diff --git a/net/test/anycast_test.py b/net/test/anycast_test.py
index eeb581c..a63f661 100755
--- a/net/test/anycast_test.py
+++ b/net/test/anycast_test.py
@@ -112,6 +112,7 @@
       # This doesn't seem to help, but still.
       self.AnycastSetsockopt(s, False, netid, addr)
     self.assertTrue(thread.finished)
+    s.close()
 
 
 if __name__ == "__main__":
diff --git a/net/test/bpf.py b/net/test/bpf.py
index 41f19eb..b96c82a 100755
--- a/net/test/bpf.py
+++ b/net/test/bpf.py
@@ -18,9 +18,9 @@
 
 import ctypes
 import os
-import platform
 import resource
 import socket
+import sys
 
 import csocket
 import cstruct
@@ -32,10 +32,6 @@
 # around this problem and pick the right syscall nr, we can additionally check
 # the bitness of the python interpreter. Assume that the 64-bit architectures
 # are not running with COMPAT_UTS_MACHINE and must be 64-bit at all times.
-#
-# Is there a better way of doing this?
-# Is it correct to use os.uname()[4] instead of platform.machine() ?
-# Should we use 'sys.maxsize > 2**32' instead of platform.architecture()[0] ?
 __NR_bpf = {  # pylint: disable=invalid-name
     "aarch64-32bit": 386,
     "aarch64-64bit": 280,
@@ -47,7 +43,17 @@
     "x86_64-32bit": 357,
     "x86_64-64bit": 321,
     "riscv64-64bit": 280,
-}[os.uname()[4] + "-" + platform.architecture()[0]]
+}[os.uname()[4] + "-" + ("64" if sys.maxsize > 0x7FFFFFFF else "32") + "bit"]
+
+# After ACK merge of 5.10.168 is when support for this was backported from
+# upstream Linux 5.14 and was merged into ACK android{12,13}-5.10 branches.
+#   ACK android12-5.10 was >= 5.10.168 without this support only for ~4.5 hours
+#   ACK android13-4.10 was >= 5.10.168 without this support only for ~25 hours
+# as such we can >= 5.10.168 instead of > 5.10.168
+HAVE_SO_NETNS_COOKIE = net_test.LINUX_VERSION >= (5, 10, 168)
+
+# Note: This is *not* correct for parisc & sparc architectures
+SO_NETNS_COOKIE = 71
 
 LOG_LEVEL = 1
 LOG_SIZE = 65536
diff --git a/net/test/bpf_test.py b/net/test/bpf_test.py
index d98c494..343ca97 100755
--- a/net/test/bpf_test.py
+++ b/net/test/bpf_test.py
@@ -79,7 +79,6 @@
 from bpf import UpdateMap
 import csocket
 import net_test
-from net_test import LINUX_VERSION
 import sock_diag
 
 libc = ctypes.CDLL(ctypes.util.find_library("c"), use_errno=True)
@@ -114,19 +113,23 @@
 def SocketUDPLoopBack(packet_count, version, prog_fd):
   family = {4: socket.AF_INET, 6: socket.AF_INET6}[version]
   sock = socket.socket(family, socket.SOCK_DGRAM, 0)
-  if prog_fd is not None:
-    BpfProgAttachSocket(sock.fileno(), prog_fd)
-  net_test.SetNonBlocking(sock)
-  addr = {4: "127.0.0.1", 6: "::1"}[version]
-  sock.bind((addr, 0))
-  addr = sock.getsockname()
-  sockaddr = csocket.Sockaddr(addr)
-  for _ in range(packet_count):
-    sock.sendto(b"foo", addr)
-    data, retaddr = csocket.Recvfrom(sock, 4096, 0)
-    assert b"foo" == data
-    assert sockaddr == retaddr
-  return sock
+  try:
+    if prog_fd is not None:
+      BpfProgAttachSocket(sock.fileno(), prog_fd)
+    net_test.SetNonBlocking(sock)
+    addr = {4: "127.0.0.1", 6: "::1"}[version]
+    sock.bind((addr, 0))
+    addr = sock.getsockname()
+    sockaddr = csocket.Sockaddr(addr)
+    for _ in range(packet_count):
+      sock.sendto(b"foo", addr)
+      data, retaddr = csocket.Recvfrom(sock, 4096, 0)
+      assert b"foo" == data
+      assert sockaddr == retaddr
+    return sock
+  except Exception as e:
+    sock.close()
+    raise e
 
