[PATCH mptcp-next 0/2] selftests: mptcp: convert iptables to nftables

[PATCH mptcp-next 0/2] selftests: mptcp: convert iptables to nftables

[Hangbin Liu]

iptables has been deprecated for years. The Linux kernel has included
nftables as the successor to iptables since 2014, and every major
distribution uses nftables as the default packet filtering framework.
The iptables command we run on modern systems is actually iptables‑nft,
a compatibility layer that translates iptables syntax to nftables rules
behind the scenes.

There are also some features that can be set easily with nft, while we need
to convert to BPF code under iptables, such as MPTCP add‑addr and
remove‑addr suboptions. To make future work easier, convert iptables usage
in mptcp to nftables.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
Hangbin Liu (2):
      selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh
      selftests: mptcp: convert iptables to nftables for mptcp_join.sh

 tools/testing/selftests/net/mptcp/config           |   3 +
 tools/testing/selftests/net/mptcp/mptcp_join.sh    | 136 ++++++++-------------
 tools/testing/selftests/net/mptcp/mptcp_lib.sh     |   2 +-
 tools/testing/selftests/net/mptcp/mptcp_sockopt.sh |  56 ++++-----
 4 files changed, 77 insertions(+), 120 deletions(-)
---
base-commit: 8dd2802091fbba563abec55e0455d0e5273c7529
change-id: 20260902-mptcp_nft-b892782ef929

Best regards,
-- 
Hangbin Liu <liuhangbin@kylinos.cn>

[PATCH mptcp-next 1/2] selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@kylinos.cn>

The per-AF iptables mark rules are replaced with an inet table
(msock_table) with separate per-AF counter drop rules for IPv4
and IPv6 drop counting.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
 tools/testing/selftests/net/mptcp/mptcp_lib.sh     |  2 +-
 tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 56 ++++++++++------------
 2 files changed, 26 insertions(+), 32 deletions(-)

diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing/selftests/net/mptcp/mptcp_lib.sh
index b9d14647f401..41febb1bbbc7 100644
--- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh
@@ -528,7 +528,7 @@ mptcp_lib_check_tools() {
 				exit ${KSFT_SKIP}
 			fi
 			;;
-		"iptables"* | "ip6tables"*)
+		"iptables"* | "ip6tables"* | "nft"*)
 			if ! "${tool}" -V &> /dev/null; then
 				mptcp_lib_pr_skip "Could not run all tests without ${tool}"
 				exit ${KSFT_SKIP}
diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
index e850a87429b6..4d0af2bf9484 100755
--- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
@@ -15,8 +15,6 @@ cin=""
 cout=""
 timeout_poll=30
 timeout_test=$((timeout_poll * 2 + 1))
-iptables="iptables"
-ip6tables="ip6tables"
 
 ns1=""
 ns2=""
@@ -49,17 +47,23 @@ add_mark_rules()
 	local ns=$1
 	local m=$2
 
-	local t
-	for t in ${iptables} ${ip6tables}; do
-		# just to debug: check we have multiple subflows connection requests
-		ip netns exec $ns $t -A OUTPUT -p tcp --syn -m mark --mark $m -j ACCEPT
-
-		# RST packets might be handled by a internal dummy socket
-		ip netns exec $ns $t -A OUTPUT -p tcp --tcp-flags RST RST -m mark --mark 0 -j ACCEPT
-
-		ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark $m -j ACCEPT
-		ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark 0 -j DROP
-	done
+	ip netns exec "$ns" nft add table inet msock_table
+	ip netns exec "$ns" nft add chain inet msock_table output \
+		'{ type filter hook output priority 0; policy accept; }'
+
+	# just to debug: check we have multiple subflows connection requests
+	ip netns exec "$ns" nft add rule inet msock_table output \
+		 meta mark "$m" tcp flags syn accept
+	# RST packets might be handled by a internal dummy socket
+	ip netns exec "$ns" nft add rule inet msock_table output \
+		meta mark 0 tcp flags rst accept
+	ip netns exec "$ns" nft add rule inet msock_table output \
+		meta mark "$m" meta l4proto tcp accept
+
+	ip netns exec "$ns" nft add rule inet msock_table output \
+		meta nfproto ipv4 meta mark 0 meta l4proto tcp counter drop
+	ip netns exec "$ns" nft add rule inet msock_table output \
+		meta nfproto ipv6 meta mark 0 meta l4proto tcp counter drop
 }
 
