2023-11-30 13:56:41

by Shachar Kagan

[permalink] [raw]
Subject: Bug report connect to VM with Vagrant

Hi Eric,

I have an issue that bisection pointed at this patch:
commit 0a8de364ff7a14558e9676f424283148110384d6
tcp: no longer abort SYN_SENT when receiving some ICMP

Full commit message at [1].

The issue appears while using Vagrant to manage nested VMs.
The steps are:
* create vagrant file
* vagrant up
* vagrant halt (VM is created but shut down)
* vagrant up - fail

Turn on a VM with ‘Vagrant up’ fails when the VM is in halt state. When the VM hasn't been created yet, 'Vagrant up' passes.
The failure occurs in the Net-SSH connection to the VM step.
Vagrant error is ‘Guest communication could not be established! This is usually because SSH is not running, the authentication information was changed, or some other networking issue.'
We use a new version of vagrant-libvirt.
Turn on the VM with virsh instead of vagrant works.

Stdout[2] bellow.

Any idea what may cause the error with your patch?

Thanks,
Shachar Kagan

[1]
commit 0a8de364ff7a14558e9676f424283148110384d6
Author: Eric Dumazet <[email protected]>
Date: Tue Nov 14 17:23:41 2023 +0000

tcp: no longer abort SYN_SENT when receiving some ICMP

Currently, non fatal ICMP messages received on behalf
of SYN_SENT sockets do call tcp_ld_RTO_revert()
to implement RFC 6069, but immediately call tcp_done(),
thus aborting the connect() attempt.

This violates RFC 1122 following requirement:

4.2.3.9 ICMP Messages
...
o Destination Unreachable -- codes 0, 1, 5

Since these Unreachable messages indicate soft error
conditions, TCP MUST NOT abort the connection, and it
SHOULD make the information available to the
application.

This patch makes sure non 'fatal' ICMP[v6] messages do not
abort the connection attempt.

It enables RFC 6069 for SYN_SENT sockets as a result.

Signed-off-by: Eric Dumazet <[email protected]>
Cc: David Morley <[email protected]>
Cc: Neal Cardwell <[email protected]>
Cc: Yuchung Cheng <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

[2]
Vagrant up stdout:
Bringing machine 'player1' up with 'libvirt' provider...
==> player1: Creating shared folders metadata...
==> player1: Starting domain.
==> player1: Domain launching with graphics connection settings...
==> player1: -- Graphics Port: 5900
==> player1: -- Graphics IP: 127.0.0.1
==> player1: -- Graphics Password: Not defined
==> player1: -- Graphics Websocket: 5700
==> player1: Waiting for domain to get an IP address...
==> player1: Waiting for machine to boot. This may take a few minutes...
player1: SSH address: 192.168.123.61:22
player1: SSH username: vagrant
player1: SSH auth method: private key
==> player1: Attempting graceful shutdown of VM...
==> player1: Attempting graceful shutdown of VM...
==> player1: Attempting graceful shutdown of VM...
player1: Guest communication could not be established! This is usually because
player1: SSH is not running, the authentication information was changed,
player1: or some other networking issue. Vagrant will force halt, if
player1: capable.
==> player1: Attempting direct shutdown of domain...



2023-11-30 14:02:56

by Eric Dumazet

[permalink] [raw]
Subject: Re: Bug report connect to VM with Vagrant

On Thu, Nov 30, 2023 at 2:55 PM Shachar Kagan <[email protected]> wrote:
>
> Hi Eric,
>
> I have an issue that bisection pointed at this patch:
> commit 0a8de364ff7a14558e9676f424283148110384d6
> tcp: no longer abort SYN_SENT when receiving some ICMP
>

Please provide tcpdump/pcap captures.

It is hard to say what is going on just by looking at some application logs.


