Laine Stump e9e5ebe6a6 network: add tc filter rule to nftables backend to fix checksum of DHCP responses ... Please see the commit log for commit v10.9.0-rc1-1-g42ab0148dd for the history and explanation of the problem that this patch is fixing. A shorter explanation is that when a guest is connected to a libvirt virtual network using a virtio-net adapter with in-kernel "vhost-net" packet processing enabled, it will fail to acquire an IP address from a DHCP seever running on the host. In commit v10.9.0-rc1-1-g42ab0148dd we tried fixing this by *zeroing out* the checksums of these packets with an nftables rule (nftables can't recompute the checksum, but it can set it to 0) . This *appeared* to work initially, but it turned out that zeroing the checksum ends up breaking dhcp packets on *non* virtio/vhost-net guest interfaces. That attempt was reverted in commit v10.9.0-rc2. Fortunately, there is an existing way to recompute the checksum of a packet as it leaves an interface - the "tc" (traffic control) utility that libvirt already uses for bandwidth management. This patch uses a tc filter rule to match dhcp response packets on the bridge and recompute their checksum. The filter rule must be attached to a tc qdisc, which may also have a filter attached for bandwidth management (in the <bandwidth> element of the network config). Not only must we add the qdisc only once (which was already handled by the patch two prior to this one), but also the filter rule for checksum fixing and the filter rule for bandwidth management must be different priorities so they don't clash; this is solved by adding the checksum-fix filter with "priority 2", while the bandwidth management filter remains "priority 1" (both will always be evaluated anyway, it's just a matter of which is evaluated first). So far this method has worked with every different guest we could throw at it, including several that failed with the previous method. Fixes: b89c4991da Reported-by: Rich Jones <rjones@redhat.com> Reported-by: Andrea Bolognani <abologna@redhat.com> Fix-Suggested-by: Eric Garver <egarver@redhat.com> Fix-Suggested-by: Phil Sutter <psutter@redhat.com> Signed-off-by: Laine Stump <laine@redhat.com> Reviewed-by: Michal Privoznik <mprivozn@redhat.com>		2024-11-26 14:36:14 +01:00
..
bhyveargv2xmldata
bhyvefirmwaredata
bhyvexml2argvdata
bhyvexml2xmloutdata
capabilityschemadata
chxml2xmlin
chxml2xmlout
commanddata
cputestdata	cpu_map: Add versions of Dhyana CPU model	2024-11-26 13:04:36 +01:00
domainbackupxml2xmlin
domainbackupxml2xmlout
domaincapsdata	cpu_map: Add KnightsMill CPU model	2024-11-26 13:04:36 +01:00
domainconfdata
domainschemadata
fchostdata/fc_host
genericxml2xmlindata
genericxml2xmloutdata
interfaceschemadata
libxlxml2domconfigdata	libxl_conf: Fix config generation for multiple serial devices	2024-10-02 16:06:50 +02:00
lxcconf2xmldata
lxcxml2xmldata
lxcxml2xmloutdata
networkxml2confdata
networkxml2firewalldata	network: add tc filter rule to nftables backend to fix checksum of DHCP responses	2024-11-26 14:36:14 +01:00
networkxml2xmlin
networkxml2xmlout
networkxml2xmlupdatein	Revert "network: allow "modify" option for DNS-Srv records"	2024-08-05 11:42:35 +02:00
networkxml2xmlupdateout	Revert "network: allow "modify" option for DNS-Srv records"	2024-08-05 11:42:35 +02:00
nodedevmdevctldata
nodedevschemadata
nodedevxml2xmlout
nssdata
nwfilterxml2firewalldata
nwfilterxml2xmlin
nwfilterxml2xmlout
qemuagentdata