 init()
@@ -105,33 +109,23 @@ cleanup()
 
 mptcp_lib_check_mptcp
 mptcp_lib_check_kallsyms
-mptcp_lib_check_tools ip "${iptables}" "${ip6tables}"
+mptcp_lib_check_tools ip nft
 
 check_mark()
 {
 	local ns=$1
 	local af=$2
 
-	local tables=${iptables}
+	drop=$(ip netns exec "$ns" nft list table inet msock_table | \
+		grep "ipv$af.*packets.*drop" | awk '{print $(NF-3)}')
 
-	if [ $af -eq 6 ];then
-		tables=${ip6tables}
+	if [ "$drop" -ne 0 ]; then
+		mptcp_lib_pr_fail "got $drop pkt drops in ns $ns IPv{$af} tables," \
+				  "not 0 - not all expected packets marked"
+		ret=${KSFT_FAIL}
+		return 1
 	fi
 
-	local counters values
-	counters=$(ip netns exec $ns $tables -v -L OUTPUT | grep DROP)
-	values=${counters%DROP*}
-
-	local v
-	for v in $values; do
-		if [ $v -ne 0 ]; then
-			mptcp_lib_pr_fail "got $tables $values in ns $ns," \
-					  "not 0 - not all expected packets marked"
-			ret=${KSFT_FAIL}
-			return 1
-		fi
-	done
-
 	return 0
 }
 

-- 
2.55.0

Re: [PATCH mptcp-next 1/2] selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh

[Matthieu Baerts]

Hi Hangbin,

On 02/09/2026 08:52, Hangbin Liu wrote:
> From: Hangbin Liu <liuhangbin@kylinos.cn>
> 
> The per-AF iptables mark rules are replaced with an inet table
> (msock_table) with separate per-AF counter drop rules for IPv4
> and IPv6 drop counting.

Thank you for looking at that!

> diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
> index e850a87429b6..4d0af2bf9484 100755
> --- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
> +++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh

(...)

> @@ -105,33 +109,23 @@ cleanup()
>  
>  mptcp_lib_check_mptcp
>  mptcp_lib_check_kallsyms
> -mptcp_lib_check_tools ip "${iptables}" "${ip6tables}"
> +mptcp_lib_check_tools ip nft
>  
>  check_mark()
>  {
>  	local ns=$1
>  	local af=$2
>  
> -	local tables=${iptables}
> +	drop=$(ip netns exec "$ns" nft list table inet msock_table | \
> +		grep "ipv$af.*packets.*drop" | awk '{print $(NF-3)}')

Would it not be cleaner to use 'nft -j' and 'jq' to get all the
(non-zero) drop counters?

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH mptcp-next 1/2] selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh

[Hangbin Liu]

On Wed, Sep 02, 2026 at 11:17:48AM +0200, Matthieu Baerts wrote:
> > @@ -105,33 +109,23 @@ cleanup()
> >  
> >  mptcp_lib_check_mptcp
> >  mptcp_lib_check_kallsyms
> > -mptcp_lib_check_tools ip "${iptables}" "${ip6tables}"
> > +mptcp_lib_check_tools ip nft
> >  
> >  check_mark()
> >  {
> >  	local ns=$1
> >  	local af=$2
> >  
> > -	local tables=${iptables}
> > +	drop=$(ip netns exec "$ns" nft list table inet msock_table | \
> > +		grep "ipv$af.*packets.*drop" | awk '{print $(NF-3)}')
> 
> Would it not be cleaner to use 'nft -j' and 'jq' to get all the
> (non-zero) drop counters?

We can get with this rule:

nft -j list table filter | jq -r '.nftables[] | select(has("rule")) |
				.rule | select (.chain=="OUTPUT" and any(.expr[]; has("drop"))) |
				.expr[] | select(has("counter")) |
				.counter.packets'

Thanks
Hangbin

[PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@kylinos.cn>

Replace the per-address-family iptables rules with a single inet table
(mjoin_table) that handles both IPv4 and IPv6. The BPF bytecode for
matching MPTCP add-addr and remove-addr suboptions is replaced with
native nft matching via "tcp option mptcp subtype". Rule handles are
captured via "nft -e --handle" so that rules can be selectively removed
during tests.