 
 # The main code block for eBPF packet counting program. It takes a preloaded
@@ -213,10 +216,13 @@
   def tearDown(self):
     if self.prog_fd >= 0:
       os.close(self.prog_fd)
+      self.prog_fd = -1
     if self.map_fd >= 0:
       os.close(self.map_fd)
+      self.map_fd = -1
     if self.sock:
       self.sock.close()
+      self.sock = None
     super(BpfTest, self).tearDown()
 
   def testCreateMap(self):
@@ -294,8 +300,8 @@
     ]
     instructions += INS_SK_FILTER_ACCEPT
     self.prog_fd = BpfProgLoad(BPF_PROG_TYPE_SOCKET_FILTER, instructions)
-    SocketUDPLoopBack(1, 4, self.prog_fd)
-    SocketUDPLoopBack(1, 6, self.prog_fd)
+    SocketUDPLoopBack(1, 4, self.prog_fd).close()
+    SocketUDPLoopBack(1, 6, self.prog_fd).close()
 
   def testPacketBlock(self):
     self.prog_fd = BpfProgLoad(BPF_PROG_TYPE_SOCKET_FILTER, INS_BPF_EXIT_BLOCK)
@@ -317,8 +323,8 @@
                      + INS_SK_FILTER_ACCEPT)
     self.prog_fd = BpfProgLoad(BPF_PROG_TYPE_SOCKET_FILTER, instructions)
     packet_count = 10
-    SocketUDPLoopBack(packet_count, 4, self.prog_fd)
-    SocketUDPLoopBack(packet_count, 6, self.prog_fd)
+    SocketUDPLoopBack(packet_count, 4, self.prog_fd).close()
+    SocketUDPLoopBack(packet_count, 6, self.prog_fd).close()
     self.assertEqual(packet_count * 2, LookupMap(self.map_fd, key).value)
 
   ##############################################################################
@@ -400,6 +406,43 @@
                                b"Apache 2.0")
     # No exceptions? Good.
 
+  ##############################################################################
+  #
+  # Test for presence of upstream 5.14 kernel patches:
+  #
+  # Android12-5.10:
+  #   UPSTREAM: net: initialize net->net_cookie at netns setup
+  #   https://android-review.git.corp.google.com/c/kernel/common/+/2503195
+  #
+  #   UPSTREAM: net: retrieve netns cookie via getsocketopt
+  #   https://android-review.git.corp.google.com/c/kernel/common/+/2503056
+  #
+  # (and potentially if you care about kernel ABI)
+  #
+  #   ANDROID: fix ABI by undoing atomic64_t -> u64 type conversion
+  #   https://android-review.git.corp.google.com/c/kernel/common/+/2504335
+  #
+  # Android13-5.10:
+  #   UPSTREAM: net: initialize net->net_cookie at netns setup
+  #   https://android-review.git.corp.google.com/c/kernel/common/+/2503795
+  #
+  #   UPSTREAM: net: retrieve netns cookie via getsocketopt
+  #   https://android-review.git.corp.google.com/c/kernel/common/+/2503796
+  #
+  # (and potentially if you care about kernel ABI)
+  #
+  #   ANDROID: fix ABI by undoing atomic64_t -> u64 type conversion
+  #   https://android-review.git.corp.google.com/c/kernel/common/+/2506895
+  #
+  @unittest.skipUnless(bpf.HAVE_SO_NETNS_COOKIE, "no SO_NETNS_COOKIE support")
+  def testGetNetNsCookie(self):
+    sk = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM, 0)
+    cookie = sk.getsockopt(socket.SOL_SOCKET, bpf.SO_NETNS_COOKIE, 8)  # sizeof(u64) == 8
+    sk.close()
+    self.assertEqual(len(cookie), 8)
+    cookie = int.from_bytes(cookie, "little")
+    self.assertGreaterEqual(cookie, 0)
+
   def testGetSocketCookie(self):
     self.map_fd = CreateMap(BPF_MAP_TYPE_HASH, KEY_SIZE, VALUE_SIZE,
                             TOTAL_ENTRIES)
@@ -439,10 +482,10 @@
     uid = TEST_UID
     with net_test.RunAsUid(uid):
       self.assertRaisesErrno(errno.ENOENT, LookupMap, self.map_fd, uid)
-      SocketUDPLoopBack(packet_count, 4, self.prog_fd)
+      SocketUDPLoopBack(packet_count, 4, self.prog_fd).close()
       self.assertEqual(packet_count, LookupMap(self.map_fd, uid).value)
       DeleteMap(self.map_fd, uid)
-      SocketUDPLoopBack(packet_count, 6, self.prog_fd)
+      SocketUDPLoopBack(packet_count, 6, self.prog_fd).close()
       self.assertEqual(packet_count, LookupMap(self.map_fd, uid).value)
 
