Injected TCP/UDP packets ignored by the linux kernel on virtual eth

Question

I try to create a local testing setup for a DPDK forwarding app, using network namespaces. The setup I created looks like this:

veth0(10.0.0.1, namespace vnet0) <> veth1(no ip, host) <-DPDK forward-> veth3(no ip, host) <> veth2(10.0.0.2, namespace vnet1)

So 2 network namespaces each with a veth pair, where the host side of the pairs are "connected" using a forwarding DPDK app.

These are the full commands I'm using to create this setup:

sudo ip link add veth0 type veth peer name veth1
sudo ip link add veth2 type veth peer name veth3

sudo ip netns add vnet0
sudo ip netns add vnet1

sudo ip link set veth0 netns vnet0
sudo ip link set veth2 netns vnet1

sudo ip -n vnet0 set veth0 up
sudo ip -n vnet1 set veth2 up

sudo ip link set veth1 up
sudo ip link set veth3 up

sudo ip -n vnet0 addr add 10.0.0.1/24 dev veth0
sudo ip -n vnet1 addr add 10.0.0.2/24 dev veth2

DPDK app:

sudo dpdk-skeleton --vdev=net_af_packet0,iface=veth1 --vdev=net_af_packet1,iface=veth3

Frames are properly forwarded between the namespaces, and ICMP ECHO also works:

sudo ip netns exec vnet1 ping 10.0.0.1

PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.116 ms

However, UDP and TCP packets are ignored by the kernel:

sudo ip netns exec vnet0 nc -l -p 8080
sudo ip netns exec vnet1 nc 10.0.0.1 8080

(TCP syn packets are being re-transmitted, without any syn+ack response from 10.0.0.1)

Running wireshark in both namespaces shows all of the relevant frames, yet the kernel seems to ignore the injected(forwarded) UDP/TCP packets. What am I missing? Is there another way to test a forwarding app on a single host?

Answer 1

The problem was that veth interfaces are using checksum offload by default so the forwarded packets had a bad checksum and were ignored by the kernel. Running ethtool --offload IFACE rx off tx off on all 4 veth interfaces fixed it.