6/seg6_local.c +++ b/net/ipv6/seg6_local.c @@ -68,7 +68,7 @@ static struct seg6_local_lwt *seg6_local_lwtunnel(struct lwtunnel_state *lwt) return (struct seg6_local_lwt *)lwt->data; } -static struct ipv6_sr_hdr *get_srh(struct sk_buff *skb) +struct ipv6_sr_hdr *seg6_get_srh(struct sk_buff *skb) { struct ipv6_sr_hdr *srh; int len, srhoff = 0; @@ -91,12 +91,13 @@ static struct ipv6_sr_hdr *get_srh(struct sk_buff *skb) return srh; } +EXPORT_SYMBOL_GPL(seg6_get_srh); static struct ipv6_sr_hdr *get_and_validate_srh(struct sk_buff *skb) { struct ipv6_sr_hdr *srh; - srh = get_srh(skb); + srh = seg6_get_srh(skb); if (!srh) return NULL; @@ -116,7 +117,7 @@ static bool decap_and_validate(struct sk_buff *skb, int proto) struct ipv6_sr_hdr *srh; unsigned int off = 0; - srh = get_srh(skb); + srh = seg6_get_srh(skb); if (srh && srh->segments_left > 0) return false; @@ -140,7 +141,7 @@ static bool decap_and_validate(struct sk_buff *skb, int proto) return true; } -static void advance_nextseg(struct ipv6_sr_hdr *srh, struct in6_addr *daddr) +void seg6_advance_nextseg(struct ipv6_sr_hdr *srh, struct in6_addr *daddr) { struct in6_addr *addr; @@ -148,6 +149,7 @@ static void advance_nextseg(struct ipv6_sr_hdr *srh, struct in6_addr *daddr) addr = srh->segments + srh->segments_left; *daddr = *addr; } +EXPORT_SYMBOL_GPL(seg6_advance_nextseg); int seg6_lookup_nexthop(struct sk_buff *skb, struct in6_addr *nhaddr, u32 tbl_id) @@ -198,6 +200,7 @@ int seg6_lookup_nexthop(struct sk_buff *skb, struct in6_addr *nhaddr, skb_dst_set(skb, dst); return dst->error; } +EXPORT_SYMBOL_GPL(seg6_lookup_nexthop); /* regular endpoint function */ static int input_action_end(struct sk_buff *skb, struct seg6_local_lwt *slwt) @@ -208,7 +211,7 @@ static int input_action_end(struct sk_buff *skb, struct seg6_local_lwt *slwt) if (!srh) goto drop; - advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); seg6_lookup_nexthop(skb, NULL, 0); @@ -228,7 +231,7 @@ static int input_action_end_x(struct sk_buff *skb, struct seg6_local_lwt *slwt) if (!srh) goto drop; - advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); seg6_lookup_nexthop(skb, &slwt->nh6, 0); @@ -247,7 +250,7 @@ static int input_action_end_t(struct sk_buff *skb, struct seg6_local_lwt *slwt) if (!srh) goto drop; - advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); seg6_lookup_nexthop(skb, NULL, slwt->table); @@ -436,7 +439,7 @@ static int input_action_end_b6_encap(struct sk_buff *skb, if (!srh) goto drop; - advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); skb_reset_inner_headers(skb); skb->encapsulation = 1; @@ -495,7 +498,7 @@ static int input_action_end_bpf(struct sk_buff *skb, kfree_skb(skb); return -EINVAL; } - advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); /* preempt_disable is needed to protect the per-CPU buffer srh_state, * which is also accessed by the bpf_lwt_seg6_* helpers From patchwork Wed Aug 22 13:10:18 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ahmed Abdelsalam X-Patchwork-Id: 960956 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="r6B8ou+9"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 41wSZy5nDSz9s7T for ; Wed, 22 Aug 2018 23:10:34 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728903AbeHVQfY (ORCPT ); Wed, 22 Aug 2018 12:35:24 -0400 Received: from mail-wm0-f65.google.com ([74.125.82.65]:38588 "EHLO mail-wm0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728057AbeHVQfY (ORCPT ); Wed, 22 Aug 2018 12:35:24 -0400 Received: by mail-wm0-f65.google.com with SMTP id t25-v6so2115760wmi.3 for ; Wed, 22 Aug 2018 06:10:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=zgkXW9ZV7DwLEY1xgVwPyi0Fa75RBm5+bSrxpPB8Pdg=; b=r6B8ou+9kdAQ0iwvHJQQajinLdUYXv4hrJIPdiOcmDhMI/Om49XigR8XHrbPhZC3lo tho6uqbI/ZVXcsLCfd0HPq9X2f/0BYAggGEtDQzmt8I0jCRXDux4shK50bttZNPGCn0u oyqNY3X08ryIfBho7nsD9UOne7xtJB6TsUFboZNcPpLY25y4iEmXKJxOYgPwIiuLVMvh V38qHz+94I729/1753CXl+ObB79uv28qv3qtQjadKZz3o+lHW/cbNMmtWfVQj5WLMi7A