[PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"

[PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@kylinos.cn>

After squash, the new commit description could be:

During conversion, we retain the same table and chain names used by the
original iptables/ip6tables setup, so rule output is identical to the
former iptables/ip6tables output. Add new function init_nftables so we
only do nft table setup when test need set nft rules.

Unlike iptables, nftables cannot match rules based on their full
specification. Since endpoint_tests is the only test that delete rules,
which inserts and deletes rules one by one. Flushing the table
directly is safe and easier than using nft_handle.

The cBPF bytecode matching MPTCP add‑addr is replaced with native nft
matching using "tcp option mptcp subtype add-addr". But the RM_ADDR
suboption is added after the MPTCP DSS option, and nft is unable to
handle this because it stops parsing further TCP options once it matches
the first one. We therefore use hard-coded offsets to match the RM_ADDR
suboption.

The config file adds CONFIG_NFT_NUMGEN (replaces iptables statistic nth),
CONFIG_NFT_REJECT and CONFIG_NFT_REJECT_INET for reject‑related rules.
Remove other unneeded configs.

Remove the iptables/ip6tables check in mptcp_lib.sh since no script use
it now.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
Tested with this nft rule and I can see it captures the rm-addr pkts

chain OUTPUT {
        type filter hook output priority filter; policy accept;
        ip saddr 10.0.2.2 tcp doff 12 @th,256,16 0x1e0c @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 counter packets 3 bytes 204 accept
        ip saddr 10.0.1.2 tcp doff 12 @th,256,16 0x1e0c @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 drop
}
---
 tools/testing/selftests/net/mptcp/mptcp_join.sh | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
index b16e24418e73..cf079c18af12 100755
--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
@@ -97,6 +97,20 @@ unset add_addr_tx_nr
 unset add_addr_echo_tx_nr
 unset add_addr_drop_tx_nr
 
+# A tcpdump capture of the RM_ADDR message looks like:
+#
+#   [TCP header: 20 bytes] [nop] [nop] [timestamp: 10 bytes] \
+#         [MPTCP DSS: 12 bytes] [MPTCP RM_ADDR: 4 bytes]
+#
+# nft cannot process the RM_ADDR option because it stops parsing after
+# matching the first DSS option. Use hard-coded byte offsets to match
+# RM_ADDR messages. We verify:
+#
+# TCP Data Offset (12 x 4 = 48 bytes), DSS (TCP[32] x 8) kind (MPTCP 0x1e)
+# and length (0x0c). RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e) and subtype (4)
+
+RM_ADDR_OFFSETS="tcp doff 12 @th,256,16 == 0x1e0c @th,352,8 == 0x1e @th,368,4 == 4"
+
 init_partial()
 {
 	capout=$(mktemp)
@@ -4375,7 +4389,7 @@ endpoint_tests()
 		local nft=1
 		ip netns exec "${ns2}" nft insert rule ip filter OUTPUT \
 			ip saddr 10.0.1.2 meta l4proto tcp \
-			tcp option mptcp subtype remove-addr drop || nft=0
+			"${RM_ADDR_OFFSETS}" drop || nft=0
 		local i
 		for i in $(seq 3); do
 			pm_nl_del_endpoint $ns2 1 10.0.1.2
@@ -4454,7 +4468,7 @@ endpoint_tests()
 		local nft=1
 		ip netns exec "${ns1}" nft insert rule ip filter OUTPUT \
 			ip saddr 10.0.1.1 meta l4proto tcp \
-			tcp option mptcp subtype remove-addr drop || nft=0
+			"${RM_ADDR_OFFSETS}" drop || nft=0
 		pm_nl_del_endpoint $ns1 42 10.0.1.1
 		sleep 0.5
 		chk_subflow_nr "after delete ID 0" 2

---
base-commit: 5ac58fb7c561392ec051c390479ca746c42ca989
change-id: 20261009-mptcp_remove_addr-6777ff1041c6

Best regards,
-- 
Hangbin Liu <liuhangbin@kylinos.cn>

[PATCH mptcp-next] squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@kylinos.cn>

After squash, the new commit description could be:

During the conversion, we retain the same filter and chain names previously
used by iptables/ip6tables. Counters are not added to accept rules because
the test does not inspect them. The syn mark rule is removed as it is
only for debugging, which could be added easily when needed.

