[PATCH iproute2-next 0/3] Add flow label support to ip-rule and route get

[PATCH iproute2-next 0/3] Add flow label support to ip-rule and route get

[Ido Schimmel]

Add IPv6 flow label support to ip-rule and route get requests following
kernel support that was added in kernel commit 6b3099ebca13 ("Merge
branch 'net-fib_rules-add-flow-label-selector-support'").

Ido Schimmel (3):
  Sync uAPI headers
  ip: route: Add IPv6 flow label support
  iprule: Add flow label support

 include/uapi/linux/fib_rules.h |  2 ++
 include/uapi/linux/rtnetlink.h |  1 +
 ip/iproute.c                   | 10 +++++-
 ip/iprule.c                    | 66 +++++++++++++++++++++++++++++++++-
 man/man8/ip-route.8.in         |  8 ++++-
 man/man8/ip-rule.8.in          |  8 ++++-
 6 files changed, 91 insertions(+), 4 deletions(-)

-- 
2.47.1

[PATCH iproute2-next 1/3] Sync uAPI headers

[Ido Schimmel]

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 include/uapi/linux/fib_rules.h | 2 ++
 include/uapi/linux/rtnetlink.h | 1 +
 2 files changed, 3 insertions(+)

diff --git a/include/uapi/linux/fib_rules.h b/include/uapi/linux/fib_rules.h
index a6924dd3aff1..00e9890ca3c0 100644
--- a/include/uapi/linux/fib_rules.h
+++ b/include/uapi/linux/fib_rules.h
@@ -68,6 +68,8 @@ enum {
 	FRA_SPORT_RANGE, /* sport */
 	FRA_DPORT_RANGE, /* dport */
 	FRA_DSCP,	/* dscp */
+	FRA_FLOWLABEL,	/* flowlabel */
+	FRA_FLOWLABEL_MASK,	/* flowlabel mask */
 	__FRA_MAX
 };
 
diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
index 458e5670ce67..478c9d836a7b 100644
--- a/include/uapi/linux/rtnetlink.h
+++ b/include/uapi/linux/rtnetlink.h
@@ -393,6 +393,7 @@ enum rtattr_type_t {
 	RTA_SPORT,
 	RTA_DPORT,
 	RTA_NH_ID,
+	RTA_FLOWLABEL,
 	__RTA_MAX
 };
 
-- 
2.47.1

[PATCH iproute2-next 2/3] ip: route: Add IPv6 flow label support

[Ido Schimmel]

Allow specifying an IPv6 flow label when performing a route lookup.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 ip/iproute.c           | 10 +++++++++-
 man/man8/ip-route.8.in |  8 +++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/ip/iproute.c b/ip/iproute.c
index 9520729e58eb..e87faecdb714 100644
--- a/ip/iproute.c
+++ b/ip/iproute.c
@@ -67,7 +67,7 @@ static void usage(void)
 		"                            [ mark NUMBER ] [ vrf NAME ]\n"
 		"                            [ uid NUMBER ] [ ipproto PROTOCOL ]\n"
 		"                            [ sport NUMBER ] [ dport NUMBER ]\n"
-		"                            [ as ADDRESS ]\n"
+		"                            [ as ADDRESS ] [ flowlabel FLOWLABEL ]\n"
 		"       ip route { add | del | change | append | replace } ROUTE\n"
 		"SELECTOR := [ root PREFIX ] [ match PREFIX ] [ exact PREFIX ]\n"
 		"            [ table TABLE_ID ] [ vrf NAME ] [ proto RTPROTO ]\n"
@@ -2129,6 +2129,14 @@ static int iproute_get(int argc, char **argv)
 				invarg("Invalid \"ipproto\" value\n",
 				       *argv);
 			addattr8(&req.n, sizeof(req), RTA_IP_PROTO, ipproto);
+		} else if (strcmp(*argv, "flowlabel") == 0) {
+			__be32 flowlabel;
+
+			NEXT_ARG();
+			if (get_be32(&flowlabel, *argv, 0))
+				invarg("invalid flowlabel\n", *argv);
+			addattr32(&req.n, sizeof(req), RTA_FLOWLABEL,
+				  flowlabel);
 		} else {
 			inet_prefix addr;
 
diff --git a/man/man8/ip-route.8.in b/man/man8/ip-route.8.in
index 676f289a6d26..69d445ef8b5c 100644
--- a/man/man8/ip-route.8.in
+++ b/man/man8/ip-route.8.in
@@ -47,7 +47,9 @@ ip-route \- routing table management
 .B  dport
 .IR NUMBER " ] ["
 .B  as
-.IR ADDRESS " ]"
+.IR ADDRESS " ] ["
+.B  flowlabel
+.IR FLOWLABEL " ]
 
 .ti -8
 .BR "ip route" " { " add " | " del " | " change " | " append " | "\
@@ -1316,6 +1318,10 @@ was given, relookup the route with the source set to the preferred
 address received from the first lookup.
 If policy routing is used, it may be a different route.
 
