[Bug 47] New: conntrack breaks nfs, corrupted packets

[bugzilla-daemon@netfilter.org]

https://bugzilla.netfilter.org/cgi-bin/bugzilla/show_bug.cgi?id=47

           Summary: conntrack breaks nfs, corrupted packets
           Product: netfilter/iptables
           Version: linux-2.4.x
          Platform: i386
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: P2
         Component: connection tracking
        AssignedTo: laforge@netfilter.org
        ReportedBy: kaber@trash.net
                CC: netfilter-buglog@lists.netfilter.org


With ip_conntrack loaded on the nfs server, client reads time out.
Clients start logging:

UDP: short packet: 192.168.0.1:0 0/120 to 192.168.0.23:0
UDP: short packet: 192.168.0.1:6439 28562/120 to 192.168.0.23:60558

tcpdump shows corrupted packets:
0:e0:7d:74:ab:cc 0:e0:7d:74:ab:cd 0800 1514: 192.168.0.1 > 192.168.0.223: (frag
42878:1480@4440+) (ttl 64, len 1500, bad cksum 29ff!)
0:e0:7d:74:ab:cc 0:e0:7d:74:ab:cd 0800 1514: 192.168.0.1 > 192.168.0.223: (frag
42879:1480@4440+) (ttl 64, len 1500, bad cksum 29fe!)

0:e0:7d:74:ab:cd is not the mac of 192.168.0.223 but 192.168.0.23. Both are
nfs-clients. If more nfs-clients show up more incorrect destination ips appear.
The packets checksum is correct if the (incorrect) destination ip is replaced by
the correct destination ip. Only single fragments have incorrect destination,
the remaining fragments of a packet are fine. Packets verified (checksum) in
ip_finish_output2 show no corruption.

Neighbour table of nfs server:
192.168.0.223 dev eth0 lladdr 00:e0:29:3c:c1:c9 nud reachable
192.168.0.23 dev eth0 lladdr 00:e0:7d:74:ab:cd nud reachable

The problem goes away as soon as ip_conntrack is unloaded. Another possibility
is to set the interface mtu to 1486 on the nfs server.

CPU: AMD-K6(tm) 3D processor, 256MB RAM
Kernel: 2.4.21-pre3 with few netfilter patches applied, problem also exists in
vanilla kernel, first noticed around 2.4.17

lspci:
00:00.0 Host bridge: Acer Laboratories Inc. [ALi] M1541 (rev 04)
00:01.0 PCI bridge: Acer Laboratories Inc. [ALi] M5243 (rev 04)
00:07.0 ISA bridge: Acer Laboratories Inc. [ALi] M1533 PCI to ISA Bridge
[Aladdin IV] (rev c3)
00:08.0 VGA compatible unclassified device: S3 Inc. 86c864 [Vision 864 DRAM] vers 0
00:09.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8139 (rev 10)
00:0a.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8139 (rev 10)
00:0f.0 IDE interface: Acer Laboratories Inc. [ALi] M5229 IDE (rev c2)



------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.