From patchwork Fri Jan 12 04:39:34 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ahmed Abdelsalam X-Patchwork-Id: 860711 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="asy5AB+w"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3zKpPk4jxWz9s9Y for ; Mon, 15 Jan 2018 20:45:46 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755242AbeAOJnj (ORCPT ); Mon, 15 Jan 2018 04:43:39 -0500 Received: from mail-wm0-f66.google.com ([74.125.82.66]:36745 "EHLO mail-wm0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755131AbeAOJnh (ORCPT ); Mon, 15 Jan 2018 04:43:37 -0500 Received: by mail-wm0-f66.google.com with SMTP id f3so550492wmc.1; Mon, 15 Jan 2018 01:43:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=5xshJhiTXKfRy9zjHMBMb8Crl8Dfx3IvrBdDUsMV2D8=; b=asy5AB+wunVva4N+sLMkHUdEuun17LuHAH0uYoVF7ClEgEx2X8j5WF0lxDuiUwTnB6 7gp3F+2Dw8IkHHybbMFjJHDlMvOavirPUWudq0EaJYm0i8fZ+cJr49jmaSS0ygVJcJAN jVE/1eahQYdawyKsE7LkDTwL7iY6MSgxI4FxGRIzLUG9EmqnBSlgFHSSBlMjjPUC/Vd1 eA7Rb4rh2NAxDxv/5ETjKB5HD78SpD6xOYqwAYjr2wdNzIJlDLSUvpCvtfWY8oOYkr39 SrlqMrpyWPDtZXfvKy8h4ZXkLWwBcTLltGVWdBBhukh6YZwvcuj80hTRs8GyWN4oJpY0 f4og== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=5xshJhiTXKfRy9zjHMBMb8Crl8Dfx3IvrBdDUsMV2D8=; b=KBii0Ywr3TCSVU8Pn9YDdW7Kdld0rKX841JPIbTOl/MDo1pI+l8lsGVnmfABUmqQKJ vJKovFqQwsEV6Fr03erD8U2oprxLVkbRkb2zSlFjEM7ZQfrLoCUpHq37TvnT9uerbXoo v5vNt6yVEmzX0IdBDWr3sHP2mVECWZDd0ONfQ1ogodJ8UhD/57FXMLe6RaKMD/AQFlyU 18R0v1rYF8TmS5RKqUbWPgYDXrdfbrCaCphrXjAfO8vrxAmdSR1id9Xw6bq140w19oiu xXaRbd+akw5W4AYLICArbNgBCiMl5N/IfClWEeuzhSHKSZ/gAN0SYaGFbMQiJmRE1eDX +yUA== X-Gm-Message-State: AKwxytfZDd9j/zd9moCcaYAFZuTLNf3kvven6dXZO0rj32N99WSiN8+c JXjte9nN8/NZGgXdax8kfyEoaAHL X-Google-Smtp-Source: ACJfBovRVcQ8n6hxn463ZRAA8EswwEbRV7B4Wi6Su2WvqKTyyXAJPvwXs5WrwfqkWuUnNZauEBybgg== X-Received: by 10.28.23.149 with SMTP id 143mr9610770wmx.83.1516009415713; Mon, 15 Jan 2018 01:43:35 -0800 (PST) Received: from sr6.gssi.infn.it (wifi-guest-target.gssi.infn.it. [192.135.27.147]) by smtp.gmail.com with ESMTPSA id 25sm11457206wrx.73.2018.01.15.01.43.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 15 Jan 2018 01:43:35 -0800 (PST) From: Ahmed Abdelsalam To: pablo@netfilter.org, davem@davemloft.net Cc: fw@strlen.de, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Ahmed Abdelsalam Subject: [nf-next 1/3] netfilter: export SRH processing functions from seg6local Date: Fri, 12 Jan 2018 05:39:34 +0100 Message-Id: <1515731976-6338-1-git-send-email-amsalam20@gmail.com> X-Mailer: git-send-email 2.1.4 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Some functions of seg6local are very useful to process SRv6 encapsulated packets This patch exports some functions of seg6local that are useful and can be re-used at different parts of the kernel, including netfilter. The set of exported functions are: (1) seg6_get_srh() (2) seg6_advance_nextseg() (3) seg6_lookup_nexthop Signed-off-by: Ahmed Abdelsalam --- include/net/seg6.h | 5 +++++ net/ipv6/seg6_local.c | 37 ++++++++++++++++++++----------------- 2 files changed, 25 insertions(+), 17 deletions(-) diff --git a/include/net/seg6.h b/include/net/seg6.h index 099bad5..b637778 100644 --- a/include/net/seg6.h +++ b/include/net/seg6.h @@ -63,5 +63,10 @@ extern bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len); extern int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto); extern int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh); +extern struct ipv6_sr_hdr *seg6_get_srh(struct sk_buff *skb); +extern void seg6_advance_nextseg(struct ipv6_sr_hdr *srh, + struct in6_addr *daddr); +extern void seg6_lookup_nexthop(struct sk_buff *skb, struct in6_addr *nhaddr, + u32 tbl_id); #endif diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c index ba3767e..1f1eaa3 100644 --- a/net/ipv6/seg6_local.c +++ b/net/ipv6/seg6_local.c @@ -59,7 +59,7 @@ static struct seg6_local_lwt *seg6_local_lwtunnel(struct lwtunnel_state *lwt) return (struct seg6_local_lwt *)lwt->data; } -static struct ipv6_sr_hdr *get_srh(struct sk_buff *skb) +struct ipv6_sr_hdr *seg6_get_srh(struct sk_buff *skb) { struct ipv6_sr_hdr *srh; int len, srhoff = 0; @@ -82,12 +82,13 @@ static struct ipv6_sr_hdr *get_srh(struct sk_buff *skb) return srh; } +EXPORT_SYMBOL_GPL(seg6_get_srh); static struct ipv6_sr_hdr *get_and_validate_srh(struct sk_buff *skb) { struct ipv6_sr_hdr *srh; - srh = get_srh(skb); + srh = seg6_get_srh(skb); if (!srh) return NULL; @@ -107,7 +108,7 @@ static bool decap_and_validate(struct sk_buff *skb, int proto) struct ipv6_sr_hdr *srh; unsigned int off = 0; - srh = get_srh(skb); + srh = seg6_get_srh(skb); if (srh && srh->segments_left > 0) return false; @@ -131,7 +132,7 @@ static bool decap_and_validate(struct sk_buff *skb, int proto) return true; } -static void advance_nextseg(struct ipv6_sr_hdr *srh, struct in6_addr *daddr) +void seg6_advance_nextseg(struct ipv6_sr_hdr *srh, struct in6_addr *daddr) { struct in6_addr *addr; @@ -139,9 +140,10 @@ static void advance_nextseg(struct ipv6_sr_hdr *srh, struct in6_addr *daddr) addr = srh->segments + srh->segments_left; *daddr = *addr; } +EXPORT_SYMBOL_GPL(seg6_advance_nextseg); -static void lookup_nexthop(struct sk_buff *skb, struct in6_addr *nhaddr, - u32 tbl_id) +void seg6_lookup_nexthop(struct sk_buff *skb, struct in6_addr *nhaddr, + u32 tbl_id) { struct net *net = dev_net(skb->dev); struct ipv6hdr *hdr = ipv6_hdr(skb); @@ -188,6 +190,7 @@ static void lookup_nexthop(struct sk_buff *skb, struct in6_addr *nhaddr, skb_dst_drop(skb); skb_dst_set(skb, dst); } +EXPORT_SYMBOL_GPL(seg6_lookup_nexthop); /* regular endpoint function */ static int input_action_end(struct sk_buff *skb, struct seg6_local_lwt *slwt) @@ -198,9 +201,9 @@ static int input_action_end(struct sk_buff *skb, struct seg6_local_lwt *slwt) if (!srh) goto drop; - advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); - lookup_nexthop(skb, NULL, 0); + seg6_lookup_nexthop(skb, NULL, 0); return dst_input(skb); @@ -218,9 +221,9 @@ static int input_action_end_x(struct sk_buff *skb, struct seg6_local_lwt *slwt) if (!srh) goto drop; - advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); - lookup_nexthop(skb, &slwt->nh6, 0); + seg6_lookup_nexthop(skb, &slwt->nh6, 0); return dst_input(skb); @@ -237,9 +240,9 @@ static int input_action_end_t(struct sk_buff *skb, struct seg6_local_lwt *slwt) if (!srh) goto drop; - advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); - lookup_nexthop(skb, NULL, slwt->table); + seg6_lookup_nexthop(skb, NULL, slwt->table); return