Re: [PATCH mptcp-next v3 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing 'add' keyword in nftables configuration script causes syntax error, silently skipping tests.
--

commit 45eaf6e2e654e036380de79d25fbc989c2055da7
Author: Hangbin Liu <liuhangbin@kylinos.cn>

selftests: mptcp: convert iptables to nftables for mptcp_join.sh

This commit replaces the iptables/ip6tables setup with nftables in the
mptcp_join.sh selftest. It introduces a new init_nftables function to setup
the nft tables using a heredoc rather than configuring them inline.

> diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> index 18ce7136a2b0e..835cb92cab1a4 100755
> --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
> +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh

[ ... ]

> @@ -184,6 +147,28 @@ init_shapers()
>  	done
>  }
>  
> +init_nftables()
> +{
> +	nft_handle=""
> +
> +	local netns table
> +	for netns in "$ns1" "$ns2"; do
> +		for table in ip ip6; do
> +			ip netns exec "$netns" nft -f - <<-EOF
> +				add table $table filter
> +				add chain $table filter INPUT \
> +					{ type filter hook input priority filter; policy accept; }
> +				add chain $table filter OUTPUT \
> +					{ type filter hook output priority filter; policy accept; }
> +
> +				table $table mangle
> +				chain $table mangle OUTPUT \
                                ^^^^

[Severity: Medium]
Are these table and chain declarations missing the "add" keyword?

The filter table rules above them use "add table" and "add chain", but the
mangle declarations omit "add". Does this syntax error cause the "nft -f -"
command to fail and abort the entire transaction, preventing the creation of
both the filter and mangle tables?

If the tables aren't created, subsequent "nft add rule" commands, like those
in setup_fail_rules() or reset_with_add_addr_timeout(), will fail. This
appears to cause the affected fault-injection and filtering tests to be
silently skipped rather than executed.

> +					{ type route hook output priority mangle; policy accept; }
> +			EOF
> +		done
> +	done
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904-mptcp_nft-v3-0-4abedaf00bf9@kylinos.cn?part=2