Jakub Kicinski <[email protected]> wrote: > The bridge test flakes on debug kernels: > > FAIL: Expected 10 packets total, but got 24 packets total > hook 3 packets 00000008 > hook 4 packets 00000010 > > The surplus are icmp fragment reassembly timeouts. The udp flood in the > stress test leaves incomplete datagrams behind in ns2 and ns3, 30 seconds > later their reassembly queues expire and both namespaces send icmp time > exceeded to ns1's pre-bridge address. ns3 is not reconfigured when the > router is turned into a bridge, so its messages arrive via veth2 and are > then forwarded out of br0. Such packets are locally originated from the > bridge point of view and are queued from the bridge output and > postrouting hooks, which is why only those two counters are off. > > Restrict the ipv4 rule to echo request/reply, the icmpv6 rule already > does this. > > We used to see 1 flake a day in NIPA before locally queuing this change, > zero flakes since (over 9 days)
Thanks for debugging and fixing this! Reviewed-by: Florian Westphal <[email protected]> > The difference between v4 and v6 has been there from day one, > which makes it seem intentional, but I don't understand nft > well enough to come up with any theories why.. Without the restriction this would also queue IPv6 neighbour discovery messages. ARP is not seen by NFPROTO_IPV4 hooks, so the restriction was not needed. I simply did not think of icmp reassembly timeout errors getting sent after some time when I wrote this.
