SRv6 - Linux Kernel Implementation
To enable SRv6 support, at least CONFIG_IPV6 must be enabled. The default built-in SRv6 code supports elementary processing of SR-enabled packets. For extended features such as SR encapsulation or other advanced processing, enable CONFIG_IPV6_SEG6_LWTUNNEL. The HMAC extension of SRv6 can be enabled through CONFIG_IPV6_SEG6_HMAC. To use iptables to filter packets on their SRv6 header, enable CONFIG_IP6_NF_MATCH_SRH (available since kernel v4.18). Finally, the BPF network functions can be enabled through CONFIG_IPV6_SEG6_BPF (available since kernel v4.18).
Today most of the recent distributions compile the kernel with CONFIG_IPV6_SEG6_LWTUNNEL and CONFIG_IPV6_SEG6_HMAC:
- Debian (since 10) - Fedora (since 24) - Raspbian (since 2018-04-18) - Ubuntu (since 18.04) - [...]
CONFIG_IPV6_SEG6_BPF is enabled in:
- Debian (since 10) - Fedora (since 27)
Fedora (since 27) is the only one enabling CONFIG_IP6_NF_MATCH_SRH as well.
srext - a Linux kernel module for the SRv6 Network Programming model In parallel, the Networking Group from University of Rome Tor Vergata, Italy, is developing a new kernel module providing more advanced Segment Routing functions. This module is intended to be eventually fully compliant with the SRv6 Network Programming model defined in draft-filsfils-spring-srv6-network-programming. The srext module is available on GitHub. SR behaviors support The following tables show the availability in Linux of each SRv6 behavior defined in draft-filsfils-spring-srv6-network-programming. New entries will be added to these tables as more SRv6 behaviors are defined in IETF documents. Endpoint functions Endpoint functions are triggered when the IPv6 Destination Address of an incoming packet matches an entry in the My Local SIDs table of an SRv6-enabled node. Name Description Release End Endpoint function 4.10 (February 2017), srext End.X Endpoint function with Layer-3 cross-connect 4.10 (February 2017), srext End.T Endpoint function with specific IPv6 table lookup 4.14 (November 2017) End.DX2 Endpoint with decapsulation and Layer-2 cross-connect 4.14 (November 2017), srext End.DX6 Endpoint with decapsulation and IPv6 cross-connect 4.14 (November 2017), srext End.DX4 Endpoint with decapsulation and IPv4 cross-connect 4.14 (November 2017), srext End.DT6 Endpoint with decapsulation and IPv6 table lookup 4.14 (November 2017) End.DT4 Endpoint with decapsulation and IPv4 table lookup In development End.B6 Endpoint bound to an SRv6 policy 4.14 (November 2017) End.B6.Encaps Endpoint bound to an SRv6 encapsulation Policy 4.14 (November 2017) End.BM Endpoint bound to an SR-MPLS Policy In development End.S Endpoint in search of a target in table T In development End.AD Endpoint to SR-unaware APP via dynamic proxy srext End.AM Endpoint to SR-unaware APP via masquerading srext Transit behaviors Transit behaviors are triggered when an in-transit packet matches a steering rule on an SRv6-enabled node. Examples of steering rules are packets arriving on a specific incoming interface or whose Destination Address belongs in a given prefix. Name Description Release T.Insert Transit behavior with insertion of an SRv6 Policy 4.10 (February 2017) T.Encaps Transit behavior with encapsulation in an SRv6 policy 4.10 (February 2017) T.Encaps.L2 T.Encaps behavior of the received L2 frame 4.14 (November 2017)
ubuntu19.10-aarch64 [root@localhost uloop3]# cat boot/config-5.3.0-18-generic | grep IPV6_SEG6 CONFIG_IPV6_SEG6_LWTUNNEL=y CONFIG_IPV6_SEG6_HMAC=y CONFIG_IPV6_SEG6_BPF=y [root@localhost uloop3]# cat boot/config-5.3.0-18-generic | grep MATCH_SRH CONFIG_IP6_NF_MATCH_SRH=m
root@ubuntu:~# ip -6 route add 2001::2 encap seg6 mode inline segs abcd::1234 dev enp1s0
root@ubuntu:~# uname -a
Linux ubuntu 5.3.0-18-generic #19-Ubuntu SMP Tue Oct 8 20:14:34 UTC 2019 aarch64 aarch64 aarch64 GNU/Linux
root@ubuntu:~#
root@ubuntu:~# ip -6 route del 2001::2 encap seg6 mode inline segs abcd::1234 dev enp1s0
root@ubuntu:~#
root@ubuntu:~# ip -6 r show
::1 dev lo proto kernel metric 256 pref medium
fe80::/64 dev enp1s0 proto kernel metric 256 pref medium
root@ubuntu:~# ip -6 route add 2001::2 encap seg6 mode inline segs abcd::1234 dev enp1s0
