Skip to contentSkip to conversation

nf_nat_edemux.sh flakes

TEST Jakub Kicinski 2 participants 4 messages Sep 26, 2025 – Oct 2, 2025 netfilter

lore
Share & tools
lore
#0 lore raw

Hi!

nf_nat_edemux.sh started flaking in NIPA quite a bit more around a week ago.

https://netdev.bots.linux.dev/contest.html?pass=0&test=nf-nat-edemux-sh&ld_cnt=400

All the failures look like this:
TAP version 13
1..1

# overriding timeout to 3600
# selftests: net/netfilter: nf_nat_edemux.sh
# PASS: socat can connect via NAT'd address
# FAIL: socat cannot connect to service via redirect (3 seconds elapsed, returned 0)
not ok 1 selftests: net/netfilter: nf_nat_edemux.sh # exit=1

(with the number of seconds being 2 or 4 occasionally)

This is on the debug kernel specifically.

#2 lore raw
Quoted 7 lines · On Sat, 27 Sep 2025 12:47:27 +0200 Florian Westphal wrote:
Quoted 3 lines · Jakub Kicinski

nf_nat_edemux.sh started flaking in NIPA quite a bit more around a week ago.

https://netdev.bots.linux.dev/contest.html?pass=0&test=nf-nat-edemux-sh&ld_cnt=400

Weird, I don't recall changes in nat engine.
I'll have a look sometime next week.

Thanks! Sometimes tests flip from flaking to not flaking after we pull from Linus after Thursday's PR. There's probably an intelligent explanation to this but it eludes me :$

While you're looking, nft-fib-sh also flakes occasionally:
https://netdev.bots.linux.dev/contest.html?pass=0&executor=vmksft-nf-dbg&test=nft-fib-sh

maintainer
#3 lore raw
Quoted 5 lines · Jakub Kicinski
Quoted 5 lines
Quoted 2 lines · Jakub Kicinski

nf_nat_edemux.sh started flaking in NIPA quite a bit more around a week ago.

Weird, I don't recall changes in nat engine.
I'll have a look sometime next week.

Looks like its not a regression but just tripping due to "1 second is long enough" not being safe anymore on debug builds.

I'll rewrite this to have it query conntrack for relevant entries instead of failing in case socat needed more than 1s to complete.

Quoted 2 lines

While you're looking, nft-fib-sh also flakes occasionally:
https://netdev.bots.linux.dev/contest.html?pass=0&executor=vmksft-nf-dbg&test=nft-fib-sh

D'oh. I think this is just because I did not RTFM.

"ping -c 1" can send more than 1 packet when combined with -w (deadline), so its failing occasionally because the packet counter is *higher* than expected.