Red Hat Bugzilla – Bug 414131
Checksum offloading and IP connection tracking don't play well together
Last modified: 2008-07-24 15:22:59 EDT
With the 2.6.9-67.EL xenU kernel I am unable to ssh into the guest if the firewall is enabled. I have confirmed that SSH is being allowed through by the firewall. sshd forks a new process to recieve the connection but this then waits forever for more data. If I "service iptables stop" within the guest then all works OK. I believe this is fixed by http://hg.uk.xensource.com/xen-unstable.hg?cs=36d020268c6c
Created attachment 279791 [details] backported version of 157:36d020268c6c I had to munge 157:36d020268c6c to get it to apply, the version I ended up with is attached. Alternatively there are a handful of prior patches that rework the GSO vs. TSO setup in netfront.c which you could pull in that would probably make 157 apply ok.
This only fails if ssh'ing from another (any) domU to the 2.6.9-67.EL xenU/domU on the same local machine. ssh-ing from dom0 works; ssh-ing from another remote machine works also.
Can you reproduce this Don? If so I'd like to login and have a look at it. Thanks!
Having seen the bug myself I agree that Ian's fix is the best one for RHEL4. I was surprised at first that the problem didn't seem to affect dom0 to domU, but then realised that's because the dom0 kernel is old enough that it checksums all TSO packets going to a non-TSO interface.
Patch/attachment listed in comment #1 posted for rhel4.7 inclusion. flags set for devel, qa, pm approval. also set 4.6.z flag, so it is reviewed if needed for 4.6 asap, or whether 4.7 is sufficient.
Committed in 68.10. RPMS are available at http://people.redhat.com/vgoyal/rhel4/
*** Bug 427443 has been marked as a duplicate of this bug. ***
Confirmed working with 68.11. Thx for the fix.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2008-0665.html