Set SRv6 Tunnel Source and HMAC Keys with ip sr

Use ip sr to read and change the two internal knobs that keep an IPv6 Segment Routing tunnel working. The examples match the installed iproute2 package, version 6.1.0-1ubuntu6.4, whose ip utility reports version 6.1.0.

Allow about fifteen minutes, plus time to confirm the address and key details with whoever operates the rest of the SRv6 network. You need an IPv6-enabled Linux host with iproute2, and read-only inspection may still need elevated privilege on your host. Setting either parameter changes kernel networking state, so use a maintenance window and record the previous values before you touch anything.

1. Confirm the installed command

Start with a version check. It does not touch networking state:

$ command -v ip
/usr/sbin/ip
$ ip -V
ip utility, iproute2-6.1.0, libbpf 1.3.0
$ dpkg-query -W -f='${Package} ${Version}\n' iproute2
iproute2 6.1.0-1ubuntu6.4

The manpage calls this command group ip sr. Its supported operations are deliberately small:

• hmac show. List the current HMAC key mapping.
• hmac set. Add or replace one HMAC key.
• tunsrc show. Read the tunnel source address.
• tunsrc set. Change the tunnel source address.

Do not add flags copied from another ip object unless the installed help or manpage documents them for this group.

2. Inspect the current tunnel source

Read the current source before you plan a change:

$ sudo ip sr tunsrc show

On the machine used for this guide, running that same command without privilege returned RTNETLINK answers: Operation not permitted. That is a permission result on this host, not evidence that the setting is absent. Retry with whatever privilege your system's network administration policy requires, and if it still fails, stop and check the kernel, SRv6 support and the privilege boundary before changing anything.

The default tunnel source is ::. With that value, the egress interface's own address gets picked for encapsulated packets. The manpage warns that this selection can hurt performance and recommends a non-default source, but that source has to be valid for the host and appropriate for the route and interface carrying the encapsulated traffic.

3. Set a deliberate tunnel source

Replace 2001:db8::1 below with a real, approved local IPv6 address. This changes the source used for SRv6 encapsulation:

$ sudo ip sr tunsrc set 2001:db8::1
$ sudo ip sr tunsrc show

The second command is your verification step. The output format comes from the installed utility, so compare the address it prints against the value you asked for rather than trusting an assumed heading or bit of punctuation.

This is not a per-route setting: it changes the internal SRv6 tunnel source for the whole host. Check the address exists on the intended interface, and check the routing design, before applying it to a production node. A source address that is not usable on the relevant path can make encapsulated traffic fail or hard to return.

To undo this example and go back to the documented default, set the source to the unspecified address:

$ sudo ip sr tunsrc set ::
$ sudo ip sr tunsrc show

That restores automatic selection from the egress interface, and with it the performance trade-off the manpage warns about. Treat it as a rollback, not automatically as the best final configuration.

4. Inspect the HMAC mapping

SRv6 HMAC configuration maps a numeric key ID to a supported hashing algorithm and a secret. Look at the existing mapping before you add or replace one:

$ sudo ip sr hmac show

The supported algorithms on this installation are sha1 and sha256. The command does not take the secret as a command-line argument, which matters: arguments can leak through process inspection and logging.

5. Add or replace one HMAC mapping

$ sudo ip sr hmac set 42 sha256
Password:

The prompt is for the HMAC passphrase, not necessarily the account password. Type it interactively, then verify the mapping:

$ sudo ip sr hmac show

Pick a key ID that does not collide with a mapping the peer configuration already uses. This installation only supports the two algorithms named above; if it reports an unsupported algorithm, correct the algorithm choice instead of guessing another spelling.

A blank passphrase removes the mapping for that key ID. That is the documented undo action, but it is still a security-sensitive change, so confirm the ID and check whether active traffic or another process depends on the mapping before using it:

$ sudo ip sr hmac set 42 sha256
Password: [press Enter at the passphrase prompt]
$ sudo ip sr hmac show

Do not put a passphrase in a shell command, environment variable or configuration file just to automate this interaction. If unattended key rotation is required, build it around the platform's documented interface and secret-handling controls, not by exposing the value to ordinary process or file inspection.

6. Separate verification from troubleshooting

Run both show commands after any planned change:

$ sudo ip sr tunsrc show
$ sudo ip sr hmac show

If either command fails, capture its exit status straight away and keep the original error text:

$ sudo ip sr tunsrc show
$ status=$?
$ printf 'tunsrc show exit status: %s\n' "$status"

An empty-looking result, a permission error and a missing SRv6 capability are three different problems, not one. Check the command's status, the kernel and the privileges available to the network administrator. ip-route(8) is the next local reference for the route and encapsulation side of SRv6; ip-sr(8) only covers these internal parameters.