Re: [PATCH v2] network: add rule to nftables backend that zeroes checksum of DHCP responses
On 10/29/24 9:14 AM, Daniel P. Berrangé wrote:
On Tue, Oct 29, 2024 at 01:09:00PM +0000, Andrea Bolognani wrote:
> On Tue, Oct 29, 2024 at 12:46:55PM +0000, Daniel P. Berrangé wrote:
>> A key difference that is probably relevant is that netbsd is
>> using an e1000 NIC in QEMU, while openbsd is using a virtio-net
>> NIC. At least when created by virt-manager.
>>
>> AFAIR, QEMU's magic checksum offload only happens for virtio-net,
>> so presumably our rules are incompatible with non-virtio-net NICs
>> in someway.
>
> Yes, that's it! The GNU/Hurd and Haiku guests are also using e1000,
> since virtio drivers are not available there; moreover, if I switch a
> random Linux guest from virtio-net to e1000 I can reproduce the issue
> there as well.
Incidentally, I think this has crossed the threshold where the cure is
worse than the disease.
We cannot ship the forthcoming libvirt release with a checksum "fix"
that breaks all usage of NICs that aren't virtio-net, as that guarantees
brokeness for all historical OS.
If we can't quickly find a way to improve this, I think we need to
revert (or disable) the checksum zero'ing fix for this release and
spend more time investigating it.
I sadly agree :-/ (although I will point out that it's not *all*
non-virtio, since e1000e seems to work). I am leaving the house now, but
will make a patch to either disable or the revert the "fix" when I get
back in a few hours. (I would rather leave it in with a switch or
something so we could continue using standard builds to test things, but
that might take too long and would definitely be too complicated for a
last instant push)
With regards,
Daniel