The config file adds CONFIG_NFT_NUMGEN (replaces iptables statistic nth),
CONFIG_NFT_REJECT and CONFIG_NFT_REJECT_IPV4 for reject‑related rules.

The iptables/ip6tables check inside mptcp_lib.sh is kept in case any
one still need them.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
 tools/testing/selftests/net/mptcp/config        |   3 +
 tools/testing/selftests/net/mptcp/mptcp_join.sh | 136 +++++++++---------------
 2 files changed, 51 insertions(+), 88 deletions(-)

diff --git a/tools/testing/selftests/net/mptcp/config b/tools/testing/selftests/net/mptcp/config
index 59051ee2a986..0d0a744c4ca8 100644
--- a/tools/testing/selftests/net/mptcp/config
+++ b/tools/testing/selftests/net/mptcp/config
@@ -30,6 +30,9 @@ CONFIG_NET_SCH_NETEM=m
 CONFIG_NF_TABLES=m
 CONFIG_NF_TABLES_INET=y
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_NUMGEN=y
+CONFIG_NFT_REJECT=m
+CONFIG_NFT_REJECT_IPV4=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_TPROXY=m
 CONFIG_SYN_COOKIES=y
diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
index 18ce7136a2b0..05cbaddb8261 100755
--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
@@ -26,8 +26,6 @@ capout=""
 cappid=""
 ns1=""
 ns2=""
-iptables="iptables"
-ip6tables="ip6tables"
 timeout_poll=30
 timeout_test=$((timeout_poll * 2 + 1))
 capture=false
@@ -50,6 +48,7 @@ declare -A failed_tests
 MPTCP_LIB_TEST_FORMAT="%03u %s\n"
 TEST_NAME=""
 nr_blank=6
+nft_handle=""
 
 # These var are used only in some tests, make sure they are not already set
 unset FAILING_LINKS
@@ -99,42 +98,6 @@ unset add_addr_tx_nr
 unset add_addr_echo_tx_nr
 unset add_addr_drop_tx_nr
 
-# generated using "nfbpf_compile '(ip && (ip[54] & 0xf0) == 0x30) ||
-#				  (ip6 && (ip6[74] & 0xf0) == 0x30)'"
-CBPF_MPTCP_SUBOPTION_ADD_ADDR="14,
-			       48 0 0 0,
-			       84 0 0 240,
-			       21 0 3 64,
-			       48 0 0 54,
-			       84 0 0 240,
-			       21 6 7 48,
-			       48 0 0 0,
-			       84 0 0 240,
-			       21 0 4 96,
-			       48 0 0 74,
-			       84 0 0 240,
-			       21 0 1 48,
-			       6 0 0 65535,
-			       6 0 0 0"
-
-# IPv4: TCP hdr of 48B, a first suboption of 12B (DACK8), the RM_ADDR suboption
-# generated using "nfbpf_compile '(ip[32] & 0xf0) == 0xc0 && ip[53] == 0x0c &&
-#				  (ip[66] & 0xf0) == 0x40'"
-CBPF_MPTCP_SUBOPTION_RM_ADDR="13,
-			      48 0 0 0,
-			      84 0 0 240,
-			      21 0 9 64,
-			      48 0 0 32,
-			      84 0 0 240,
-			      21 0 6 192,
-			      48 0 0 53,
-			      21 0 4 12,
-			      48 0 0 66,
-			      84 0 0 240,
-			      21 0 1 64,
-			      6 0 0 65535,
-			      6 0 0 0"
-
 init_partial()
 {
 	capout=$(mktemp)
@@ -147,6 +110,14 @@ init_partial()
 		if $checksum; then
 			ip netns exec $netns sysctl -q net.mptcp.checksum_enabled=1
 		fi
+
+		ip netns exec "$netns" nft add table inet mjoin_table
+		ip netns exec "$netns" nft add chain inet mjoin_table input \
+			'{ type filter hook input priority filter; policy accept; }'
+		ip netns exec "$netns" nft add chain inet mjoin_table output \
+			'{ type filter hook output priority filter; policy accept; }'
+		ip netns exec "$netns" nft add chain inet mjoin_table mangle \
+			'{ type filter hook output priority mangle; policy accept; }'
 	done
 
