[RFC PATCH iproute2-next 0/4] seg6: add SRv6 End.DT2U and srl2 support

[RFC PATCH iproute2-next 0/4] seg6: add SRv6 End.DT2U and srl2 support

[Andrea Mayer]

Hi all,

this series adds iproute2 support for SRv6 L2 VPN functionality based
on the End.DT2U behavior and the srl2 link type.

The goal is to expose in userspace the pieces needed to support SRv6
L2 service delivery through an internal SRv6 L2 endpoint, similarly
to the model already used by VXLAN.

Today, Linux supports SRv6 L2 decapsulation only through the End.DX2
behavior, i.e., by forwarding the exposed Ethernet frame to a
configured egress netdevice. This supports L2 decapsulation toward an
output interface, but does not provide a native internal netdevice
representing the SRv6 L2 service endpoint. On the encapsulation side,
the existing H.L2.Encaps lwtunnel mode cannot encapsulate non-IP
protocols such as ARP, since they never enter the routing path.

The companion kernel series addresses that limitation by adding the
End.DT2U seg6local behavior and introducing the srl2 device. This
iproute2 series provides the corresponding userspace support: parsing
and printing of End.DT2U with the l2dev attribute, creation and
configuration of srl2 links, and man page documentation for both.

The series is structured as follows:

 Patch: 1/4 adds iproute2 support for the SRv6 End.DT2U behavior,
        including parsing and printing of the l2dev attribute;

 Patch: 2/4 adds support for the srl2 link type and its segs parameter,
        used to configure the SRv6 segment list for L2 encapsulation;

 Patch: 3/4 documents End.DT2U in the ip-route man page;

 Patch: 4/4 documents the srl2 link type in the ip-link man page.


Example usage:

  ip link add srl2-0 type srl2 segs fc00::a,fc00::b
  ip link set srl2-0 master br0

  ip -6 route add fc00::100/128 encap seg6local action End.DT2U \
      l2dev srl2-0 dev dum0

  # encapsulating traffic from veth-hs into srl2-0
  ip link set veth-hs master br0


This series depends on the companion kernel RFC:

  [RFC PATCH net-next 0/3] seg6: SRv6 L2 VPN with End.DT2U and srl2 device

Comments are welcome!

Thanks,
Andrea and Stefano


Andrea Mayer (4):
  seg6: add support for SRv6 End.DT2U behavior
  seg6: add srl2 link type support
  seg6: man: document End.DT2U behavior in ip-route man page
  seg6: man: document srl2 link type in ip-link man page

 include/uapi/linux/seg6_local.h |   3 +
 include/uapi/linux/srl2.h       |  20 ++++
 ip/Makefile                     |   2 +-
 ip/iplink_srl2.c                | 176 ++++++++++++++++++++++++++++++++
 ip/iproute.c                    |   7 +-
 ip/iproute_lwtunnel.c           |  20 +++-
 man/man8/ip-link.8.in           |  23 +++++
 man/man8/ip-route.8.in          |  21 ++++
 8 files changed, 267 insertions(+), 5 deletions(-)
 create mode 100644 include/uapi/linux/srl2.h
 create mode 100644 ip/iplink_srl2.c

-- 
2.20.1

[RFC PATCH iproute2-next 1/4] seg6: add support for SRv6 End.DT2U behavior

[Andrea Mayer]

Add parsing and printing for the End.DT2U seg6local action with
its l2dev attribute, and update the usage help text.

Usage:

  ip -6 route add fc00::100/128 encap seg6local action End.DT2U \
      l2dev veth0 dev dum0

  where veth0 is a bridge port.

Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it>
---
 include/uapi/linux/seg6_local.h |  3 +++
 ip/iproute.c                    |  7 ++++---
 ip/iproute_lwtunnel.c           | 20 +++++++++++++++++++-
 3 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/include/uapi/linux/seg6_local.h b/include/uapi/linux/seg6_local.h
index 6e71d97f..c0717510 100644
--- a/include/uapi/linux/seg6_local.h
+++ b/include/uapi/linux/seg6_local.h
@@ -29,6 +29,7 @@ enum {
 	SEG6_LOCAL_VRFTABLE,
 	SEG6_LOCAL_COUNTERS,
 	SEG6_LOCAL_FLAVORS,
+	SEG6_LOCAL_L2DEV,
 	__SEG6_LOCAL_MAX,
 };
 #define SEG6_LOCAL_MAX (__SEG6_LOCAL_MAX - 1)
@@ -67,6 +68,8 @@ enum {
 	SEG6_LOCAL_ACTION_END_BPF	= 15,
 	/* decap and lookup of DA in v4 or v6 table */
 	SEG6_LOCAL_ACTION_END_DT46	= 16,
+	/* decap and unicast MAC L2 table lookup */
+	SEG6_LOCAL_ACTION_END_DT2U	= 17,
 
