Skip to content

Conversation

catenacyber
Copy link
Contributor

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/7674

Describe changes:

  • on top of Vxlan tunnel 7717 v1 #13302
  • introduces configurable tunnel_id to distinguish same-looking (same 5-tuple) flows encapsulated in different tunnels
  • adds a config option to "skip" the packets that are not part of a tunnel
  • handle xdp bypass of these encapsulated flows
  • use this new tunnel_id as a multi-tenant selector

Provide values to any of the below to override the defaults.

SV_BRANCH=OISF/suricata-verify#2522

#13654 with

  • NULL deref fix with ebpf programs loaded and no tunnels section in suricata.yaml
  • Fully handle the config option to skip non-tunneled packets

catenacyber and others added 11 commits August 26, 2025 20:55
Instead of directly accessing the field

Will allow PacketTunnelType to hold the precise tunnel type like
DECODE_TUNNEL_ERSPANII with a modification of PacketIsTunnelChild
So that we know for a packet which precise type of tunnel it
is (like erspan2).
ebpf program does not handle 3 layers of vlan
Ticket: 7717

Allows for instance to process/log ARP packets over VXLAN.

That means we need to decode the ethernet layer above vxlan
instead of skipping it as part of the vxlan, even if the vxlan
decoder still checks the ethernet layer to avoid FPs.
Ticket: 7674

To distinguish flows with the same 5-tuple but coming from different
tunnel sources.
@catenacyber catenacyber added this to the 9.0 milestone Aug 26, 2025
Copy link

codecov bot commented Aug 26, 2025

Codecov Report

❌ Patch coverage is 57.41935% with 132 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.53%. Comparing base (49629f7) to head (1b359e1).
⚠️ Report is 45 commits behind head on master.

Additional details and impacted files
@@             Coverage Diff             @@
##           master   #13748       +/-   ##
===========================================
+ Coverage   77.16%   83.53%    +6.36%     
===========================================
  Files         945     1012       +67     
  Lines      172228   277540   +105312     
===========================================
+ Hits       132906   231844    +98938     
- Misses      39322    45696     +6374     
Flag Coverage Δ
fuzzcorpus 62.86% <30.00%> (-0.08%) ⬇️
livemode 18.75% <10.32%> (-0.25%) ⬇️
pcap 44.84% <30.32%> (+0.16%) ⬆️
suricata-verify 65.08% <55.83%> (+0.01%) ⬆️
unittests 58.66% <17.97%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline = 27230

@catenacyber
Copy link
Contributor Author

Next version in #13839

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants