Re: [PATCH mptcp-next v3 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Hangbin Liu <hangbin.liu@linux.dev>]

On Fri, Sep 04, 2026 at 07:42:06AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] Missing 'add' keyword in nftables configuration script causes syntax error, silently skipping tests.
> --
> 
> commit 45eaf6e2e654e036380de79d25fbc989c2055da7
> Author: Hangbin Liu <liuhangbin@kylinos.cn>
> 
> selftests: mptcp: convert iptables to nftables for mptcp_join.sh
> 
> This commit replaces the iptables/ip6tables setup with nftables in the
> mptcp_join.sh selftest. It introduces a new init_nftables function to setup
> the nft tables using a heredoc rather than configuring them inline.
> 
> > diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> > index 18ce7136a2b0e..835cb92cab1a4 100755
> > --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
> > +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> 
> [ ... ]
> 
> > @@ -184,6 +147,28 @@ init_shapers()
> >  	done
> >  }
> >  
> > +init_nftables()
> > +{
> > +	nft_handle=""
> > +
> > +	local netns table
> > +	for netns in "$ns1" "$ns2"; do
> > +		for table in ip ip6; do
> > +			ip netns exec "$netns" nft -f - <<-EOF
> > +				add table $table filter
> > +				add chain $table filter INPUT \
> > +					{ type filter hook input priority filter; policy accept; }
> > +				add chain $table filter OUTPUT \
> > +					{ type filter hook output priority filter; policy accept; }
> > +
> > +				table $table mangle
> > +				chain $table mangle OUTPUT \
>                                 ^^^^
> 
> [Severity: Medium]
> Are these table and chain declarations missing the "add" keyword?
> 

Ah, copy‑and‑paste error. But the test passed when I run it.

After investigating, I found the interesting usage for nft. Both

nft -f - <<-EOF
add table ...
add chain ..
EOF

and

nft -f - <<-EOF
table ...
chain ..
EOF

Works!

Anyway, I will sync the writing in next version (if have) to not miss-leading
others.

Thanks
Hangbin