 	__SEG6_LOCAL_ACTION_MAX,
 };
diff --git a/ip/iproute.c b/ip/iproute.c
index c2538894..89d8ec1e 100644
--- a/ip/iproute.c
+++ b/ip/iproute.c
@@ -104,11 +104,12 @@ static void usage(void)
 		"SEGMODE := [ encap | encap.red | inline | l2encap | l2encap.red ]\n"
 		"SEG6LOCAL := action ACTION [ OPTIONS ] [ count ]\n"
 		"ACTION := { End | End.X | End.T | End.DX2 | End.DX6 | End.DX4 |\n"
-		"            End.DT6 | End.DT4 | End.DT46 | End.B6 | End.B6.Encaps |\n"
+		"            End.DT6 | End.DT4 | End.DT46 | End.DT2U | End.B6 | End.B6.Encaps |\n"
 		"            End.BM | End.S | End.AS | End.AM | End.BPF }\n"
 		"OPTIONS := OPTION [ OPTIONS ]\n"
-		"OPTION := { flavors FLAVORS | srh SEG6HDR | nh4 ADDR | nh6 ADDR | iif DEV | oif DEV |\n"
-		"            table TABLEID | vrftable TABLEID | endpoint PROGNAME }\n"
+		"OPTION := { flavors FLAVORS | srh SEG6HDR | nh4 ADDR | nh6 ADDR |\n"
+		"            iif DEV | oif DEV | l2dev DEV | table TABLEID |\n"
+		"            vrftable TABLEID | endpoint PROGNAME }\n"
 		"FLAVORS := { FLAVOR[,FLAVOR] }\n"
 		"FLAVOR := { psp | usp | usd | next-csid }\n"
 		"IOAM6HDR := trace prealloc type IOAM6_TRACE_TYPE ns IOAM6_NAMESPACE size IOAM6_TRACE_SIZE\n"
diff --git a/ip/iproute_lwtunnel.c b/ip/iproute_lwtunnel.c
index a7885dba..40e9bbd2 100644
--- a/ip/iproute_lwtunnel.c
+++ b/ip/iproute_lwtunnel.c
@@ -398,6 +398,7 @@ static const char *seg6_action_names[SEG6_LOCAL_ACTION_MAX + 1] = {
 	[SEG6_LOCAL_ACTION_END_AM]		= "End.AM",
 	[SEG6_LOCAL_ACTION_END_BPF]		= "End.BPF",
 	[SEG6_LOCAL_ACTION_END_DT46]		= "End.DT46",
+	[SEG6_LOCAL_ACTION_END_DT2U]		= "End.DT2U",
 };
 
 static const char *format_action_type(int action)
@@ -561,6 +562,13 @@ static void print_encap_seg6local(FILE *fp, struct rtattr *encap)
 			     "oif %s ", ll_index_to_name(oif));
 	}
 
+	if (tb[SEG6_LOCAL_L2DEV]) {
+		int l2dev = rta_getattr_u32(tb[SEG6_LOCAL_L2DEV]);
+
+		print_string(PRINT_ANY, "l2dev",
+			     "l2dev %s ", ll_index_to_name(l2dev));
+	}
+
 	if (tb[SEG6_LOCAL_BPF])
 		print_encap_bpf_prog(fp, tb[SEG6_LOCAL_BPF], "endpoint");
 
@@ -1419,12 +1427,13 @@ static int parse_encap_seg6local(struct rtattr *rta, size_t len, int *argcp,
 	int nh4_ok = 0, nh6_ok = 0, iif_ok = 0, oif_ok = 0, flavors_ok = 0;
 	int segs_ok = 0, hmac_ok = 0, table_ok = 0, vrftable_ok = 0;
 	int action_ok = 0, srh_ok = 0, bpf_ok = 0, counters_ok = 0;
-	__u32 action = 0, table, vrftable, iif, oif;
+	__u32 action = 0, table, vrftable, iif, oif, l2dev;
 	struct ipv6_sr_hdr *srh;
 	char **argv = *argvp;
 	int argc = *argcp;
 	char segbuf[1024];
 	inet_prefix addr;
+	int l2dev_ok = 0;
 	__u32 hmac = 0;
 	int ret = 0;
 
