Bug 414131 - Checksum offloading and IP connection tracking don't play well together
Summary: Checksum offloading and IP connection tracking don't play well together
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: kernel-xen
Version: 4.6
Hardware: All
OS: Linux
low
low
Target Milestone: ---
: ---
Assignee: Herbert Xu
QA Contact: Martin Jenner
URL:
Whiteboard:
: 427443 (view as bug list)
Depends On:
Blocks: 427873
TreeView+ depends on / blocked
 
Reported: 2007-12-06 15:31 UTC by Ian Campbell
Modified: 2008-07-24 19:22 UTC (History)
3 users (show)

Fixed In Version: RHSA-2008-0665
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-07-24 19:22:59 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
backported version of 157:36d020268c6c (1.76 KB, patch)
2007-12-06 15:33 UTC, Ian Campbell 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2008:0665 0 normal SHIPPED_LIVE Moderate: Updated kernel packages for Red Hat Enterprise Linux 4.7 2008-07-24 16:41:06 UTC

Description Ian Campbell 2007-12-06 15:31:00 UTC 
With the 2.6.9-67.EL xenU kernel I am unable to ssh into the guest if the
firewall is enabled. I have confirmed that SSH is being allowed through by the
firewall. sshd forks a new process to recieve the connection but this then waits
forever for more data.

If I "service iptables stop" within the guest then all works OK. 

I believe this is fixed by
http://hg.uk.xensource.com/xen-unstable.hg?cs=36d020268c6c
Comment 1 Ian Campbell 2007-12-06 15:33:54 UTC 
Created attachment 279791 [details]
backported version of 157:36d020268c6c

I had to munge 157:36d020268c6c to get it to apply, the version I ended up with
is attached.

Alternatively there are a handful of prior patches that rework the GSO vs. TSO
setup in netfront.c which you could pull in that would probably make 157 apply
ok.
Comment 2 Don Dutile (Red Hat) 2008-01-07 23:01:24 UTC 
This only fails if ssh'ing from another (any) domU to the 2.6.9-67.EL xenU/domU
on the same local machine.
ssh-ing from dom0 works; ssh-ing from another remote machine works also.
Comment 3 Herbert Xu 2008-01-08 06:02:44 UTC 
Can you reproduce this Don? If so I'd like to login and have a look at it.  Thanks!
Comment 4 Herbert Xu 2008-01-09 00:02:31 UTC 
Having seen the bug myself I agree that Ian's fix is the best one for RHEL4.

I was surprised at first that the problem didn't seem to affect dom0 to domU,
but then realised that's because the dom0 kernel is old enough that it checksums
all TSO packets going to a non-TSO interface.
Comment 5 Don Dutile (Red Hat) 2008-01-15 16:28:33 UTC 
Patch/attachment listed in comment #1 posted for rhel4.7 inclusion.
flags set for devel, qa, pm approval.
also set 4.6.z flag, so it is reviewed if needed for 4.6 asap, or whether 4.7 is
sufficient.
Comment 7 Vivek Goyal 2008-02-07 19:51:13 UTC 
Committed in 68.10. RPMS are available at http://people.redhat.com/vgoyal/rhel4/
Comment 8 Andreas Thienemann 2008-02-13 09:35:41 UTC 
*** Bug 427443 has been marked as a duplicate of this bug. ***
Comment 9 Andreas Thienemann 2008-02-13 09:36:36 UTC 
Confirmed working with 68.11. Thx for the fix.
Comment 12 errata-xmlrpc 2008-07-24 19:22:59 UTC 
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2008-0665.html
Note You need to log in before you can comment on or make changes to this bug.