dst_input(skb); @@ -331,7 +334,7 @@ static int input_action_end_dx6(struct sk_buff *skb, if (!ipv6_addr_any(&slwt->nh6)) nhaddr = &slwt->nh6; - lookup_nexthop(skb, nhaddr, 0); + seg6_lookup_nexthop(skb, nhaddr, 0); return dst_input(skb); drop: @@ -380,7 +383,7 @@ static int input_action_end_dt6(struct sk_buff *skb, if (!pskb_may_pull(skb, sizeof(struct ipv6hdr))) goto drop; - lookup_nexthop(skb, NULL, slwt->table); + seg6_lookup_nexthop(skb, NULL, slwt->table); return dst_input(skb); @@ -406,7 +409,7 @@ static int input_action_end_b6(struct sk_buff *skb, struct seg6_local_lwt *slwt) ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); skb_set_transport_header(skb, sizeof(struct ipv6hdr)); - lookup_nexthop(skb, NULL, 0); + seg6_lookup_nexthop(skb, NULL, 0); return dst_input(skb); @@ -426,7 +429,7 @@ static int input_action_end_b6_encap(struct sk_buff *skb, if (!srh) goto drop; - advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); skb_reset_inner_headers(skb); skb->encapsulation = 1; @@ -438,7 +441,7 @@ static int input_action_end_b6_encap(struct sk_buff *skb, ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); skb_set_transport_header(skb, sizeof(struct ipv6hdr)); - lookup_nexthop(skb, NULL, 0); + seg6_lookup_nexthop(skb, NULL, 0); return dst_input(skb); From patchwork Fri Jan 12 04:39:35 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ahmed Abdelsalam X-Patchwork-Id: 860709 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="tCCBQQAZ"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3zKpPX50rZz9s9Y for ; Mon, 15 Jan 2018 20:45:36 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932655AbeAOJpF (ORCPT ); Mon, 15 Jan 2018 04:45:05 -0500 Received: from mail-wm0-f67.google.com ([74.125.82.67]:37498 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755235AbeAOJnj (ORCPT ); Mon, 15 Jan 2018 04:43:39 -0500 Received: by mail-wm0-f67.google.com with SMTP id v71so536988wmv.2; Mon, 15 Jan 2018 01:43:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=7uGKUKG6aLCVMED/i5wSMo4yqPEyxcioLb7mJFiVK4M=; b=tCCBQQAZwSRERlADK//3kIE76jQ/+pDbQqXsmplb5XSOn1mnbCfXZyLGfEgoC2TA3z ixQ9cm8QS95mU4Tws8yeBUiieF6ngF0mLGsmbUjy3Hr5X/ozgI7BV22QhjkSElo9NWDL 15IZKcqkeb/rwcKmSNVVeO7QwfUeRaquyKpcvCFxsX4Yw/PxY5093Fx0WzFT9Wsa9N0Y rgfH03InUO6cEK45pc13j1qge1U+TnDjJUcgenM3W+KWDh3GkMay7UAr+cCKqVFnKWCs Y8zt1ZvW0VLxL+Jd5AxsJakalpiJM6C400hnFQB7f5QHmG970QamP5olQbN77d+/q6MN XwjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=7uGKUKG6aLCVMED/i5wSMo4yqPEyxcioLb7mJFiVK4M=; b=gKCd4iAQofh/q7pNMGV43dfBINXEvZJj1YHbJCLgXCyLrcyRjA+bUFd9NSwU3TY79G lGYcnDFpRKFgcaqbGNdFGY30xSVpb6jc222WNIflShZkQeYA3TfY4ypPyFM/6XOs+q1Y lDj3Xge87UJx55xPlipIlxygtR71RjQOYb9Wx1Trwlofm4eaMtrntBHiDsfwik28QlHk 2fqKOC1H4/BxsaZi7sW06ARkxlcSLw+G7SDAUk5e1OIA1rRGcgvoPpcOyldqGpHzY7ph hynuMdseqG7kbfLEjOGZCxp10SII7kY3LgTqaon32zr3yKCyVOlOA8zP49cdMrRPUtNS 4NZA== X-Gm-Message-State: AKwxytcBPFJFiDCiYfbqbzwKe5LFJrV86VufpQXJJ7zheVxlbGYV7RSX IxPsg4y5DdLUbZRoM+kxsko= X-Google-Smtp-Source: ACJfBotcukQX9/u0PvXdA05Z4+IB7nFIg66hWJwRrINdfdWlbjlkCha+dMx/0R3vlsAb7jvTTLl2wQ== X-Received: by 10.28.174.20 with SMTP id x20mr9236661wme.87.1516009417548; Mon, 