> Full commit message at [1].
>
> The issue appears while using Vagrant to manage nested VMs.
> The steps are:
> * create vagrant file
> * vagrant up
> * vagrant halt (VM is created but shut down)
> * vagrant up - fail
>
> Turn on a VM with ‘Vagrant up’ fails when the VM is in halt state. When the VM hasn't been created yet, 'Vagrant up' passes.
> The failure occurs in the Net-SSH connection to the VM step.
> Vagrant error is ‘Guest communication could not be established! This is usually because SSH is not running, the authentication information was changed, or some other networking issue.'
> We use a new version of vagrant-libvirt.
> Turn on the VM with virsh instead of vagrant works.
>
> Stdout[2] bellow.
>
> Any idea what may cause the error with your patch?
>
> Thanks,
> Shachar Kagan
>
> [1]
> commit 0a8de364ff7a14558e9676f424283148110384d6
> Author: Eric Dumazet <[email protected]>
> Date: Tue Nov 14 17:23:41 2023 +0000
>
> tcp: no longer abort SYN_SENT when receiving some ICMP
>
> Currently, non fatal ICMP messages received on behalf
> of SYN_SENT sockets do call tcp_ld_RTO_revert()
> to implement RFC 6069, but immediately call tcp_done(),
> thus aborting the connect() attempt.
>
> This violates RFC 1122 following requirement:
>
> 4.2.3.9 ICMP Messages
> ...
> o Destination Unreachable -- codes 0, 1, 5
>
> Since these Unreachable messages indicate soft error
> conditions, TCP MUST NOT abort the connection, and it
> SHOULD make the information available to the
> application.
>
> This patch makes sure non 'fatal' ICMP[v6] messages do not
> abort the connection attempt.
>
> It enables RFC 6069 for SYN_SENT sockets as a result.
>
> Signed-off-by: Eric Dumazet <[email protected]>
> Cc: David Morley <[email protected]>
> Cc: Neal Cardwell <[email protected]>
> Cc: Yuchung Cheng <[email protected]>
> Signed-off-by: David S. Miller <[email protected]>
>
> [2]
> Vagrant up stdout:
> Bringing machine 'player1' up with 'libvirt' provider...
> ==> player1: Creating shared folders metadata...
> ==> player1: Starting domain.
> ==> player1: Domain launching with graphics connection settings...
> ==> player1: -- Graphics Port: 5900
> ==> player1: -- Graphics IP: 127.0.0.1
> ==> player1: -- Graphics Password: Not defined
> ==> player1: -- Graphics Websocket: 5700
> ==> player1: Waiting for domain to get an IP address...
> ==> player1: Waiting for machine to boot. This may take a few minutes...
> player1: SSH address: 192.168.123.61:22
> player1: SSH username: vagrant
> player1: SSH auth method: private key
> ==> player1: Attempting graceful shutdown of VM...
> ==> player1: Attempting graceful shutdown of VM...
> ==> player1: Attempting graceful shutdown of VM...
> player1: Guest communication could not be established! This is usually because
> player1: SSH is not running, the authentication information was changed,
> player1: or some other networking issue. Vagrant will force halt, if
> player1: capable.
> ==> player1: Attempting direct shutdown of domain...
>
>

