Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Hangbin Liu <hangbin.liu@linux.dev>]

On Mon, Sep 07, 2026 at 07:50:04AM +0200, Matthieu Baerts wrote:
> >> If a global nft_handle var is used, that doesn't seem clear, and I think
> >> it would be clearer/easier to:
> >>
> >> - either delete a specific rule (but I don't think that's supported)
> >>
> >> - get the handle from the test and use it to delete the rule
> >>
> >> - or flush the table.
> >>
> >> So up to you, but probably best to avoid using nft_handle as global var.
> > 
> > Thanks, endpoint_tests is the only test that could delete iptables rules.
> > I use the nft_handle mainly because the iptables also delete rules with
> > specific match (iptables -D OUTPUT -s .. -p tcp -j REJECT) other than flush
> > the table directly.
> > 
> > endpoint_tests
> >   - reset_with_tcp_filter
> >     - iptables -D
> >     - iptables -I
> >     - iptables -D
> >   - reset_with_events
> >     - iptables -I
> >     - iptables -D
> >   - reset_with_tcp_filter
> >     - iptables -D
> > 
> > While from the logic it should be safe to flush the tables. I can avoid the
> > nft_handle in v4 (after v3 review).
> 
> Just to be sure it is clear: nft_handle can be used, just better to
> avoid using it globally I think. An alternative could be to pass a local
> nft_handle to reset_with_tcp_filter and set it there, but in bash,
> that's not very clear either.

reset_with_tcp_filter is also used by subflows_error_tests(). It's not easy
to just passing nft_handle to reset_with_tcp_filter for endpoint_tests and
leave subflows_error_tests() not affect. If there is a new version,
I'd prefer to just flush the table if you have no objections.

> >> You need to use `|git rebase --onto` instead, e.g.
> >>
> >>   git fetch origin  # adapt here and below if needed
> > 
> > For export branch, I think git fetch is not enough? I have to reset
> > to latest net/net-next merge commit and pull on that.
> 
> I'm not sure to understand. 'git fetch' with the right remote should get
> the latest <remote>/export branch ...

I get what you mean now. I checked out the export branch, which is not needed.

> 
> >>   git rebase --onto origin/export "$(b4 prep --show-info base-commit)"
> 
> ... then this command will use this new ref. Why do you need to reset
> net/net-next merge commit?
> 
> > Yes, it works! New git usage learned :)
> > 
> >>
> >> Can you check if it works for you, please? (so I can update the wiki
> >> page if needed)
> >>
> >> The alternative is to use `for-review`, with a continuous history, see:
> >>
> >>   https://github.com/multipath-tcp/mptcp_net-next/wiki/Git-Branches
> > 
> > I will try this tree next time
> 
> Up to you, but "export" is good as well, and required when using "git
> blame".

Got it.

Thanks
Hangbin