Also handle missing UDP checksums on nftables

[stefanor]

Is there an existing issue for this?

• There is no existing issue for this feature

What are you currently unable to do

In a simple setup with a bridged network, VMs are unable to receive DHCPv4 address allocations with systemd-networkd, due to UDP checksum errors:

# SYSTEMD_LOG_LEVEL=debug /lib/systemd/systemd-networkd
...
enp5s0: DHCPv4 client: DISCOVER
ignoring packet: invalid UDP checksum

What do you think would need to be added

Maybe systemd could be persuaded to accept an option to ignore UDP checksums? Or detect virtio interfaces. But... we also have to live with the systemds that we've got in the world, and so we need workarounds.

I see that historically we were able to fix checksums in iptables, but that isn't possible with nftables.

What we can do is ethtool -K $IFACE tx off (or equivalent) on the host, when adding the interface to the bridge.

[stgraber]

Looks like there is a bit of an equivalent in the ability to clear the checksum field:
https://patchew.org/Libvirt/20241021041438.135816-1-laine@redhat.com/

[stgraber]

@stefanor can you try that approach manually through nftables?
If that works, we should be able to easily add it in the same situation we would the xtables equivalent.

[stefanor]

You know what, I found that on my laptop's nftables already. I've been down this rabbit hole and it works :)

[stgraber]

Nice, what's the rule that you have on there?

[stefanor]

Something like:

nft insert rule inet incus out.incusbr0 index 0 oifname "incusbr0" ip protocol udp udp checksum set 0;

[stgraber]

Sounds good, we'll get that added to our template.

[MaheshPunjabi]

Hi @stgraber Can I try ?

[stgraber]

@MaheshPunjabi sure!

For xtables, we applied this rule through NetworkSetup when opts.FeaturesV4 wasn't nil and opts.FeaturesV4.ICMPDHCPDNSAccess was set to true.

We should do the same in the nftables driver. Looks like there we're calling networkSetupICMPDHCPDNSAccess which then runs the nftablesNetICMPDHCPDNS template.
So that's what should get extended to add the recommended rule in the IPv4 case.