 	check_invert=0
@@ -196,7 +167,7 @@ init() {
 
 	mptcp_lib_check_mptcp
 	mptcp_lib_check_kallsyms
-	mptcp_lib_check_tools ip tc ss "${iptables}" "${ip6tables}"
+	mptcp_lib_check_tools ip tc ss nft
 
 	sin=$(mktemp)
 	sout=$(mktemp)
@@ -381,23 +352,18 @@ reset_with_cookies()
 reset_with_add_addr_timeout()
 {
 	local ip="${2:-4}"
-	local tables
 
 	reset "${1}" || return 1
 
-	tables="${iptables}"
-	if [ $ip -eq 6 ]; then
-		tables="${ip6tables}"
-	fi
-
 	# set a maximum, to avoid too long timeout with exponential backoff
 	ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=1
 
-	if ! ip netns exec $ns2 $tables -A OUTPUT -p tcp \
-			-m tcp --tcp-option 30 \
-			-m bpf --bytecode \
-			"$CBPF_MPTCP_SUBOPTION_ADD_ADDR" \
-			-j DROP; then
+
+	nft_handle=$(ip netns exec "$ns2" nft -e --handle add rule \
+		inet mjoin_table output meta nfproto ipv${ip} \
+		tcp option mptcp subtype add-addr \
+		drop | head -n1 | awk '{print $NF}')
+	if [ -z "$nft_handle" ]; then
 		mark_as_skipped "unable to set the 'add addr' rule"
 		return 1
 	fi
@@ -450,22 +416,16 @@ setup_fail_rules()
 	validate_checksum=true
 	local i="$1"
 	local ip="${2:-4}"
-	local tables
 
-	tables="${iptables}"
-	if [ $ip -eq 6 ]; then
-		tables="${ip6tables}"
+	nft_handle=$(ip netns exec "$ns2" nft -e --handle add rule \
+		inet mjoin_table mangle oifname ns2eth$i \
+		meta nfproto ipv${ip} meta l4proto tcp \
+		meta length 150-9999 numgen inc mod 99999 == 1 \
+		meta mark set 42 | head -n1 | awk '{print $NF}')
+	if [ -z "$nft_handle" ]; then
+		return ${KSFT_SKIP}
 	fi
 
-	ip netns exec $ns2 $tables \
-		-t mangle \
-		-A OUTPUT \
-		-o ns2eth$i \
-		-p tcp \
-		-m length --length 150:9999 \
-		-m statistic --mode nth --packet 1 --every 99999 \
-		-j MARK --set-mark 42 || return ${KSFT_SKIP}
-
 	tc -n $ns2 qdisc add dev ns2eth$i clsact || return ${KSFT_SKIP}
 	tc -n $ns2 filter add dev ns2eth$i egress \
 		protocol ip prio 1000 \
@@ -515,11 +475,11 @@ reset_with_tcp_filter()
 	local target="${3}"
 	local chain="${4:-INPUT}"
 
-	if ! ip netns exec "${ns}" ${iptables} \
-			-A "${chain}" \
-			-s "${src}" \
-			-p tcp \
-			-j "${target}"; then
+	nft_handle=$(ip netns exec "$ns" nft -e --handle add rule \
+		inet mjoin_table "${chain,,}" \
+		ip saddr "{ ${src} }" meta l4proto tcp "${target,,}" | \
+		head -n1 | awk '{print $NF}')
+	if [ -z "$nft_handle" ]; then
 		mark_as_skipped "unable to set the filter rules"
 		return 1
 	fi
@@ -4315,10 +4275,12 @@ userspace_tests()
 
