[PATCH net-next 0/2] seg6: add FIB table attribute for post-encap SID route lookup

[Andrea Mayer <andrea.mayer@uniroma2.it>]

After SRv6 encapsulation the kernel looks up the route for the first SID,
the outer IPv6 destination of the encapsulated packet. This post-encap SID
route lookup uses the FIB table of the current routing context. When the
encap route is installed in a VRF, the VRF's table may not have a route for
the SID, which should be handled by another table, e.g. one used for
underlay connectivity.

A new optional SEG6_IPTUNNEL_TABLE attribute selects the FIB table used for
this lookup. When set by the user, the attribute is honored on both the
input path (traffic that is received, encapsulated and forwarded) and the
output path (traffic that is locally originated and then encapsulated).
SRv6 encap routes that do not set the attribute use the current routing
context, as before.

A companion iproute2 series follows on the mailing list. The examples below
show how to use the "lookup" attribute:

  # SID route installed in the underlay table 500
  ip -6 route add fc00::100/128 via fd00::1 dev veth0 table 500

  # encap route in vrf-100; the first SID is looked up in table 500
  ip -6 route add cafe::1/128 vrf vrf-100 \
      encap seg6 mode encap segs fc00::100 lookup 500 dev veth0

  # or if the SID is already handled by the main table
  ip -6 route add cafe::1/128 vrf vrf-100 \
      encap seg6 mode encap segs fc00::100 lookup main dev veth0

This work started from a use case raised by Nicolas Dichtel and took shape
in the discussion with him [1]. Thanks Nicolas.

The series is made of two patches. The first implements the attribute. The
second adds an L3 VPN selftest that exercises both the input and the output
path, with the attribute (traffic reaches its destination) and without it
(the packet is dropped).

Thanks,
Andrea

[1] https://lore.kernel.org/all/20260327140709.959636-1-nicolas.dichtel@6wind.com/T/

Andrea Mayer (2):
  seg6: add FIB table attribute for post-encap SID route lookup
  selftests: seg6: add test for post-encap SID route lookup

 include/uapi/linux/seg6_iptunnel.h            |    1 +
 net/ipv6/seg6_iptunnel.c                      |  132 ++-
 tools/testing/selftests/net/Makefile          |    1 +
 .../net/srv6_encap_lookup_l3vpn_test.sh       | 1027 +++++++++++++++++
 4 files changed, 1145 insertions(+), 16 deletions(-)
 create mode 100755 tools/testing/selftests/net/srv6_encap_lookup_l3vpn_test.sh

-- 
2.20.1