@@ -1483,6 +1492,15 @@ static int parse_encap_seg6local(struct rtattr *rta, size_t len, int *argcp,
 			if (!oif)
 				exit(nodev(*argv));
 			ret = rta_addattr32(rta, len, SEG6_LOCAL_OIF, oif);
+		} else if (strcmp(*argv, "l2dev") == 0) {
+			NEXT_ARG();
+			if (l2dev_ok++)
+				duparg2("l2dev", *argv);
+			l2dev = ll_name_to_index(*argv);
+			if (!l2dev)
+				exit(nodev(*argv));
+			ret = rta_addattr32(rta, len, SEG6_LOCAL_L2DEV,
+					    l2dev);
 		} else if (strcmp(*argv, "count") == 0) {
 			if (counters_ok++)
 				duparg2("count", *argv);
-- 
2.20.1

[RFC PATCH iproute2-next 2/4] seg6: add srl2 link type support

[Andrea Mayer]

Add the srl2 link type for creating SRv6 Ethernet pseudowire
devices with a segment list parameter.

Usage:

  ip link add srl2-0 type srl2 segs fc00::a,fc00::b

Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it>
---
 include/uapi/linux/srl2.h |  20 +++++
 ip/Makefile               |   2 +-
 ip/iplink_srl2.c          | 176 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 197 insertions(+), 1 deletion(-)
 create mode 100644 include/uapi/linux/srl2.h
 create mode 100644 ip/iplink_srl2.c

diff --git a/include/uapi/linux/srl2.h b/include/uapi/linux/srl2.h
new file mode 100644
index 00000000..e7c8f6fc
--- /dev/null
+++ b/include/uapi/linux/srl2.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later WITH Linux-syscall-note */
+/*
+ *  SRv6 L2 tunnel device
+ *
+ *  Author:
+ *  Andrea Mayer <andrea.mayer@uniroma2.it>
+ */
+
+#ifndef _UAPI_LINUX_SRL2_H
+#define _UAPI_LINUX_SRL2_H
+
+enum {
+	IFLA_SRL2_UNSPEC,
+	IFLA_SRL2_SRH,	/* binary: struct ipv6_sr_hdr + segments */
+	__IFLA_SRL2_MAX,
+};
+
+#define IFLA_SRL2_MAX (__IFLA_SRL2_MAX - 1)
+
+#endif
diff --git a/ip/Makefile b/ip/Makefile
index 3535ba78..99a1724d 100644
--- a/ip/Makefile
+++ b/ip/Makefile
@@ -11,7 +11,7 @@ IPOBJ=ip.o ipaddress.o ipaddrlabel.o iproute.o iprule.o ipnetns.o \
     iplink_bridge.o iplink_bridge_slave.o iplink_dsa.o ipfou.o iplink_ipvlan.o \
     iplink_geneve.o iplink_vrf.o iproute_lwtunnel.o ipmacsec.o ipila.o \
     ipvrf.o iplink_xstats.o ipseg6.o iplink_netdevsim.o iplink_rmnet.o \
-    ipnexthop.o ipmptcp.o iplink_bareudp.o iplink_wwan.o ipioam6.o \
+    ipnexthop.o ipmptcp.o iplink_bareudp.o iplink_wwan.o ipioam6.o iplink_srl2.o \
     iplink_amt.o iplink_batadv.o iplink_gtp.o iplink_virt_wifi.o \
     iplink_netkit.o ipstats.o
 