qemublocktestdata	qemu: monitor: Extract vmstate presence for internal snapshots in qemuBlockGetNamedNodeData	2024-11-18 13:51:13 +01:00
qemucapabilitiesdata	tests: qemucapabilitiesdata: Update 'x86_64' capabilities for the qemu-9.2 dev cycle	2024-11-19 13:06:02 +01:00
qemucaps2xmloutdata
qemudomaincheckpointxml2xmlin
qemudomaincheckpointxml2xmlout
qemudomainsnapshotxml2xmlin
qemudomainsnapshotxml2xmlout
qemufirmwaredata	tests: Add firmware descriptor for edk2 on riscv64	2024-07-19 15:18:40 +02:00
qemuhotplugtestcpus
qemuhotplugtestdevices	qemuhotplugtest: Add testcases for hotplugging evdev input devices	2024-05-16 14:57:02 +02:00
qemuhotplugtestdomains	qemuhotplugtest: Add testcases for hotplugging evdev input devices	2024-05-16 14:57:02 +02:00
qemumemlockdata
qemumigparamsdata	tests: switch to compact empty JSON object formatting	2024-09-24 08:24:00 +02:00
qemumigrationcookiexmldata
qemumonitorjsondata
qemunbdkitdata
qemusecuritydata
qemustatusxml2xmldata	qemuxmlactivetest: Add tests for <dataStore>	2024-11-25 22:31:18 +01:00
qemuvhostuserdata	qemu: fill capabilities for virtiofsd	2024-07-10 12:32:23 +02:00
qemuxmlactive2xmldata	qemuxml(conf|active)test: Use 'nbd' instead of 'gluster' in 'disk-backing-chains-(no)index' cases	2024-10-16 14:39:09 +02:00
qemuxmlconfdata	qemuxmlconftest: Add test cases for the <dataStore> feature	2024-11-25 22:31:18 +01:00
schemas
secretxml2xmlin
securityselinuxhelperdata
securityselinuxlabeldata
storagepoolcapsschemadata
storagepoolschemadata
storagepoolxml2argvdata
storagepoolxml2xmlin
storagepoolxml2xmlout
storagevolschemadata
storagevolxml2argvdata
storagevolxml2xmlin
storagevolxml2xmlout
sysinfodata	virsysinfo: Calculate OEM string index better	2024-07-25 16:51:17 +02:00
vboxsnapshotxmldata
viracpidata
vircaps2xmldata	tests: Add caps2xml and resctrl data from the wild	2024-09-13 12:57:42 +02:00
vircgroupdata
virconfdata
virfilecachedata
virfiledata
virhostcpudata
virjsondata
virmacmaptestdata	tests: switch to compact empty JSON object formatting	2024-09-24 08:24:00 +02:00
virnetdaemondata
virnetdevopenvswitchdata
virnetdevtestdata/sys/class/net
virnetworkportxml2xmldata
virnwfilterbindingxml2xmldata
virpcitestdata
virprocessstatdata
virresctrldata	tests: Add caps2xml and resctrl data from the wild	2024-09-13 12:57:42 +02:00
virscsidata
virshtestdata	virshtest: Add test case for script friendly options	2024-09-05 15:24:55 +02:00
virstoragetestdata	tests: virstoragetest: Add tests for detection of qcow2 'data_file' feature	2024-11-25 22:31:18 +01:00
virstorageutildata
virusbtestdata/sys_bus_usb/devices
virutiltestdata
vmwareverdata
vmx2xmldata	vmx: Get the VMware boolean uefi.secureBoot.enabled	2024-11-18 15:29:43 +01:00
xlconfigdata	conf: Always format firmware image format	2024-11-15 09:42:04 +01:00
xmconfigdata	conf: Always format firmware image format	2024-11-15 09:42:04 +01:00
xml2vmxdata
.valgrind.supp
bhyveargv2xmlmock.c
bhyveargv2xmltest.c
bhyvexml2argvmock.c
bhyvexml2argvtest.c
bhyvexml2xmltest.c
chxml2xmlmock.c
chxml2xmltest.c
commandhelper.c
commandtest.c	virGetGroupList: Refactor and fix callers	2024-05-23 14:32:24 +02:00
cputest.c	domain_capabilities: Report canonical names of CPU models	2024-11-26 13:04:34 +01:00
domaincapsmock.c
domaincapstest.c	hypervisor: move HostdevHostSupportsPassthroughVFIO	2024-11-15 13:15:22 +01:00
domainconftest.c
esxutilstest.c
eventtest.c
fchosttest.c	tests: fix tests when test driver is disabled	2024-05-08 15:57:31 +01:00