 
@@ -493,8 +536,8 @@
     self.assertRaisesErrno(errno.EAGAIN, SocketUDPLoopBack, 1, 4, None)
     self.assertRaisesErrno(errno.EAGAIN, SocketUDPLoopBack, 1, 6, None)
     BpfProgDetach(self._cg_fd, BPF_CGROUP_INET_INGRESS)
-    SocketUDPLoopBack(1, 4, None)
-    SocketUDPLoopBack(1, 6, None)
+    SocketUDPLoopBack(1, 4, None).close()
+    SocketUDPLoopBack(1, 6, None).close()
 
   def testCgroupEgress(self):
     self.prog_fd = BpfProgLoad(BPF_PROG_TYPE_CGROUP_SKB, INS_BPF_EXIT_BLOCK)
@@ -502,8 +545,8 @@
     self.assertRaisesErrno(errno.EPERM, SocketUDPLoopBack, 1, 4, None)
     self.assertRaisesErrno(errno.EPERM, SocketUDPLoopBack, 1, 6, None)
     BpfProgDetach(self._cg_fd, BPF_CGROUP_INET_EGRESS)
-    SocketUDPLoopBack(1, 4, None)
-    SocketUDPLoopBack(1, 6, None)
+    SocketUDPLoopBack(1, 4, None).close()
+    SocketUDPLoopBack(1, 6, None).close()
 
   def testCgroupBpfUid(self):
     self.map_fd = CreateMap(BPF_MAP_TYPE_HASH, KEY_SIZE, VALUE_SIZE,
@@ -522,10 +565,10 @@
     uid = TEST_UID
     with net_test.RunAsUid(uid):
       self.assertRaisesErrno(errno.ENOENT, LookupMap, self.map_fd, uid)
-      SocketUDPLoopBack(packet_count, 4, None)
+      SocketUDPLoopBack(packet_count, 4, None).close()
       self.assertEqual(packet_count, LookupMap(self.map_fd, uid).value)
       DeleteMap(self.map_fd, uid)
-      SocketUDPLoopBack(packet_count, 6, None)
+      SocketUDPLoopBack(packet_count, 6, None).close()
       self.assertEqual(packet_count, LookupMap(self.map_fd, uid).value)
     BpfProgDetach(self._cg_fd, BPF_CGROUP_INET_INGRESS)
 
diff --git a/net/test/leak_test.py b/net/test/leak_test.py
index 0e72c21..54bbe73 100755
--- a/net/test/leak_test.py
+++ b/net/test/leak_test.py
@@ -72,6 +72,7 @@
     bogusval = 2 ** 31 - val
     s.setsockopt(SOL_SOCKET, force_option, bogusval)
     self.assertLessEqual(minbuf, s.getsockopt(SOL_SOCKET, option))
+    s.close()
 
   def testRcvBufForce(self):
     self.CheckForceSocketBufferOption(SO_RCVBUF, self.SO_RCVBUFFORCE)
diff --git a/net/test/multinetwork_test.py b/net/test/multinetwork_test.py
index 3a7682e..051b7d1 100755
--- a/net/test/multinetwork_test.py
+++ b/net/test/multinetwork_test.py
@@ -65,6 +65,7 @@
     s.sendto(packet + packets.PING_PAYLOAD, (dstsockaddr, 19321))
 
     self.ExpectPacketOn(netid, msg, expected)
+    s.close()
 
   def CheckTCPSYNPacket(self, version, netid, routing_mode):
     s = self.BuildSocket(version, net_test.TCPSocket, netid, routing_mode)
@@ -102,7 +103,8 @@
       s.connect((dstsockaddr, 53))
       s.send(UDP_PAYLOAD)
       self.ExpectPacketOn(netid, msg % "connect/send", expected)
-      s.close()
+
+    s.close()
 
   def CheckRawGrePacket(self, version, netid, routing_mode):
     s = self.BuildSocket(version, net_test.RawGRESocket, netid, routing_mode)
@@ -123,6 +125,7 @@
     msg = "Raw IPv%d GRE with inner IPv%d UDP: expected %s on %s" % (
         version, inner_version, desc, self.GetInterfaceName(netid))
     self.ExpectPacketOn(netid, msg, expected)
+    s.close()
 
   def CheckOutgoingPackets(self, routing_mode):
     for _ in range(self.ITERATIONS):
@@ -249,6 +252,8 @@
         self.SelectInterface(s, None, mode)
         prevnetid = netid
 
