Bug #4214
closedHonor vlan: use-for-tracking in ebpf maps
Added by Odin Jenseg over 5 years ago. Updated about 1 month ago.
Description
In XDP and EBPF filters, it is possible to "disable" vlan used for tracking, but Suricata does not honor this config when adding keys to EBPF maps.
Will provide PR.
OJ Updated by Odin Jenseg over 5 years ago Actions #1
OJ Updated by Odin Jenseg over 5 years ago Actions #2
A second thought, it might make more sense to remove VLAN_TRACKING in https://github.com/OISF/suricata/tree/master/ebpf?
EL Updated by Eric Leblond over 5 years ago Actions #3
Odin Jenseg wrote in #note-2:
A second thought, it might make more sense to remove VLAN_TRACKING in https://github.com/OISF/suricata/tree/master/ebpf?
We may have some cases where vlan could be use to differentiate IP addresses.
IMO, it would make sense to have a version of the eBPF filter that does not contain the fields so we can spare some memory and computation. Problem is that Suricata would need to send two different set of keys in the eBPF calls. It should be doable but it will increase a bit more the complexity of the code.
OJ Updated by Odin Jenseg over 5 years ago Actions #4
Agree, it make more sense to be able to do this. Would it make sense with my PR, to not include VLAN tags in the key if vlan use for tracking is disabled in Suricata.
If I understand the code correct now; vlan is still used as a ebpf key if vlan used for tracking is disabled in Suricata and makes the VLAN_TRACKING flag not usable in EBPF/XDP filters.
PA Updated by Philippe Antoine over 4 years ago Actions #5
- Status changed from New to In Review
PA Updated by Philippe Antoine over 4 years ago Actions #6
- Target version set to 7.0.0-beta1
VJ Updated by Victor Julien almost 4 years ago Actions #7
- Status changed from In Review to New
- Assignee deleted (
Odin Jenseg) - Target version changed from 7.0.0-beta1 to TBD
VJ Updated by Victor Julien over 3 years ago Actions #8
- Assignee set to Community Ticket
PA Updated by Philippe Antoine about 1 year ago Actions #9
- Affected Versions 8.0.0 added
PA Updated by Philippe Antoine about 1 month ago Actions #10
- Is duplicate of Bug #8242: eBPF maps created by Suricata don't take vlan.use-for-tracking into account added
PA Updated by Philippe Antoine about 1 month ago Actions #11
- Status changed from New to Rejected
Now going with #8242 which has a PR