Skip to content

Vxlan tunnel 7717 v2.3 #14369

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
catenacyber wants to merge 5 commits into from
Closed

Vxlan tunnel 7717 v2.3 #14369

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9e0a62c
decode: use PacketIsTunnelChild
catenacyber Apr 24, 2025
1f7ad26
decode: store tunnel protocol in packet structure
catenacyber Apr 24, 2025
b9bb71c
ebpf: check maps compatibility
catenacyber May 2, 2025
084128d
decode/xvlan: treat as its own tunnel
catenacyber Apr 24, 2025
7db942d
decode: use compact uint8_t instead of enum in struct
catenacyber Oct 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions src/decode.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -395,7 +395,7 @@ inline int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
* \retval p the pseudo packet or NULL if out of memory
*/
Packet *PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent,
const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
{
int ret;

Expand Down Expand Up @@ -426,13 +426,14 @@ Packet *PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *pare
/* set the root ptr to the lowest layer */
if (parent->root != NULL) {
p->root = parent->root;
BUG_ON(parent->ttype != PacketTunnelChild);
BUG_ON(!PacketIsTunnelChild(parent));
} else {
p->root = parent;
parent->ttype = PacketTunnelRoot;
}
/* tell new packet it's part of a tunnel */
p->ttype = PacketTunnelChild;
p->tproto = (uint8_t)proto;

ret = DecodeTunnel(tv, dtv, p, GET_PKT_DATA(p),
GET_PKT_LEN(p), proto);
Expand Down Expand Up @@ -487,7 +488,7 @@ Packet *PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, u
/* set the root ptr to the lowest layer */
if (parent->root != NULL) {
p->root = parent->root;
BUG_ON(parent->ttype != PacketTunnelChild);
BUG_ON(!PacketIsTunnelChild(parent));
} else {
p->root = parent;
// we set parent->ttype later
Expand Down
31 changes: 17 additions & 14 deletions src/decode.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -481,6 +481,20 @@ struct PacketL4 {
} vars;
};

enum DecodeTunnelProto {
DECODE_TUNNEL_ETHERNET,
DECODE_TUNNEL_ERSPANII,
DECODE_TUNNEL_ERSPANI,
DECODE_TUNNEL_VLAN,
DECODE_TUNNEL_IPV4,
DECODE_TUNNEL_IPV6,
DECODE_TUNNEL_IPV6_TEREDO, /**< separate protocol for stricter error handling */
DECODE_TUNNEL_PPP,
DECODE_TUNNEL_NSH,
DECODE_TUNNEL_ARP,
DECODE_TUNNEL_UNSET
};

/* sizes of the members:
* src: 17 bytes
* dst: 17 bytes
Expand Down Expand Up @@ -552,6 +566,9 @@ typedef struct Packet_
/* tunnel type: none, root or child */
enum PacketTunnelType ttype;

/* tunnel protocol */
enum DecodeTunnelProto tproto;

SCTime_t ts;

union {
Expand Down Expand Up @@ -1099,20 +1116,6 @@ static inline void PacketTunnelSetVerdicted(Packet *p)
p->tunnel_verdicted = true;
}

enum DecodeTunnelProto {
DECODE_TUNNEL_ETHERNET,
DECODE_TUNNEL_ERSPANII,
DECODE_TUNNEL_ERSPANI,
DECODE_TUNNEL_VLAN,
DECODE_TUNNEL_IPV4,
DECODE_TUNNEL_IPV6,
DECODE_TUNNEL_IPV6_TEREDO, /**< separate protocol for stricter error handling */
DECODE_TUNNEL_PPP,
DECODE_TUNNEL_NSH,
DECODE_TUNNEL_ARP,
DECODE_TUNNEL_UNSET
};

