Project

General

Profile

Actions
Copy link

Feature #7674

open

xdp: possibility to bypass encapsulated flows

Added by Philippe Antoine about 8 hours ago.

Status:
New
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
9.0.0-beta1
Effort:
Difficulty:
Label:

Description

The ebpf xdp_filter.c program does not handle encapsulated flows (with erspan, VXLAN, or some other tunnel)
But it could.

Even if it does, Suricata AFPXDPBypassCallback checks PacketIsTunnel and falls back to local bypass in this case

The feature request here is to
  • Have config options for which kinds of tunnels AFPXDPBypassCallback can handle
  • have the example xdp_filter.c handle these

Some other improvements to xdp_filter.c will be proposed : ARP bypass, and tunnel stripping ( related to https://github.com/OISF/suricata/pull/11472 )

No data to display

Actions
Copy link

Also available in: Atom PDF