Feature #7753: vxlan: decoder drops packets with non-zero reserved fields - Suricata - Open Information Security Foundation

Actions

Copy link

Feature #7753

closed

vxlan: decoder drops packets with non-zero reserved fields

Added by Fupeng Zhao 4 months ago. Updated 9 days ago.

Status:

Closed

Priority:

Normal

Assignee:

Fupeng Zhao

Target version:

9.0.0-beta1

Effort:

Difficulty:

Label:

C, Needs Suricata-Verify test, Protocol

Description

The current VXLAN decoder implementation follows RFC draft-mahalingam-dutt-dcops-vxlan-00 too strictly and does not ignore the Reserved fields on receipt, as required by RFC 7348 §5 . This causes valid VXLAN packets with non-zero Reserved bits to be dropped, leading to loss of response-side traffic in some environments.

Files

vxlan-non-zero-reserved-fields.pcap (1.95 KB) vxlan-non-zero-reserved-fields.pcap

Fupeng Zhao, 06/12/2025 06:44 AM

Subtasks 1 (0 open — 1 closed)

Actions

Copy link

Updated by Fupeng Zhao 4 months ago

Status changed from New to Assigned
Assignee changed from OISF Dev to Fupeng Zhao

Assigned to myself.

I plan to remove the strict validation of the Reserved fields entirely. Since we don’t decode the inner packet before parsing the VXLAN header, we can’t reliably determine the packet direction (transmit vs receive) and thus can’t selectively apply Reserved field checks.

Open to alternative suggestions if there's a preferred way to handle this.

Actions

Copy link