After conversion, the generated output matches the original
iptables/ip6tables behavior.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
 tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
index b4e3eddc9cf2..ef2738720e24 100755
--- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
@@ -54,11 +54,6 @@ add_mark_rules()
 			add chain $table filter OUTPUT \
 				{ type filter hook output priority 0; policy accept; }
 
-			# just to debug: check we have multiple subflows connection requests
-			add rule $table filter OUTPUT \
-				tcp flags & (fin | syn | rst | ack) == syn \
-				meta mark $m accept
-
 			# RST packets might be handled by a internal dummy socket
 			add rule $table filter OUTPUT \
 				tcp flags & rst == rst meta mark 0x0 accept

---
base-commit: 5ac58fb7c561392ec051c390479ca746c42ca989
change-id: 20261009-mptcp_rm_debug-27ffeedc78aa

Best regards,
-- 
Hangbin Liu <liuhangbin@kylinos.cn>

Re: [PATCH mptcp-next] squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] selftests: mptcp: incorrect squash target in commit message
--

commit 95308d8ced7d193c5aadb0348b4665a25a875b28
Author: Hangbin Liu <liuhangbin@kylinos.cn>

squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"

This commit removes the syn mark rule from the output filter in the mptcp
selftests. It is intended to be squashed into a previous patch converting
iptables to nftables.

> squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"

[Severity: Low]
Is the commit title targeting the correct script for this squash? The title
explicitly states "mptcp_join.sh", but the diff exclusively modifies
"mptcp_sockopt.sh".

If this is squashed into the "mptcp_join.sh" commit, it might cause confusion
about the patch's purpose or result in applying the squash to the wrong target
commit.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009-mptcp_rm_debug-v1-1-a7b4fdbe1b5f@kylinos.cn?part=1

Re: [PATCH mptcp-next] squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"

[Hangbin Liu]

On Fri, Oct 09, 2026 at 07:31:13AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Low] selftests: mptcp: incorrect squash target in commit message
> --
> 
> commit 95308d8ced7d193c5aadb0348b4665a25a875b28
> Author: Hangbin Liu <liuhangbin@kylinos.cn>
> 
> squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"
> 
> This commit removes the syn mark rule from the output filter in the mptcp
> selftests. It is intended to be squashed into a previous patch converting
> iptables to nftables.
> 
> > squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"
> 
> [Severity: Low]
> Is the commit title targeting the correct script for this squash? The title
> explicitly states "mptcp_join.sh", but the diff exclusively modifies
> "mptcp_sockopt.sh".
> 
> If this is squashed into the "mptcp_join.sh" commit, it might cause confusion
> about the patch's purpose or result in applying the squash to the wrong target
> commit.

Oh, sorry for the typo, this patch should target to mptcp_sockopt.sh

Hangbin

Re: [PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"

[MPTCP CI]

Hi Hangbin,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf: Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/37900753671

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/634b3ec4831b
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1182160


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)

Re: [PATCH mptcp-next] squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"

[MPTCP CI]

Hi Hangbin,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Unstable: 1 failed test(s): selftest_mptcp_connect_mmap ⚠️ 
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf: Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/37900860669

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/a09fd9597ecf
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1182161


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)

Re: [PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"

[Matthieu Baerts]

Hi Hangbin,

On 09/10/2026 09:26, Hangbin Liu wrote:
> From: Hangbin Liu <liuhangbin@kylinos.cn>
> 
> After squash, the new commit description could be:

Thank you for the new version!

> diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> index b16e24418e73..cf079c18af12 100755
> --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
> +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> @@ -97,6 +97,20 @@ unset add_addr_tx_nr
>  unset add_addr_echo_tx_nr
>  unset add_addr_drop_tx_nr
>  
> +# A tcpdump capture of the RM_ADDR message looks like:
> +#
> +#   [TCP header: 20 bytes] [nop] [nop] [timestamp: 10 bytes] \
> +#         [MPTCP DSS: 12 bytes] [MPTCP RM_ADDR: 4 bytes]
> +#
> +# nft cannot process the RM_ADDR option because it stops parsing after
> +# matching the first DSS option. Use hard-coded byte offsets to match
> +# RM_ADDR messages. We verify:
> +#
> +# TCP Data Offset (12 x 4 = 48 bytes), DSS (TCP[32] x 8) kind (MPTCP 0x1e)
> +# and length (0x0c). RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e) and subtype (4)
> +
> +RM_ADDR_OFFSETS="tcp doff 12 @th,256,16 == 0x1e0c @th,352,8 == 0x1e @th,368,4 == 4"

The subtype is on 4 bits. For the moment, the rest are not used, but
would it not be better to compare the 20 first bits of this offset?

