pasta regression: tcp_splice no longer working correctly #23517
Description
While updating our CI images we have two new failed tests. Both try to pull some encrypted image from a local registry container started with podman however the pull never completes and seems to just hang. I am not sure what is special about the encrypted pull code path all other pull tests seem fine.
Reproducer with pasta 2024-07-26.
make localintegration FOCUS="podman run and decrypt from local registry", I have not yet tried to create a reproducer outside of the suite. Let me know if you need one.
If you want to test a custom pasta build start it with
CONTAINERS_HELPER_BINARY_DIR=/dir/to/passt make localintegration FOCUS="podman run and decrypt from local registry"
so podman uses the pasta binary in this directory path.
And to speed to speed the test up in the failing case you can apply
diff --git a/Makefile b/Makefile
index 076318d93..00925f6c4 100644
--- a/Makefile
+++ b/Makefile
@@ -140,7 +140,7 @@ GINKGO ?= ./test/tools/build/ginkgo
GINKGO_JSON ?= $(if $(CI),--json-report ginkgo-e2e.json,)
# Allow control over some Ginkgo parameters
-GINKGO_FLAKE_ATTEMPTS ?= 3
+GINKGO_FLAKE_ATTEMPTS ?= 1
GINKGO_NO_COLOR ?= y
# Conditional required to produce empty-output if binary not built yet.
diff --git a/test/e2e/run_test.go b/test/e2e/run_test.go
index cfb81aa2d..07980862b 100644
--- a/test/e2e/run_test.go
+++ b/test/e2e/run_test.go
@@ -2185,7 +2185,7 @@ WORKDIR /madethis`, BB)
// Must fail without --decryption-key
session = podmanTest.Podman([]string{"run", "--tls-verify=false", imgPath})
- session.WaitWithDefaultTimeout()
+ session.Wait(30)
Expect(session).Should(ExitWithError(125, "Trying to pull "+imgPath))
Expect(session.ErrorToString()).To(ContainSubstring("invalid tar header"))
Switching the test registry container to use slirp4netns makes it work, using pasta 2024-06-24 also works.
With git bisect on the passt repo and the reproducer above I got 66a02c9f7c tcp_splice: Use parameterised macros for per-side event/flag bits as first bad commit which sounds related. Full bisect log for reference:
git bisect start
# status: waiting for both good and bad commits
# bad: [0149d11cc5043d618cf4a6e6e8201d5718836dd2] pasta: modify hostname when detaching new namespace
git bisect bad 0149d11cc5043d618cf4a6e6e8201d5718836dd2
# status: waiting for good commit(s), bad commit known
# good: [1ee2ecade3f41e2a3e51c1e580b08cba977a7c8d] udp: Reduce scope of rport in udp_invert_portmap()
git bisect good 1ee2ecade3f41e2a3e51c1e580b08cba977a7c8d
# bad: [6d76278c21ce2aae7f68ba6807de570cc88f5499] icmp: Obtain destination addresses from the flowsides
git bisect bad 6d76278c21ce2aae7f68ba6807de570cc88f5499
# good: [4e1f850f61caaff0c65ce9d5fc4322a4aea807dc] udp, tcp: Tweak handling of no_udp and no_tcp flags
git bisect good 4e1f850f61caaff0c65ce9d5fc4322a4aea807dc
# bad: [4e2d36e83fb1ff86c2e7f6d0832827d59f829934] flow: Common address information for target side
git bisect bad 4e2d36e83fb1ff86c2e7f6d0832827d59f829934
# good: [5235c47c791919333aec8707ff2839d50bdf727a] flow: Introduce flow_foreach_sidei() macro
git bisect good 5235c47c791919333aec8707ff2839d50bdf727a
# bad: [01e5611ec3912f02fb683305db8913f8eca15fee] doc: Test behaviour of closing duplicate UDP sockets
git bisect bad 01e5611ec3912f02fb683305db8913f8eca15fee
# bad: [66a02c9f7cd5c7a643d9ac5dad5a7209a6e1c467] tcp_splice: Use parameterised macros for per-side event/flag bits
git bisect bad 66a02c9f7cd5c7a643d9ac5dad5a7209a6e1c467
# first bad commit: [66a02c9f7cd5c7a643d9ac5dad5a7209a6e1c467] tcp_splice: Use parameterised macros for per-side event/flag bits