Stephen Hemminger schrieb:
Could you try turning off rx checksumming (with ethtool).
ethtool -K eth0 rx off
There probably still are (generic) bugs in the netfilter code for CHECKSUM_HW
socket buffers.
"ethtool -K eth0 rx off" does cure my problem with sky2.
Anybody is invited to send patches as the problem is 100% reproducible here.
cu,
Knut
On Tue, 24 Jan 2006 10:43:57 +0100
Knut Petersen [off-list ref] wrote:
Stephen Hemminger schrieb:
quoted
Could you try turning off rx checksumming (with ethtool).
ethtool -K eth0 rx off
There probably still are (generic) bugs in the netfilter code for CHECKSUM_HW
socket buffers.
"ethtool -K eth0 rx off" does cure my problem with sky2.
Anybody is invited to send patches as the problem is 100% reproducible here.
Does it always show up on icmp only?
What are the iptables rules (iptables -L)
--
Stephen Hemminger [off-list ref]
OSDL http://developer.osdl.org/~shemminger
Knut Petersen [off-list ref] wrote:
"ethtool -K eth0 rx off" does cure my problem with sky2.
Anybody is invited to send patches as the problem is 100% reproducible here.
Does the problem go away if you disable conntrack by unloading its module?
Please try to capture the offending ICMP packet with tcpdump and show us
what it looks like.
Thanks,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
* Herbert Xu wrote:
Does the problem go away if you disable conntrack by unloading its module?
Please try to capture the offending ICMP packet with tcpdump and show us
what it looks like.
Well, there are no problems if SuSEfirewall2 is disabled. But have a look
at the loaded modules:
ipt_MASQUERADE 3968 1
pppoe 15360 2
pppox 4616 1 pppoe
af_packet 23240 2
ppp_generic 30740 6 pppoe,pppox
slhc 7040 1 ppp_generic
ipt_TOS 2816 28
ipt_TCPMSS 4800 2
ipt_LOG 7232 55
ipt_limit 2880 55
ipt_pkttype 1984 4
ipt_state 2240 46
ip6t_LOG 8000 1
ip6t_limit 3008 1
ip6t_REJECT 5824 3
ipt_REJECT 5952 3
iptable_mangle 3200 1
iptable_nat 8836 1
iptable_filter 3264 1
ip6table_mangle 2752 0
ip_nat_ftp 3776 0
ip_nat 18284 3 ipt_MASQUERADE,iptable_nat,ip_nat_ftp
ip_conntrack_ftp 8240 1 ip_nat_ftp
ip_conntrack 51020 6
ipt_MASQUERADE,ipt_state,iptable_nat,ip_nat_ftp,ip_nat,ip_conntrack_ftp
ip_tables 24088 11
ipt_MASQUERADE,ipt_TOS,ipt_TCPMSS,ipt_LOG,ipt_limit,ipt_pkttype,ipt_state,ipt_REJECT,iptable_mangle,iptable_nat,iptable_filter
ip6table_filter 3136 1
ip6_tables 25624 5
ip6t_LOG,ip6t_limit,ip6t_REJECT,ip6table_mangle,ip6table_filter
ipv6 271712 14 ip6t_REJECT
How should I unload ip_conntrack alone?
* Stephen Hemminger wrote:
Does it always show up on icmp only?
What are the iptables rules (iptables -L)
As far as I can see, all my sky2 problems are gone with -K rx off.
So here is more information. I executed the following script:
logger Starting test
logger "Executing ethtool -K eth0 rx off"
ethtool -K eth0 rx off
logger "Executing tcpdump -i eth0 -vv > tcpdumpfile &"
tcpdump -i eth0 -vv > tcpdumpfile &
logger "Executing host www.suse.com"
host www.suse.com
logger "Sleeping 2 seconds"
sleep 2
logger "Executing ping -c 2 195.135.220.3"
ping -c 2 195.135.220.3
logger "Sleeping 2 seconds"
sleep 2
logger "Executing ethtool -K eth0 rx on"
ethtool -K eth0 rx on
logger "Sleeping 2 seconds"
sleep 2
logger "Executing host www.suse.com"
host www.suse.com
logger "Sleeping 2 seconds"
sleep 2
logger "Executing ping -c 2 195.135.220.3"
ping -c 2 195.135.220.3
logger "Sleeping 2 seconds"
sleep 2
logger "Executing ethtool -K eth0 rx off"
ethtool -K eth0 rx off
logger "Sleeping 2 seconds"
sleep 2
logger "killall tcpdump"
killall tcpdump
logger End of test
The first host and ping worked fine, after the ethtool -K eth0 rx on
the host www.suse.com timed out with
;; connection timed out; no servers could be reached
and the ping 195.135.220.3 provoked the stack traces you see in sky2syslog.
I attach the syslog for the time of the test, the output of iptables -L
and the
output of tcpdump as the very long lines included would be hard to read
with linebreaks.
No, I did _not_ delete anything from the tcpdump file.
cu,
Knut
On Fri, Jan 27, 2006 at 07:07:34AM +0100, Knut Petersen wrote:
Well, there are no problems if SuSEfirewall2 is disabled. But have a look
at the loaded modules:
ipt_MASQUERADE 3968 1
pppoe 15360 2
pppox 4616 1 pppoe
OK, although we can't rule out sky2/netfilter from the enquiry, I've
identified two bugs in ppp/pppoe that may be responsible for what you
are seeing. So please try the following patch and let us know if the
problem still exists (or deteriorates/improves).
[PPP]: Fixed hardware RX checksum handling
When we pull the PPP protocol off the skb, we forgot to update the
hardware RX checksum. This may lead to messages such as
dsl0: hw csum failure.
Similarly, we need to clear the hardware checksum flag when we use
the existing packet to store the decompressed result.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
Herbert Xu wrote:
On Fri, Jan 27, 2006 at 07:07:34AM +0100, Knut Petersen wrote:
quoted
Well, there are no problems if SuSEfirewall2 is disabled. But have a look
at the loaded modules:
ipt_MASQUERADE 3968 1
pppoe 15360 2
pppox 4616 1 pppoe
OK, although we can't rule out sky2/netfilter from the enquiry, I've
identified two bugs in ppp/pppoe that may be responsible for what you
are seeing. So please try the following patch and let us know if the
problem still exists (or deteriorates/improves).
[PPP]: Fixed hardware RX checksum handling
When we pull the PPP protocol off the skb, we forgot to update the
hardware RX checksum. This may lead to messages such as
dsl0: hw csum failure.
Similarly, we need to clear the hardware checksum flag when we use
the existing packet to store the decompressed result.
We had a couple of reports of incorrect hardware checksums with
PPPoE. KdF, can you test Herbert's patch (attached again to this
mail) please?
Herbert Xu wrote:
When we pull the PPP protocol off the skb, we forgot to update the
hardware RX checksum. This may lead to messages such as
dsl0: hw csum failure.
Similarly, we need to clear the hardware checksum flag when we use
the existing packet to store the decompressed result.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
ACK
That patch seems to solve all my problems with
sky2 / pppoe / SuSE 9.2 Firewall.
Thanks a lot!
cu,
Knut