Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 414131 - Checksum offloading and IP connection tracking don't play well together
Checksum offloading and IP connection tracking don't play well together
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: kernel-xen (Show other bugs)
All Linux
low Severity low
: ---
: ---
Assigned To: Herbert Xu
Martin Jenner
: 427443 (view as bug list)
Depends On:
Blocks: 427873
  Show dependency treegraph
Reported: 2007-12-06 10:31 EST by Ian Campbell
Modified: 2008-07-24 15:22 EDT (History)
3 users (show)

See Also:
Fixed In Version: RHSA-2008-0665
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-07-24 15:22:59 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
backported version of 157:36d020268c6c (1.76 KB, patch)
2007-12-06 10:33 EST, Ian Campbell
no flags Details | Diff

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2008:0665 normal SHIPPED_LIVE Moderate: Updated kernel packages for Red Hat Enterprise Linux 4.7 2008-07-24 12:41:06 EDT

  None (edit)
Description Ian Campbell 2007-12-06 10:31:00 EST
With the 2.6.9-67.EL xenU kernel I am unable to ssh into the guest if the
firewall is enabled. I have confirmed that SSH is being allowed through by the
firewall. sshd forks a new process to recieve the connection but this then waits
forever for more data.

If I "service iptables stop" within the guest then all works OK. 

I believe this is fixed by
Comment 1 Ian Campbell 2007-12-06 10:33:54 EST
Created attachment 279791 [details]
backported version of 157:36d020268c6c

I had to munge 157:36d020268c6c to get it to apply, the version I ended up with
is attached.

Alternatively there are a handful of prior patches that rework the GSO vs. TSO
setup in netfront.c which you could pull in that would probably make 157 apply
Comment 2 Don Dutile 2008-01-07 18:01:24 EST
This only fails if ssh'ing from another (any) domU to the 2.6.9-67.EL xenU/domU
on the same local machine.
ssh-ing from dom0 works; ssh-ing from another remote machine works also.

Comment 3 Herbert Xu 2008-01-08 01:02:44 EST
Can you reproduce this Don? If so I'd like to login and have a look at it.  Thanks!
Comment 4 Herbert Xu 2008-01-08 19:02:31 EST
Having seen the bug myself I agree that Ian's fix is the best one for RHEL4.

I was surprised at first that the problem didn't seem to affect dom0 to domU,
but then realised that's because the dom0 kernel is old enough that it checksums
all TSO packets going to a non-TSO interface.
Comment 5 Don Dutile 2008-01-15 11:28:33 EST
Patch/attachment listed in comment #1 posted for rhel4.7 inclusion.
flags set for devel, qa, pm approval.
also set 4.6.z flag, so it is reviewed if needed for 4.6 asap, or whether 4.7 is
Comment 7 Vivek Goyal 2008-02-07 14:51:13 EST
Committed in 68.10. RPMS are available at http://people.redhat.com/vgoyal/rhel4/
Comment 8 Andreas Thienemann 2008-02-13 04:35:41 EST
*** Bug 427443 has been marked as a duplicate of this bug. ***
Comment 9 Andreas Thienemann 2008-02-13 04:36:36 EST
Confirmed working with 68.11. Thx for the fix.
Comment 12 errata-xmlrpc 2008-07-24 15:22:59 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.