+      s.close()
+
   def testIPv4Remarking(self):
     """Checks that updating the mark on an IPv4 socket changes routing."""
     self.CheckRemarking(4, False)
@@ -300,6 +305,7 @@
         msg = "IPv6 UDP using sticky pktinfo: expected UDP packet on %s" % (
             self.GetInterfaceName(netid))
         self.ExpectPacketOn(netid, msg, expected)
+        s.close()
 
   def CheckPktinfoRouting(self, version):
     for _ in range(self.ITERATIONS):
@@ -340,6 +346,8 @@
             version, desc, self.GetInterfaceName(netid))
         self.ExpectPacketOn(netid, msg, expected)
 
+        s.close()
+
   def testIPv4PktinfoRouting(self):
     self.CheckPktinfoRouting(4)
 
@@ -801,6 +809,7 @@
         else:
           self.assertRaisesErrno(errno.ENETUNREACH, s.sendto, UDP_PAYLOAD,
                                  (net_test.IPV6_ADDR, 1234))
+        s.close()
 
     try:
       CheckIPv6Connectivity(True)
@@ -850,6 +859,8 @@
       msg = "After NA response, expecting %s" % desc
       self.ExpectPacketOn(netid, msg, expected)
 
+      s.close()
+
   # This test documents a known issue: routing tables are never deleted.
   @unittest.skipUnless(multinetwork_base.HAVE_AUTOCONF_TABLE,
                        "no support for per-table autoconf")
@@ -896,6 +907,7 @@
       self.fail("Should have received an RTM_NEWNDUSEROPT message. "
                 "Please ensure the kernel supports receiving the "
                 "PREF64 RA option. Error: %s" % e)
+    s.close()
 
     # Check that the message is received correctly.
     nlmsghdr, data = cstruct.Read(data, netlink.NLMsgHdr)
@@ -1005,6 +1017,8 @@
         metrics = attributes["RTA_METRICS"]
         self.assertEqual(packets.PTB_MTU, metrics["RTAX_MTU"])
 
+        s2.close()
+
   def testIPv4BasicPMTU(self):
     """Tests IPv4 path MTU discovery.
 
@@ -1256,6 +1270,7 @@
       CheckSendFails()
     finally:
       self.iproute.UidRangeRule(6, False, uid, uid, table, self.PRIORITY_UID)
+      s.close()
 
 
 class RulesTest(net_test.NetworkTest):
diff --git a/net/test/neighbour_test.py b/net/test/neighbour_test.py
index ac15897..74b1156 100755
--- a/net/test/neighbour_test.py
+++ b/net/test/neighbour_test.py
@@ -116,6 +116,9 @@
     # so as not to affect other tests.
     self.ChangeRouterNudState(4, NUD_PERMANENT)
 
+    self.sock.close()
+    self.sock = None
+
   def ChangeRouterNudState(self, version, state):
     router = self._RouterAddress(self.netid, version)
     macaddr = self.RouterMacAddress(self.netid)
@@ -268,6 +271,7 @@
 
     # Send a packet, and verify we go into DELAY and then to PROBE.
     s.send(net_test.UDP_PAYLOAD)
+    s.close()
     self.assertNeighbourState(NUD_DELAY, router6)
     self.SleepMs(self.DELAY_TIME_MS * 1.1)
     self.assertNeighbourState(NUD_PROBE, router6)
@@ -323,7 +327,7 @@
     time.sleep(1)
 
     # Send another packet and expect a multicast NS.
-    self.SendDnsRequest(net_test.IPV6_ADDR)
+    self.SendDnsRequest(net_test.IPV6_ADDR).close()
     self.ExpectMulticastNS(router6)
 
     # Receive a unicast NA with the R flag set to 0.
@@ -351,7 +355,7 @@
     self.SetUnicastSolicit(proto, iface, self.UCAST_SOLICIT_LARGE)
 
     # Send a packet and check that we go into DELAY.
-    self.SendDnsRequest(ip_addr)
+    self.SendDnsRequest(ip_addr).close()
     self.assertNeighbourState(NUD_DELAY, router)
 
