[TEST] nf_nat_edemux.sh flakes

[TEST] nf_nat_edemux.sh flakes

[Jakub Kicinski]

Hi!

nf_nat_edemux.sh started flaking in NIPA quite a bit more around a week ago.

https://netdev.bots.linux.dev/contest.html?pass=0&test=nf-nat-edemux-sh&ld_cnt=400

All the failures look like this:
TAP version 13
1..1
# overriding timeout to 3600
# selftests: net/netfilter: nf_nat_edemux.sh
# PASS: socat can connect via NAT'd address
# FAIL: socat cannot connect to service via redirect (3 seconds elapsed, returned 0)
not ok 1 selftests: net/netfilter: nf_nat_edemux.sh # exit=1

(with the number of seconds being 2 or 4 occasionally)

This is on the debug kernel specifically.

Re: [TEST] nf_nat_edemux.sh flakes

[Florian Westphal]

Jakub Kicinski <kuba@kernel.org> wrote:
> nf_nat_edemux.sh started flaking in NIPA quite a bit more around a week ago.
> 
> https://netdev.bots.linux.dev/contest.html?pass=0&test=nf-nat-edemux-sh&ld_cnt=400

Weird, I don't recall changes in nat engine.
I'll have a look sometime next week.

Re: [TEST] nf_nat_edemux.sh flakes

[Jakub Kicinski]

On Sat, 27 Sep 2025 12:47:27 +0200 Florian Westphal wrote:
> Jakub Kicinski <kuba@kernel.org> wrote:
> > nf_nat_edemux.sh started flaking in NIPA quite a bit more around a week ago.
> > 
> > https://netdev.bots.linux.dev/contest.html?pass=0&test=nf-nat-edemux-sh&ld_cnt=400  
> 
> Weird, I don't recall changes in nat engine.
> I'll have a look sometime next week.

Thanks! Sometimes tests flip from flaking to not flaking after we pull
from Linus after Thursday's PR. There's probably an intelligent
explanation to this but it eludes me :$

While you're looking, nft-fib-sh also flakes occasionally:
https://netdev.bots.linux.dev/contest.html?pass=0&executor=vmksft-nf-dbg&test=nft-fib-sh

Re: [TEST] nf_nat_edemux.sh flakes

[Florian Westphal]

Jakub Kicinski <kuba@kernel.org> wrote:
> > Jakub Kicinski <kuba@kernel.org> wrote:
> > > nf_nat_edemux.sh started flaking in NIPA quite a bit more around a week ago.
> > > 
> > Weird, I don't recall changes in nat engine.
> > I'll have a look sometime next week.

Looks like its not a regression but just tripping due to
"1 second is long enough" not being safe anymore on debug builds.

I'll rewrite this to have it query conntrack for relevant entries
instead of failing in case socat needed more than 1s to complete.

> While you're looking, nft-fib-sh also flakes occasionally:
> https://netdev.bots.linux.dev/contest.html?pass=0&executor=vmksft-nf-dbg&test=nft-fib-sh

D'oh.  I think this is just because I did not RTFM.

"ping -c 1" can send more than 1 packet when combined with -w
(deadline), so its failing occasionally because the packet counter
is *higher* than expected.