Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
For bugs related to Red Hat Enterprise Linux 4 product line. The current stable release is 4.9. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 414131

Summary: Checksum offloading and IP connection tracking don't play well together
Product: Red Hat Enterprise Linux 4 Reporter: Ian Campbell <ijc>
Component: kernel-xenAssignee: Herbert Xu <herbert.xu>
Status: CLOSED ERRATA QA Contact: Martin Jenner <mjenner>
Severity: low Docs Contact:
Priority: low    
Version: 4.6CC: athienem, ddutile, xen-maint
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: RHSA-2008-0665 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-07-24 19:22:59 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 427873    
Attachments:
Description Flags
backported version of 157:36d020268c6c none

Description Ian Campbell 2007-12-06 15:31:00 UTC 
With the 2.6.9-67.EL xenU kernel I am unable to ssh into the guest if the
firewall is enabled. I have confirmed that SSH is being allowed through by the
firewall. sshd forks a new process to recieve the connection but this then waits
forever for more data.

If I "service iptables stop" within the guest then all works OK. 

I believe this is fixed by
http://hg.uk.xensource.com/xen-unstable.hg?cs=36d020268c6c
Comment 1 Ian Campbell 2007-12-06 15:33:54 UTC 
Created attachment 279791 [details]
backported version of 157:36d020268c6c

I had to munge 157:36d020268c6c to get it to apply, the version I ended up with
is attached.

Alternatively there are a handful of prior patches that rework the GSO vs. TSO
setup in netfront.c which you could pull in that would probably make 157 apply
ok.
Comment 2 Don Dutile (Red Hat) 2008-01-07 23:01:24 UTC 
This only fails if ssh'ing from another (any) domU to the 2.6.9-67.EL xenU/domU
on the same local machine.
ssh-ing from dom0 works; ssh-ing from another remote machine works also.
Comment 3 Herbert Xu 2008-01-08 06:02:44 UTC 
Can you reproduce this Don? If so I'd like to login and have a look at it.  Thanks!
Comment 4 Herbert Xu 2008-01-09 00:02:31 UTC 
Having seen the bug myself I agree that Ian's fix is the best one for RHEL4.

I was surprised at first that the problem didn't seem to affect dom0 to domU,
but then realised that's because the dom0 kernel is old enough that it checksums
all TSO packets going to a non-TSO interface.
Comment 5 Don Dutile (Red Hat) 2008-01-15 16:28:33 UTC 
Patch/attachment listed in comment #1 posted for rhel4.7 inclusion.
flags set for devel, qa, pm approval.
also set 4.6.z flag, so it is reviewed if needed for 4.6 asap, or whether 4.7 is
sufficient.
Comment 7 Vivek Goyal 2008-02-07 19:51:13 UTC 
Committed in 68.10. RPMS are available at http://people.redhat.com/vgoyal/rhel4/
Comment 8 Andreas Thienemann 2008-02-13 09:35:41 UTC 
*** Bug 427443 has been marked as a duplicate of this bug. ***
Comment 9 Andreas Thienemann 2008-02-13 09:36:36 UTC 
Confirmed working with 68.11. Thx for the fix.
Comment 12 errata-xmlrpc 2008-07-24 19:22:59 UTC 
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2008-0665.html