     # Probing 4 times but no reponse
diff --git a/net/test/netlink.py b/net/test/netlink.py
index 190667c..b5efe11 100644
--- a/net/test/netlink.py
+++ b/net/test/netlink.py
@@ -183,6 +183,11 @@
 
   def close(self):
     self.sock.close()
+    self.sock = None
+
+  def __del__(self):
+    if self.sock:
+      self.close()
 
   def MaybeDebugCommand(self, command, flags, data):
     # Default no-op implementation to be overridden by subclasses.
diff --git a/net/test/nf_test.py b/net/test/nf_test.py
index 8cc283f..2583c9a 100755
--- a/net/test/nf_test.py
+++ b/net/test/nf_test.py
@@ -55,6 +55,7 @@
       sock.connect((addr, 53))
     except IOError:
       pass
+    sock.close()
 
   def testRejectTcp4(self):
     self.CheckRejectedTcp(4, _TEST_IP4_ADDR)
@@ -74,6 +75,7 @@
       sock.sendto(net_test.UDP_PAYLOAD, (addr, 53))
     except IOError:
       pass
+    sock.close()
 
   def testRejectUdp4(self):
     self.CheckRejectedUdp(4, _TEST_IP4_ADDR)
diff --git a/net/test/pf_key.py b/net/test/pf_key.py
index cc8e76c..ca6689e 100755
--- a/net/test/pf_key.py
+++ b/net/test/pf_key.py
@@ -200,6 +200,13 @@
     net_test.SetNonBlocking(self.sock)
     self.seq = 0
 
+  def close(self):
+    self.sock.close()
+    self.sock = None
+
+  def __del__(self):
+    if self.sock: self.close()
+
   def Recv(self):
     reply = self.sock.recv(4096)
     msg = SadbMsg(reply)
diff --git a/net/test/pf_key_test.py b/net/test/pf_key_test.py
index 77cf82c..7791bd1 100755
--- a/net/test/pf_key_test.py
+++ b/net/test/pf_key_test.py
@@ -34,6 +34,10 @@
     self.pf_key = pf_key.PfKey()
     self.xfrm = xfrm.Xfrm()
 
+  def tearDown(self):
+    self.pf_key.close()
+    self.pf_key = None
+
   def testAddDelSa(self):
     src4 = csocket.Sockaddr(("192.0.2.1", 0))
     dst4 = csocket.Sockaddr(("192.0.2.2", 1))
diff --git a/net/test/ping6_test.py b/net/test/ping6_test.py
index 7cb75cc..af2e4c5 100755
--- a/net/test/ping6_test.py
+++ b/net/test/ping6_test.py
@@ -336,10 +336,12 @@
   def testIPv4SendWithNoConnection(self):
     s = net_test.IPv4PingSocket()
     self.assertRaisesErrno(errno.EDESTADDRREQ, s.send, net_test.IPV4_PING)
+    s.close()
 
   def testIPv6SendWithNoConnection(self):
     s = net_test.IPv6PingSocket()
     self.assertRaisesErrno(errno.EDESTADDRREQ, s.send, net_test.IPV6_PING)
+    s.close()
 
   def testIPv4LoopbackPingWithConnect(self):
     s = net_test.IPv4PingSocket()
@@ -347,24 +349,28 @@
     data = net_test.IPV4_PING + b"foobarbaz"
     s.send(data)
     self.assertValidPingResponse(s, data)
+    s.close()
 
   def testIPv6LoopbackPingWithConnect(self):
     s = net_test.IPv6PingSocket()
     s.connect(("::1", 55))
     s.send(net_test.IPV6_PING)
     self.assertValidPingResponse(s, net_test.IPV6_PING)
+    s.close()
 
   def testIPv4PingUsingSendto(self):
     s = net_test.IPv4PingSocket()
     written = s.sendto(net_test.IPV4_PING, (net_test.IPV4_ADDR, 55))
     self.assertEqual(len(net_test.IPV4_PING), written)
     self.assertValidPingResponse(s, net_test.IPV4_PING)
+    s.close()
 
   def testIPv6PingUsingSendto(self):
     s = net_test.IPv6PingSocket()
     written = s.sendto(net_test.IPV6_PING, (net_test.IPV6_ADDR, 55))
     self.assertEqual(len(net_test.IPV6_PING), written)
     self.assertValidPingResponse(s, net_test.IPV6_PING)
+    s.close()
 
