Disable vlan hw accel when promiscuous mode
Subsystems (2)
PATCH 2/2 Disable vlan hw accel when promiscuous mode
2007/11/11, Joonwoo Park <[email protected]>:
Quoted 4 lines
IMHO even though netdevice is in the promiscuous mode, we should receive all of ingress packets. This disable the vlan filtering feature when a vlan hw accel configured e1000 device goes into promiscuous mode. This make packets visible to sniffers though it's not vlan id of itself.
Any check, comments will be appreciated.
Hi,
Not anymore about just e1000 :)
I made an another patch with different approach which doesn't fix nic driver.
In addition, this patch does disable all hw vlan acceleration features (rx, tx, filter) for promiscuous netdevice. (It makes possible tcpdump -i eth0 vlan)
Actually, my previous patch did just disable filter for e1000, so we can't see vlan header of packet. (e1000 stripped off the header)
I think this patch is much better than previous of mine.
How do you think?
Any assist will be appreciated.
Thanks.
Joonwoo
[NET]: Disable vlan hw acceleration when promiscuous mode
--- include/linux/if_vlan.h | 5 ++- net/8021q/vlan.c | 84 ++++++++++++++++++++++++++++++++++++++++++++--- net/8021q/vlan.h | 3 ++ net/core/dev.c | 8 ++++- 4 files changed, 93 insertions(+), 7 deletions(-)
include/linux/if_vlan.h +4 -1
@@ -63,6 +63,8 @@ struct vlan_hdr {/* found in socket.c */ extern void vlan_ioctl_set (int (*hook)(struct net *,void __user *)); +extern void vlan_dev_disable_hwaccel (struct net_device *any_dev); +void vlan_dev_enable_hwaccel (struct net_device *any_dev);#define VLAN_NAME "vlan"
@@ -367,7 +369,8 @@ static inline int __vlan_hwaccel_get_tag(struct sk_buff *skb, unsigned short *ta*/ static inline int vlan_get_tag (struct sk_buff *skb,unsigned short *tag) { -if (skb->dev->features &NETIF_F_HW_VLAN_TX ) { +if (skb->dev->features &NETIF_F_HW_VLAN_TX && + !(skb->dev->flags &IFF_PROMISC )) {return __vlan_hwaccel_get_tag (skb, tag); }else {return __vlan_get_tag (skb, tag);
net/8021q/vlan.c +79 -5
102 lines not on this page · raw message
net/8021q/vlan.h +3 -0
@@ -81,6 +81,9 @@ int unregister_vlan_device(struct net_device *dev);int vlan_netlink_init (void );void vlan_netlink_fini (void ); +void vlan_dev_disable_hwaccel (struct net_device *any_dev); +void vlan_dev_enable_hwaccel (struct net_device *any_dev); +extern struct rtnl_link_ops vlan_link_ops;#endif /* !(__BEN_VLAN_802_1Q_INC__) */
net/core/dev.c +7 -1
@@ -119,6 +119,7 @@#include <linux/err.h> #include <linux/ctype.h> #include <linux/if_arp.h> +#include <linux/if_vlan.h> #include "net-sysfs.h"
@@ -2782,8 +2783,13 @@ void dev_set_promiscuity(struct net_device *dev, int inc)unsigned short old_flags = dev->flags;__dev_set_promiscuity (dev, inc); -if (dev->flags != old_flags) +if (dev->flags != old_flags) {dev_set_rx_mode (dev); +if (dev->flags &IFF_PROMISC ) +vlan_dev_disable_hwaccel (dev); +else +vlan_dev_enable_hwaccel (dev); + } }/**
---
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
Quoted 9 lines · Joonwoo Park
Not anymore about just e1000 :)
I made an another patch with different approach which doesn't fix nic driver.
In addition, this patch does disable all hw vlan acceleration features (rx, tx, filter) for promiscuous netdevice. (It makes possible tcpdump -i eth0 vlan)
Actually, my previous patch did just disable filter for e1000, so we can't see vlan header of packet. (e1000 stripped off the header)
I think this patch is much better than previous of mine.
How do you think?
I don't like this :)
Let's not turn promiscuous mode into catch-all flag that disables all optimisations that may interfere with tcpdump. It should show us all the packets by disabling any hardware filtering but that's it.
BTW, how does the VLAN TX acceleration work at all? It's using skb->cb to carry the tags but then calls dev_queue_xmit. Once you do that packet schedulers can scribble all over skb->cb.
Also vlan_skb_recv should be moved out-of-line. It's absolutely humongous. It'll generate tail-calls anyway so performance-wise it's useless.
Cheers,
Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txtQuoted 7 lines · Herbert Xu
BTW, how does the VLAN TX acceleration work at all? It's using
skb->cbto carry the tags but then callsdev_queue_xmit. Once you do that packet schedulers can scribble all overskb->cb.Also
vlan_skb_recvshould be moved out-of-line. It's absolutely humongous. It'll generate tail-calls anyway so performance-wise it's useless.
I have a number of VLAN cleanups queued and intend to do these two changes on top.
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/