fdstreamtest.c
genericxml2xmltest.c
interfacexml2xmltest.c
libxlmock.c	test: drop bogus check for YAJL from libxl test/mock	2024-05-08 16:01:34 +01:00
libxlxml2domconfigtest.c	libxl_conf: Fix config generation for multiple serial devices	2024-10-02 16:06:50 +02:00
lxcconf2xmltest.c
lxcxml2xmltest.c
meson.build	meson: options: drop yajl	2024-09-24 08:24:00 +02:00
metadatatest.c
networkmetadatatest.c
networkxml2conftest.c
networkxml2firewalltest.c	network: add more firewall test cases	2024-06-24 13:51:04 +01:00
networkxml2xmltest.c
networkxml2xmlupdatetest.c	Revert "network: allow "modify" option for DNS-Srv records"	2024-08-05 11:42:35 +02:00
nodedevmdevctltest.c
nodedevxml2xmltest.c	test: nodedev: fill active_config at driver startup time	2024-04-24 09:38:54 -04:00
nsslinktest.c
nssmock.c
nsstest.c
nwfilterebiptablestest.c
nwfilterxml2firewalltest.c
nwfilterxml2xmltest.c
objecteventtest.c
openvzutilstest.c
openvzutilstest.conf
permitted_file_access.txt
pkix_asn1_tab.c
qemuagenttest.c
qemublocktest.c	qemu: monitor: Extract vmstate presence for internal snapshots in qemuBlockGetNamedNodeData	2024-11-18 13:51:13 +01:00
qemucapabilitiestest.c
qemucaps2xmlmock.c
qemucaps2xmltest.c
qemucapsprobe.c
qemucapsprobemock.c
qemucommandutiltest.c
qemucpumock.c
qemudomaincheckpointxml2xmltest.c
qemudomainsnapshotxml2xmltest.c
qemufirmwaretest.c	tests: Add firmware descriptor for edk2 on riscv64	2024-07-19 15:18:40 +02:00
qemuhotplugmock.c
qemuhotplugtest.c	tests: add capabilities for QEMU 9.1.0 on s390x	2024-10-24 18:46:21 +02:00
qemumemlocktest.c
qemumigparamstest.c	tests: switch to compact empty JSON object formatting	2024-09-24 08:24:00 +02:00
qemumigrationcookiexmltest.c	lib: Annotate more function as NULL terminated	2024-06-06 09:29:58 +02:00
qemumonitorjsontest.c	qemu: chardev: Use 'reconnect-ms' instead of deprecated 'reconnect'	2024-10-16 14:39:09 +02:00
qemumonitortestutils.c	qemumonitortestutils: Fix G_GNUC_PRINTF annotation of qemuMonitorTestAddErrorResponse()	2024-06-06 09:32:43 +02:00
qemumonitortestutils.h	qemumonitortestutils: Fix G_GNUC_PRINTF annotation of qemuMonitorTestAddErrorResponse()	2024-06-06 09:32:43 +02:00
qemunbdkittest.c
qemusecuritymock.c
qemusecuritytest.c	qemusecuritytest: drop disk-network-tlsx509-vxhs test case	2024-07-02 09:13:47 +02:00
qemusecuritytest.h
qemuvhostusertest.c	tests: vhostuser: add virtiofsd json descriptor	2024-07-10 12:32:23 +02:00
qemuxml2argvmock.c	hypervisor: Move domain interface mgmt methods	2024-08-26 16:10:04 +02:00
qemuxmlactivetest.c	qemuxmlactivetest: Add tests for <dataStore>	2024-11-25 22:31:18 +01:00
qemuxmlconftest.c	qemuxmlconftest: Add test cases for the <dataStore> feature	2024-11-25 22:31:18 +01:00
scsihosttest.c
seclabeltest.c
secretxml2xmltest.c
securityselinuxhelper.c	tests: stop stubbing libselinux APIs for purpose of data overrides	2024-10-16 15:47:52 +01:00
securityselinuxlabeltest.c	tests: stop stubbing libselinux APIs for purpose of data overrides	2024-10-16 15:47:52 +01:00
securityselinuxtest.c	tests: stop stubbing libselinux APIs for purpose of data overrides	2024-10-16 15:47:52 +01:00
shunloadhelper.c
shunloadtest.c
sockettest.c
ssh.c
storagepoolcapstest.c
storagepoolxml2argvtest.c
storagepoolxml2xmltest.c
storagevolxml2argvtest.c
storagevolxml2xmltest.c
sysinfotest.c	virsysinfo: Calculate OEM string index better	2024-07-25 16:51:17 +02:00
testutils.c
testutils.h	lib: Annotate more function as NULL terminated	2024-06-06 09:29:58 +02:00