+.TP
+.BI flowlabel " FLOWLABEL"
+ipv6 flow label as seen by the route lookup
+
 .P
 Note that this operation is not equivalent to
 .BR "ip route show" .
-- 
2.47.1

[PATCH iproute2-next 3/3] iprule: Add flow label support

[Ido Schimmel]

Add support for 'flowlabel' selector in ip-rule.

Rules can be added with or without a mask in which case exact match is
used:

 # ip -6 rule add flowlabel 0x12345 table 100
 # ip -6 rule add flowlabel 0x11/0xff table 200
 # ip -6 rule add flowlabel 0x54321 table 300
 # ip -6 rule del flowlabel 0x54321 table 300

Dump output:

 $ ip -6 rule show
 0:      from all lookup local
 32764:  from all lookup 200 flowlabel 0x11/0xff
 32765:  from all lookup 100 flowlabel 0x12345
 32766:  from all lookup main

Dump can be filtered by flow label value and mask:

 $ ip -6 rule show flowlabel 0x12345
 32765:  from all lookup 100 flowlabel 0x12345
 $ ip -6 rule show flowlabel 0x11/0xff
 32764:  from all lookup 200 flowlabel 0x11/0xff

JSON output:

 $ ip -6 -j -p rule show flowlabel 0x12345
 [ {
         "priority": 32765,
         "src": "all",
         "table": "100",
         "flowlabel": "0x12345",
         "flowlabel_mask": "0xfffff"
     } ]
 $ ip -6 -j -p rule show flowlabel 0x11/0xff
 [ {
         "priority": 32764,
         "src": "all",
         "table": "200",
         "flowlabel": "0x11",
         "flowlabel_mask": "0xff"
     } ]

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
---
 ip/iprule.c           | 66 ++++++++++++++++++++++++++++++++++++++++++-
 man/man8/ip-rule.8.in |  8 +++++-
 2 files changed, 72 insertions(+), 2 deletions(-)

diff --git a/ip/iprule.c b/ip/iprule.c
index ae067c72a66d..f239f91573a7 100644
--- a/ip/iprule.c
+++ b/ip/iprule.c
@@ -46,7 +46,7 @@ static void usage(void)
 		"            [ ipproto PROTOCOL ]\n"
 		"            [ sport [ NUMBER | NUMBER-NUMBER ]\n"
 		"            [ dport [ NUMBER | NUMBER-NUMBER ] ]\n"
-		"            [ dscp DSCP ]\n"
+		"            [ dscp DSCP ] [ flowlabel FLOWLABEL[/MASK] ]\n"
 		"ACTION := [ table TABLE_ID ]\n"
 		"          [ protocol PROTO ]\n"
 		"          [ nat ADDRESS ]\n"
@@ -69,6 +69,7 @@ static struct
 	unsigned int pref, prefmask;
 	unsigned int fwmark, fwmask;
 	unsigned int dscp, dscpmask;
+	__u32 flowlabel, flowlabel_mask;
 	uint64_t tun_id;
 	char iif[IFNAMSIZ];
 	char oif[IFNAMSIZ];
@@ -232,6 +233,19 @@ static bool filter_nlmsg(struct nlmsghdr *n, struct rtattr **tb, int host_len)
 		}
 	}
 
+	if (filter.flowlabel_mask) {
+		__u32 flowlabel, flowlabel_mask;
+
+		if (!tb[FRA_FLOWLABEL] || !tb[FRA_FLOWLABEL_MASK])
+			return false;
+		flowlabel = rta_getattr_be32(tb[FRA_FLOWLABEL]);
+		flowlabel_mask = rta_getattr_be32(tb[FRA_FLOWLABEL_MASK]);
+
+		if (filter.flowlabel != flowlabel ||
+		    filter.flowlabel_mask != flowlabel_mask)
+			return false;
+	}
+
 	table = frh_get_table(frh, tb);
 	if (filter.tb > 0 && filter.tb ^ table)
 		return false;
@@ -489,6 +503,23 @@ int print_rule(struct nlmsghdr *n, void *arg)
 			     rtnl_dscp_n2a(dscp, b1, sizeof(b1)));
 	}
 
+	/* The kernel will either provide both attributes, or none */
+	if (tb[FRA_FLOWLABEL] && tb[FRA_FLOWLABEL_MASK]) {
+		__u32 flowlabel, flowlabel_mask;
+
+		flowlabel = rta_getattr_be32(tb[FRA_FLOWLABEL]);
+		flowlabel_mask = rta_getattr_be32(tb[FRA_FLOWLABEL_MASK]);
+
+		print_0xhex(PRINT_ANY, "flowlabel", " flowlabel %#llx",
+			    flowlabel);
+		if (flowlabel_mask == LABEL_MAX_MASK)
+			print_0xhex(PRINT_JSON, "flowlabel_mask", NULL,
+				    flowlabel_mask);
+		else
+			print_0xhex(PRINT_ANY, "flowlabel_mask", "/%#llx",
+				    flowlabel_mask);
+	}
+
 	print_string(PRINT_FP, NULL, "\n", "");
 	close_json_object();
 	fflush(fp);
@@ -569,6 +600,24 @@ static int flush_rule(struct nlmsghdr *n, void *arg)
 	return 0;
 }
 
