config/mt: Add vlan-pair MT selector #9729
Conversation
Issue: 6237 The VLAN pair selector uses a pair of values to select a tenant. - vlan-id - vlan-id-inner Each of these can accept a wild-card value (0). The tenant is selected by - vlan-id matches the outer vlan or is 0 - vlan-id-inner matches the inner vlan or is 0
Issue: 6237
jlucovsky
requested review from
jasonish,
inashivb,
jufajardini and
victorjulien
as code owners
| :: | ||
|
|
||
| register-tenant-handler <tenant id> vlan <vlan id> | ||
| register-tenant-handler <tenant id> vlan-pair <vlan id> |
There was a problem hiding this comment.
I find it confusing that we speak of pair but have a singular value
There was a problem hiding this comment.
also think it would be best to not mix these with the simple vlan examples, but have it separately
There was a problem hiding this comment.
Thanks for the catch. Actually, it's register-tenant-handler <tenant id> vlan-pair <vlan id> <vlan inner id>
I'll separate the examples so it's clearer.
| yaml: tenant-3.yaml | ||
|
|
||
| mappings: | ||
| - vlan-id: 1000 |
There was a problem hiding this comment.
wondering if it would be better to have a new vlan-id-pair name here, with a value of an array? Or something like "qinq": [ 1000, 1 ]
There was a problem hiding this comment.
How long til we'll need qinqinqinqinqinqinq? I like the qinq name here where the value is an array. Limited to 2 for now perhaps, but could grow.
There was a problem hiding this comment.
I like both ideas and I suggest vlan-id-tuple: [1000, 1] along with changing the selector name from vlan-pair to vlan-tuple
There was a problem hiding this comment.
It would be nice if the selector value, and the name of the field for that select could be the same, however we don't have that for vlan and vlan-id now. If vlan-tuple it could be nice to have:
selector: vlan-tuple
mappings:
- vlan-tuple: [..]
There was a problem hiding this comment.
I like that suggestion @jasonish -- will do.
|
Information: QA ran without warnings. Pipeline 16373 |
|
Continued in #9737 |
Continuation of #9401
Add a new MT selector type to support use cases where a VLAN pair should be used to determine the MT tenant.
Packets with one VLAN id will never match as
vlan-pairrequires at least QinQTenants are selected by:
vlan-idorvlan-idis 0 (wildcard)vlan-id-innerorvlan-id-inneris 0 (wildcard)Link to redmine ticket: 6237
Describe changes:
vlan-pair-- for use cases where a VLAN pair should determines the tenant.Updates
Provide values to any of the below to override the defaults.
To use a pull request use a branch name like
pr/NwhereNis thepull request number.
Alternatively,
SV_BRANCHmay also be a link to anOISF/suricata-verify pull-request.