From 0ee2f8285c81878687a9f92e6a3b0f10c4d75584 Mon Sep 17 00:00:00 2001
From: Christian Breunig <christian@breunig.cc>
Date: Wed, 20 Dec 2023 22:38:52 +0100
Subject: srv6: T591: enable SR enabled packet processing on defined interfaces

The Linux Kernel needs to be told if IPv6 SR enabled packets whether should be
processed or not. This is done using

/proc/sys/net/conf/<iface>/seg6_* variables:

seg6_enabled - BOOL
  Accept or drop SR-enabled IPv6 packets on this interface.
  Relevant packets are those with SRH present and DA = local.
  0 - disabled (default)
  not 0 - enabled

Or the VyOS CLI command:
* set protocols segment-routing interface eth0 srv6

(cherry picked from commit 774cc97eda61eb0b91df820797fb3c705d0073d5)
---
 .../protocols-segment-routing.xml.in               | 48 ++++++++++++++++++++++
 1 file changed, 48 insertions(+)

(limited to 'interface-definitions/protocols-segment-routing.xml.in')

diff --git a/interface-definitions/protocols-segment-routing.xml.in b/interface-definitions/protocols-segment-routing.xml.in
index d461e9c5d..4308f0c91 100644
--- a/interface-definitions/protocols-segment-routing.xml.in
+++ b/interface-definitions/protocols-segment-routing.xml.in
@@ -8,6 +8,54 @@
           <priority>900</priority>
         </properties>
         <children>
+          <tagNode name="interface">
+            <properties>
+              <help>Interface specific Segment Routing options</help>
+              <completionHelp>
+                <script>${vyos_completion_dir}/list_interfaces</script>
+              </completionHelp>
+              <valueHelp>
+                <format>txt</format>
+                <description>Interface name</description>
+              </valueHelp>
+              <constraint>
+                #include <include/constraint/interface-name.xml.i>
+              </constraint>
+            </properties>
+            <children>
+              <node name="srv6">
+                <properties>
+                  <help>Accept SR-enabled IPv6 packets on this interface</help>
+                </properties>
+                <children>
+                  <leafNode name="hmac">
+                    <properties>
+                      <help>Define HMAC policy for ingress SR-enabled packets on this interface</help>
+                      <completionHelp>
+                        <list>accept drop ignore</list>
+                      </completionHelp>
+                      <valueHelp>
+                        <format>accept</format>
+                        <description>Accept packets without HMAC, validate packets with HMAC</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>drop</format>
+                        <description>Drop packets without HMAC, validate packets with HMAC</description>
+                      </valueHelp>
+                      <valueHelp>
+                        <format>ignore</format>
+                        <description>Ignore HMAC field.</description>
+                      </valueHelp>
+                      <constraint>
+                        <regex>(accept|drop|ignore)</regex>
+                      </constraint>
+                    </properties>
+                    <defaultValue>accept</defaultValue>
+                  </leafNode>
+                </children>
+              </node>
+            </children>
+          </tagNode>
           <node name="srv6">
             <properties>
               <help>Segment-Routing SRv6 configuration</help>
-- 
cgit v1.2.3