Packet *PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent,
const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto);
Packet *PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto);
Expand Down
10 changes: 5 additions & 5 deletions src/log-pcap.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -258,7 +258,7 @@ static bool PcapLogCondition(ThreadVars *tv, void *thread_data, const Packet *p)
return false;
}

if (p->ttype == PacketTunnelChild) {
if (PacketIsTunnelChild(p)) {
return false;
}
return true;
Expand Down Expand Up @@ -390,7 +390,7 @@ static int PcapLogOpenHandles(PcapLogData *pl, const Packet *p)
PCAPLOG_PROFILE_START;

int datalink = p->datalink;
if (p->ttype == PacketTunnelChild) {
if (PacketIsTunnelChild(p)) {
Packet *real_p = p->root;
datalink = real_p->datalink;
}
Expand Down Expand Up @@ -626,7 +626,7 @@ static int PcapLog(ThreadVars *tv, void *thread_data, const Packet *p)
pl->pkt_cnt++;
pl->h->ts.tv_sec = SCTIME_SECS(p->ts);
pl->h->ts.tv_usec = SCTIME_USECS(p->ts);
if (p->ttype == PacketTunnelChild) {
if (PacketIsTunnelChild(p)) {
rp = p->root;
pl->h->caplen = GET_PKT_LEN(rp);
pl->h->len = GET_PKT_LEN(rp);
Expand Down Expand Up @@ -700,7 +700,7 @@ static int PcapLog(ThreadVars *tv, void *thread_data, const Packet *p)
/* PcapLogDumpSegment has written over the PcapLogData variables so need to update */
pl->h->ts.tv_sec = SCTIME_SECS(p->ts);
pl->h->ts.tv_usec = SCTIME_USECS(p->ts);
if (p->ttype == PacketTunnelChild) {
if (PacketIsTunnelChild(p)) {
rp = p->root;
pl->h->caplen = GET_PKT_LEN(rp);
pl->h->len = GET_PKT_LEN(rp);
Expand All @@ -713,7 +713,7 @@ static int PcapLog(ThreadVars *tv, void *thread_data, const Packet *p)
}
}

if (p->ttype == PacketTunnelChild) {
if (PacketIsTunnelChild(p)) {
rp = p->root;
ret = PcapWrite(tv, td, GET_PKT_DATA(rp), len);
} else {
Expand Down
8 changes: 0 additions & 8 deletions src/source-af-packet.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2282,7 +2282,6 @@ static int AFPBypassCallback(Packet *p)
keys[0]->port16[1] = p->dp;
keys[0]->vlan0 = p->vlan_id[0];
keys[0]->vlan1 = p->vlan_id[1];
keys[0]->vlan2 = p->vlan_id[2];
Copy link
Member

@victorjulien victorjulien Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

program looks like it could be easily extended to support vlan2, should that be considered instead?

Copy link
Contributor Author

@catenacyber catenacyber Feb 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not so easy, bu I try something


if (p->proto == IPPROTO_TCP) {
keys[0]->ip_proto = 1;
Expand All @@ -2308,7 +2307,6 @@ static int AFPBypassCallback(Packet *p)
keys[1]->port16[1] = p->sp;
keys[1]->vlan0 = p->vlan_id[0];
keys[1]->vlan1 = p->vlan_id[1];
keys[1]->vlan2 = p->vlan_id[2];

keys[1]->ip_proto = keys[0]->ip_proto;
if (AFPInsertHalfFlow(p->afp_v.v4_map_fd, keys[1],
Expand Down Expand Up @@ -2343,7 +2341,6 @@ static int AFPBypassCallback(Packet *p)
keys[0]->port16[1] = p->dp;
keys[0]->vlan0 = p->vlan_id[0];
keys[0]->vlan1 = p->vlan_id[1];
keys[0]->vlan2 = p->vlan_id[2];

if (p->proto == IPPROTO_TCP) {
keys[0]->ip_proto = 1;
Expand Down Expand Up @@ -2371,7 +2368,6 @@ static int AFPBypassCallback(Packet *p)
keys[1]->port16[1] = p->sp;
keys[1]->vlan0 = p->vlan_id[0];
keys[1]->vlan1 = p->vlan_id[1];
keys[1]->vlan2 = p->vlan_id[2];

