netdev - Re: [PATCH net-next] selftests: netfilter: fix conntrack stress test failures on debug kernels

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250507170437.0ed28860@kernel.org>
Date: Wed, 7 May 2025 17:04:37 -0700
From: Jakub Kicinski <kuba@...nel.org>
To: Florian Westphal <fw@...len.de>
Cc: <netdev@...r.kernel.org>, netfilter-devel
 <netfilter-devel@...r.kernel.org>
Subject: Re: [PATCH net-next] selftests: netfilter: fix conntrack stress
 test failures on debug kernels

On Wed,  7 May 2025 09:49:55 +0200 Florian Westphal wrote:
> Jakub reports test failures on debug kernel:
> FAIL: proc inconsistency after uniq filter for ...
> 
> This is because entries are expiring while validation is happening.
> 
> Increase the timeout of ctnetlink injected entries and the
> icmp (ping) timeout to 1h to avoid this.
> 
> To reduce run-time, add less entries via ctnetlink when KSFT_MACHINE_SLOW
> is set.
> 
> also log of a failed run had:
>  PASS: dump in netns had same entry count (-C 0, -L 0, -p 0, /proc 0)
> 
> ... i.e. all entries already expired: add a check and set failure if
> this happens.
> 
> While at it, include a diff when there were duplicate entries and add
> netns name to error messages (it tells if icmp or ctnetlink failed).
> 
> Fixes: d33f889fd80c ("selftests: netfilter: add conntrack stress test")
> Reported-by: Jakub Kicinski <kuba@...nel.org>
> Closes: https://lore.kernel.org/netdev/20250506061125.1a244d12@kernel.org/
> Signed-off-by: Florian Westphal <fw@...len.de>

Great! Run 6 times since and 100% green. Thanks for the quick reaction.