From fa56d0b3e6b8bf62396a820a84621c9eb8707a42 Mon Sep 17 00:00:00 2001 From: Wido den Hollander Date: Mon, 31 Oct 2016 20:43:39 +0100 Subject: [PATCH] CLOUDSTACK-8326: Always fill UDP checksums in DHCP replies in VR In some cases the UDP checksums in packets from DHCP servers are incorrect. This is a problem for some DHCP clients that ignore packets with bad checksums. This patch inserts an iptables rule to ensure DHCP servers always send packets with correct checksums. Due to this bug DHCP offers are sometimes not accepted by Instances. The end-result without this fix is no connectivity for the Instance due to the lack of a IPv4 address. This is also commited in OpenStack: - https://github.com/projectcalico/felix/issues/40 - https://review.openstack.org/148718 - https://bugzilla.redhat.com/show_bug.cgi?id=910619 Signed-off-by: Wido den Hollander --- .../patches/debian/config/opt/cloud/bin/cs/CsAddress.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py index 64ddb2681b7..075fddb3760 100755 --- a/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py +++ b/systemvm/patches/debian/config/opt/cloud/bin/cs/CsAddress.py @@ -359,6 +359,10 @@ class CsIP: "-m state --state RELATED,ESTABLISHED " + "-j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff"]) + self.fw.append(["mangle", "front", + "-A POSTROUTING " + + "-p udp -m udp --dport 68 -j CHECKSUM --checksum-fill"]) + if self.get_type() in ["public"]: self.fw.append(["mangle", "front", "-A PREROUTING " + @@ -375,9 +379,6 @@ class CsIP: "-A VPN_%s -m state --state RELATED,ESTABLISHED -j ACCEPT" % self.address['public_ip']]) self.fw.append(["mangle", "", "-A VPN_%s -j RETURN" % self.address['public_ip']]) - self.fw.append(["mangle", "front", - "-A POSTROUTING " + - "-p udp -m udp --dport 68 -j CHECKSUM --checksum-fill"]) self.fw.append(["nat", "", "-A POSTROUTING -o eth2 -j SNAT --to-source %s" % self.address['public_ip']]) self.fw.append(["mangle", "", @@ -453,6 +454,8 @@ class CsIP: ["mangle", "front", "-A ACL_OUTBOUND_%s -d 224.0.0.18/32 -j ACCEPT" % self.dev]) self.fw.append( ["filter", "", "-A INPUT -i %s -p udp -m udp --dport 67 -j ACCEPT" % self.dev]) + self.fw.append( + ["mangle", "front", "-A POSTROUTING " + "-p udp -m udp --dport 68 -j CHECKSUM --checksum-fill"]) self.fw.append( ["filter", "", "-A INPUT -i %s -p udp -m udp --dport 53 -s %s -j ACCEPT" % (self.dev, guestNetworkCidr)]) self.fw.append(