SERA: IPv6 Segment Routing Aware Firewall
Clone or download
amsalam20 Add support for IPv6 segment routing 'SEG6' target
Service Function Chaining (SFC) is one of the main use-cases of IPv6
Segment Routing (SRv6)[1].

The Segment Routing Header (SRH) allows including a list of segments
in the IPv6 packet. This segment list can be used to steer the packet
though a set of Virtual Network Functions (VNFS) e.g., Firewall, DPI, IDS

The edge node (SR ingress node) classifies the traffic and consequently
includes the segment lists in the IPv6 packet.

The IPv6 segment routing 'SEG6' target supports a set of SR-specific
actions. This set of actions allows branching within a pre-defined
SRv6 SFC policy instead of the usual linear exploration of the VNF chain.

As an example, consider a service chain which includes a firewall
followed by an Intrusion Detection System. The firewall may decide
to skip the IDS for a subset of traffic that matches some conditions.

This patch implements the following SR-specific actions:
(1) go-next: is the default action of the SEG6 target. It sends packets
towards the next SID from SRH.
(2) skip-next: skips the next SID in the SRH.
(3) go-last: skips the remaining part of the segment list and send the
packet towards the last segment.

[1] https://tools.ietf.org/html/draft-clad-spring-segment-routing-service-chaining-00

Signed-off-by: Ahmed Abdelsalam <amsalam20@gmail.com>
Latest commit 4dfb638 Apr 30, 2018
Permalink
Failed to load latest commit information.
Documentation
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile
README

README

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.