Service Function Chaining (SFC) is one of the main use-cases of IPv6 Segment Routing (SRv6) [1]. The Segment Routing Header (SRH) allows including a list of segments in the IPv6 packet. This segment list can be used to steer the packetthough a set of Virtual Network Functions (VNFS) e.g., Firewall, DPI, IDS. The edge node (SR ingress node) classifies the traffic and consequently includes the segment lists in the IPv6 packet. The matching of SRH previous, next and last SIDs has been added to ip6tables in kernel 4.16. Once a packet matches one of these options, we can perform an SR specific actions. The IPv6 segment routing 'SEG6' target supports a set of SR-specific actions. The first set of actions include those actions necessary to allow branching within a pre-defined SRv6 SFC policy instead of the usual linear exploration of the VNF chain. This patch implements the following SR-specific actions: (1) go-next: sends packets towards the next SID from SRH. (2) skip-next: skips the next SID in the SRH. (3) go-last: skips the remaining part of the segment list and send the packet towards the last segment. [1] https://tools.ietf.org/html/draft-xuclad-spring-sr-service-programming-00 Signed-off-by: Ahmed Abdelsalam <amsalam20@xxxxxxxxx> --- Changes in v2: - Added check on seg6->action and return -EOPNOTSUPP for non supported actions - Removed the pr_err() call from the evaluation function. include/uapi/linux/netfilter_ipv6/ip6t_SEG6.h | 22 +++++ net/ipv6/netfilter/Kconfig | 15 ++++ net/ipv6/netfilter/Makefile | 1 + net/ipv6/netfilter/ip6t_SEG6.c | 120 ++++++++++++++++++++++++++ 4 files changed, 158 insertions(+) create mode 100644 include/uapi/linux/netfilter_ipv6/ip6t_SEG6.h create mode 100644 net/ipv6/netfilter/ip6t_SEG6.c diff --git a/include/uapi/linux/netfilter_ipv6/ip6t_SEG6.h b/include/uapi/linux/netfilter_ipv6/ip6t_SEG6.h new file mode 100644 index 000000000000..443805d0d1b2 --- /dev/null +++ b/include/uapi/linux/netfilter_ipv6/ip6t_SEG6.h @@ -0,0 +1,22 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ + +#ifndef _IP6T_SEG6_H +#define _IP6T_SEG6_H + +#include <linux/types.h> + +/* SEG6 action options */ +enum ip6t_seg6_action { + IP6T_SEG6_GO_NEXT, + IP6T_SEG6_SKIP_NEXT, + IP6T_SEG6_GO_LAST, + IP6T_SEG6_BSID, +}; + +struct ip6t_seg6_info { + __u32 action; /* SEG6 action */ + struct in6_addr bsid; /* SRv6 Bind SID */ + unsigned int tbl; /* Routing table of bsid */ +}; + +#endif /*_IP6T_SEG6_H*/ diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig index 339d0762b027..a2502c54a837 100644 --- a/net/ipv6/netfilter/Kconfig +++ b/net/ipv6/netfilter/Kconfig @@ -344,6 +344,21 @@ config IP6_NF_TARGET_NPT endif # IP6_NF_NAT +if IPV6_SEG6_LWTUNNEL + +config IP6_NF_TARGET_SEG6 + tristate 'IPv6 Segment Routing "SEG6" target support' + depends on NETFILTER_ADVANCED + help + SEG6 is an ip6tables target for IPv6 Segment Routing encapsualted + packets. It supports a set of Segment Routing specific actions + that can be applied based on SRH information. It is useful for + SRv6 Service Function chaining use-cases. + + To compile it as a module, choose M here. If unsure, say N. + +endif # IPV6_SEG6_LWTUNNEL + endif # IP6_NF_IPTABLES endmenu diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile index 200c0c235565..68e86e18f15f 100644 --- a/net/ipv6/netfilter/Makefile +++ b/net/ipv6/netfilter/Makefile @@ -58,3 +58,4 @@ obj-$(CONFIG_IP6_NF_TARGET_MASQUERADE) += ip6t_MASQUERADE.o obj-$(CONFIG_IP6_NF_TARGET_NPT) += ip6t_NPT.o obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o obj-$(CONFIG_IP6_NF_TARGET_SYNPROXY) += ip6t_SYNPROXY.o +obj-$(CONFIG_IP6_NF_TARGET_SEG6) += ip6t_SEG6.o diff --git a/net/ipv6/netfilter/ip6t_SEG6.c b/net/ipv6/netfilter/ip6t_SEG6.c new file mode 100644 index 000000000000..0adfb98ccaf2 --- /dev/null +++ b/net/ipv6/netfilter/ip6t_SEG6.c @@ -0,0 +1,120 @@ +/** + * IPv6 Segment Routing target module (SEG6). + * + * Author: + * Ahmed Abdelsalam <amsalam20@xxxxxxxxx> + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License + * as published by the Free Software Foundation; either version 2 + * of the License, or (at your option) any later version. + */ + +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +#include <linux/gfp.h> +#include <linux/module.h> +#include <linux/skbuff.h> +#include <linux/icmpv6.h> +#include <linux/netdevice.h> +#include <linux/netfilter/x_tables.h> +#include <linux/netfilter_ipv6/ip6_tables.h> +#include <linux/netfilter_ipv6/ip6t_SEG6.h> + +#include <net/flow.h> +#include <net/seg6.h> +#include <net/ip6_route.h> + +static int seg6_go_next(struct sk_buff *skb, struct ipv6_sr_hdr *srh) +{ + if (srh->segments_left == 0) + return NF_DROP; + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_lookup_nexthop(skb, NULL, 0); + dst_input(skb); + return NF_STOLEN; +} + +static int seg6_skip_next(struct sk_buff *skb, struct ipv6_sr_hdr *srh) +{ + if (srh->segments_left < 2) + return NF_DROP; + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_lookup_nexthop(skb, NULL, 0); + dst_input(skb); + return NF_STOLEN; +} + +static int seg6_go_last(struct sk_buff *skb, struct ipv6_sr_hdr *srh) +{ + if (srh->segments_left == 0) + return NF_DROP; + srh->segments_left = 1; + seg6_advance_nextseg(srh, &ipv6_hdr(skb)->daddr); + seg6_lookup_nexthop(skb, NULL, 0); + dst_input(skb); + return NF_STOLEN; +} + +static unsigned int +seg6_tg6(struct sk_buff *skb, const struct xt_action_param *par) +{ + struct ipv6_sr_hdr *srh; + const struct ip6t_seg6_info *seg6 = par->targinfo; + + srh = seg6_get_srh(skb); + if (!srh) + return NF_DROP; + + switch (seg6->action) { + case IP6T_SEG6_GO_NEXT: + return seg6_go_next(skb, srh); + case IP6T_SEG6_SKIP_NEXT: + return seg6_skip_next(skb, srh); + case IP6T_SEG6_GO_LAST: + return seg6_go_last(skb, srh); + } + + return NF_DROP; +} + +static int seg6_check(const struct xt_tgchk_param *par) +{ + const struct ip6t_seg6_info *seg6 = par->targinfo; + + switch (seg6->action) { + case IP6T_SEG6_GO_NEXT: + case IP6T_SEG6_SKIP_NEXT: + case IP6T_SEG6_GO_LAST: + return 0; + default: + return -EOPNOTSUPP; + } +} + +static struct xt_target seg6_tg6_reg __read_mostly = { + .name = "SEG6", + .family = NFPROTO_IPV6, + .target = seg6_tg6, + .targetsize = sizeof(struct ip6t_seg6_info), + .checkentry = seg6_check, + .me = THIS_MODULE +}; + +static int __init seg6_tg6_init(void) +{ + return xt_register_target(&seg6_tg6_reg); +} + +static void __exit seg6_tg6_exit(void) +{ + xt_unregister_target(&seg6_tg6_reg); +} + +module_init(seg6_tg6_init); +module_exit(seg6_tg6_exit); + +MODULE_LICENSE("GPL"); +MODULE_DESCRIPTION("Xtables: IPv6 Segment Routing Target (SEG6)"); +MODULE_AUTHOR("Ahmed Abdelsalam <amsalam20@xxxxxxxxx>"); -- 2.11.0
