[RFC net-next v2 05/18] net: ipxlat: add engine skeleton and configuration model

[Ralf Lici <ralf@mandelbit.com>]

Add the reusable ipxlat module, immutable RFC 6052/EAM configuration
structures and validation helpers. Attachment-specific configuration
is intentionally left for a later patch.

Signed-off-by: Ralf Lici <ralf@mandelbit.com>
---
Changes since RFC v1 https://lore.kernel.org/netdev/20260319151230.655687-2-ralf@mandelbit.com/
- Move ipxlat from drivers/net to net/ipxlat, remove the virtual
  netdevice and generic-netlink control plane, and make the engine
  independent of any attachment. (Toke)
- Replace mutable per-device values with validated immutable RFC 6052
  and EAM configuration structures supplied by the caller.

 include/net/ipxlat.h | 66 +++++++++++++++++++++++++++++++++++
 net/Kconfig          |  1 +
 net/Makefile         |  1 +
 net/ipxlat/Kconfig   | 14 ++++++++
 net/ipxlat/Makefile  |  8 +++++
 net/ipxlat/config.c  | 82 ++++++++++++++++++++++++++++++++++++++++++++
 net/ipxlat/core.c    | 17 +++++++++
 7 files changed, 189 insertions(+)
 create mode 100644 include/net/ipxlat.h
 create mode 100644 net/ipxlat/Kconfig
 create mode 100644 net/ipxlat/Makefile
 create mode 100644 net/ipxlat/config.c
 create mode 100644 net/ipxlat/core.c

diff --git a/include/net/ipxlat.h b/include/net/ipxlat.h
new file mode 100644
index 000000000000..6b8efb2669b8
--- /dev/null
+++ b/include/net/ipxlat.h
@@ -0,0 +1,66 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*  IPXLAT - Stateless IP/ICMP Translation (SIIT) engine
+ *
+ *  Copyright (C) 2024- Alberto Leiva Popper <ydahhrk@gmail.com>
+ *  Copyright (C) 2026- Mandelbit SRL
+ *  Copyright (C) 2026- Daniel Gröber <dxld@darkboxed.org>
+ *
+ *  Author:	Alberto Leiva Popper <ydahhrk@gmail.com>
+ *		Antonio Quartulli <antonio@mandelbit.com>
+ *		Daniel Gröber <dxld@darkboxed.org>
+ *		Ralf Lici <ralf@mandelbit.com>
+ */
+
+#ifndef _NET_IPXLAT_H_
+#define _NET_IPXLAT_H_
+
+#include <linux/in6.h>
+#include <linux/types.h>
+
+struct ipxlat_prefix4 {
+	__be32 addr;
+	u8 len;
+};
+
+struct ipxlat_prefix6 {
+	struct in6_addr addr;
+	u8 len;
+};
+
+struct ipxlat_eam {
+	struct ipxlat_prefix4 prefix4;
+	struct ipxlat_prefix6 prefix6;
+};
+
+/**
+ * struct ipxlat_config - immutable translation configuration
+ * @rfc6052_prefix6: RFC 6052 fallback prefix
+ * @has_eam: whether @eam is present
+ * @eam: optional RFC 7757 explicit address mapping
+ */
+struct ipxlat_config {
+	struct ipxlat_prefix6 rfc6052_prefix6;
+	bool has_eam;
+	struct ipxlat_eam eam;
+};
+
+/**
+ * ipxlat_prefix6_len_valid - check an RFC 6052 prefix length
+ * @len: prefix length in bits
+ *
+ * Return: true when @len is one of the RFC 6052 prefix lengths.
+ */
+bool ipxlat_prefix6_len_valid(u8 len);
+
+/**
+ * ipxlat_config_validate - validate a complete translation configuration
+ * @cfg: configuration to validate
+ *
+ * If present, the EAM's IPv6 prefix must provide enough host bits for its IPv4
+ * prefix.
+ *
+ * Return: 0 when valid, otherwise a negative errno.
+ */
+int ipxlat_config_validate(const struct ipxlat_config *cfg);
+
+#endif /* _NET_IPXLAT_H_ */
diff --git a/net/Kconfig b/net/Kconfig
index 76ab44aa439a..c4d8b9a707aa 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -135,6 +135,7 @@ config INET
 if INET
 source "net/ipv4/Kconfig"
 source "net/ipv6/Kconfig"
+source "net/ipxlat/Kconfig"
 source "net/netlabel/Kconfig"
 source "net/mptcp/Kconfig"
 