   def testIPv4NoCrash(self):
     # Python 2.x does not provide either read() or recvmsg.
@@ -374,6 +380,7 @@
     fd = s.fileno()
     reply = posix.read(fd, 4096)
     self.assertEqual(written, len(reply))
+    s.close()
 
   def testIPv6NoCrash(self):
     # Python 2.x does not provide either read() or recvmsg.
@@ -383,6 +390,7 @@
     fd = s.fileno()
     reply = posix.read(fd, 4096)
     self.assertEqual(written, len(reply))
+    s.close()
 
   def testCrossProtocolCrash(self):
     # Checks that an ICMP error containing a ping packet that matches the ID
@@ -411,6 +419,7 @@
     _, port = s.getsockname()
     scapy.send(GetIPv6Unreachable(port), verbose=False)
     # No crash? Good.
+    s.close()
 
   def testCrossProtocolCalls(self):
     """Tests that passing in the wrong family returns EAFNOSUPPORT.
@@ -454,12 +463,15 @@
                       s4, ipv6sockaddr, net_test.IPV4_PING, None, 0)
     CheckEAFNoSupport(csocket.Sendmsg,
                       s6, ipv4sockaddr, net_test.IPV6_PING, None, 0)
+    s4.close()
+    s6.close()
 
   def testIPv4Bind(self):
     # Bind to unspecified address.
     s = net_test.IPv4PingSocket()
     s.bind(("0.0.0.0", 544))
     self.assertEqual(("0.0.0.0", 544), s.getsockname())
+    s.close()
 
     # Bind to loopback.
     s = net_test.IPv4PingSocket()
@@ -468,6 +480,7 @@
 
     # Binding twice is not allowed.
     self.assertRaisesErrno(errno.EINVAL, s.bind, ("127.0.0.1", 22))
+    s.close()
 
     # But binding two different sockets to the same ID is allowed.
     s2 = net_test.IPv4PingSocket()
@@ -476,6 +489,8 @@
     s3 = net_test.IPv4PingSocket()
     s3.bind(("127.0.0.1", 99))
     self.assertEqual(("127.0.0.1", 99), s3.getsockname())
+    s2.close()
+    s3.close()
 
     # If two sockets bind to the same port, the first one to call read() gets
     # the response.
@@ -493,16 +508,22 @@
     s4.setsockopt(SOL_SOCKET, SO_REUSEADDR, 0)
     self.assertRaisesErrno(errno.EADDRINUSE, s6.bind, ("0.0.0.0", 167))
 
+    s4.close()
+    s5.close()
+    s6.close()
+
     # Can't bind after sendto.
     s = net_test.IPv4PingSocket()
     s.sendto(net_test.IPV4_PING, (net_test.IPV4_ADDR, 9132))
     self.assertRaisesErrno(errno.EINVAL, s.bind, ("0.0.0.0", 5429))
+    s.close()
 
   def testIPv6Bind(self):
     # Bind to unspecified address.
     s = net_test.IPv6PingSocket()
     s.bind(("::", 769))
     self.assertEqual(("::", 769, 0, 0), s.getsockname())
+    s.close()
 
     # Bind to loopback.
     s = net_test.IPv6PingSocket()
@@ -511,6 +532,7 @@
 
     # Binding twice is not allowed.
     self.assertRaisesErrno(errno.EINVAL, s.bind, ("::1", 22))
+    s.close()
 
     # But binding two different sockets to the same ID is allowed.
     s2 = net_test.IPv6PingSocket()
@@ -519,17 +541,22 @@
     s3 = net_test.IPv6PingSocket()
     s3.bind(("::1", 99))
     self.assertEqual(("::1", 99, 0, 0), s3.getsockname())
+    s2.close()
+    s3.close()
 
     # Binding both IPv4 and IPv6 to the same socket works.
     s4 = net_test.IPv4PingSocket()
     s6 = net_test.IPv6PingSocket()
     s4.bind(("0.0.0.0", 444))
     s6.bind(("::", 666, 0, 0))
+    s4.close()
+    s6.close()
 
