Re: [PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"

[Matthieu Baerts <matttbe@kernel.org>]

On 09/10/2026 11:26, Hangbin Liu wrote:
> On Fri, Oct 09, 2026 at 11:03:07AM +0200, Matthieu Baerts wrote:
>> Hi Hangbin,
>>
>> On 09/10/2026 09:26, Hangbin Liu wrote:
>>> From: Hangbin Liu <liuhangbin@kylinos.cn>
>>>
>>> After squash, the new commit description could be:
>>
>> Thank you for the new version!
>>
>>> diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
>>> index b16e24418e73..cf079c18af12 100755
>>> --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
>>> +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
>>> @@ -97,6 +97,20 @@ unset add_addr_tx_nr
>>>  unset add_addr_echo_tx_nr
>>>  unset add_addr_drop_tx_nr
>>>  
>>> +# A tcpdump capture of the RM_ADDR message looks like:
>>> +#
>>> +#   [TCP header: 20 bytes] [nop] [nop] [timestamp: 10 bytes] \
>>> +#         [MPTCP DSS: 12 bytes] [MPTCP RM_ADDR: 4 bytes]
>>> +#
>>> +# nft cannot process the RM_ADDR option because it stops parsing after
>>> +# matching the first DSS option. Use hard-coded byte offsets to match
>>> +# RM_ADDR messages. We verify:
>>> +#
>>> +# TCP Data Offset (12 x 4 = 48 bytes), DSS (TCP[32] x 8) kind (MPTCP 0x1e)
>>> +# and length (0x0c). RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e) and subtype (4)
>>> +
>>> +RM_ADDR_OFFSETS="tcp doff 12 @th,256,16 == 0x1e0c @th,352,8 == 0x1e @th,368,4 == 4"
>>
>> The subtype is on 4 bits. For the moment, the rest are not used, but
>> would it not be better to compare the 20 first bits of this offset?
>>
>> So using this: (not tested)
>>
>>   "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,12 == 0x1e044"
> 
> Here it should be @th,352,20 == 0x1e044

Yes indeed, 20, not 12.

>> Or maybe we prefer not to be strict for the RM_ADDR size to match
>> options with multiple IDs? Then having:
>>
>>   "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,8 == 0x1e @th,368,4 == 4"
>>
>> and for the comment:
>>
>> # TCP Data Offset (12 x 4 = 48 bytes).
>> # DSS (TCP[32] x 8) kind (MPTCP 0x1e), length (0x0c), subtype (2).
>> # RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e), variable length, subtype (4).
>>
>> I can modify this when applying if that's OK for you (and validated).
> 
> And both works for me. I tested these 2 rules, all are able to capture the
> RM_ADDR messages.
> 
>         chain OUTPUT {
>                 type filter hook output priority filter; policy accept;
>                 ip saddr 10.0.2.1 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,24 & 0xfffff0 == 0x1e0440 counter packets 1 bytes 68 accept
>                 ip saddr 10.0.1.1 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,24 & 0xfffff0 == 0x1e0440 drop

Did you use 24 for the length because 20 is not accepted?

>         }
> 
>         chain OUTPUT {
>                 type filter hook output priority filter; policy accept;
>                 ip saddr 10.0.2.2 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 counter packets 3 bytes 204 accept
>                 ip saddr 10.0.1.2 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 drop

Same here for 8 instead of 4.

Or is it nft which automatically converted the length to a multiple of 8
with a mask?

>         }
> 
> Thanks
> Hangbin

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.