Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Matthieu Baerts <matttbe@kernel.org>]

On 07/09/2026 08:59, Hangbin Liu wrote:
> On Mon, Sep 07, 2026 at 07:50:04AM +0200, Matthieu Baerts wrote:
>>>> If a global nft_handle var is used, that doesn't seem clear, and I think
>>>> it would be clearer/easier to:
>>>>
>>>> - either delete a specific rule (but I don't think that's supported)
>>>>
>>>> - get the handle from the test and use it to delete the rule
>>>>
>>>> - or flush the table.
>>>>
>>>> So up to you, but probably best to avoid using nft_handle as global var.
>>>
>>> Thanks, endpoint_tests is the only test that could delete iptables rules.
>>> I use the nft_handle mainly because the iptables also delete rules with
>>> specific match (iptables -D OUTPUT -s .. -p tcp -j REJECT) other than flush
>>> the table directly.
>>>
>>> endpoint_tests
>>>   - reset_with_tcp_filter
>>>     - iptables -D
>>>     - iptables -I
>>>     - iptables -D
>>>   - reset_with_events
>>>     - iptables -I
>>>     - iptables -D
>>>   - reset_with_tcp_filter
>>>     - iptables -D
>>>
>>> While from the logic it should be safe to flush the tables. I can avoid the
>>> nft_handle in v4 (after v3 review).
>>
>> Just to be sure it is clear: nft_handle can be used, just better to
>> avoid using it globally I think. An alternative could be to pass a local
>> nft_handle to reset_with_tcp_filter and set it there, but in bash,
>> that's not very clear either.
> 
> reset_with_tcp_filter is also used by subflows_error_tests(). It's not easy
> to just passing nft_handle to reset_with_tcp_filter for endpoint_tests and
> leave subflows_error_tests() not affect. If there is a new version,
> I'd prefer to just flush the table if you have no objections.

Fine by me. Deleting a specific rule doesn't seem to be as easy as with
IPTables. Please mention in the commit message that flushing is fine and
easier/clearer.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.