2023-11-30 14:11:11

by Bagas Sanjaya

[permalink] [raw]
Subject: Re: Bug report connect to VM with Vagrant

On Thu, Nov 30, 2023 at 01:55:06PM +0000, Shachar Kagan wrote:
> Hi Eric,
>
> I have an issue that bisection pointed at this patch:
> commit 0a8de364ff7a14558e9676f424283148110384d6
> tcp: no longer abort SYN_SENT when receiving some ICMP
>
> Full commit message at [1].
>
> The issue appears while using Vagrant to manage nested VMs.
> The steps are:
> * create vagrant file
> * vagrant up
> * vagrant halt (VM is created but shut down)
> * vagrant up - fail
>
> Turn on a VM with ‘Vagrant up’ fails when the VM is in halt state. When the VM hasn't been created yet, 'Vagrant up' passes.
> The failure occurs in the Net-SSH connection to the VM step.
> Vagrant error is ‘Guest communication could not be established! This is usually because SSH is not running, the authentication information was changed, or some other networking issue.'
> We use a new version of vagrant-libvirt.
> Turn on the VM with virsh instead of vagrant works.
>
> Stdout[2] bellow.
>
> Any idea what may cause the error with your patch?
>
> Thanks,
> Shachar Kagan
>
> [1]
> commit 0a8de364ff7a14558e9676f424283148110384d6
> Author: Eric Dumazet <[email protected]>
> Date: Tue Nov 14 17:23:41 2023 +0000
>
> tcp: no longer abort SYN_SENT when receiving some ICMP
>
> Currently, non fatal ICMP messages received on behalf
> of SYN_SENT sockets do call tcp_ld_RTO_revert()
> to implement RFC 6069, but immediately call tcp_done(),
> thus aborting the connect() attempt.
>
> This violates RFC 1122 following requirement:
>
> 4.2.3.9 ICMP Messages
> ...
> o Destination Unreachable -- codes 0, 1, 5
>
> Since these Unreachable messages indicate soft error
> conditions, TCP MUST NOT abort the connection, and it
> SHOULD make the information available to the
> application.
>
> This patch makes sure non 'fatal' ICMP[v6] messages do not
> abort the connection attempt.
>
> It enables RFC 6069 for SYN_SENT sockets as a result.
>
> Signed-off-by: Eric Dumazet <[email protected]>
> Cc: David Morley <[email protected]>
> Cc: Neal Cardwell <[email protected]>
> Cc: Yuchung Cheng <[email protected]>
> Signed-off-by: David S. Miller <[email protected]>
>
> [2]
> Vagrant up stdout:
> Bringing machine 'player1' up with 'libvirt' provider...
> ==> player1: Creating shared folders metadata...
> ==> player1: Starting domain.
> ==> player1: Domain launching with graphics connection settings...
> ==> player1: -- Graphics Port: 5900
> ==> player1: -- Graphics IP: 127.0.0.1
> ==> player1: -- Graphics Password: Not defined
> ==> player1: -- Graphics Websocket: 5700
> ==> player1: Waiting for domain to get an IP address...
> ==> player1: Waiting for machine to boot. This may take a few minutes...
> player1: SSH address: 192.168.123.61:22
> player1: SSH username: vagrant
> player1: SSH auth method: private key
> ==> player1: Attempting graceful shutdown of VM...
> ==> player1: Attempting graceful shutdown of VM...
> ==> player1: Attempting graceful shutdown of VM...
> player1: Guest communication could not be established! This is usually because
> player1: SSH is not running, the authentication information was changed,
> player1: or some other networking issue. Vagrant will force halt, if
> player1: capable.
> ==> player1: Attempting direct shutdown of domain...
>
>

Thanks for the regression report. I'm adding it to regzbot:

#regzbot ^introduced: 0a8de364ff7a14
#regzbot title: starting Vagrant VM fails due to not aborting SYN_SENT

--
An old man doll... just what I always wanted! - Clara


Attachments:
(No filename) (3.76 kB)
signature.asc (235.00 B)
Download all attachments

2023-12-07 13:03:52

by Shachar Kagan

[permalink] [raw]
Subject: RE: Bug report connect to VM with Vagrant


>> On Thu, Nov 30, 2023 at 2:55 PM Shachar Kagan <[email protected]> wrote:
>>
>> Hi Eric,
>>
>> I have an issue that bisection pointed at this patch:
>> commit 0a8de364ff7a14558e9676f424283148110384d6
>> tcp: no longer abort SYN_SENT when receiving some ICMP
>>
>
> Please provide tcpdump/pcap captures.
>
> It is hard to say what is going on just by looking at some application logs.
>

I managed to capture the tcpdump of ‘Vagrant up’ step over old kernel and new kernel where this step fails. Both captures are attached.
The tcpdump is filtered by given IP of the nested VM.

