plugin_net: validate nf_conntrack_hashsize before converting to int

[xiejing-dev]

DESC: validate nf_conntrack_hashsize before converting to int
before the fix:

[root@localhost myprof]# cat tuned.conf
[main]
[vm]
transparent_hugepage=madvise

[net]
nf_conntrack_hashsize=abc

[sysctl]
vm.dirty_ratio = 20
[root@localhost myprof]# tuned-adm profile myprof
[root@localhost myprof]# tuned-adm verify
Verification failed, current system settings differ from the preset profile.
You can mostly fix this by restarting the TuneD daemon, e.g.:
  systemctl restart tuned
or
  service tuned restart
Sometimes (if some plugins like bootloader are used) a reboot may be required.
See TuneD log file ('/var/log/tuned/tuned.log') for details.
[root@localhost myprof]#
[root@localhost myprof]# tail -10f /var/log/tuned/tuned.log
       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/tuned/plugins/base.py", line 606, in _verify_non_device_command
    new_value = command["set"](new_value, instance, True, False)
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/tuned/plugins/plugin_net.py", line 503, in _set_nf_conntrack_hashsize
    hashsize = int(value)
               ^^^^^^^^^^
ValueError: invalid literal for int() with base 10: 'abc'

after this fix:

[root@localhost noarch]# tuned-adm profile myprof
[root@localhost noarch]# tuned-adm verify
Verification succeeded, current system settings match the preset profile.
See TuneD log file ('/var/log/tuned/tuned.log') for details.
[root@localhost noarch]# tail -f /var/log/tuned/tuned.log
2026-06-09 21:00:45,351 INFO     tuned.plugins.plugin_vm: Setting option 'dirty_ratio' to '20'
2026-06-09 21:00:45,352 INFO     tuned.profiles.loader: loading profile: myprof
2026-06-09 21:00:45,352 INFO     tuned.daemon.daemon: starting tuning
2026-06-09 21:00:45,356 INFO     tuned.plugins.base: instance net: assigning devices ens37, ens33
2026-06-09 21:00:45,358 WARNING  tuned.plugins.plugin_net: nf_conntrack_hashsize value 'abc' is not integer
2026-06-09 21:00:45,358 INFO     tuned.plugins.plugin_sysctl: reapplying system sysctl
2026-06-09 21:00:45,359 INFO     tuned.daemon.daemon: static tuning from profile 'myprof' applied
2026-06-09 21:00:52,027 INFO     tuned.daemon.daemon: verifying profile(s): myprof
2026-06-09 21:00:52,027 WARNING  tuned.plugins.plugin_net: nf_conntrack_hashsize value 'abc' is not integer
2026-06-09 21:00:52,027 INFO     tuned.plugins.base: verify: passed: 'vm.dirty_ratio' = '20'

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 890eb268-db18-4819-9b1d-8714f2ad0e05

📥 Commits

Reviewing files that changed from the base of the PR and between 0eb28ac and 81f30f8.

📒 Files selected for processing (1)

• tuned/plugins/plugin_net.py

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Enhanced error handling for network connection tracking configuration: invalid inputs now trigger a warning and allow the system to continue, rather than raising an error. Valid inputs continue to be processed normally.

Walkthrough

_set_nf_conntrack_hashsize in plugin_net.py now wraps the int(value) conversion in a try/except ValueError block. Non-integer inputs log a warning and return None; valid integer inputs proceed through the existing range check and write to /sys/module/nf_conntrack/parameters/hashsize unchanged.

Changes

nf_conntrack hashsize input validation

Layer / File(s)	Summary
ValueError guard in _set_nf_conntrack_hashsize tuned/plugins/plugin_net.py	Wraps int(value) in try/except ValueError; invalid inputs now emit a warning and return None instead of raising an unhandled exception.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding validation for nf_conntrack_hashsize before converting it to an integer.
Description check	✅ Passed	The description is directly related to the changeset, providing detailed context about the problem, the fix, and before/after behavior.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[xiejing-dev]

/packit retest-failed