mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-12-22 05:35:25 +00:00
e9e5ebe6a6
Please see the commit log for commit v10.9.0-rc1-1-g42ab0148dd for the
history and explanation of the problem that this patch is fixing.
A shorter explanation is that when a guest is connected to a libvirt
virtual network using a virtio-net adapter with in-kernel "vhost-net"
packet processing enabled, it will fail to acquire an IP address from
a DHCP seever running on the host.
In commit v10.9.0-rc1-1-g42ab0148dd we tried fixing this by *zeroing
out* the checksums of these packets with an nftables rule (nftables
can't recompute the checksum, but it can set it to 0) . This
*appeared* to work initially, but it turned out that zeroing the
checksum ends up breaking dhcp packets on *non* virtio/vhost-net guest
interfaces. That attempt was reverted in commit v10.9.0-rc2.
Fortunately, there is an existing way to recompute the checksum of a
packet as it leaves an interface - the "tc" (traffic control) utility
that libvirt already uses for bandwidth management. This patch uses a
tc filter rule to match dhcp response packets on the bridge and
recompute their checksum.
The filter rule must be attached to a tc qdisc, which may also have a
filter attached for bandwidth management (in the <bandwidth> element
of the network config). Not only must we add the qdisc only once
(which was already handled by the patch two prior to this one), but
also the filter rule for checksum fixing and the filter rule for
bandwidth management must be different priorities so they don't clash;
this is solved by adding the checksum-fix filter with "priority 2",
while the bandwidth management filter remains "priority 1" (both will
always be evaluated anyway, it's just a matter of which is evaluated
first).
So far this method has worked with every different guest we could
throw at it, including several that failed with the previous method.
Fixes: b89c4991da
Reported-by: Rich Jones <rjones@redhat.com>
Reported-by: Andrea Bolognani <abologna@redhat.com>
Fix-Suggested-by: Eric Garver <egarver@redhat.com>
Fix-Suggested-by: Phil Sutter <psutter@redhat.com>
Signed-off-by: Laine Stump <laine@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
243 lines
2.2 KiB
Plaintext
243 lines
2.2 KiB
Plaintext
tc \
|
|
qdisc \
|
|
show \
|
|
dev \
|
|
virbr0 \
|
|
handle \
|
|
1:
|
|
tc \
|
|
qdisc \
|
|
add \
|
|
dev \
|
|
virbr0 \
|
|
root \
|
|
handle \
|
|
1: \
|
|
htb \
|
|
default \
|
|
2
|
|
tc \
|
|
filter \
|
|
add \
|
|
dev \
|
|
virbr0 \
|
|
prio \
|
|
2 \
|
|
protocol \
|
|
ip \
|
|
parent \
|
|
1: \
|
|
u32 \
|
|
match \
|
|
ip \
|
|
dport \
|
|
68 \
|
|
ffff \
|
|
action \
|
|
csum \
|
|
ip \
|
|
and \
|
|
udp
|
|
nft \
|
|
-ae insert \
|
|
rule \
|
|
ip \