So using this: (not tested)

  "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,12 == 0x1e044"

Or maybe we prefer not to be strict for the RM_ADDR size to match
options with multiple IDs? Then having:

  "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,8 == 0x1e @th,368,4 == 4"

and for the comment:

# TCP Data Offset (12 x 4 = 48 bytes).
# DSS (TCP[32] x 8) kind (MPTCP 0x1e), length (0x0c), subtype (2).
# RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e), variable length, subtype (4).

I can modify this when applying if that's OK for you (and validated).

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"

[Hangbin Liu]

On Fri, Oct 09, 2026 at 11:03:07AM +0200, Matthieu Baerts wrote:
> Hi Hangbin,
> 
> On 09/10/2026 09:26, Hangbin Liu wrote:
> > From: Hangbin Liu <liuhangbin@kylinos.cn>
> > 
> > After squash, the new commit description could be:
> 
> Thank you for the new version!
> 
> > diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> > index b16e24418e73..cf079c18af12 100755
> > --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
> > +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> > @@ -97,6 +97,20 @@ unset add_addr_tx_nr
> >  unset add_addr_echo_tx_nr
> >  unset add_addr_drop_tx_nr
> >  
> > +# A tcpdump capture of the RM_ADDR message looks like:
> > +#
> > +#   [TCP header: 20 bytes] [nop] [nop] [timestamp: 10 bytes] \
> > +#         [MPTCP DSS: 12 bytes] [MPTCP RM_ADDR: 4 bytes]
> > +#
> > +# nft cannot process the RM_ADDR option because it stops parsing after
> > +# matching the first DSS option. Use hard-coded byte offsets to match
> > +# RM_ADDR messages. We verify:
> > +#
> > +# TCP Data Offset (12 x 4 = 48 bytes), DSS (TCP[32] x 8) kind (MPTCP 0x1e)
> > +# and length (0x0c). RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e) and subtype (4)
> > +
> > +RM_ADDR_OFFSETS="tcp doff 12 @th,256,16 == 0x1e0c @th,352,8 == 0x1e @th,368,4 == 4"
> 
> The subtype is on 4 bits. For the moment, the rest are not used, but
> would it not be better to compare the 20 first bits of this offset?
> 
> So using this: (not tested)
> 
>   "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,12 == 0x1e044"

Here it should be @th,352,20 == 0x1e044
> 
> Or maybe we prefer not to be strict for the RM_ADDR size to match
> options with multiple IDs? Then having:
> 
>   "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,8 == 0x1e @th,368,4 == 4"
> 
> and for the comment:
> 
> # TCP Data Offset (12 x 4 = 48 bytes).
> # DSS (TCP[32] x 8) kind (MPTCP 0x1e), length (0x0c), subtype (2).
> # RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e), variable length, subtype (4).
> 
> I can modify this when applying if that's OK for you (and validated).

And both works for me. I tested these 2 rules, all are able to capture the
RM_ADDR messages.

        chain OUTPUT {
                type filter hook output priority filter; policy accept;
                ip saddr 10.0.2.1 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,24 & 0xfffff0 == 0x1e0440 counter packets 1 bytes 68 accept
                ip saddr 10.0.1.1 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,24 & 0xfffff0 == 0x1e0440 drop
        }

        chain OUTPUT {
                type filter hook output priority filter; policy accept;
                ip saddr 10.0.2.2 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 counter packets 3 bytes 204 accept
                ip saddr 10.0.1.2 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 drop
        }

Thanks
Hangbin

Re: [PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"

[Matthieu Baerts]