diff --git a/ip/iplink_srl2.c b/ip/iplink_srl2.c
new file mode 100644
index 00000000..b0a546b3
--- /dev/null
+++ b/ip/iplink_srl2.c
@@ -0,0 +1,176 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ *  iproute2 support for SRv6 L2 tunnel device (srl2)
+ *
+ *  Usage:
+ *    ip link add srl2-0 type srl2 segs fc00::a,fc00::b
+ *    ip link set srl2-0 up
+ *    ip link set srl2-0 master br0
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <linux/seg6.h>
+#include <linux/srl2.h>
+
+#include "libnetlink.h"
+#include "utils.h"
+#include "ip_common.h"
+#include "json_print.h"
+
+static void print_explain(FILE *f)
+{
+	fprintf(f,
+		"Usage: ... srl2 segs SEG1,SEG2,...,SEGn\n"
+		"\n"
+		"Where:	SEGi := IPv6 address (SRv6 SID)\n"
+	);
+}
+
+static void explain(void)
+{
+	print_explain(stderr);
+}
+
+/* Build an SRH from a comma-separated list of segments.
+ * The segment list is stored in reverse order in the SRH:
+ *   segments[0] = last SID (final destination)
+ *   segments[first_segment] = first SID (first hop)
+ *
+ * For a srl2 device, the SRH is used as an encap template.
+ * The first SID becomes the outer IPv6 DA after encapsulation.
+ *
+ * Returns a malloc'd SRH or NULL on error.  Caller must free.
+ */
+static struct ipv6_sr_hdr *srl2_parse_srh(char *segbuf)
+{
+	struct ipv6_sr_hdr *srh;
+	int nsegs = 0;
+	int srhlen;
+	char *s;
+	int i;
+
+	if (!segbuf || !*segbuf)
+		invarg("missing segment list", "segs");
+
+	s = segbuf;
+	for (i = 0; *s; *s++ == ',' ? i++ : *s);
+	nsegs = i + 1;
+
+	srhlen = 8 + 16 * nsegs;
+
+	srh = calloc(1, srhlen);
+	if (!srh)
+		return NULL;
+
+	srh->hdrlen = (srhlen >> 3) - 1;
+	srh->type = 4;
+	srh->segments_left = nsegs - 1;
+	srh->first_segment = nsegs - 1;
+
+	i = srh->first_segment;
+	for (s = strtok(segbuf, ","); s; s = strtok(NULL, ",")) {
+		inet_prefix addr;
+
+		get_addr(&addr, s, AF_INET6);
+		memcpy(&srh->segments[i], addr.data, sizeof(struct in6_addr));
+		i--;
+	}
+
+	return srh;
+}
+
+static int srl2_parse_opt(struct link_util *lu, int argc, char **argv,
+			    struct nlmsghdr *n)
+{
+	struct ipv6_sr_hdr *srh = NULL;
+	char segbuf[1024] = {};
+	int segs_ok = 0;
+
+	while (argc > 0) {
+		if (strcmp(*argv, "segs") == 0) {
+			NEXT_ARG();
+			if (segs_ok++)
+				duparg2("segs", *argv);
+			if (strlen(*argv) >= sizeof(segbuf))
+				invarg("segment list too long", "segs");
+			strlcpy(segbuf, *argv, sizeof(segbuf));
+		} else if (strcmp(*argv, "help") == 0) {
+			explain();
+			return -1;
+		} else {
+			fprintf(stderr, "srl2: unknown command \"%s\"?\n",
+				*argv);
+			explain();
+			return -1;
+		}
+		argc--, argv++;
+	}
+
+	if (!segs_ok) {
+		fprintf(stderr, "srl2: missing \"segs\" argument\n");
+		explain();
+		return -1;
+	}
+
+	srh = srl2_parse_srh(segbuf);
+	if (!srh) {
+		fprintf(stderr, "srl2: failed to parse segment list\n");
+		return -1;
+	}
+
+	addattr_l(n, 1024, IFLA_SRL2_SRH, srh,
+		  (srh->hdrlen + 1) << 3);
+
+	free(srh);
+	return 0;
+}
+
+static void srl2_print_opt(struct link_util *lu, FILE *f,
+			     struct rtattr *tb[])
+{
+	struct ipv6_sr_hdr *srh;
+	int i;
+
+	if (!tb)
+		return;
+
+	if (!tb[IFLA_SRL2_SRH])
+		return;
+
+	srh = RTA_DATA(tb[IFLA_SRL2_SRH]);
+
+	if (is_json_context())
+		open_json_array(PRINT_JSON, "segs");
+	else
+		print_string(PRINT_FP, NULL, "segs %s", "");
+
+	for (i = srh->first_segment; i >= 0; i--) {
+		if (!is_json_context() && i < srh->first_segment)
+			print_string(PRINT_FP, NULL, "%s", ",");
+
+		print_color_string(PRINT_ANY, COLOR_INET6, NULL, "%s",
+				   rt_addr_n2a(AF_INET6, 16,
+					       &srh->segments[i]));
+	}
+
+	if (is_json_context())
+		close_json_array(PRINT_JSON, NULL);
+	else
+		print_string(PRINT_FP, NULL, "%s", " ");
+}
+
+static void srl2_print_help(struct link_util *lu, int argc, char **argv,
+			      FILE *f)
+{
+	print_explain(f);
+}
+
+struct link_util srl2_link_util = {
+	.id		= "srl2",
+	.maxattr	= IFLA_SRL2_MAX,
+	.parse_opt	= srl2_parse_opt,
+	.print_opt	= srl2_print_opt,
+	.print_help	= srl2_print_help,
+};
-- 
2.20.1

[RFC PATCH iproute2-next 3/4] seg6: man: document End.DT2U behavior in ip-route man page

[Andrea Mayer]

Document the End.DT2U seg6local action in the ip-route(8) man page.
Add the End.DT2U syntax, describe the l2dev parameter, and provide
a usage example in the SRv6 examples section.

Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it>
---
 man/man8/ip-route.8.in | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/man/man8/ip-route.8.in b/man/man8/ip-route.8.in
index aafa6d98..bba7a4fd 100644
--- a/man/man8/ip-route.8.in
+++ b/man/man8/ip-route.8.in
@@ -993,6 +993,21 @@ only accepts packets with either a zero Segments Left value or no SRH
 at all, and an inner IPv4 or IPv6 packet. Other matching packets are
 dropped.
 
+.B End.DT2U l2dev
+.I DEVICE
+- Decapsulate the inner Ethernet frame and deliver it locally on the
+specified L2 device.
+.I DEVICE
+must be either a bridge port or a
+.B srl2
+device. When
+.I DEVICE
+is a bridge port, the Linux bridge performs MAC source address learning,
+destination MAC lookup, and L2 forwarding within the local bridge
+domain. This action only accepts packets with either a zero Segments
+Left value or no SRH at all, and an inner Ethernet frame (protocol 143).
+Other matching packets are dropped.
+
 .B End.B6 srh segs
 .IR SEGMENTS " [ "
 .B hmac
@@ -1450,6 +1465,12 @@ ip -6 route add 2001:db8:1::/64 encap seg6local action End.DT46 vrftable 100 dev
 Adds an IPv6 route with SRv6 decapsulation and forward with lookup in VRF table.
 .RE
 .PP
+ip -6 route add fc00::100/128 encap seg6local action End.DT2U l2dev srl2-0 dev eth0
+.RS 4
+Adds an IPv6 route with SRv6 L2 decapsulation and local delivery of the
+inner Ethernet frame on srl2-0.
+.RE
+.PP
 ip -6 route add 2001:db8:1::/64 encap seg6local action End flavors psp dev eth0
 .RS 4
 Adds an IPv6 route with SRv6 End behavior with psp flavor enabled.
-- 
2.20.1

[RFC PATCH iproute2-next 4/4] seg6: man: document srl2 link type in ip-link man page

[Andrea Mayer]

Document the srl2 link type in the ip-link(8) man page. Add srl2
to the list of supported link types and describe its segs parameter
and basic usage.

Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it>
---
 man/man8/ip-link.8.in | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/man/man8/ip-link.8.in b/man/man8/ip-link.8.in
index ef45fe08..7971a10c 100644
--- a/man/man8/ip-link.8.in
+++ b/man/man8/ip-link.8.in
@@ -253,6 +253,7 @@ ip-link \- network device configuration
 .BR pfcp " |"
 .BR rmnet " |"
 .BR sit " |"
+.BR srl2 " |"
 .BR vcan " | "
 .BR veth " | "
 .BR virt_wifi " |"
@@ -402,6 +403,9 @@ Link types:
 .BR sit
 - Virtual tunnel interface IPv6 over IPv4
 .sp
+.BR srl2
+- SRv6 L2 tunnel device
+.sp
 .B vcan
 - Virtual Controller Area Network interface
 .sp
@@ -1529,6 +1533,25 @@ When
 is "ipv4", this allows the tunnel to also handle IPv6. This option is disabled
 by default.
 
+.TP
+SRL2 Type Support
+For a link of type
+.I SRL2
+the following additional arguments are supported:
+
+.BI "ip link add " DEVICE
+.BI type " srl2 " segs " SEG1,SEG2,...,SEGn"
+
+.in +8
+.sp
+.BI segs " SEG1,SEG2,...,SEGn"
+- specifies the SRv6 segment list for encapsulation. The segments
+are IPv6 addresses separated by commas. Each L2 frame transmitted
+through the device is encapsulated in an IPv6 header with a Segment
+Routing Header (SRH) containing the specified segment list.
+
+.in -8
+
 .TP
 AMT Type Support
 For a link of type
-- 
2.20.1