diff --git a/net/Makefile b/net/Makefile
index 5b2dd7f07a85..ea92d88706e3 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -20,6 +20,7 @@ obj-$(CONFIG_XFRM)		+= xfrm/
 obj-$(CONFIG_UNIX)		+= unix/
 obj-$(CONFIG_INET_PSP)		+= psp/
 obj-y				+= ipv6/
+obj-$(CONFIG_NET_IPXLAT)	+= ipxlat/
 obj-$(CONFIG_PACKET)		+= packet/
 obj-$(CONFIG_NET_KEY)		+= key/
 obj-$(CONFIG_BRIDGE)		+= bridge/
diff --git a/net/ipxlat/Kconfig b/net/ipxlat/Kconfig
new file mode 100644
index 000000000000..6b0e47f8ce90
--- /dev/null
+++ b/net/ipxlat/Kconfig
@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# IPXLAT - Stateless IP/ICMP Translation (SIIT)
+#
+
+config NET_IPXLAT
+	tristate "IPv6<>IPv4 packet translation engine (SIIT)"
+	depends on IPV6
+	help
+	  Reusable stateless IP/ICMP packet translation engine implementing
+	  RFC 7915. Useful for IPv6 focused networks. Particularly NAT64,
+	  SIIT-DC, 464XLAT network architectures.
+
+	  To compile this engine as a module, choose M here.
diff --git a/net/ipxlat/Makefile b/net/ipxlat/Makefile
new file mode 100644
index 000000000000..47d00b7b05bb
--- /dev/null
+++ b/net/ipxlat/Makefile
@@ -0,0 +1,8 @@
+# SPDX-License-Identifier: GPL-2.0
+#
+# IPXLAT - Stateless IP/ICMP Translation (SIIT) engine
+
+obj-$(CONFIG_NET_IPXLAT) += ipxlat.o
+
+ipxlat-objs += config.o
+ipxlat-objs += core.o
diff --git a/net/ipxlat/config.c b/net/ipxlat/config.c
new file mode 100644
index 000000000000..06bd6fdc6c21
--- /dev/null
+++ b/net/ipxlat/config.c
@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: GPL-2.0
+/*  IPXLAT - Stateless IP/ICMP Translation (SIIT) engine
+ *
+ *  Copyright (C) 2024- Alberto Leiva Popper <ydahhrk@gmail.com>
+ *  Copyright (C) 2026- Mandelbit SRL
+ *  Copyright (C) 2026- Daniel Gröber <dxld@darkboxed.org>
+ *
+ *  Author:	Alberto Leiva Popper <ydahhrk@gmail.com>
+ *		Antonio Quartulli <antonio@mandelbit.com>
+ *		Daniel Gröber <dxld@darkboxed.org>
+ *		Ralf Lici <ralf@mandelbit.com>
+ */
+
+#include <linux/errno.h>
+#include <linux/inetdevice.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <linux/module.h>
+#include <net/ipv6.h>
+
+#include <net/ipxlat.h>
+
+bool ipxlat_prefix6_len_valid(u8 len)
+{
+	switch (len) {
+	case 32:
+	case 40:
+	case 48:
+	case 56:
+	case 64:
+	case 96:
+		return true;
+	default:
+		return false;
+	}
+}
+EXPORT_SYMBOL_GPL(ipxlat_prefix6_len_valid);
+
+static bool ipxlat_v4_prefix_canonical(const struct ipxlat_prefix4 *prefix)
+{
+	__be32 mask = inet_make_mask(prefix->len);
+
+	return (prefix->addr & mask) == prefix->addr;
+}
+
+static bool ipxlat_v6_prefix_canonical(const struct ipxlat_prefix6 *prefix)
+{
+	struct in6_addr masked = prefix->addr;
+
+	ipv6_addr_prefix(&masked, &prefix->addr, prefix->len);
+	return ipv6_addr_equal(&masked, &prefix->addr);
+}
+
+int ipxlat_config_validate(const struct ipxlat_config *cfg)
+{
+	u8 host4, host6;
+
+	if (!ipxlat_prefix6_len_valid(cfg->rfc6052_prefix6.len))
+		return -EINVAL;
+	if (!ipxlat_v6_prefix_canonical(&cfg->rfc6052_prefix6))
+		return -EINVAL;
+	if (cfg->rfc6052_prefix6.addr.s6_addr[8])
+		return -EINVAL;
+
+	if (!cfg->has_eam)
+		return 0;
+
+	if (cfg->eam.prefix4.len > 32 || cfg->eam.prefix6.len > 128)
+		return -EINVAL;
+	if (!ipxlat_v4_prefix_canonical(&cfg->eam.prefix4) ||
+	    !ipxlat_v6_prefix_canonical(&cfg->eam.prefix6))
+		return -EINVAL;
+
+	host4 = 32 - cfg->eam.prefix4.len;
+	host6 = 128 - cfg->eam.prefix6.len;
+	/* every IPv4 host bit must fit into the mapped IPv6 host space */
+	if (host4 > host6)
+		return -EINVAL;
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(ipxlat_config_validate);
diff --git a/net/ipxlat/core.c b/net/ipxlat/core.c
new file mode 100644
index 000000000000..85037446291e
--- /dev/null
+++ b/net/ipxlat/core.c
@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: GPL-2.0
+/*  IPXLAT - Stateless IP/ICMP Translation (SIIT) engine
+ *
+ *  Copyright (C) 2024- Alberto Leiva Popper <ydahhrk@gmail.com>
+ *  Copyright (C) 2026- Mandelbit SRL
+ *  Copyright (C) 2026- Daniel Gröber <dxld@darkboxed.org>
+ *
+ *  Author:	Alberto Leiva Popper <ydahhrk@gmail.com>
+ *		Antonio Quartulli <antonio@mandelbit.com>
+ *		Daniel Gröber <dxld@darkboxed.org>
+ *		Ralf Lici <ralf@mandelbit.com>
+ */
+
+#include <linux/module.h>
+
+MODULE_DESCRIPTION("IPv6<>IPv4 stateless translation engine (SIIT)");
+MODULE_LICENSE("GPL");
-- 
2.55.0