{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/18776","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/18776/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/18776/comments","events_url":"https://api.github.com/repos/docker/docker/issues/18776/events","html_url":"https://github.com/docker/docker/issues/18776","id":123008931,"number":18776,"title":"IPv6 routing permits corrupt data to be delivered to applications (veth driver bug)","user":{"login":"evanj","id":675151,"avatar_url":"https://avatars.githubusercontent.com/u/675151?v=3","gravatar_id":"","url":"https://api.github.com/users/evanj","html_url":"https://github.com/evanj","followers_url":"https://api.github.com/users/evanj/followers","following_url":"https://api.github.com/users/evanj/following{/other_user}","gists_url":"https://api.github.com/users/evanj/gists{/gist_id}","starred_url":"https://api.github.com/users/evanj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/evanj/subscriptions","organizations_url":"https://api.github.com/users/evanj/orgs","repos_url":"https://api.github.com/users/evanj/repos","events_url":"https://api.github.com/users/evanj/events{/privacy}","received_events_url":"https://api.github.com/users/evanj/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/group/networking","name":"group/networking","color":"F6FBFF"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2015-12-18T19:12:40Z","updated_at":"2016-06-28T23:24:21Z","closed_at":null,"body":"veth devices mark all packets as \"checksums known good.\" This is wrong if packets came from hardware. If corrupt packets are routed from \"real\" devices to veth devices, like Docker does for IPv6, applications can receive corrupt data. Docker's standard IPv4 configurations, which use NAT to route packets, are not affected by this.\r\n\r\n*Workaround*: Docker should be disabling rx checksum offloading on veth devices inside containers to avoid this bug, for all configurations. Even if typical IPv4 configurations are not affected, since many people use Docker containers with other networking configurations, this will protect all of them.\r\n\r\nWe were affected by this bug at Twitter, so I've been searching the Internet to determine what else is affected. More Details are in this Kubernetes bug report (which is also affected).\r\n\r\nKubernetes bug: https://github.com/kubernetes/kubernetes/issues/18898\r\nMesos bug: https://issues.apache.org/jira/browse/MESOS-4105\r\nLinux kernel patch: http://thread.gmane.org/gmane.linux.kernel/2111961\r\n"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/229213919","html_url":"https://github.com/docker/docker/issues/18776#issuecomment-229213919","issue_url":"https://api.github.com/repos/docker/docker/issues/18776","id":229213919,"user":{"login":"evanj","id":675151,"avatar_url":"https://avatars.githubusercontent.com/u/675151?v=3","gravatar_id":"","url":"https://api.github.com/users/evanj","html_url":"https://github.com/evanj","followers_url":"https://api.github.com/users/evanj/followers","following_url":"https://api.github.com/users/evanj/following{/other_user}","gists_url":"https://api.github.com/users/evanj/gists{/gist_id}","starred_url":"https://api.github.com/users/evanj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/evanj/subscriptions","organizations_url":"https://api.github.com/users/evanj/orgs","repos_url":"https://api.github.com/users/evanj/repos","events_url":"https://api.github.com/users/evanj/events{/privacy}","received_events_url":"https://api.github.com/users/evanj/received_events","type":"User","site_admin":false},"created_at":"2016-06-28T23:24:21Z","updated_at":"2016-06-28T23:24:21Z","body":"FWIW: The kernel patch to address this issue has been backported into the stable kernel, so there may be nothing to be done here. Eventually people will upgrade their kernel, or they might receive corrupt packets. I suggest just closing this and recommending people use the latest stable kernel they can."}}
{"actor":{"display_login":"evanj"}}