Hi,
Some Gentoo users have reported very long application startup times in 2.6.12.
This seems to be because the applications are attempting to connect to local
ports such as sunrpc/portmap (where these services are not running), but some
packets are being dropped, so the application load just pauses until the
connection times out.
There was a similar problem reported recently ("2.6.12: connection tracking
broken?"), regarding bridge devices. No bridge devices are involved here.
This is easy to reproduce, and the problem exists on both Linux 2.6.12 and
2.6.13-rc2. This was not a problem on Linux 2.6.11.
Taking a simple configuration:
# iptables -P INPUT ACCEPT
# iptables -P OUTPUT ACCEPT
# iptables -P FORWARD ACCEPT
I don't have a webserver running. If I try and telnet to port 80, I
immediately get connection refused, as expected:
# telnet 127.0.0.1 80
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection refused
I now add another rule, to drop invalid packets, and retry the telnet connection.
# iptables -A INPUT -m state --state INVALID -j DROP
# telnet 127.0.0.1 80
<very long pause>
telnet: connect to address 127.0.0.1: Connection timed out
During the pause, netstat reports the connection state as SYN_SENT:
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 1 localhost:39066 localhost:http SYN_SENT
I now flush the filter table, and make the kernel log invalid packets:
# iptables -t filter -F
#iptables -A INPUT -m state --state INVALID -j LOG --log-prefix "inv "
When retrying the telnet test, this appears in the logs:
Jul 8 14:53:04 dsd inv IN=lo OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1 DST=127.0.0.1
LEN=40 TOS=0x10 PREC=0x00 TTL=64 ID=15 DF PROTO=TCP SPT=80 DPT=58950 WINDOW=0
RES=0x00 ACK RST URGP=0
Does this mean that the kernel thinks its own ACK RST packet is invalid?
There is a Gentoo bug on this here:
http://bugs.gentoo.org/96948
...but I think I got the imporant info into this message.
Let me know if I can provide any more info. For those interested in a
temporary workaround, you can explicitly allow all local traffic, i.e.
# iptables -A INPUT -i lo -j ACCEPT
# iptables -A INPUT -m state --state INVALID -j DROP
Thanks.
Daniel
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
| |
 |