| Message ID | 20201103125242.11468-1-andrea.mayer@uniroma2.it |
|---|---|
| Headers | show |
| Series | seg6: add support for SRv6 End.DT4 behavior | expand |
On 11/3/20 5:52 AM, Andrea Mayer wrote: > this selftest is designed for evaluating the new SRv6 End.DT4 behavior > used, in this example, for implementing IPv4 L3 VPN use cases. > > Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it> > --- > .../selftests/net/srv6_end_dt4_l3vpn_test.sh | 494 ++++++++++++++++++ > 1 file changed, 494 insertions(+) > create mode 100755 tools/testing/selftests/net/srv6_end_dt4_l3vpn_test.sh > > diff --git a/tools/testing/selftests/net/srv6_end_dt4_l3vpn_test.sh b/tools/testing/selftests/net/srv6_end_dt4_l3vpn_test.sh > new file mode 100755 > index 000000000000..a5547fed5048 > --- /dev/null > +++ b/tools/testing/selftests/net/srv6_end_dt4_l3vpn_test.sh > @@ -0,0 +1,494 @@ > +#!/bin/bash > +# SPDX-License-Identifier: GPL-2.0 > +# > +# author: Andrea Mayer <andrea.mayer@uniroma2.it> > + > +# This test is designed for evaluating the new SRv6 End.DT4 behavior used for > +# implementing IPv4 L3 VPN use cases. > +# > +# Hereafter a network diagram is shown, where two different tenants (named 100 > +# and 200) offer IPv4 L3 VPN services allowing hosts to communicate with each > +# other across an IPv6 network. > +# > +# Only hosts belonging to the same tenant (and to the same VPN) can communicate > +# with each other. Instead, the communication among hosts of different tenants > +# is forbidden. > +# In other words, hosts hs-t100-1 and hs-t100-2 are connected through the IPv4 > +# L3 VPN of tenant 100 while hs-t200-3 and hs-t200-4 are connected using the > +# IPv4 L3 VPN of tenant 200. Cross connection between tenant 100 and tenant 200 > +# is forbidden and thus, for example, hs-t100-1 cannot reach hs-t200-3 and vice > +# versa. > +# > +# Routers rt-1 and rt-2 implement IPv4 L3 VPN services leveraging the SRv6 > +# architecture. The key components for such VPNs are: a) SRv6 Encap behavior, > +# b) SRv6 End.DT4 behavior and c) VRF. > +# > +# To explain how an IPv4 L3 VPN based on SRv6 works, let us briefly consider an > +# example where, within the same domain of tenant 100, the host hs-t100-1 pings > +# the host hs-t100-2. > +# > +# First of all, L2 reachability of the host hs-t100-2 is taken into account by > +# the router rt-1 which acts as an arp proxy. > +# > +# When the host hs-t100-1 sends an IPv4 packet destined to hs-t100-2, the > +# router rt-1 receives the packet on the internal veth-t100 interface. Such > +# interface is enslaved to the VRF vrf-100 whose associated table contains the > +# SRv6 Encap route for encapsulating any IPv4 packet in a IPv6 plus the Segment > +# Routing Header (SRH) packet. This packet is sent through the (IPv6) core > +# network up to the router rt-2 that receives it on veth0 interface. > +# > +# The rt-2 router uses the 'localsid' routing table to process incoming > +# IPv6+SRH packets which belong to the VPN of the tenant 100. For each of these > +# packets, the SRv6 End.DT4 behavior removes the outer IPv6+SRH headers and > +# performs the lookup on the vrf-100 table using the destination address of > +# the decapsulated IPv4 packet. Afterwards, the packet is sent to the host > +# hs-t100-2 through the veth-t100 interface. > +# > +# The ping response follows the same processing but this time the role of rt-1 > +# and rt-2 are swapped. > +# > +# Of course, the IPv4 L3 VPN for tenant 200 works exactly as the IPv4 L3 VPN > +# for tenant 100. In this case, only hosts hs-t200-3 and hs-t200-4 are able to > +# connect with each other. > +# > +# > +# +-------------------+ +-------------------+ > +# | | | | > +# | hs-t100-1 netns | | hs-t100-2 netns | > +# | | | | > +# | +-------------+ | | +-------------+ | > +# | | veth0 | | | | veth0 | | > +# | | 10.0.0.1/24 | | | | 10.0.0.2/24 | | > +# | +-------------+ | | +-------------+ | > +# | . | | . | > +# +-------------------+ +-------------------+ > +# . . > +# . . > +# . . > +# +-----------------------------------+ +-----------------------------------+ > +# | . | | . | > +# | +---------------+ | | +---------------- | > +# | | veth-t100 | | | | veth-t100 | | > +# | | 10.0.0.254/24 | +----------+ | | +----------+ | 10.0.0.254/24 | | > +# | +-------+-------+ | localsid | | | | localsid | +-------+-------- | > +# | | | table | | | | table | | | > +# | +----+----+ +----------+ | | +----------+ +----+----+ | > +# | | vrf-100 | | | | vrf-100 | | > +# | +---------+ +------------+ | | +------------+ +---------+ | > +# | | veth0 | | | | veth0 | | > +# | | fd00::1/64 |.|...|.