On 09/10/2026 11:26, Hangbin Liu wrote:
> On Fri, Oct 09, 2026 at 11:03:07AM +0200, Matthieu Baerts wrote:
>> Hi Hangbin,
>>
>> On 09/10/2026 09:26, Hangbin Liu wrote:
>>> From: Hangbin Liu <liuhangbin@kylinos.cn>
>>>
>>> After squash, the new commit description could be:
>>
>> Thank you for the new version!
>>
>>> diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
>>> index b16e24418e73..cf079c18af12 100755
>>> --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
>>> +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
>>> @@ -97,6 +97,20 @@ unset add_addr_tx_nr
>>>  unset add_addr_echo_tx_nr
>>>  unset add_addr_drop_tx_nr
>>>  
>>> +# A tcpdump capture of the RM_ADDR message looks like:
>>> +#
>>> +#   [TCP header: 20 bytes] [nop] [nop] [timestamp: 10 bytes] \
>>> +#         [MPTCP DSS: 12 bytes] [MPTCP RM_ADDR: 4 bytes]
>>> +#
>>> +# nft cannot process the RM_ADDR option because it stops parsing after
>>> +# matching the first DSS option. Use hard-coded byte offsets to match
>>> +# RM_ADDR messages. We verify:
>>> +#
>>> +# TCP Data Offset (12 x 4 = 48 bytes), DSS (TCP[32] x 8) kind (MPTCP 0x1e)
>>> +# and length (0x0c). RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e) and subtype (4)
>>> +
>>> +RM_ADDR_OFFSETS="tcp doff 12 @th,256,16 == 0x1e0c @th,352,8 == 0x1e @th,368,4 == 4"
>>
>> The subtype is on 4 bits. For the moment, the rest are not used, but
>> would it not be better to compare the 20 first bits of this offset?
>>
>> So using this: (not tested)
>>
>>   "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,12 == 0x1e044"
> 
> Here it should be @th,352,20 == 0x1e044

Yes indeed, 20, not 12.

>> Or maybe we prefer not to be strict for the RM_ADDR size to match
>> options with multiple IDs? Then having:
>>
>>   "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,8 == 0x1e @th,368,4 == 4"
>>
>> and for the comment:
>>
>> # TCP Data Offset (12 x 4 = 48 bytes).
>> # DSS (TCP[32] x 8) kind (MPTCP 0x1e), length (0x0c), subtype (2).
>> # RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e), variable length, subtype (4).
>>
>> I can modify this when applying if that's OK for you (and validated).
> 
> And both works for me. I tested these 2 rules, all are able to capture the
> RM_ADDR messages.
> 
>         chain OUTPUT {
>                 type filter hook output priority filter; policy accept;
>                 ip saddr 10.0.2.1 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,24 & 0xfffff0 == 0x1e0440 counter packets 1 bytes 68 accept
>                 ip saddr 10.0.1.1 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,24 & 0xfffff0 == 0x1e0440 drop

Did you use 24 for the length because 20 is not accepted?

>         }
> 
>         chain OUTPUT {
>                 type filter hook output priority filter; policy accept;
>                 ip saddr 10.0.2.2 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 counter packets 3 bytes 204 accept
>                 ip saddr 10.0.1.2 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 drop

Same here for 8 instead of 4.

Or is it nft which automatically converted the length to a multiple of 8
with a mask?

>         }
> 
> Thanks
> Hangbin

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"

[Matthieu Baerts]

