Add yaml option to disable vlan ids hashing

In some cases using the vlan id(s) in flow hashing is problematic. Cases
of broken routers have been reported. So this option allows for disabling
the use of vlan id(s) while calculating the flow hash, and in the future
other hashes.

Vlan tracking for flow is enabled by default.

diff --git a/src/decode-vlan.c b/src/decode-vlan.c
index 7130ed3a0cea4659e903c99e5016f5f3e227ef0d..11dab31113fa4f124a5aa61dd04964ebb786e485 100644 (file)
--- a/src/decode-vlan.c
+++ b/src/decode-vlan.c
@@ -77,7 +77,10 @@ void DecodeVLAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt,
             p, pkt, proto, GET_VLAN_PRIORITY(p->vlanh[p->vlan_idx]),
             GET_VLAN_CFI(p->vlanh[p->vlan_idx]), GET_VLAN_ID(p->vlanh[p->vlan_idx]), len);
 
-    p->vlan_id[p->vlan_idx] = (uint16_t)GET_VLAN_ID(p->vlanh[p->vlan_idx]);
+    /* only store the id for flow hashing if it's not disabled. */
+    if (dtv->vlan_disabled == 0)
+        p->vlan_id[p->vlan_idx] = (uint16_t)GET_VLAN_ID(p->vlanh[p->vlan_idx]);
+
     p->vlan_idx++;
 
     switch (proto)   {

diff --git a/src/decode.c b/src/decode.c
index e790f4707850197a68075013a3b1b18fb0b98151..091b1a426ccc0ec8faa43981e12a6b8c234a13cc 100644 (file)
--- a/src/decode.c
+++ b/src/decode.c
@@ -432,6 +432,13 @@ DecodeThreadVars *DecodeThreadVarsAlloc()
     /* initialize UDP app layer code */
     AlpProtoFinalize2Thread(&dtv->udp_dp_ctx);
 
+    /** set config defaults */
+    int vlanbool = 0;
+    if ((ConfGetBool("vlan.use-for-tracking", &vlanbool)) == 1 && vlanbool == 0) {
+        dtv->vlan_disabled = 1;
+    }
+    SCLogDebug("vlan tracking is %s", dtv->vlan_disabled == 0 ? "enabled" : "disabled");
+
     return dtv;
 }
 

diff --git a/src/decode.h b/src/decode.h
index 3d96df622b3780a99ee8582381c6fa8dc4d58af0..3a31d74250af2f1ea16ee73f13f86b1561f91381 100644 (file)
--- a/src/decode.h
+++ b/src/decode.h
@@ -547,6 +547,8 @@ typedef struct DecodeThreadVars_
     /** Specific context for udp protocol detection (here atm) */
     AlpProtoDetectThreadCtx udp_dp_ctx;
 
+    int vlan_disabled;
+
     /** stats/counters */
     uint16_t counter_pkts;
     uint16_t counter_pkts_per_sec;

diff --git a/suricata.yaml.in b/suricata.yaml.in
index dc6be13b961bd757ce35f06122e069ef35a34069..31afdf34847ba5bbca03ee570d5328a39e92752c 100644 (file)
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -531,6 +531,13 @@ flow:
   prealloc: 10000
   emergency-recovery: 30
 
+# This option controls the use of vlan ids in the flow hashing. Normally this
+# should be enabled, but in some (broken) setups where both sides of a flow are
+# not tagged with the same vlan tag, we can ignore the vlan id's in the flow
+# hashing.
+vlan:
+  use-for-tracking: true
+
 # Specific timeouts for flows. Here you can specify the timeouts that the
 # active flows will wait to transit from the current state to another, on each
 # protocol. The value of "new" determine the seconds to wait after a hanshake or