On 11/11/2020 7:43 AM, Jakub Kicinski wrote:
> On Tue, 10 Nov 2020 16:39:58 +0100 Markus Blöchl wrote:
>> The rx-vlan-filter feature flag prevents unexpected tagged frames on
>> the wire from reaching the kernel in promiscuous mode.
>> Disable this offloading feature in the lan7800 controller whenever
>> IFF_PROMISC is set and make sure that the hardware features
>> are updated when IFF_PROMISC changes.
>>
>> Signed-off-by: Markus Blöchl <markus.bloe...@ipetronik.com>
>> ---
>>
>> Notes:
>> When sniffing ethernet using a LAN7800 ethernet controller, vlan-tagged
>> frames are silently dropped by the controller due to the
>> RFE_CTL_VLAN_FILTER flag being set by default since commit
>> 4a27327b156e("net: lan78xx: Add support for VLAN filtering.").
>>
>> In order to receive those tagged frames it is necessary to manually
>> disable
>> rx vlan filtering using ethtool ( `ethtool -K ethX rx-vlan-filter off` or
>> corresponding ioctls ). Setting all bits in the vlan filter table to 1 is
>> an even worse approach, imho.
>>
>> As a user I would probably expect that setting IFF_PROMISC should be
>> enough
>> in all cases to receive all valid traffic.
>> Therefore I think this behaviour is a bug in the driver, since other
>> drivers (notably ixgbe) automatically disable rx-vlan-filter when
>> IFF_PROMISC is set. Please correct me if I am wrong here.
>
> I've been mulling over this, I'm not 100% sure that disabling VLAN
> filters on promisc is indeed the right thing to do. The ixgbe doing
> this is somewhat convincing. OTOH users would not expect flow filters
> to get disabled when promisc is on, so why disable vlan filters?
>
> Either way we should either document this as an expected behavior or
> make the core clear the features automatically rather than force
> drivers to worry about it.
>
> Does anyone else have an opinion, please?
The semantics of promiscuous are pretty clear though, and if you have a
NIC with VLAN filtering capability which could prevent the stack from
seeing *all* packets, that would be considered a bug. I suppose that you
could not disable VLAN filtering but instead install all 4096 - N VLANs
(N being currently used) into the filter to guarantee receiving those
VLAN tagged frames?
As far as flow filters, this is actually a good question, it sounds like
there are some possibly interesting problems to solve there. For
instance with an Ethernet switch, if you had a rule that diverted
packets to be switched directly to a particular port, what should happen
when either of these ports is in promiscuous mode? Should the switch be
instructed to replace all of the rules to forward + copy to the CPU?
--
Florian