testutilshostcpus.h
testutilslxc.c
testutilslxc.h
testutilsqemu.c	util: Add parsing support for swtpm_setup's cmdarg-profile capability	2024-11-18 08:46:24 +01:00
testutilsqemu.h	Drop unused function declarations	2024-11-12 15:35:53 +01:00
testutilsqemuschema.c	testutilsqemuschema: Support 'unstable' feature in QMP schema validator	2024-10-01 12:53:49 +02:00
testutilsqemuschema.h	lib: Annotate more function as NULL terminated	2024-06-06 09:29:58 +02:00
testutilsxen.c
testutilsxen.h
utiltest.c
vboxsnapshotxmltest.c
viracpitest.c
viralloctest.c
virauthconfigtest.c
virbitmaptest.c	virBitmapShrink: Do not attempt to clear bits beyond end of buffer	2024-09-10 14:25:37 +02:00
virbuftest.c
vircaps2xmltest.c	tests: Add caps2xml and resctrl data from the wild	2024-09-13 12:57:42 +02:00
vircgroupmock.c
vircgrouptest.c
virconftest.c
vircryptotest.c
virdnsmasqmock.c
virdriverconnvalidatetest.c
virdrivermoduletest.c
virendiantest.c
virerrortest.c
virfilecachemock.c
virfilecachetest.c
virfilemock.c
virfiletest.c	qemu: Propagate shared_filesystems	2024-10-03 13:29:26 +02:00
virfilewrapper.c
virfilewrapper.h
virfirewallmock.c
virfirewalltest.c	util/network: new virFirewallBackend enum	2024-05-22 23:19:18 -04:00
virgdbusmock.c
virhostcpumock.c
virhostcputest.c
virhostdevmock.c
virhostdevtest.c
virhostidmock.c
viridentitytest.c	tests: stop stubbing libselinux APIs for purpose of data overrides	2024-10-16 15:47:52 +01:00
viriscsitest.c
virjsontest.c	tests: json: relax some test cases	2024-08-16 13:11:57 +02:00
virkeycodetest.c
virkmodtest.c
virlockspacetest.c
virlogtest.c
virmacmaptest.c	tests: switch to compact empty JSON object formatting	2024-09-24 08:24:00 +02:00
virmigtest.c
virmock.h
virmockstathelpers.c
virnetdaemonmock.c
virnetdaemontest.c	build: introduce WITH_JSON	2024-09-24 08:24:00 +02:00
virnetdevbandwidthmock.c
virnetdevbandwidthtest.c	util: don't re-add the qdisc used for tx filters if it already exists	2024-11-26 14:36:14 +01:00
virnetdevmock.c
virnetdevopenvswitchtest.c
virnetdevtest.c
virnetmessagetest.c
virnetserverclientmock.c
virnetserverclienttest.c
virnetsockettest.c
virnettlscontexttest.c
virnettlshelpers.c
virnettlshelpers.h
virnettlssessiontest.c
virnetworkportxml2xmltest.c
virnumamock.c
virnwfilterbindingxml2xmltest.c
virpcimock.c
virpcitest.c
virpcivpdtest.c
virpolkittest.c
virportallocatormock.c
virportallocatortest.c
virprocessmock.c
virprocessstattest.c
virrandommock.c
virresctrltest.c	tests: Add caps2xml and resctrl data from the wild	2024-09-13 12:57:42 +02:00
virrotatingfiletest.c
virschematest.c	virschematest: Replace g_lstat() with virFileIsLink()	2024-08-28 08:46:16 +02:00
virscsitest.c
virsh-auth
virsh-auth.xml
virshtest.c	virshtest: Add test case for script friendly options	2024-09-05 15:24:55 +02:00
virstoragetest.c	tests: virstoragetest: Add tests for detection of qcow2 'data_file' feature	2024-11-25 22:31:18 +01:00
virstorageutiltest.c
virstringtest.c
virsystemdtest.c
virt-aa-helper-test
virtestmock.c
virtimetest.c
virtypedparamtest.c	virTypedParamsFilter: Introduce option to filter also by type	2024-10-01 12:57:02 +02:00
viruritest.c
virusbmock.c
virusbtest.c
vmwarevertest.c
vmx2xmltest.c	vmx: Allow '*' to appear in VMX file keys	2024-09-12 09:51:58 +02:00
vshtabletest.c
xlconfigtest.c	libxl: Fix domxml-to-native conversion	2024-05-02 15:57:29 -06:00
xmconfigtest.c	libxl: Fix domxml-to-native conversion	2024-05-02 15:57:29 -06:00
xml2vmxtest.c