teq0sRhehiKlB4iOkpbbYGCSu7G+Gq65OggDMsVh81pYDuYOPKlAe4NDuLu/2bhEuYl+ N+Jw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=zgkXW9ZV7DwLEY1xgVwPyi0Fa75RBm5+bSrxpPB8Pdg=; b=F6hadd03mFYljp8CzvYyUGUJY8CL9Vr+4xrqM0OCkVnjK+tCVwW4X8BfFZ7IMGEI1F Ceuf0iLmY4t+0vtxExXOC88RjXtLde61WBycH/C06YGwwqbWzlqudSWncOYMNga5NTWX ssdTbLKYv9RdQePIlAVSaAjL7svoHduSEt/c7EwMaqFh2TuySC0NbWOQSYS/c6UcIRcB lxBGK8stRLty+59fR1zghu0VSR9l5QqAiekkLcI4imXdz+OWf80lkapkRC/hzqOWvaj0 Iobns81tuQ1Y5GpDvjUBPa1WQpPvSjqB75G8cf4kKdn2BYlM70LTbMLWwISsUBApOhAi Jf7w== X-Gm-Message-State: APzg51BB1v5Jql32Uf7grXayDjpLQAB2VpKRtIcOgKgtZpauQgn8U0pZ uBtf96xgSuq4BRNL22m1G04= X-Google-Smtp-Source: ANB0Vdbe5ycNAY0FgjtyT0Dh3tzNQt8PRvu4BPaDmXb4uMHG0B3FPLxtQr0uBuklZ5b+0LlWsDhJjg== X-Received: by 2002:a1c:3314:: with SMTP id z20-v6mr2218176wmz.95.1534943430645; Wed, 22 Aug 2018 06:10:30 -0700 (PDT) Received: from localhost.localdomain ([192.135.27.140]) by smtp.gmail.com with ESMTPSA id 200-v6sm2862429wmv.6.2018.08.22.06.10.29 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 22 Aug 2018 06:10:30 -0700 (PDT) From: Ahmed Abdelsalam To: pablo@netfilter.org, fw@strlen.de, netfilter-devel@vger.kernel.org Cc: davem@davemloft.net, dlebrun@google.com, coreteam@netfilter.org, amsalam20@gmail.com Subject: [nf-next v2 3/3] netfilter: using ip6tables as L2/L3/L4 classifier for SRv6 Date: Wed, 22 Aug 2018 15:10:18 +0200 Message-Id: <20180822131018.11286-3-amsalam20@gmail.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180822131018.11286-1-amsalam20@gmail.com> References: <20180822131018.11286-1-amsalam20@gmail.com> Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org In Linux, SRv6 policies can be pushed based on the destination address of packets. However for many use-cases, it is needed to push SRv6 policies based on information from L2/L3/L4. Consider a use-case where you want to push SRv6 policies based on the application layer protocol (HTTP/DNS), which requires being able to match the destination port of a packet. In this patch, we use iptables a classifier for SRv6, hence we benefit from all of its matching capabilities. We added a new action to the SEG6 target, named "bind-sid", that takes the BSID and the SID table as arguments. Each packet that matches an iptables rule with SEG6 target that has the bind-sid action, will go through the SRv6 policies configured for that BSID. Example: We have an SRv6 policy configured in Linux as follows: ip -6 route add A99::1 encap seg6 mode encap segs F1::,F2:: dev eth1 We can steer traffic through this SRv6 policy using the matching power of iptables firewall as follows: ip6atbles -t raw -I PREROUTING -s -d \ -p --sport --dport \ -j SEG6 --seg6-action bind-sid --bsid A99::1 --bsid-tbl 0 This new SEG6 action should perfectly address all use-cases that require pushing SRv6 policies based information from Layer3/Layer4. Signed-off-by: Ahmed Abdelsalam --- net/ipv6/netfilter/ip6t_SEG6.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/net/ipv6/netfilter/ip6t_SEG6.c b/net/ipv6/netfilter/ip6t_SEG6.c index 0adfb98ccaf2..283786cf4126 100644 --- a/net/ipv6/netfilter/ip6t_SEG6.c +++ b/net/ipv6/netfilter/ip6t_SEG6.c @@ -25,6 +25,14 @@ #include #include +static int seg6_bsid(struct sk_buff *skb, struct in6_addr bsid, + u32 tbl) +{ + seg6_lookup_nexthop(skb, &bsid, tbl); + dst_input(skb); + return NF_STOLEN; +} + static int seg6_go_next(struct sk_buff *skb, struct ipv6_sr_hdr *srh) { if (srh->segments_left == 0) @@ -63,6 +71,10 @@ seg6_tg6(struct sk_buff *skb, const struct xt_action_param *par) struct ipv6_sr_hdr *srh; const struct ip6t_seg6_info *seg6 = par->targinfo; + /* bind-sid action doesn't require packets with SRH */ + if (seg6->action == IP6T_SEG6_BSID) + return seg6_bsid(skb, seg6->bsid, seg6->tbl); + srh = seg6_get_srh(skb); if (!srh) return NF_DROP; @@ -87,6 +99,7 @@ static int seg6_check(const struct xt_tgchk_param *par) case IP6T_SEG6_GO_NEXT: case IP6T_SEG6_SKIP_NEXT: case IP6T_SEG6_GO_LAST: + case IP6T_SEG6_BSID: return 0; default: return -EOPNOTSUPP;