Let me know if there is any other information that I can provide to assist with the investigation.

>> Full commit message at [1].
>>
>> The issue appears while using Vagrant to manage nested VMs.
>> The steps are:
>> * create vagrant file
>> * vagrant up
>> * vagrant halt (VM is created but shut down)
>> * vagrant up - fail
>>
>> Turn on a VM with ‘Vagrant up’ fails when the VM is in halt state. When the VM hasn't been created yet, 'Vagrant up' passes.
>> The failure occurs in the Net-SSH connection to the VM step.
>> Vagrant error is ‘Guest communication could not be established! This is usually because SSH is not running, the authentication information was changed, or some other networking issue.'
>> We use a new version of vagrant-libvirt.
>> Turn on the VM with virsh instead of vagrant works.
>>
>> Stdout[2] bellow.
>>
>> Any idea what may cause the error with your patch?
>>
>> Thanks,
>> Shachar Kagan
>>
>> [1]
>> commit 0a8de364ff7a14558e9676f424283148110384d6
>> Author: Eric Dumazet <[email protected]>
>> Date: Tue Nov 14 17:23:41 2023 +0000
>>
>> tcp: no longer abort SYN_SENT when receiving some ICMP
>>
>> Currently, non fatal ICMP messages received on behalf
>> of SYN_SENT sockets do call tcp_ld_RTO_revert()
>> to implement RFC 6069, but immediately call tcp_done(),
>> thus aborting the connect() attempt.
>>
>> This violates RFC 1122 following requirement:
>>
>> 4.2.3.9 ICMP Messages
>> ...
>> o Destination Unreachable -- codes 0, 1, 5
>>
>> Since these Unreachable messages indicate soft error
>> conditions, TCP MUST NOT abort the connection, and it
>> SHOULD make the information available to the
>> application.
>>
>> This patch makes sure non 'fatal' ICMP[v6] messages do not
>> abort the connection attempt.
>>
>> It enables RFC 6069 for SYN_SENT sockets as a result.
>>
>> Signed-off-by: Eric Dumazet <[email protected]>
>> Cc: David Morley <[email protected]>
>> Cc: Neal Cardwell <[email protected]>
>> Cc: Yuchung Cheng <[email protected]>
>> Signed-off-by: David S. Miller <[email protected]>
>>
>> [2]
>> Vagrant up stdout:
>> Bringing machine 'player1' up with 'libvirt' provider...
>> ==> player1: Creating shared folders metadata...
>> ==> player1: Starting domain.
>> ==> player1: Domain launching with graphics connection settings...
>> ==> player1: -- Graphics Port: 5900
>> ==> player1: -- Graphics IP: 127.0.0.1
>> ==> player1: -- Graphics Password: Not defined ==> player1: --
>> Graphics Websocket: 5700 ==> player1: Waiting for domain to get an IP
>> address...
>> ==> player1: Waiting for machine to boot. This may take a few minutes...
>> player1: SSH address: 192.168.123.61:22
>> player1: SSH username: vagrant
>> player1: SSH auth method: private key ==> player1: Attempting
>> graceful shutdown of VM...
>> ==> player1: Attempting graceful shutdown of VM...
>> ==> player1: Attempting graceful shutdown of VM...
>> player1: Guest communication could not be established! This is usually because
>> player1: SSH is not running, the authentication information was changed,
>> player1: or some other networking issue. Vagrant will force halt, if
>> player1: capable.
>> ==> player1: Attempting direct shutdown of domain...
>>
>>


Attachments:
new_kernel_guest_vm_ip_filter.pcap (62.22 kB)
new_kernel_guest_vm_ip_filter.pcap
old_kernel_guest_vm_ip_filter.pcap (1.58 MB)
old_kernel_guest_vm_ip_filter.pcap
Download all attachments

