veth devices mark all packets as "checksums known good." This is wrong if packets came from hardware. If corrupt packets are routed from "real" devices to veth devices, like Docker does for IPv6, applications can receive corrupt data. Docker's standard IPv4 configurations, which use NAT to route packets, are not affected by this.
Workaround: Docker should be disabling rx checksum offloading on veth devices inside containers to avoid this bug, for all configurations. Even if typical IPv4 configurations are not affected, since many people use Docker containers with other networking configurations, this will protect all of them.
We were affected by this bug at Twitter, so I've been searching the Internet to determine what else is affected. More Details are in this Kubernetes bug report (which is also affected).
Kubernetes bug: kubernetes/kubernetes#18898
Mesos bug: https://issues.apache.org/jira/browse/MESOS-4105
Linux kernel patch: http://thread.gmane.org/gmane.linux.kernel/2111961
veth devices mark all packets as "checksums known good." This is wrong if packets came from hardware. If corrupt packets are routed from "real" devices to veth devices, like Docker does for IPv6, applications can receive corrupt data. Docker's standard IPv4 configurations, which use NAT to route packets, are not affected by this.
Workaround: Docker should be disabling rx checksum offloading on veth devices inside containers to avoid this bug, for all configurations. Even if typical IPv4 configurations are not affected, since many people use Docker containers with other networking configurations, this will protect all of them.
We were affected by this bug at Twitter, so I've been searching the Internet to determine what else is affected. More Details are in this Kubernetes bug report (which is also affected).
Kubernetes bug: kubernetes/kubernetes#18898
Mesos bug: https://issues.apache.org/jira/browse/MESOS-4105
Linux kernel patch: http://thread.gmane.org/gmane.linux.kernel/2111961