nf_nat_edemux.sh flakes
Hi!
nf_nat_edemux.sh started flaking in NIPA quite a bit more around a week ago.
https://netdev.bots.linux.dev/contest.html?pass=0&test=nf-nat-edemux-sh&ld_cnt=400
All the failures look like this:
TAP version 13
1..1
# overriding timeout to 3600 # selftests: net/netfilter: nf_nat_edemux.sh # PASS: socat can connect via NAT'd address # FAIL: socat cannot connect to service via redirect (3 seconds elapsed, returned 0) not ok 1 selftests: net/netfilter: nf_nat_edemux.sh # exit=1
(with the number of seconds being 2 or 4 occasionally)
This is on the debug kernel specifically.
Florian Westphal
maintainerQuoted 3 lines · Jakub Kicinski
nf_nat_edemux.shstarted flaking in NIPA quite a bit more around a week ago.https://netdev.bots.linux.dev/contest.html?pass=0&test=nf-nat-edemux-sh&ld_cnt=400
Weird, I don't recall changes in nat engine.
I'll have a look sometime next week.
Quoted 7 lines · On Sat, 27 Sep 2025 12:47:27 +0200 Florian Westphal wrote:
Quoted 3 lines · Jakub Kicinski
nf_nat_edemux.shstarted flaking in NIPA quite a bit more around a week ago.https://netdev.bots.linux.dev/contest.html?pass=0&test=nf-nat-edemux-sh&ld_cnt=400
Weird, I don't recall changes in nat engine.
I'll have a look sometime next week.
Thanks! Sometimes tests flip from flaking to not flaking after we pull from Linus after Thursday's PR. There's probably an intelligent explanation to this but it eludes me :$
While you're looking, nft-fib-sh also flakes occasionally:
https://netdev.bots.linux.dev/contest.html?pass=0&executor=vmksft-nf-dbg&test=nft-fib-sh
Florian Westphal
maintainerQuoted 5 lines · Jakub Kicinski
Quoted 5 lines
Quoted 2 lines · Jakub Kicinski
nf_nat_edemux.shstarted flaking in NIPA quite a bit more around a week ago.Weird, I don't recall changes in nat engine.
I'll have a look sometime next week.
Looks like its not a regression but just tripping due to "1 second is long enough" not being safe anymore on debug builds.
I'll rewrite this to have it query conntrack for relevant entries instead of failing in case socat needed more than 1s to complete.
Quoted 2 lines
While you're looking, nft-fib-sh also flakes occasionally:
https://netdev.bots.linux.dev/contest.html?pass=0&executor=vmksft-nf-dbg&test=nft-fib-sh
D'oh. I think this is just because I did not RTFM.
"ping -c 1" can send more than 1 packet when combined with -w (deadline), so its failing occasionally because the packet counter is *higher* than expected.