| fd00::2/64 | | > +# | +---------+ +------------+ | | +------------+ +---------+ | > +# | | vrf-200 | | | | vrf-200 | | > +# | +----+----+ | | +----+----+ | > +# | | | | | | > +# | +---------------+ | | +---------------- | > +# | | veth-t200 | | | | veth-t200 | | > +# | | 10.0.0.254/24 | | | | 10.0.0.254/24 | | > +# | +---------------+ rt-1 netns | | rt-2 netns +---------------- | > +# | . | | . | > +# +-----------------------------------+ +-----------------------------------+ > +# . . > +# . . > +# . . > +# . . > +# +-------------------+ +-------------------+ > +# | . | | . | > +# | +-------------+ | | +-------------+ | > +# | | veth0 | | | | veth0 | | > +# | | 10.0.0.3/24 | | | | 10.0.0.4/24 | | > +# | +-------------+ | | +-------------+ | > +# | | | | > +# | hs-t200-3 netns | | hs-t200-4 netns | > +# | | | | > +# +-------------------+ +-------------------+ > +# > +# > +# ~~~~~~~~~~~~~~~~~~~~~~~~~ > +# | Network configuration | > +# ~~~~~~~~~~~~~~~~~~~~~~~~~ > +# > +# rt-1: localsid table (table 90) > +# +----------------------------------------------+ > +# |SID |Action | > +# +----------------------------------------------+ > +# |fc00:21:100::6004|apply SRv6 End.DT4 table 100| > +# +----------------------------------------------+ > +# |fc00:21:200::6004|apply SRv6 End.DT4 table 200| > +# +----------------------------------------------+ > +# > +# rt-1: VRF tenant 100 (table 100) > +# +---------------------------------------------------+ > +# |host |Action | > +# +---------------------------------------------------+ > +# |10.0.0.2 |apply seg6 encap segs fc00:12:100::6004| > +# +---------------------------------------------------+ > +# |10.0.0.0/24|forward to dev veth_t100 | > +# +---------------------------------------------------+ > +# > +# rt-1: VRF tenant 200 (table 200) > +# +---------------------------------------------------+ > +# |host |Action | > +# +---------------------------------------------------+ > +# |10.0.0.4 |apply seg6 encap segs fc00:12:200::6004| > +# +---------------------------------------------------+ > +# |10.0.0.0/24|forward to dev veth_t200 | > +# +---------------------------------------------------+ > +# > +# > +# rt-2: localsid table (table 90) > +# +----------------------------------------------+ > +# |SID |Action | > +# +----------------------------------------------+ > +# |fc00:12:100::6004|apply SRv6 End.DT4 table 100| > +# +----------------------------------------------+ > +# |fc00:12:200::6004|apply SRv6 End.DT4 table 200| > +# +----------------------------------------------+ > +# > +# rt-2: VRF tenant 100 (table 100) > +# +---------------------------------------------------+ > +# |host |Action | > +# +---------------------------------------------------+ > +# |10.0.0.1 |apply seg6 encap segs fc00:21:100::6004| > +# +---------------------------------------------------+ > +# |10.0.0.0/24|forward to dev veth_t100 | > +# +---------------------------------------------------+ > +# > +# rt-2: VRF tenant 200 (table 200) > +# +---------------------------------------------------+ > +# |host |Action | > +# +---------------------------------------------------+ > +# |10.0.0.3 |apply seg6 encap segs fc00:21:200::6004| > +# +---------------------------------------------------+ > +# |10.0.0.0/24|forward to dev veth_t200 | > +# +---------------------------------------------------+ > +# > + > thanks for creating the very well documented test case. Reviewed-by: David Ahern <dsahern@kernel.org>
This patchset provides support for the SRv6 End.DT4 behavior. The SRv6 End.DT4 is used to implement multi-tenant IPv4 L3 VPN. It decapsulates the received packets and performs IPv4 routing lookup in the routing table of the tenant. The SRv6 End.DT4 Linux implementation leverages a VRF device. The SRv6 End.DT4 is defined in the SRv6 Network Programming [1]. - Patch 1/5 is needed to solve a pre-existing issue with tunneled packets when a sniffer is attached; - Patch 2/5 improves the management of the seg6local attributes used by the SRv6 behaviors; - Patch 3/5 introduces two callbacks used for customizing the creation/destruction of a SRv6 behavior; - Patch 4/5 is the core patch that adds support for the SRv6 End.DT4 behavior; - Patch 5/5 adds the selftest for SRv6 End.DT4 behavior. I would like to thank David Ahern for his support during the development of this patch set. Comments, suggestions and improvements are very welcome! Thanks, Andrea Mayer v1 improve comments; add new patch 2/5 titled: seg6: improve management of behavior attributes seg6: add support for the SRv6 End.DT4 behavior - remove the inline keyword in the definition of fib6_config_get_net(). selftests: add selftest for the SRv6 End.DT4 behavior - add check for the vrf sysctl [1] https://tools.ietf.org/html/draft-ietf-spring-srv6-network-programming Andrea Mayer (5): vrf: add mac header for tunneled packets when sniffer is attached seg6: improve management of behavior attributes seg6: add callbacks for customizing the creation/destruction of a behavior seg6: add support for the SRv6 End.DT4 behavior selftests: add selftest for the SRv6 End.DT4 behavior drivers/net/vrf.c | 78 ++- net/ipv6/seg6_local.c | 370 ++++++++++++- .../selftests/net/srv6_end_dt4_l3vpn_test.sh | 494 ++++++++++++++++++ 3 files changed, 927 insertions(+), 15 deletions(-) create mode 100755 tools/testing/selftests/net/srv6_end_dt4_l3vpn_test.sh