|
|
libvirt_network \
|
|
guest_output \
|
|
iif \
|
|
virbr0 \
|
|
counter \
|
|
reject
|
|
nft \
|
|
-ae insert \
|
|
rule \
|
|
ip \
|
|
libvirt_network \
|
|
guest_input \
|
|
oif \
|
|
virbr0 \
|
|
counter \
|
|
reject
|
|
nft \
|
|
-ae insert \
|
|
rule \
|
|
ip \
|
|
libvirt_network \
|
|
guest_cross \
|
|
iif \
|
|
virbr0 \
|
|
oif \
|
|
virbr0 \
|
|
counter \
|
|
accept
|
|
nft \
|
|
-ae insert \
|
|
rule \
|
|
ip6 \
|
|
libvirt_network \
|
|
guest_output \
|
|
iif \
|
|
virbr0 \
|
|
counter \
|
|
reject
|
|
nft \
|
|
-ae insert \
|
|
rule \
|
|
ip6 \
|
|
libvirt_network \
|
|
guest_input \
|
|
oif \
|
|
virbr0 \
|
|
counter \
|
|
reject
|
|
nft \
|
|
-ae insert \
|
|
rule \
|
|
ip6 \
|
|
libvirt_network \
|
|
guest_cross \
|
|
iif \
|
|
virbr0 \
|
|
oif \
|
|
virbr0 \
|
|
counter \
|
|
accept
|
|
nft \
|
|
-ae insert \
|
|
rule \
|
|
ip \
|
|
libvirt_network \
|
|
guest_output \
|
|
ip \
|
|
saddr \
|
|
192.168.122.0/24 \
|
|
iif \
|
|
virbr0 \
|
|
counter \
|
|
accept
|
|
nft \
|
|
-ae insert \
|
|
rule \
|
|
ip \
|
|
libvirt_network \
|
|
guest_input \
|
|
oif \
|
|
virbr0 \
|
|
ip \
|
|
daddr \
|
|
192.168.122.0/24 \
|
|
ct \
|
|
state \
|
|
related,established \
|
|
counter \
|
|
accept
|
|
nft \
|
|
-ae insert \
|
|
rule \
|
|
ip \
|
|
libvirt_network \
|
|
guest_nat \
|
|
ip \
|
|
saddr \
|
|
192.168.122.0/24 \
|
|
ip \
|
|
daddr \
|
|
'!=' \
|
|
192.168.122.0/24 \
|
|
counter \
|
|
masquerade
|
|
nft \
|
|
-ae insert \
|
|
rule \
|
|
ip \
|
|
libvirt_network \
|
|
guest_nat \
|
|
meta \
|
|
l4proto \
|
|
udp \
|
|
ip \
|
|
saddr \
|
|
192.168.122.0/24 \
|
|
ip \
|
|
daddr \
|
|
'!=' \
|
|
192.168.122.0/24 \
|
|
counter \
|
|
masquerade \
|
|
to \
|
|
:1024-65535
|
|
nft \
|
|
-ae insert \
|
|
rule \
|
|
ip \
|
|
libvirt_network \
|
|
guest_nat \
|
|
meta \
|
|
l4proto \
|
|
tcp \
|
|
ip \
|
|
saddr \
|
|
192.168.122.0/24 \
|
|
ip \
|
|
daddr \
|
|
'!=' \
|
|
192.168.122.0/24 \
|
|
counter \
|
|
masquerade \
|
|
to \
|
|
:1024-65535
|
|
nft \
|
|
-ae insert \
|
|
rule \
|
|
ip \
|
|
libvirt_network \
|
|
guest_nat \
|
|
ip \
|
|
saddr \
|
|
192.168.122.0/24 \
|
|
ip \
|
|
daddr \
|
|
255.255.255.255/32 \
|
|
counter \
|
|
return
|
|
nft \
|
|
-ae insert \
|
|
rule \
|
|
ip \
|
|
libvirt_network \
|
|
guest_nat \
|
|
ip \
|
|
saddr \
|
|
192.168.122.0/24 \
|
|
ip \
|
|
daddr \
|
|
224.0.0.0/24 \
|
|
counter \
|
|
return
|
|
nft \
|
|
-ae insert \
|
|
rule \
|
|
ip6 \
|
|
libvirt_network \
|
|
guest_output \
|
|
ip6 \
|
|
saddr \
|
|
2001:db8:ca2:2::/64 \
|
|
iif \
|
|
virbr0 \
|
|
counter \
|
|
accept
|
|
nft \
|
|
-ae insert \
|
|
rule \
|
|
ip6 \
|
|
libvirt_network \
|
|
guest_input \
|
|
ip6 \
|
|
daddr \
|
|
2001:db8:ca2:2::/64 \
|
|
oif \
|
|
virbr0 \
|
|
counter \
|
|
accept
|