     # Can't bind after sendto.
     s = net_test.IPv6PingSocket()
     s.sendto(net_test.IPV6_PING, (net_test.IPV6_ADDR, 9132))
     self.assertRaisesErrno(errno.EINVAL, s.bind, ("::", 5429))
+    s.close()
 
   def testIPv4InvalidBind(self):
     s = net_test.IPv4PingSocket()
@@ -546,6 +573,7 @@
     except IOError as e:
       if e.errno == errno.EACCES:
         pass  # We're not root. let it go for now.
+    s.close()
 
   def testIPv6InvalidBind(self):
     s = net_test.IPv6PingSocket()
@@ -561,6 +589,7 @@
     except IOError as e:
       if e.errno == errno.EACCES:
         pass  # We're not root. let it go for now.
+    s.close()
 
   def testAfUnspecBind(self):
     # Binding to AF_UNSPEC is treated as IPv4 if the address is 0.0.0.0.
@@ -574,12 +603,14 @@
     sockaddr = csocket.Sockaddr(("127.0.0.1", 58234))
     sockaddr.family = AF_UNSPEC
     self.assertRaisesErrno(errno.EAFNOSUPPORT, csocket.Bind, s4, sockaddr)
+    s4.close()
 
     # This doesn't work for IPv6.
     s6 = net_test.IPv6PingSocket()
     sockaddr = csocket.Sockaddr(("::1", 58997))
     sockaddr.family = AF_UNSPEC
     self.assertRaisesErrno(errno.EAFNOSUPPORT, csocket.Bind, s6, sockaddr)
+    s6.close()
 
   def testIPv6ScopedBind(self):
     # Can't bind to a link-local address without a scope ID.
@@ -602,22 +633,26 @@
     # on the machine.
     self.assertRaisesErrno(errno.EADDRNOTAVAIL,
                            s.bind, ("fe80::f00", 1026, 0, 1))
+    s.close()
 
     # Scope IDs on non-link-local addresses are silently ignored.
     s = net_test.IPv6PingSocket()
     s.bind(("::1", 1234, 0, 1))
     self.assertEqual(("::1", 1234, 0, 0), s.getsockname())
+    s.close()
 
   def testBindAffectsIdentifier(self):
     s = net_test.IPv6PingSocket()
     s.bind((self.globaladdr, 0xf976))
     s.sendto(net_test.IPV6_PING, (net_test.IPV6_ADDR, 55))
     self.assertEqual(b"\xf9\x76", s.recv(32768)[4:6])
+    s.close()
 
     s = net_test.IPv6PingSocket()
     s.bind((self.globaladdr, 0xace))
     s.sendto(net_test.IPV6_PING, (net_test.IPV6_ADDR, 55))
     self.assertEqual(b"\x0a\xce", s.recv(32768)[4:6])
+    s.close()
 
   def testLinkLocalAddress(self):
     s = net_test.IPv6PingSocket()
@@ -628,6 +663,7 @@
     # doesn't understand the "fe80::1%lo" format, even though it returns it.
     s.sendto(net_test.IPV6_PING, ("fe80::1", 55, 0, self.ifindex))
     # No exceptions? Good.
+    s.close()
 
   def testLinkLocalOif(self):
     """Checks that ping to link-local addresses works correctly.
@@ -673,6 +709,8 @@
           s2.connect((dst, 123, 0, scopeid))
           s2.send(net_test.IPV6_PING)
           self.assertValidPingResponse(s2, net_test.IPV6_PING)
+        s2.close()
+      s.close()
 
   def testMappedAddressFails(self):
     s = net_test.IPv6PingSocket()
@@ -682,6 +720,7 @@
     self.assertValidPingResponse(s, net_test.IPV6_PING)
     self.assertRaisesErrno(errno.EINVAL, s.sendto, net_test.IPV6_PING,
                            ("::ffff:192.0.2.1", 55))
+    s.close()
 
   @unittest.skipUnless(False, "skipping: does not work yet")
   def testFlowLabel(self):
@@ -709,6 +748,7 @@
     _, src = s.recvfrom(32768)
     _, _, flowlabel, _ = src
     self.assertEqual(0xdead, flowlabel & 0xfffff)
+    s.close()
 
   def testIPv4Error(self):
     s = net_test.IPv4PingSocket()
@@ -718,6 +758,7 @@
     # We can't check the actual error because Python 2.7 doesn't implement
     # recvmsg, but we can at least check that the socket returns an error.
     self.assertRaisesErrno(errno.EHOSTUNREACH, s.recv, 32768)  # No response.
+    s.close()
 
   def testIPv6Error(self):
     s = net_test.IPv6PingSocket()
@@ -727,6 +768,7 @@
     # We can't check the actual error because Python 2.7 doesn't implement
     # recvmsg, but we can at least check that the socket returns an error.
     self.assertRaisesErrno(errno.EHOSTUNREACH, s.recv, 32768)  # No response.
+    s.close()
 
