** Description changed: On a Realtek RTL8111E NIC using the r8169 driver, outgoing IPv4 TCP traffic from an 802.1Q VLAN subinterface is never received by the peer when TX checksum offload is enabled. ICMP, ARP and IPv6 TCP over the same interface work. Disabling TX checksum offload for IPV4 on the parent interface fixes the problem. ## Environment - Distribution: KDE neon User Edition (Ubuntu 24.04 noble) - Kernel: 7.0.0-42-generic - NIC: Realtek RTL8111E - Driver: r8169 - Network configuration : - - enp4s0: untagged, 192.168.1.50/24 (DHCP) - - vlan5@enp4s0: 802.1Q VLAN id 5, 192.168.5.12/24 (main device: enp4s0) + - enp4s0: untagged, 192.168.1.50/24 (DHCP) + - vlan5@enp4s0: 802.1Q VLAN id 5, 192.168.5.12/24 (main device: enp4s0) - Peer: 192.168.5.10 in VLAN 5 - sshd listening on 0.0.0.0:22 and [::]:22, no firewall rules affecting the traffic + sshd listening on 0.0.0.0:22 and [::]:22, no firewall rules affecting the traffic ## Steps to reproduce nc -vz -w 5 -s 192.168.5.12 192.168.5.10 22 ## Expected result TCP connection succeeds (Connection to 192.168.5.10 22 port [tcp/ssh] succeeded!) ## Actual result The connection times out. nc to ports 22 or other behave the same way (nc: connect to 192.168.5.10 port 22 (tcp) failed: Connection timed out) ## Observations - ICMP echo and ARP work in both directions on VLAN 5. - IPv6 TCP (SSH over link-local address) works over the same VLAN interface. - A tcpdump on the receiving peer shows ICMP and ARP from 192.168.5.12, but no TCP packets at all during connection attempts. - Reverse direction: SYNs from the peer (192.168.5.10 -> 192.168.5.12) arrive with the correct VLAN tag (vlan 5). The peer retransmits the SYN and never gets a response - No local firewall: nft ruleset empty, iptables policies ACCEPT, ufw inactive - Captures on the affected machine show only incoming frames : outgoing ICMP echo requests, which the peer did receive, do not appear. - A other machine with exactly the same VLAN setup but another NIC connects to the same peer via IPv4 SSH without problems. ## Investigations Initial hardware offload state on enp4s0: tx-checksum-ipv4 on, tx- checksum-ipv6 on, tcp-segmentation-offload off, generic-segmentation- offload off, tx-vlan-offload on, rx-vlan-offload on. ethtool -K enp4s0 tx off tso off gso off txvlan off -> TCP works (nc to port 22 succeeds) ethtool -K enp4s0 tx on (txvlan, tso, gso remain off) -> TCP fails again (timeout) ethtool -K enp4s0 tx off -> TCP works (nc to port 22 succeeds) By adjusting the settings, it is possible to narrow the problem down to "tx-checksum-ipv4" only to trigger the problem. The assumption is that the r8169 driver has a bug in the way it calculates the checksum for VLAN tagged traffic when sending data via TCP, and only for IPv4, which causes outgoing packets to be lost The problem does not occur with kernel 7.0.0-38-generic - ## Workaround ethtool -K enp4s0 tx-checksum-ipv4 off ## Not tested yet - Other r8168 driver - - Capturing frames on the wire or on the peer's host to verify whether the TCP checksum is actually wrong + - Capturing frames on the wire or on the peer's host to verify whether the TCP checksum is actually wrong (done - see comments)
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2173506 Title: r8169 IPv4 TCP via 802.1Q VLAN subinterface times out unless TX checksum offload is disabled To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux-signed/+bug/2173506/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