root@ubuntu:~# ip -6 r show
::1 dev lo proto kernel metric 256 pref medium
2001::2 encap seg6 mode inline segs 2 [ abcd::1234 :: ] dev enp1s0 metric 1024 pref medium
fe80::/64 dev enp1s0 proto kernel metric 256 pref medium
root@ubuntu:~# ip -6 route del 2001::2 encap seg6 mode inline segs abcd::1234 dev enp1s0
root@ubuntu:~# ip -6 r show
::1 dev lo proto kernel metric 256 pref medium
fe80::/64 dev enp1s0 proto kernel metric 256 pref medium
root@ubuntu:~#
root@ubuntu:~# ip sr help
Usage: ip sr { COMMAND | help }
ip sr hmac show
ip sr hmac set KEYID ALGO
ip sr tunsrc show
ip sr tunsrc set ADDRESS
where ALGO := { sha1 | sha256 }
root@ubuntu:~# ip sr hmac show
root@ubuntu:~# ip sr tunsrc show
tunsrc addr 2001::1
root@ubuntu:~# ip -6 r show
::1 dev lo proto kernel metric 256 pref medium
2001::2 encap seg6 mode inline segs 2 [ abcd::1234 :: ] dev enp1s0 metric 1024 pref medium
2001::/64 dev enp1s0 proto kernel metric 256 pref medium
abcd::1234 via 2001::2 dev enp1s0 metric 1024 pref medium
fe80::/64 dev enp1s0 proto kernel metric 256 pref medium
centos8
[root@localhost ~]# uname -a Linux localhost.localdomain 4.18.0-147.3.1.el8_1.x86_64 #1 SMP Fri Jan 3 23:55:26 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux [root@localhost ~]# [root@localhost ~]# cat /boot/config-`uname -r` | grep grep IPV6_SEG6 grep: IPV6_SEG6: No such file or directory [root@localhost ~]# cat /boot/config-`uname -r` | grep IPV6_SEG6 # CONFIG_IPV6_SEG6_LWTUNNEL is not set # CONFIG_IPV6_SEG6_HMAC is not set [root@localhost ~]# cat /boot/config-`uname -r` | grep MATCH_SRH # CONFIG_IP6_NF_MATCH_SRH is not set
查看分配的 IPv6地址：ip -6 addr show ； 查看 IPv6 的路由表：ip -6 route，
ip -6 addr show dev
ip -6 n
ip -6 route list
ipv6 global & link-local 是共存的
ip -6 route show
ip -6 a ip -6 r ip -6 neigh ip n flush dev XXXX perf trace --no-syscalls --event 'net:*' ping6 xxxxxxxxxxx --------trace
添加IPV6地址 ip -6 addr add <ipv6address>/<prefixlength> dev <interface> ip -6 addr add 2001:0db8:0:f101::1/64 dev eth0 ifconfig <interface> inet6 add <ipv6address>/<prefixlength> ifconfig eth0 inet6 add 2001:0db8:0:f101::1/64 添加默认路由 ip -6 route add <ipv6network>/<prefixlength> via <ipv6address> ip -6 route add default via 2001:0db8:0:f101::1 route -A inet6 add <ipv6network>/<prefixlength> gw route -A inet6 add default gw 2001:0db8:0:f101::1 查看路由 ip -6 route show route -A 'inet6' route -6
ip6tables --list
sysctl -w net.ipv6.conf.all.disable_ipv6=0 sysctl -w net.ipv4.ip_forward=1 sysctl -w net.ipv6.conf.all.forwarding=1 sysctl -w net.ipv6.conf.all.seg6_enabled=1 sysctl -w net.ipv6.conf.default.seg6_enabled=1
net.ipv6.conf.all.forwarding = 1
root@ubuntu:~# sysctl -a | grep net.ipv6.conf | grep disable net.ipv6.conf.all.disable_ipv6 = 0 net.ipv6.conf.all.disable_policy = 0 net.ipv6.conf.default.disable_ipv6 = 0 net.ipv6.conf.default.disable_policy = 0 net.ipv6.conf.enp1s0.disable_ipv6 = 0 net.ipv6.conf.enp1s0.disable_policy = 0 net.ipv6.conf.lo.disable_ipv6 = 0 net.ipv6.conf.lo.disable_policy = 0
root@ubuntu:~# sysctl -a | grep net.ipv6.conf.default.accept_ra net.ipv6.conf.default.accept_ra = 1 net.ipv6.conf.default.accept_ra_defrtr = 1 net.ipv6.conf.default.accept_ra_from_local = 0 net.ipv6.conf.default.accept_ra_min_hop_limit = 1 net.ipv6.conf.default.accept_ra_mtu = 1 net.ipv6.conf.default.accept_ra_pinfo = 1 net.ipv6.conf.default.accept_ra_rt_info_max_plen = 0 net.ipv6.conf.default.accept_ra_rt_info_min_plen = 0 net.ipv6.conf.default.accept_ra_rtr_pref = 1
root@ubuntu:~# ping6 2001::2 PING 2001::2(2001::2) 56 data bytes ^C --- 2001::2 ping statistics --- 341 packets transmitted, 0 received, 100% packet loss, time 374403ms root@ubuntu:~# ping6 2001::2%enp1s0 ping6: 2001::2%enp1s0: Name or service not known root@ubuntu:~# ping6 2001::2%2 PING 2001::2%2(2001::2%2) 56 data bytes
We setup a IPv6 network with two ubuntu systems and we make one PC as HOST and other as ROUTER(based on the concept of SLAAC). The host sent the "Router solicitation" message, but the router not respond with any "Router advertisement".
The corresponding configuration we done for router is
sudo sysctl -w net.ipv6.conf.enp1s0.autoconf=1
sudo sysctl -w net.ipv6.conf.enp1s0.accept_ra=2
sudo sysctl -w net.ipv6.conf.enp1s0.forwarding=1
