Re: [PATCH mptcp-next v2 0/2] selftests: mptcp: convert iptables to nftables

[Hangbin Liu <hangbin.liu@linux.dev>]

Hi,

Sorry everyone. Please ignore this version patch as it was post before
I catch up Matthieu's feedback. I will update the patch with a next version.

Hangbin
On Thu, Sep 03, 2026 at 09:12:19AM +0800, Hangbin Liu wrote:
> iptables has been deprecated for years. The Linux kernel has included
> nftables as the successor to iptables since 2014, and every major
> distribution uses nftables as the default packet filtering framework.
> The iptables command we run on modern systems is actually iptables‑nft,
> a compatibility layer that translates iptables syntax to nftables rules
> behind the scenes.
> 
> There are also some features that can be set easily with nft, while we need
> to convert to BPF code under iptables, such as MPTCP add‑addr and
> remove‑addr suboptions. To make future work easier, convert iptables usage
> in mptcp to nftables.
> 
> Tested with iptables-translate to make sure each nft conversion is the same
> with previous one. e.g. for mptcp_sockopt.sh, the ip6tables shows
> 
> bash-5.3# ip6tables -L
> Chain INPUT (policy ACCEPT)
> target     prot opt source               destination
> 
> Chain FORWARD (policy ACCEPT)
> target     prot opt source               destination
> 
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
> ACCEPT     tcp  --  anywhere             anywhere             tcp flags:FIN,SYN,RST,ACK/SYN mark match 0x1
> ACCEPT     tcp  --  anywhere             anywhere             tcp flags:RST/RST mark match 0x0
> ACCEPT     tcp  --  anywhere             anywhere             mark match 0x1
> DROP       tcp  --  anywhere             anywhere             mark match 0x0
> 
> And the backend nft shows like
> 
> bash-5.3# nft list tables
> table ip6 filter
> bash-5.3# nft list table ip6 filter
> table ip6 filter {
>         chain OUTPUT {
>                 type filter hook output priority filter; policy accept;
>                 tcp flags & (fin | syn | rst | ack) == syn meta mark 0x00000001 counter packets 0 bytes 0 accept
>                 tcp flags & rst == rst meta mark 0x00000000 counter packets 0 bytes 0 accept
>                 meta l4proto tcp meta mark 0x00000001 counter packets 0 bytes 0 accept
>                 meta l4proto tcp meta mark 0x00000000 counter packets 0 bytes 0 drop
>         }
> }
> 
> Which matches what we change in the script, except the counter.
> 
> Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
> ---
> Changes in v2:
> - Fix --sync and --tcp-flags RST convert not match issue (sashiko)
> - make sure drop is a number in check_mark. (sashiko)
> - Other than using one inet table, use ip/ip6 tables to retain the same
>   table and chain names used by the original iptables/ip6tables setup.
> - Link to v1: https://lore.kernel.org/r/20260902-mptcp_nft-v1-0-559caa16f410@kylinos.cn
> 
> ---
> Hangbin Liu (2):
>       selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh
>       selftests: mptcp: convert iptables to nftables for mptcp_join.sh
> 
>  tools/testing/selftests/net/mptcp/config           |   3 +
>  tools/testing/selftests/net/mptcp/mptcp_join.sh    | 142 ++++++++-------------
>  tools/testing/selftests/net/mptcp/mptcp_lib.sh     |   2 +-
>  tools/testing/selftests/net/mptcp/mptcp_sockopt.sh |  51 ++++----
>  4 files changed, 84 insertions(+), 114 deletions(-)
> ---
> base-commit: 8dd2802091fbba563abec55e0455d0e5273c7529
> change-id: 20260902-mptcp_nft-b892782ef929
> 
> Best regards,
> -- 
> Hangbin Liu <liuhangbin@kylinos.cn>
>