On 09/10/2026 11:38, Matthieu Baerts wrote:
> On 09/10/2026 11:26, Hangbin Liu wrote:
>> On Fri, Oct 09, 2026 at 11:03:07AM +0200, Matthieu Baerts wrote:
>>> Hi Hangbin,
>>>
>>> On 09/10/2026 09:26, Hangbin Liu wrote:
>>>> From: Hangbin Liu <liuhangbin@kylinos.cn>
>>>>
>>>> After squash, the new commit description could be:
>>>
>>> Thank you for the new version!
>>>
>>>> diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
>>>> index b16e24418e73..cf079c18af12 100755
>>>> --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
>>>> +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
>>>> @@ -97,6 +97,20 @@ unset add_addr_tx_nr
>>>>  unset add_addr_echo_tx_nr
>>>>  unset add_addr_drop_tx_nr
>>>>  
>>>> +# A tcpdump capture of the RM_ADDR message looks like:
>>>> +#
>>>> +#   [TCP header: 20 bytes] [nop] [nop] [timestamp: 10 bytes] \
>>>> +#         [MPTCP DSS: 12 bytes] [MPTCP RM_ADDR: 4 bytes]
>>>> +#
>>>> +# nft cannot process the RM_ADDR option because it stops parsing after
>>>> +# matching the first DSS option. Use hard-coded byte offsets to match
>>>> +# RM_ADDR messages. We verify:
>>>> +#
>>>> +# TCP Data Offset (12 x 4 = 48 bytes), DSS (TCP[32] x 8) kind (MPTCP 0x1e)
>>>> +# and length (0x0c). RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e) and subtype (4)
>>>> +
>>>> +RM_ADDR_OFFSETS="tcp doff 12 @th,256,16 == 0x1e0c @th,352,8 == 0x1e @th,368,4 == 4"
>>>
>>> The subtype is on 4 bits. For the moment, the rest are not used, but
>>> would it not be better to compare the 20 first bits of this offset?
>>>
>>> So using this: (not tested)
>>>
>>>   "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,12 == 0x1e044"
>>
>> Here it should be @th,352,20 == 0x1e044
> 
> Yes indeed, 20, not 12.
> 
>>> Or maybe we prefer not to be strict for the RM_ADDR size to match
>>> options with multiple IDs? Then having:
>>>
>>>   "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,8 == 0x1e @th,368,4 == 4"
>>>
>>> and for the comment:
>>>
>>> # TCP Data Offset (12 x 4 = 48 bytes).
>>> # DSS (TCP[32] x 8) kind (MPTCP 0x1e), length (0x0c), subtype (2).
>>> # RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e), variable length, subtype (4).
>>>
>>> I can modify this when applying if that's OK for you (and validated).
>>
>> And both works for me. I tested these 2 rules, all are able to capture the
>> RM_ADDR messages.

Thank you for having checked!

>>
>>         chain OUTPUT {
>>                 type filter hook output priority filter; policy accept;
>>                 ip saddr 10.0.2.1 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,24 & 0xfffff0 == 0x1e0440 counter packets 1 bytes 68 accept
>>                 ip saddr 10.0.1.1 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,24 & 0xfffff0 == 0x1e0440 drop
> 
> Did you use 24 for the length because 20 is not accepted?
> 
>>         }
>>
>>         chain OUTPUT {
>>                 type filter hook output priority filter; policy accept;
>>                 ip saddr 10.0.2.2 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 counter packets 3 bytes 204 accept
>>                 ip saddr 10.0.1.2 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 drop
> 
> Same here for 8 instead of 4.
> 
> Or is it nft which automatically converted the length to a multiple of 8
> with a mask?

Yes it is apparently.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH mptcp-next] squash to "selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh"

[Matthieu Baerts]

Hi Hangbin,

On 09/10/2026 09:27, Hangbin Liu wrote:
> From: Hangbin Liu <liuhangbin@kylinos.cn>
> 
> After squash, the new commit description could be:
> 
> During the conversion, we retain the same filter and chain names previously
> used by iptables/ip6tables. Counters are not added to accept rules because
> the test does not inspect them. The syn mark rule is removed as it is
> only for debugging, which could be added easily when needed.
> 
> After conversion, the generated output matches the original
> iptables/ip6tables behavior.

Thank you, now in our repo:

- 8bec9f45285e: "squashed" in "selftests: mptcp: convert iptables to
nftables for mptcp_sockopt.sh"

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"

[Matthieu Baerts]

Hi Hangbin,

On 09/10/2026 09:26, Hangbin Liu wrote:
> From: Hangbin Liu <liuhangbin@kylinos.cn>
> 
> After squash, the new commit description could be:
Thank you, now in our repo:

New patches for t/upstream:
- 8bec9f45285e: squash to "selftests: mptcp: convert iptables to
nftables for mptcp_sockopt.sh"
- 4995527f04f5: tg:msg: add notes from the squash-to commit
  → the other Squash-to patch

- 9ea0a7a5c683: Squash to "selftests: mptcp: convert iptables to
nftables for mptcp_join.sh"
- 3385248cdea7: tg:msg: add notes from the squash-to commit
  → this Squash-to patch

- b5888e236f17: Squash to "selftests: mptcp: convert iptables to
nftables for mptcp_join.sh"
  → an extra modification as discussed in this email thread

- Results: 4edaecd07abe..45035345367c (export)

Tests are now in progress:

- export:
https://github.com/multipath-tcp/mptcp_net-next/commit/916150e52b3520605f54439b34888275cda250ea/checks

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.