2023-12-08 10:50:08

by Eric Dumazet

[permalink] [raw]
Subject: Re: Bug report connect to VM with Vagrant

On Thu, Dec 7, 2023 at 2:03 PM Shachar Kagan <[email protected]> wrote:
>
>
> >> On Thu, Nov 30, 2023 at 2:55 PM Shachar Kagan <[email protected]> wrote:
> >>
> >> Hi Eric,
> >>
> >> I have an issue that bisection pointed at this patch:
> >> commit 0a8de364ff7a14558e9676f424283148110384d6
> >> tcp: no longer abort SYN_SENT when receiving some ICMP
> >>
> >
> > Please provide tcpdump/pcap captures.
> >
> > It is hard to say what is going on just by looking at some application logs.
> >
>
> I managed to capture the tcpdump of ‘Vagrant up’ step over old kernel and new kernel where this step fails. Both captures are attached.
> The tcpdump is filtered by given IP of the nested VM.

Hi Shachar

I do not see any ICMP messages in these files, can you get them ?

Feel free to continue this exchange privately, no need to send MB
email to various lists.

Thanks.

Subject: Re: Bug report connect to VM with Vagrant

On 08.12.23 11:49, Eric Dumazet wrote:
> On Thu, Dec 7, 2023 at 2:03 PM Shachar Kagan <[email protected]> wrote:
>>>> On Thu, Nov 30, 2023 at 2:55 PM Shachar Kagan <[email protected]> wrote:
>>>>
>>>> I have an issue that bisection pointed at this patch:
>>>> commit 0a8de364ff7a14558e9676f424283148110384d6
>>>> tcp: no longer abort SYN_SENT when receiving some ICMP
>>>
>>> Please provide tcpdump/pcap captures.
>>>
>>> It is hard to say what is going on just by looking at some application logs.
>>
>> I managed to capture the tcpdump of ‘Vagrant up’ step over old kernel and new kernel where this step fails. Both captures are attached.
>> The tcpdump is filtered by given IP of the nested VM.
>
> I do not see any ICMP messages in these files, can you get them ?
>
> Feel free to continue this exchange privately, no need to send MB
> email to various lists.

Here this thread died, so I assume this turned out to be not a
regression at all or something like that? If not please speak up!

#regzbot inconclusive: radio silence

Ciao, Thorsten (wearing his 'the Linux kernel's regression tracker' hat)
--
Everything you wanna know about Linux kernel regression tracking:
https://linux-regtracking.leemhuis.info/about/#tldr
If I did something stupid, please tell me, as explained on that page.

2023-12-27 08:33:54

by Leon Romanovsky

[permalink] [raw]
Subject: Re: Bug report connect to VM with Vagrant

On Fri, Dec 15, 2023 at 10:55:05AM +0100, Linux regression tracking (Thorsten Leemhuis) wrote:
> On 08.12.23 11:49, Eric Dumazet wrote:
> > On Thu, Dec 7, 2023 at 2:03 PM Shachar Kagan <[email protected]> wrote:
> >>>> On Thu, Nov 30, 2023 at 2:55 PM Shachar Kagan <[email protected]> wrote:
> >>>>
> >>>> I have an issue that bisection pointed at this patch:
> >>>> commit 0a8de364ff7a14558e9676f424283148110384d6
> >>>> tcp: no longer abort SYN_SENT when receiving some ICMP
> >>>
> >>> Please provide tcpdump/pcap captures.
> >>>
> >>> It is hard to say what is going on just by looking at some application logs.
> >>
> >> I managed to capture the tcpdump of ‘Vagrant up’ step over old kernel and new kernel where this step fails. Both captures are attached.
> >> The tcpdump is filtered by given IP of the nested VM.
> >
> > I do not see any ICMP messages in these files, can you get them ?
> >
> > Feel free to continue this exchange privately, no need to send MB
> > email to various lists.
>
> Here this thread died, so I assume this turned out to be not a
> regression at all or something like that? If not please speak up!

No, it wasn't fixed and/or reverted. Right now, Vagrant is broken and
all our regressions around nested VM functionality doesn't run.

