From mboxrd@z Thu Jan 1 00:00:00 1970 From: "plamen .." Subject: XEN and ipq_read Date: Tue, 27 Apr 2010 11:31:33 +0300 (EEST) Message-ID: <340661326.4879.1272357093666.JavaMail.apache@mail21.abv.bg> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Return-path: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: xen-devel@lists.xensource.com List-Id: xen-devel@lists.xenproject.org Hi all, I'm using Ubuntu Hardy, Xen version 3.2.1-rc1-pre, Dom0 kernel 2.6.24-27-= xen, PV DomU kernel 2.6.24-27-xen.=20 I'm setting DomU as a router having iptables 1.3.8. I put an IDS system S= nort in inline mode (IPS) on the router, which is configured to retrieve = specific packets from kernel (iptables ... -j QUEUE and ip_queue module).= At first snort started to report errors on each received packet. After a= little bit of debugging and doing a sample application to test ipq_read(= ) I found that raw data sent from kernel contains about 24 bytes more tha= n expected. The additional bytes are in the meta data structure before th= e real packet content. This breaks raw data parsing. After a little bit o= f additional debugging I noticed that this happens only on Xen DomU VMs. = On Dom0 it work fine, on other servers not running Xen it works also fine= .=20 Currently I'm about to install rtr DomU as HVM and I think it will work f= ine, but I don't want to leave it like this in production.=20 Is there any reason in xen kernel to break sending packets from kernel to= user space through the ip_queue module ? If so is there any way to work = around this issue ? Thanks in advance, Plamen