Hardware Offload still active in case of PPPoE on top of a VLAN interface

[KuddelSK]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug

I have disabled all hardware offload features on the Interfaces/Settings page.
If i look at the option lists that can be seen using ifconfig my igb3 interface still has all options enabled.
I don't know of a working version as it only came to my attention in the context of another problem i am investigating.

To Reproduce

• Deactivate all hardware offload features using the Interfaces/Settings page
• Add a VLAN-Interface on top of the raw interface (igb3 in my case)
• Assign the VLAN-interface to WAN
• Inside the WAN interface page set IPv4 connectivity to PPPoE
• Reboot
• Open a shell on the router and look at the interface options (of the raw interface; igb3 in my case) using "ifconfig"

Expected behavior

I expect that all interfaces respect these settings and the features, as seen by ifconfig, are removed.

Additional context

ifconfig shows this (hardware offload disabled in the settings page; this is the raw WAN interface):

igb3: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=e527bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,WOL_MAGIC,VLAN_HWFILTER,VLAN_HWTSO,RXCSUM_IPV6,TXCSUM_IPV6>
	ether XX:XX:XX:XX:XX:XX
	inet6 YY::YYY:YYYY:YYYY:YYYY%igb3 prefixlen 64 scopeid 0x4
	media: Ethernet autoselect (1000baseT <full-duplex>)
	status: active
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>

My impression is that the NICs are initialized with all offload features activated.
The configured values are then propagated to interfaces where an active link is detected.
It looks like the "link active" signal is not received if there is no direct assignment of the interface.

If you apply the above process but skip the reboot, the settings are respected and the offload features deactivated.

If you reverse the process (use e.g. DHCP instead of PPPoE and assign WAN to the raw interface) the settings are respected also.

This problem is especially troubling in the context of wireguard. I see '[bad udp cksum 0x8e46 -> ...]' messages during a dump of a wireguard handshake and the packets are not received on the client side.
After some research i found the advice to deactivate the hardware checksum feature as it may cause problems in that area. As mentioned above i can't do this right now.
UDP packets of other programs have correct checksums. Therefore it looks like something which is specific to the combination of Wireguard and hardware offload.

Environment

OpnSense 21.7.6
APU 4d4 (GX-412TC CPU; 4 Nics i211AT )

[fichtner]

Hi,

From the looks of this we don't chase the root hardware interface and this hasn't been changed in a recent refactor regarding hardware interface derivation. The easies way to do this reliably is to assign the igb3 interface as an OPTx and enable it. That will properly scrub the hardware settings.

Cheers,
Franco

[KuddelSK]

Thank you for the hint. I should have thought of it myself. It works. My wireguard problem is still present but at least i could check that it has nothing to do with the hardware offload on that interface.

[fichtner]

Needs to be retested on 22.1 (parent interface handling changed considerably).

[KuddelSK]

My configuration has changed and i can not easily test this setting any time soon. Sorry. But what worked back then was your hint about assigning the parent interface also.
These days i always do this for all interfaces and it seems to work on 22.1 also. But i have no PPPoE connection anymore.

[fichtner]

Fair enough, thanks for the valuable input. Close then? 😊

[KuddelSK]

Yes. I guess this can be closed. Am i supposed to do this? Sorry for the question but i am new to the github issue tracker.

[fichtner]

I can do it, just asked if you agreed. Thanks!