<div>
<span style="font-size: 15px;">The backport seems reasonable IMO.</span></div><div><span style="font-size: 15px;"><br></span></div><div><span style="font-size: 15px;">Is this tested in a multihost environment?.</span></div><div><span style="font-size: 15px;"><br></span></div><div><span style="font-size: 15px;">I ask, because given the Ian explanation (which probably I got wrong), the issue is in the </span></div><div><span style="font-size: 15px;">NET->NIC->VM path </span><span style="font-size: 15px;">while the patch fixes the path in the network node (this is ran in the</span></div><div><span style="font-size: 15px;">dhcp agent). dhcp->NIC->NET.</span></div><div><span style="font-size: 15px;"><br></span></div><div><span style="font-size: 15px;"><br></span></div><div><span style="font-size: 15px;">Best,</span></div><div><div><span style="font-size: 10pt;">Miguel Ángel Ajo</span></div><div><br></div></div>
<p style="color: #A0A0A8;">On Tuesday, 2 de June de 2015 at 9:32, Ian Wells wrote:</p>
<blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;">
<span><div><div><div dir="ltr"><div>The fix should work fine. It is technically a workaround for the way checksums work in virtualised systems, and the unfortunate fact that some DHCP clients check checksums on packets where the hardware has checksum offload enabled. (This doesn't work due to an optimisation in the way QEMU treats packet checksums. You'll see the problem if your machine is running the VM on the same host as its DHCP server and the VM has a vulnerable client.)<br><br>I haven't tried it myself but I have confidence in it and would recommend a backport.<br>-- <br></div>Ian.<br></div><div><br><div>On 1 June 2015 at 21:32, Kevin Benton <span dir="ltr"><<a href="mailto:blak111@gmail.com" target="_blank">blak111@gmail.com</a>></span> wrote:<br><blockquote type="cite"><div><div dir="ltr">I would propose a back-port of it and then continue the discussion on the patch. I don't see any major blockers for back-porting it.</div><div><div><div><br><div>On Mon, Jun 1, 2015 at 7:01 PM, Tidwell, Ryan <span dir="ltr"><<a href="mailto:ryan.tidwell@hp.com" target="_blank">ryan.tidwell@hp.com</a>></span> wrote:<br><blockquote type="cite"><div>Not seeing this on Kilo, we're seeing this on Juno builds (that's expected). I'm interested in a Juno backport, but mainly wanted to be see if others had confidence in the fix. The discussion in the bug report also seemed to indicate there were other alternative solutions others might be looking into that didn't involve an iptables rule.<br>
<span><font color="#888888"><br>
-Ryan<br>
</font></span><div><div><br>
-----Original Message-----<br>
From: Mark McClain [mailto:<a href="mailto:mark@mcclain.xyz" target="_blank">mark@mcclain.xyz</a>]<br>
Sent: Monday, June 01, 2015 6:47 PM<br>
To: OpenStack Development Mailing List (not for usage questions)<br>
Subject: Re: [openstack-dev] [Neutron] virtual machine can not get DHCP lease due packet has no checksum<br>
<br>
<br>
> On Jun 1, 2015, at 7:26 PM, Tidwell, Ryan <<a href="mailto:ryan.tidwell@hp.com" target="_blank">ryan.tidwell@hp.com</a>> wrote:<br>
><br>
> I see a fix for <a href="https://bugs.launchpad.net/neutron/+bug/1244589" target="_blank">https://bugs.launchpad.net/neutron/+bug/1244589</a> merged during Kilo. I'm wondering if we think we have identified a root cause and have merged an appropriate long-term fix, or if <a href="https://review.openstack.org/148718" target="_blank">https://review.openstack.org/148718</a> was merged just so there's at least a fix available while we investigate other alternatives. Does anyone have an update to provide?<br>
><br>
> -Ryan<br>
<br>
The fix works in environments we’ve tested in. Are you still seeing problems?<br>
<br>
mark<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</div></div></div></blockquote></div><br><br clear="all"><div><br></div></div></div><span><font color="#888888">-- <br><div><div>Kevin Benton</div></div>
</font></span></div>
<br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></div></blockquote></div><br></div>
</div><div><div>__________________________________________________________________________</div><div>OpenStack Development Mailing List (not for usage questions)</div><div>Unsubscribe: <a href="mailto:OpenStack-dev-request@lists.openstack.org?subject:unsubscribe">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a></div><div><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a></div></div></div></span>
</blockquote>
<div>
<br>
</div>