   def testIPv6MulticastPing(self):
     s = net_test.IPv6PingSocket()
@@ -736,18 +778,21 @@
     s.sendto(net_test.IPV6_PING, ("ff02::1", 55, 0, self.ifindex))
     self.assertValidPingResponse(s, net_test.IPV6_PING)
     self.assertValidPingResponse(s, net_test.IPV6_PING)
+    s.close()
 
   def testIPv4LargePacket(self):
     s = net_test.IPv4PingSocket()
     data = net_test.IPV4_PING + 20000 * b"a"
     s.sendto(data, ("127.0.0.1", 987))
     self.assertValidPingResponse(s, data)
+    s.close()
 
   def testIPv6LargePacket(self):
     s = net_test.IPv6PingSocket()
     s.bind(("::", 0xace))
     data = net_test.IPV6_PING + b"\x01" + 19994 * b"\x00" + b"aaaaa"
     s.sendto(data, ("::1", 953))
+    s.close()
 
   def testIcmpSocketsNotInIcmp6(self):
     numrows = len(self.ReadProcNetSocket("icmp"))
@@ -757,6 +802,7 @@
     s.connect(("127.0.0.1", 0xbeef))
     self.assertEqual(numrows + 1, len(self.ReadProcNetSocket("icmp")))
     self.assertEqual(numrows6, len(self.ReadProcNetSocket("icmp6")))
+    s.close()
 
   def testIcmp6SocketsNotInIcmp(self):
     numrows = len(self.ReadProcNetSocket("icmp"))
@@ -766,12 +812,14 @@
     s.connect(("::1", 0xbeef))
     self.assertEqual(numrows, len(self.ReadProcNetSocket("icmp")))
     self.assertEqual(numrows6 + 1, len(self.ReadProcNetSocket("icmp6")))
+    s.close()
 
   def testProcNetIcmp(self):
     s = net_test.Socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP)
     s.bind(("127.0.0.1", 0xace))
     s.connect(("127.0.0.1", 0xbeef))
     self.CheckSockStatFile("icmp", "127.0.0.1", 0xace, "127.0.0.1", 0xbeef, 1)
+    s.close()
 
   def testProcNetIcmp6(self):
     numrows6 = len(self.ReadProcNetSocket("icmp6"))
@@ -789,6 +837,7 @@
     self.assertEqual(0, len(self.ReadProcNetSocket("icmp6")))
     s.sendto(net_test.IPV6_PING, (net_test.IPV6_ADDR, 12345))
     self.assertEqual(1, len(self.ReadProcNetSocket("icmp6")))
+    s.close()
 
     # Can't bind after sendto, apparently.
     s = net_test.IPv6PingSocket()
@@ -807,18 +856,21 @@
     self.assertValidPingResponse(s, net_test.IPV6_PING)
     self.CheckSockStatFile("icmp6", self.lladdr, 0xd00d, "ff02::1", 0xdead, 1,
                            txmem=0, rxmem=0)
+    s.close()
 
   def testProcNetUdp6(self):
     s = net_test.Socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP)
     s.bind(("::1", 0xace))
     s.connect(("::1", 0xbeef))
     self.CheckSockStatFile("udp6", "::1", 0xace, "::1", 0xbeef, 1)
+    s.close()
 
   def testProcNetRaw6(self):
     s = net_test.Socket(AF_INET6, SOCK_RAW, IPPROTO_RAW)
     s.bind(("::1", 0xace))
     s.connect(("::1", 0xbeef))
     self.CheckSockStatFile("raw6", "::1", 0xff, "::1", 0, 1)
+    s.close()
 
   def testIPv6MTU(self):
     """Tests IPV6_RECVERR and path MTU discovery on ping sockets.
@@ -859,6 +911,7 @@
     ]
 
     self.assertEqual(msglist, cmsg)
+    s.close()
 
 
 if __name__ == "__main__":
diff --git a/net/test/resilient_rs_test.py b/net/test/resilient_rs_test.py
index f6e022b..f53217d 100755
--- a/net/test/resilient_rs_test.py
+++ b/net/test/resilient_rs_test.py
@@ -171,5 +171,7 @@
       self.assertLess(min_exp, t)
       self.assertGreater(max_exp, t)
 
+    tun.close()
+
 if __name__ == "__main__":
   unittest.main()