Eric, can you please revert the bisected patch while you are continuing
your offline discussion with Shachar?

Thanks

>
> #regzbot inconclusive: radio silence
>
> Ciao, Thorsten (wearing his 'the Linux kernel's regression tracker' hat)
> --
> Everything you wanna know about Linux kernel regression tracking:
> https://linux-regtracking.leemhuis.info/about/#tldr
> If I did something stupid, please tell me, as explained on that page.
>

2024-01-02 09:50:22

by Eric Dumazet

[permalink] [raw]
Subject: Re: Bug report connect to VM with Vagrant

On Wed, Dec 27, 2023 at 9:33 AM Leon Romanovsky <[email protected]> wrote:
>
> On Fri, Dec 15, 2023 at 10:55:05AM +0100, Linux regression tracking (Thorsten Leemhuis) wrote:
> > On 08.12.23 11:49, Eric Dumazet wrote:
> > > On Thu, Dec 7, 2023 at 2:03 PM Shachar Kagan <[email protected]> wrote:
> > >>>> On Thu, Nov 30, 2023 at 2:55 PM Shachar Kagan <[email protected]> wrote:
> > >>>>
> > >>>> I have an issue that bisection pointed at this patch:
> > >>>> commit 0a8de364ff7a14558e9676f424283148110384d6
> > >>>> tcp: no longer abort SYN_SENT when receiving some ICMP
> > >>>
> > >>> Please provide tcpdump/pcap captures.
> > >>>
> > >>> It is hard to say what is going on just by looking at some application logs.
> > >>
> > >> I managed to capture the tcpdump of ‘Vagrant up’ step over old kernel and new kernel where this step fails. Both captures are attached.
> > >> The tcpdump is filtered by given IP of the nested VM.
> > >
> > > I do not see any ICMP messages in these files, can you get them ?
> > >
> > > Feel free to continue this exchange privately, no need to send MB
> > > email to various lists.
> >
> > Here this thread died, so I assume this turned out to be not a
> > regression at all or something like that? If not please speak up!
>
> No, it wasn't fixed and/or reverted. Right now, Vagrant is broken and
> all our regressions around nested VM functionality doesn't run.
>
> Eric, can you please revert the bisected patch while you are continuing
> your offline discussion with Shachar?
>

This is not how things work.

I have not received any evidence yet, only partial packet dumps with
no ICMP messages that could be related to the 'Vagrant issue'

Patch is adhering to the RFC.

If an application wants to have fast reaction to ICMP, it must use
appropriate socket options instead of relying on a prior
implementation detail.

2024-01-02 09:55:44

by Leon Romanovsky

[permalink] [raw]
Subject: Re: Bug report connect to VM with Vagrant

On Tue, Jan 02, 2024 at 10:49:58AM +0100, Eric Dumazet wrote:
> On Wed, Dec 27, 2023 at 9:33 AM Leon Romanovsky <[email protected]> wrote:
> >
> > On Fri, Dec 15, 2023 at 10:55:05AM +0100, Linux regression tracking (Thorsten Leemhuis) wrote:
> > > On 08.12.23 11:49, Eric Dumazet wrote:
> > > > On Thu, Dec 7, 2023 at 2:03 PM Shachar Kagan <[email protected]> wrote:
> > > >>>> On Thu, Nov 30, 2023 at 2:55 PM Shachar Kagan <[email protected]> wrote:
> > > >>>>
> > > >>>> I have an issue that bisection pointed at this patch:
> > > >>>> commit 0a8de364ff7a14558e9676f424283148110384d6
> > > >>>> tcp: no longer abort SYN_SENT when receiving some ICMP
> > > >>>
> > > >>> Please provide tcpdump/pcap captures.
> > > >>>
> > > >>> It is hard to say what is going on just by looking at some application logs.
> > > >>
> > > >> I managed to capture the tcpdump of ‘Vagrant up’ step over old kernel and new kernel where this step fails. Both captures are attached.
> > > >> The tcpdump is filtered by given IP of the nested VM.
> > > >
> > > > I do not see any ICMP messages in these files, can you get them ?
> > > >
> > > > Feel free to continue this exchange privately, no need to send MB
> > > > email to various lists.
> > >
> > > Here this thread died, so I assume this turned out to be not a
> > > regression at all or something like that? If not please speak up!
> >
> > No, it wasn't fixed and/or reverted. Right now, Vagrant is broken and
> > all our regressions around nested VM functionality doesn't run.
> >
> > Eric, can you please revert the bisected patch while you are continuing
> > your offline discussion with Shachar?
> >
>
> This is not how things work.
>
> I have not received any evidence yet, only partial packet dumps with
> no ICMP messages that could be related to the 'Vagrant issue'