15 Jan 2018 01:43:37 -0800 (PST) Received: from sr6.gssi.infn.it (wifi-guest-target.gssi.infn.it. [192.135.27.147]) by smtp.gmail.com with ESMTPSA id 25sm11457206wrx.73.2018.01.15.01.43.36 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 15 Jan 2018 01:43:36 -0800 (PST) From: Ahmed Abdelsalam To: pablo@netfilter.org, davem@davemloft.net Cc: fw@strlen.de, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Ahmed Abdelsalam Subject: [nf-next 2/3] netfilter: add an option to control iptables SEG6 target support Date: Fri, 12 Jan 2018 05:39:35 +0100 Message-Id: <1515731976-6338-2-git-send-email-amsalam20@gmail.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1515731976-6338-1-git-send-email-amsalam20@gmail.com> References: <1515731976-6338-1-git-send-email-amsalam20@gmail.com> Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org This patch adds a new option CONFIG_IP6_NF_TARGET_SEG6 to enable/disable support of iptables SEG6 target. Signed-off-by: Ahmed Abdelsalam --- net/ipv6/netfilter/Kconfig | 12 ++++++++++++ net/ipv6/netfilter/Makefile | 1 + 2 files changed, 13 insertions(+) diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig index 4a634b7..8e98afc 100644 --- a/net/ipv6/netfilter/Kconfig +++ b/net/ipv6/netfilter/Kconfig @@ -364,6 +364,18 @@ config IP6_NF_TARGET_NPT endif # IP6_NF_NAT +if IPV6_SEG6_LWTUNNEL +config IP6_NF_TARGET_SEG6 + tristate 'IPv6 Segment Routing "SEG6" target support' + depends on NETFILTER_ADVANCED + help + SEG6 is an special target for IPv6 Segment Routing encapsualted + packets. It supports a set of Segment Routing specific actions + that are based on SRH information. It is useful for SRv6 Service + Function chaining use-cases. + + To compile it as a module, choose M here. If unsure, say N. +endif # IPV6_SEG6_LWTUNNEL endif # IP6_NF_IPTABLES endmenu diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile index d984057..67eff84 100644 --- a/net/ipv6/netfilter/Makefile +++ b/net/ipv6/netfilter/Makefile @@ -64,3 +64,4 @@ obj-$(CONFIG_IP6_NF_TARGET_MASQUERADE) += ip6t_MASQUERADE.o obj-$(CONFIG_IP6_NF_TARGET_NPT) += ip6t_NPT.o obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o obj-$(CONFIG_IP6_NF_TARGET_SYNPROXY) += ip6t_SYNPROXY.o +obj-$(CONFIG_IP6_NF_TARGET_SEG6) += ip6t_SEG6.o From patchwork Fri Jan 12 04:39:36 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ahmed Abdelsalam X-Patchwork-Id: 860707 X-Patchwork-Delegate: pablo@netfilter.org Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netfilter-devel-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="AznCNVa8"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3zKpNq3WW5z9s9Y for ; Mon, 15 Jan 2018 20:44:59 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755269AbeAOJnr (ORCPT ); Mon, 15 Jan 2018 04:43:47 -0500 Received: from mail-wm0-f67.google.com ([74.125.82.67]:34779 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755131AbeAOJnl (ORCPT ); Mon, 15 Jan 2018 04:43:41 -0500 Received: by mail-wm0-f67.google.com with SMTP id 81so11696681wmb.1; Mon, 15 Jan 2018 01:43:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=6SOHHsO9ZgZwAeYlHbJnZH4eN1KW6mCxfZaFyN3U8yc=; b=AznCNVa8SSLyT8N+iKbfzHlRr6smcfji3U7p/U2FiMpsd2OJf/zAjotB/IoSfP46U/ oszrvYmYedWAL7tmV4Bzmcm/FixTYBnpnhNh/cIIgD1sqNPykwrTPb9UP6bSD2fK2SMV YNefKd7wC+ea8MuCa/VKXjsFxJjBSbbZUTyPFJv8w3OhUafrcW/czuAvuAR+6/v9aSct 6XSa17CW3fZXARG+VHl/hm4vC2Tb7ogjGGvhGFFBZ50FuZl2/a1R7vAgpOXrSmh4QxB7 yfNh7JbvcG2hpJoYt9Z3FSj/OpOv+yW9V3NowFaza7aBlklcTXoT5CP/wbYzZLa1mfhO oyEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=6SOHHsO9ZgZwAeYlHbJnZH4eN1KW6mCxfZaFyN3U8yc=; b=k+9Z9VXWFhnxQjU/V0vTIwoEDmi4iIrXs/qh5NOiwe1fnkRSkWkApMsdeqz8soG/X8 6dcDF/f+KoW47y53XJxd41riIY3q36KqXOkTme4RlomyE6c+tfz7tcG5AidViid8stmB NyQ3wgjFOzl7uj5P4n73KF4+dCJq56wxReUyj+au06iffew1vefWRPLWoSaNXG1RBvTD dpoaEltvD0xTK9Cdn0GrsFHHJQGGXI8j3NdPEwAPNDrld9b08pwJtVBHWlXUOM0ROZ4F L3mq+K9DNVdHbmQ65KychnFN5VG7b1xyXXVOQXEONIa1wVfP/Klr50cExttE8AOrOdKt 5j9A== X-Gm-Message-State: AKwxytej80iGQFW0fileY7TX23qNO34YQcKfZiCOaoqaDIEqldlwVYfC 3CcVsVyUiYNYx4qmWVgRR7A= X-Google-Smtp-Source: ACJfBotP+LKtu8XhNYjE7Dse/0kCB3xTqq3fPVNjPzwvkMGecjNuzv/dPGFvwYHspWyC/mita1pu1A== X-Received: by 10.28.58.196 with SMTP id h187mr11055762wma.107.1516009419455; Mon, 15 Jan 2018 01:43:39 -0800 (PST) Received: from sr6.gssi.infn.it (wifi-guest-target.gssi.infn.it. [192.135.27.147]) by smtp.gmail.com with ESMTPSA id 25sm11457206wrx.73.2018.01.15.01.43.38 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 15 Jan 2018 01:43:38 -0800 (PST) From: Ahmed Abdelsalam To: pablo@netfilter.org, davem@davemloft.net Cc: fw@strlen.de, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Ahmed Abdelsalam Subject: [nf-next 3/3] netfilter: Add support for IPv6 segment routing 'SEG6' target Date: Fri, 12 Jan 2018 05:39:36 +0100 Message-Id: <1515731976-6338-3-git-send-email-amsalam20@gmail.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1515731976-6338-1-git-send-email-amsalam20@gmail.com> References: <1515731976-6338-1-git-send-email-amsalam20@gmail.com> Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Service Function Chaining (SFC) is one of the main use-cases of IPv6 Segment Routing (SRv6)[1]. The Segment Routing Header (SRH) allows including a list of segments in the IPv6 packet. This segment list can be used to steer the packet though a set of Virtual Network Functions (VNFS) e.g., Firewall, DPI, IDS. The edge node (SR ingress node) classifies the traffic and consequently includes the segment lists in the IPv6 packet. The IPv6 segment routing 'SEG6' target supports a set of SR-specific actions. This set of actions allows branching within a pre-defined SRv6 SFC policy instead of the usual linear exploration of the VNF chain. As an example, consider a service chain which includes a firewall followed by an Intrusion Detection System. The firewall may decide to skip the IDS for a subset of traffic that matches some conditions. This patch implements the following SR-specific actions: (1) go-next: is the default action of the SEG6 target. It sends packets towards the next SID from SRH. (2) skip-next: skips the next SID in the SRH. (3) go-last: skips the remaining part of the segment list and send the packet towards the last segment. [1] https://tools.ietf.org/html/draft-clad-spring-segment-routing-service-chaining-00 Signed-off-by: Ahmed Abdelsalam --- include/uapi/linux/netfilter_ipv6/ip6t_SEG6.h | 18 ++++ net/ipv6/netfilter/ip6t_SEG6.c | 113 ++++++++++++++++++++++++++ 2 files changed, 131 insertions(+) create mode 100644 include/uapi/linux/netfilter_ipv6/ip6t_SEG6.h create mode 100644 net/ipv6/netfilter/ip6t_SEG6.c diff --git a/include/uapi/linux/netfilter_ipv6/ip6t_SEG6.h b/include/uapi/linux/netfilter_ipv6/ip6t_SEG6.h new file mode 100644 index 0000000..38b380a --- /dev/null +++ b/include/uapi/linux/netfilter_ipv6/ip6t_SEG6.h @@ -0,0 +1,18 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ +#ifndef _IP6T_SEG6_H +#define _IP6T_SEG6_H + +#include + +/* seg6 action options */ +enum ip6t_seg6_action { + IP6T_SEG6_GO_NEXT, + IP6T_SEG6_SKIP_NEXT, + IP6T_SEG6_GO_LAST, +}; + +struct ip6t_seg6_info { + __u32 action; /* SEG6 action */ +}; + +#endif /*_IP6T_SEG6_H*/ diff --git a/net/ipv6/netfilter/ip6t_SEG6.c b/net/ipv6/netfilter/ip6t_SEG6.c new file mode 100644 index 0000000..3d326e2 --- /dev/null +++ b/net/ipv6/netfilter/ip6t_SEG6.c @@ -0,0 +1,113 @@ +/* IPv6 Segment Routing target module (SEG6). + * + * Author: + * Ahmed Abdelsalam + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + */ + +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include +#include + +static int seg6_go_next(struct sk_buff *skb, struct ipv6_sr_hdr *srh) +{ + if (srh->segments_left == 0) + return NF_DROP; + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_lookup_nexthop(skb, NULL, 0); + dst_input(skb); + return NF_STOLEN; +} + +static int seg6_skip_next(struct sk_buff *skb, struct ipv6_sr_hdr *srh) +{ + if (srh->segments_left < 2) + return NF_DROP; + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_lookup_nexthop(skb, NULL, 0); + dst_input(skb); + return NF_STOLEN; +} + +static int seg6_go_last(struct sk_buff *skb, struct ipv6_sr_hdr *srh) +{ + if (srh->segments_left == 0) + return NF_DROP; + srh->segments_left = 1; + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_lookup_nexthop(skb, NULL, 0); + dst_input(skb); + return NF_STOLEN; +} + +static unsigned int +seg6_tg6(struct sk_buff *skb, const struct xt_action_param *par) +{ + struct ipv6_sr_hdr *srh; + const struct ip6t_seg6_info *seg6 = par->targinfo; + + srh = seg6_get_srh(skb); + if (!srh) + return NF_DROP; + + switch (seg6->action) { + case IP6T_SEG6_GO_NEXT: + return seg6_go_next(skb, srh); + case IP6T_SEG6_SKIP_NEXT: + return seg6_skip_next(skb, srh); + case IP6T_SEG6_GO_LAST: + return seg6_go_last(skb, srh); + } + pr_err("Unknown SEG6 action\n"); + return NF_DROP; +} + +static int seg6_check(const struct xt_tgchk_param *par) +{ + /** + * In the future, some new action may require using this function + */ + return 0; +} + +static struct xt_target seg6_tg6_reg __read_mostly = { + .name = "SEG6", + .family = NFPROTO_IPV6, + .target = seg6_tg6, + .targetsize = sizeof(struct ip6t_seg6_info), + .checkentry = seg6_check, + .me = THIS_MODULE +}; + +static int __init seg6_tg6_init(void) +{ + return xt_register_target(&seg6_tg6_reg); +} + +static void __exit seg6_tg6_exit(void) +{ + xt_unregister_target(&seg6_tg6_reg); +} + +module_init(seg6_tg6_init); +module_exit(seg6_tg6_exit); + +MODULE_LICENSE("GPL"); +MODULE_DESCRIPTION("Xtables: IPv6 Segment Routing Target (SEG6)"); +MODULE_AUTHOR("Ahmed Abdelsalam ");