A pool-operator in XAPI-based hypervisors (XenServer, XCP-ng) can disable NIC hardware offload features on any physical network interface by writing ethtool-gro=off, ethtool-tso=off, ethtool-gso=off, ethtool-lro=off, or other ethtool-* keys to PIF.other_config. These keys are consumed by nm.ml:45-110 (determine_ethtool_settings) and passed to xcp-networkd for application via ethtool -K. Disabling offloads forces the host CPU to perform network segmentation and reassembly in software, causing performance degradation that affects all VMs and management traffic on the affected PIF. The ethtool-gro key has an additional impact: it overrides the PIF.properties:gro first-class field through a backward compatibility path documented in pif-properties.md:35. The PIF.other_config field has zero map_keys_roles entries.
PIF.other_config is a Map(String, String) field defined at datamodel.ml:2784-2788 with no ~writer_roles override and no ~map_keys_roles. It inherits _R_POOL_OP from the PIF class default.
The ethtool settings extraction at nm.ml:45-110:
determine_ethtool_settings:
reads ethtool-speed, ethtool-duplex, ethtool-autoneg, ethtool-advertise
reads ethtool-rx, ethtool-tx, ethtool-sg, ethtool-tso, ethtool-ufo,
ethtool-gso, ethtool-gro, ethtool-lro
The extracted settings are passed to xcp-networkd via bridge/interface configuration. xcp-networkd applies them using ethtool -K <interface> <feature> <on|off> through execve (no shell injection possible).
PIF.other_config has the highest merge precedence in the other_config merge chain at nm.ml:112-120. PIF values override both Network.other_config and Pool.other_config. This means a PIF-level ethtool setting cannot be overridden by pool-level or network-level configuration.
The performance impact of disabling offloads:
Missing RBAC protection. PIF.other_config has zero map_keys_roles entries. All ethtool-* keys are writable by any pool-operator.
No impact assessment at write time. XAPI does not evaluate whether disabling offloads on a management or storage PIF would degrade critical infrastructure performance.
Backward compatibility override. The ethtool-gro key in other_config overrides the PIF.properties:gro first-class field, bypassing the RBAC and validation of the dedicated property.
set_other_config RBAC bypass. The set_other_config method replaces the entire map atomically and bypasses map_keys_roles per-key checks.
| Scenario | Impact | Pre-conditions | Status |
|---|---|---|---|
| Management PIF performance degradation | Host CPU saturation from software segmentation on management traffic | pool-operator, disable TSO/GRO on management PIF | Source-traced |
| Storage PIF throughput reduction | iSCSI/NFS throughput drops due to software packet processing | pool-operator, disable offloads on storage PIF | Source-traced |
| GRO backward compat bypass | Disable GRO via other_config, overriding PIF.properties:gro | pool-operator | Source-traced |
| BOC-1 chain | vm-admin disables offloads across all PIFs via RBAC collapse | vm-admin, BOC-1 | Source-traced |
PIF.other_config for ethtool-* key changes=off) on management or storage PIFsdisclosure/vendor-detection-guidance.mdPIF.other_config entries for unexpected ethtool-* settingsethtool -k <interface> across all hostsAdd map_keys_roles protection. Restrict ethtool-* keys to _R_POOL_ADMIN in datamodel.ml. NIC offload configuration is a host infrastructure operation.
Remove backward compatibility override. Deprecate the ethtool-gro other_config key in favor of the PIF.properties:gro first-class field with proper RBAC.
Upstream patches exist. They are held privately pending coordinated disclosure.
Disclosure:
datamodel.ml:2784-2788 (PIF.other_config field definition, zero map_keys_roles), nm.ml:45-110 (determine_ethtool_settings), nm.ml:112-120 (PIF has highest merge precedence), pif-properties.md:35 (GRO backward compatibility override)disclosure/advisories/poc-security-advisory.md (POC-4)research/investigations/pif-other-config.mdDiscovered and reported by Jakob Wolffhechel, Moksha.