Revert of the original patch worked, so it is strong enough evidence to do
not break very popular orchestration software.

>
> Patch is adhering to the RFC.
>
> If an application wants to have fast reaction to ICMP, it must use
> appropriate socket options instead of relying on a prior
> implementation detail.

Maybe yes, maybe not. Right now, Vagrant is broken.

Thanks

2024-01-02 10:06:31

by Eric Dumazet

[permalink] [raw]
Subject: Re: Bug report connect to VM with Vagrant

On Tue, Jan 2, 2024 at 10:55 AM Leon Romanovsky <[email protected]> wrote:
>
> On Tue, Jan 02, 2024 at 10:49:58AM +0100, Eric Dumazet wrote:
> > On Wed, Dec 27, 2023 at 9:33 AM Leon Romanovsky <[email protected]> wrote:
> > >
> > > On Fri, Dec 15, 2023 at 10:55:05AM +0100, Linux regression tracking (Thorsten Leemhuis) wrote:
> > > > On 08.12.23 11:49, Eric Dumazet wrote:
> > > > > On Thu, Dec 7, 2023 at 2:03 PM Shachar Kagan <[email protected]> wrote:
> > > > >>>> On Thu, Nov 30, 2023 at 2:55 PM Shachar Kagan <[email protected]> wrote:
> > > > >>>>
> > > > >>>> I have an issue that bisection pointed at this patch:
> > > > >>>> commit 0a8de364ff7a14558e9676f424283148110384d6
> > > > >>>> tcp: no longer abort SYN_SENT when receiving some ICMP
> > > > >>>
> > > > >>> Please provide tcpdump/pcap captures.
> > > > >>>
> > > > >>> It is hard to say what is going on just by looking at some application logs.
> > > > >>
> > > > >> I managed to capture the tcpdump of ‘Vagrant up’ step over old kernel and new kernel where this step fails. Both captures are attached.
> > > > >> The tcpdump is filtered by given IP of the nested VM.
> > > > >
> > > > > I do not see any ICMP messages in these files, can you get them ?
> > > > >
> > > > > Feel free to continue this exchange privately, no need to send MB
> > > > > email to various lists.
> > > >
> > > > Here this thread died, so I assume this turned out to be not a
> > > > regression at all or something like that? If not please speak up!
> > >
> > > No, it wasn't fixed and/or reverted. Right now, Vagrant is broken and
> > > all our regressions around nested VM functionality doesn't run.
> > >
> > > Eric, can you please revert the bisected patch while you are continuing
> > > your offline discussion with Shachar?
> > >
> >
> > This is not how things work.
> >
> > I have not received any evidence yet, only partial packet dumps with
> > no ICMP messages that could be related to the 'Vagrant issue'
>
> Revert of the original patch worked, so it is strong enough evidence to do
> not break very popular orchestration software.
>
> >
> > Patch is adhering to the RFC.
> >
> > If an application wants to have fast reaction to ICMP, it must use
> > appropriate socket options instead of relying on a prior
> > implementation detail.
>
> Maybe yes, maybe not. Right now, Vagrant is broken.

Maybe, but after one month, I still have not received any evidence of the issue.