+static void iprule_flowlabel_parse(char *arg, __u32 *flowlabel,
+				   __u32 *flowlabel_mask)
+{
+	char *slash;
+
+	slash = strchr(arg, '/');
+	if (slash != NULL)
+		*slash = '\0';
+	if (get_u32(flowlabel, arg, 0))
+		invarg("invalid flowlabel\n", arg);
+	if (slash) {
+		if (get_u32(flowlabel_mask, slash + 1, 0))
+			invarg("invalid flowlabel mask\n", slash + 1);
+	} else {
+		*flowlabel_mask = LABEL_MAX_MASK;
+	}
+}
+
 static int iprule_list_flush_or_save(int argc, char **argv, int action)
 {
 	rtnl_filter_t filter_fn;
@@ -726,6 +775,11 @@ static int iprule_list_flush_or_save(int argc, char **argv, int action)
 				invarg("invalid dscp\n", *argv);
 			filter.dscp = dscp;
 			filter.dscpmask = 1;
+		} else if (strcmp(*argv, "flowlabel") == 0) {
+			NEXT_ARG();
+
+			iprule_flowlabel_parse(*argv, &filter.flowlabel,
+					       &filter.flowlabel_mask);
 		} else {
 			if (matches(*argv, "dst") == 0 ||
 			    matches(*argv, "to") == 0) {
@@ -1011,6 +1065,16 @@ static int iprule_modify(int cmd, int argc, char **argv)
 			if (rtnl_dscp_a2n(&dscp, *argv))
 				invarg("invalid dscp\n", *argv);
 			addattr8(&req.n, sizeof(req), FRA_DSCP, dscp);
+		} else if (strcmp(*argv, "flowlabel") == 0) {
+			__u32 flowlabel, flowlabel_mask;
+
+			NEXT_ARG();
+			iprule_flowlabel_parse(*argv, &flowlabel,
+					       &flowlabel_mask);
+			addattr32(&req.n, sizeof(req), FRA_FLOWLABEL,
+				  htonl(flowlabel));
+			addattr32(&req.n, sizeof(req), FRA_FLOWLABEL_MASK,
+				  htonl(flowlabel_mask));
 		} else {
 			int type;
 
diff --git a/man/man8/ip-rule.8.in b/man/man8/ip-rule.8.in
index 51f3050ae8f8..6fc741d4f470 100644
--- a/man/man8/ip-rule.8.in
+++ b/man/man8/ip-rule.8.in
@@ -58,7 +58,9 @@ ip-rule \- routing policy database management
 .IR NUMBER " | "
 .IR NUMBER "-" NUMBER " ] ] [ "
 .B  tun_id
-.IR TUN_ID " ]"
+.IR TUN_ID " ] [ "
+.B  flowlabel
+.IR FLOWLABEL\fR[\fB/\fIMASK "] ]"
 .BR
 
 
@@ -322,6 +324,10 @@ In the last case the router does not translate the packets, but
 masquerades them to this address.
 Using map-to instead of nat means the same thing.
 
+.TP
+.BI flowlabel " FLOWLABEL\fR[\fB/\fIMASK\fR]"
+select the IPv6 flow label to match with an optional mask.
+
 .B Warning:
 Changes to the RPDB made with these commands do not become active
 immediately. It is assumed that after a script finishes a batch of
-- 
2.47.1

Re: [PATCH iproute2-next 0/3] Add flow label support to ip-rule and route get

[Guillaume Nault]

On Mon, Dec 23, 2024 at 10:26:39AM +0200, Ido Schimmel wrote:
> Add IPv6 flow label support to ip-rule and route get requests following
> kernel support that was added in kernel commit 6b3099ebca13 ("Merge
> branch 'net-fib_rules-add-flow-label-selector-support'").

For the serie,
Reviewed-by: Guillaume Nault <gnault@redhat.com>

Re: [PATCH iproute2-next 3/3] iprule: Add flow label support

[Stephen Hemminger]

On Mon, 23 Dec 2024 10:26:42 +0200
Ido Schimmel <idosch@nvidia.com> wrote:

>  
> +static void iprule_flowlabel_parse(char *arg, __u32 *flowlabel,
> +				   __u32 *flowlabel_mask)
> +{
> +	char *slash;
> +
> +	slash = strchr(arg, '/');
> +	if (slash != NULL)
> +		*slash = '\0';
> +	if (get_u32(flowlabel, arg, 0))
> +		invarg("invalid flowlabel\n", arg);

The function invarg already adds a new line at the end