keys[1]->ip_proto = keys[0]->ip_proto;
if (AFPInsertHalfFlow(p->afp_v.v6_map_fd, keys[1],
Expand Down Expand Up @@ -2439,7 +2435,6 @@ static int AFPXDPBypassCallback(Packet *p)
keys[0]->port16[1] = htons(p->dp);
keys[0]->vlan0 = p->vlan_id[0];
keys[0]->vlan1 = p->vlan_id[1];
keys[0]->vlan2 = p->vlan_id[2];
if (p->proto == IPPROTO_TCP) {
keys[0]->ip_proto = 1;
} else {
Expand All @@ -2464,7 +2459,6 @@ static int AFPXDPBypassCallback(Packet *p)
keys[1]->port16[1] = htons(p->sp);
keys[1]->vlan0 = p->vlan_id[0];
keys[1]->vlan1 = p->vlan_id[1];
keys[1]->vlan2 = p->vlan_id[2];
keys[1]->ip_proto = keys[0]->ip_proto;
if (AFPInsertHalfFlow(p->afp_v.v4_map_fd, keys[1],
p->afp_v.nr_cpus) == 0) {
Expand Down Expand Up @@ -2497,7 +2491,6 @@ static int AFPXDPBypassCallback(Packet *p)
keys[0]->port16[1] = htons(p->dp);
keys[0]->vlan0 = p->vlan_id[0];
keys[0]->vlan1 = p->vlan_id[1];
keys[0]->vlan2 = p->vlan_id[2];
if (p->proto == IPPROTO_TCP) {
keys[0]->ip_proto = 1;
} else {
Expand All @@ -2524,7 +2517,6 @@ static int AFPXDPBypassCallback(Packet *p)
keys[1]->port16[1] = htons(p->sp);
keys[1]->vlan0 = p->vlan_id[0];
keys[1]->vlan1 = p->vlan_id[1];
keys[1]->vlan2 = p->vlan_id[2];
keys[1]->ip_proto = keys[0]->ip_proto;
if (AFPInsertHalfFlow(p->afp_v.v6_map_fd, keys[1],
p->afp_v.nr_cpus) == 0) {
Expand Down
14 changes: 12 additions & 2 deletions src/util-ebpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -413,6 +413,18 @@ int EBPFLoadFile(const char *iface, const char *path, const char * section,
SCLogError("Too many BPF maps in eBPF files");
break;
}
if (strcmp(bpf_map__name(map), "flow_table_v4") == 0) {
if (bpf_map__key_size(map) != sizeof(struct flowv4_keys)) {
SCLogError("Incompatible flow_table_v4");
break;
}
}
if (strcmp(bpf_map__name(map), "flow_table_v6") == 0) {
if (bpf_map__key_size(map) != sizeof(struct flowv6_keys)) {
SCLogError("Incompatible flow_table_v6");
break;
}
}
SCLogDebug("Got a map '%s' with fd '%d'", bpf_map__name(map), bpf_map__fd(map));
bpf_map_data->array[bpf_map_data->last].fd = bpf_map__fd(map);
bpf_map_data->array[bpf_map_data->last].name = SCStrdup(bpf_map__name(map));
Expand Down Expand Up @@ -749,7 +761,6 @@ static int EBPFForEachFlowV4Table(ThreadVars *th_v, LiveDevice *dev, const char
flow_key.dst.addr_data32[3] = 0;
flow_key.vlan_id[0] = next_key.vlan0;
flow_key.vlan_id[1] = next_key.vlan1;
flow_key.vlan_id[2] = next_key.vlan2;
if (next_key.ip_proto == 1) {
flow_key.proto = IPPROTO_TCP;
} else {
Expand Down Expand Up @@ -868,7 +879,6 @@ static int EBPFForEachFlowV6Table(ThreadVars *th_v,
}
flow_key.vlan_id[0] = next_key.vlan0;
flow_key.vlan_id[1] = next_key.vlan1;
flow_key.vlan_id[2] = next_key.vlan2;
if (next_key.ip_proto == 1) {
flow_key.proto = IPPROTO_TCP;
} else {
Expand Down
2 changes: 0 additions & 2 deletions src/util-ebpf.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,6 @@ struct flowv4_keys {
__u8 ip_proto:1;
__u16 vlan0:15;
__u16 vlan1;
__u16 vlan2;
};

struct flowv6_keys {
Expand All @@ -58,7 +57,6 @@ struct flowv6_keys {
__u8 ip_proto:1;
__u16 vlan0:15;
__u16 vlan1;
__u16 vlan2;
};

struct pair {
Expand Down