 		# force quick loss
 		ip netns exec $ns2 sysctl -q net.ipv4.tcp_syn_retries=1
-		if ip netns exec "${ns1}" ${iptables} -A INPUT -s "10.0.1.2" \
-		      -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset &&
-		   ip netns exec "${ns2}" ${iptables} -A INPUT -d "10.0.1.2" \
-		      -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset; then
+		if ip netns exec "${ns1}" nft add rule inet mjoin_table \
+			input ip saddr "10.0.1.2" meta l4proto tcp \
+			tcp option mptcp exists reject with tcp reset &&
+		   ip netns exec "${ns2}" nft add rule inet mjoin_table \
+			input ip daddr "10.0.1.2" meta l4proto tcp \
+			tcp option mptcp exists reject with tcp reset; then
 			wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 1
 			wait_event ns1 MPTCP_LIB_EVENT_SUB_CLOSED 1
 			chk_subflows_total 1 1
@@ -4393,7 +4355,7 @@ endpoint_tests()
 		chk_subflow_nr "after new reject" 2
 		chk_mptcp_info subflows 1 subflows 1
 
-		ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJECT
+		ip netns exec "${ns2}" nft delete rule inet mjoin_table output handle "$nft_handle"
 		pm_nl_del_endpoint $ns2 3 10.0.3.2
 		pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow
 		wait_mpj 3
@@ -4402,12 +4364,10 @@ endpoint_tests()
 
 		# To make sure RM_ADDR are sent over a different subflow, but
 		# allow the rest to quickly and cleanly close the subflow
-		local ipt=1
-		ip netns exec "${ns2}" ${iptables} -I OUTPUT -s "10.0.1.2" \
-			-p tcp -m tcp --tcp-option 30 \
-			-m bpf --bytecode \
-			"$CBPF_MPTCP_SUBOPTION_RM_ADDR" \
-			-j DROP || ipt=0
+		nft_handle=$(ip netns exec "${ns2}" nft -e --handle insert rule \
+			inet mjoin_table output ip saddr 10.0.1.2 meta l4proto tcp \
+			tcp option mptcp subtype remove-addr \
+			drop | head -n1 | awk '{print $NF}')
 		local i
 		for i in $(seq 3); do
 			pm_nl_del_endpoint $ns2 1 10.0.1.2
@@ -4420,7 +4380,8 @@ endpoint_tests()
 			chk_subflow_nr "after re-add id 0 ($i)" 3
 			chk_mptcp_info subflows 3 subflows 3
 		done
-		[ ${ipt} = 1 ] && ip netns exec "${ns2}" ${iptables} -D OUTPUT 1
+		[ -n "${nft_handle}" ] && ip netns exec "${ns2}" nft delete rule \
+			inet mjoin_table output handle "${nft_handle}"
 
 		mptcp_lib_kill_group_wait $tests_pid
 
@@ -4482,18 +4443,17 @@ endpoint_tests()
 
 		# To make sure RM_ADDR are sent over a different subflow, but
 		# allow the rest to quickly and cleanly close the subflow
-		local ipt=1
-		ip netns exec "${ns1}" ${iptables} -I OUTPUT -s "10.0.1.1" \
-			-p tcp -m tcp --tcp-option 30 \
-			-m bpf --bytecode \
-			"$CBPF_MPTCP_SUBOPTION_RM_ADDR" \
-			-j DROP || ipt=0
+		nft_handle=$(ip netns exec "${ns1}" nft -e --handle insert rule \
+			inet mjoin_table output ip saddr 10.0.1.1 meta l4proto tcp \
+			tcp option mptcp subtype remove-addr \
+			drop | head -n1 | awk '{print $NF}')
 		pm_nl_del_endpoint $ns1 42 10.0.1.1
 		sleep 0.5
 		chk_subflow_nr "after delete ID 0" 2
 		chk_mptcp_info subflows 2 subflows 2
 		chk_mptcp_info add_addr_signal 2 add_addr_accepted 2
-		[ ${ipt} = 1 ] && ip netns exec "${ns1}" ${iptables} -D OUTPUT 1
+		[ -n "${nft_handle}" ] && ip netns exec "${ns1}" nft delete rule \
+			inet mjoin_table output handle "${nft_handle}"
 
 		pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal
 		wait_mpj 4
@@ -4555,7 +4515,7 @@ endpoint_tests()
 		pm_nl_flush_endpoint $ns2
 		pm_nl_flush_endpoint $ns1
 		wait_rm_addr $ns2 0
-		ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJECT
+		ip netns exec "${ns2}" nft delete rule inet mjoin_table output handle "$nft_handle"
 		pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow
 		wait_mpj 1
 		pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal

-- 
2.55.0

Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Matthieu Baerts]

Hi Hangbin,

On 02/09/2026 08:52, Hangbin Liu wrote:
> From: Hangbin Liu <liuhangbin@kylinos.cn>
> 
> Replace the per-address-family iptables rules with a single inet table
> (mjoin_table) that handles both IPv4 and IPv6. The BPF bytecode for
> matching MPTCP add-addr and remove-addr suboptions is replaced with
> native nft matching via "tcp option mptcp subtype". Rule handles are

Good idea!

> captured via "nft -e --handle" so that rules can be selectively removed
> during tests.
> 
> The config file adds CONFIG_NFT_NUMGEN (replaces iptables statistic nth),
> CONFIG_NFT_REJECT and CONFIG_NFT_REJECT_IPV4 for reject‑related rules.
> 
> The iptables/ip6tables check inside mptcp_lib.sh is kept in case any
> one still need them.

Please remove them, not to be tempted to use them.

> Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
> ---
>  tools/testing/selftests/net/mptcp/config        |   3 +
>  tools/testing/selftests/net/mptcp/mptcp_join.sh | 136 +++++++++---------------
>  2 files changed, 51 insertions(+), 88 deletions(-)
> 
> diff --git a/tools/testing/selftests/net/mptcp/config b/tools/testing/selftests/net/mptcp/config
> index 59051ee2a986..0d0a744c4ca8 100644
> --- a/tools/testing/selftests/net/mptcp/config
> +++ b/tools/testing/selftests/net/mptcp/config
> @@ -30,6 +30,9 @@ CONFIG_NET_SCH_NETEM=m
>  CONFIG_NF_TABLES=m
>  CONFIG_NF_TABLES_INET=y
>  CONFIG_NFT_COMPAT=m
> +CONFIG_NFT_NUMGEN=y
> +CONFIG_NFT_REJECT=m
> +CONFIG_NFT_REJECT_IPV4=m

Even if we currently don't need the v6 version, I wonder if we shouldn't
add it here. Up to you, when we will need it, we can also add it here, fine.

I wonder if we shouldn't remove the ones linked to IPTables. I was
thinking that maybe we could keep them for debug purposes, but same as
the reject v6, we can add them when required instead of guessing which
ones would be useful, "just in case". So yes, do you mind removing the
ones that are no longer needed, please?

>  CONFIG_NFT_SOCKET=m
>  CONFIG_NFT_TPROXY=m
>  CONFIG_SYN_COOKIES=y
> diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> index 18ce7136a2b0..05cbaddb8261 100755
> --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
> +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> @@ -26,8 +26,6 @@ capout=""
>  cappid=""
>  ns1=""
>  ns2=""
> -iptables="iptables"
> -ip6tables="ip6tables"
>  timeout_poll=30
>  timeout_test=$((timeout_poll * 2 + 1))
>  capture=false
> @@ -50,6 +48,7 @@ declare -A failed_tests
>  MPTCP_LIB_TEST_FORMAT="%03u %s\n"
>  TEST_NAME=""
>  nr_blank=6
> +nft_handle=""
>  
>  # These var are used only in some tests, make sure they are not already set
>  unset FAILING_LINKS
> @@ -99,42 +98,6 @@ unset add_addr_tx_nr
>  unset add_addr_echo_tx_nr
>  unset add_addr_drop_tx_nr
>  
> -# generated using "nfbpf_compile '(ip && (ip[54] & 0xf0) == 0x30) ||
> -#				  (ip6 && (ip6[74] & 0xf0) == 0x30)'"
> -CBPF_MPTCP_SUBOPTION_ADD_ADDR="14,
> -			       48 0 0 0,
> -			       84 0 0 240,
> -			       21 0 3 64,
> -			       48 0 0 54,
> -			       84 0 0 240,
> -			       21 6 7 48,
> -			       48 0 0 0,
> -			       84 0 0 240,
> -			       21 0 4 96,
> -			       48 0 0 74,
> -			       84 0 0 240,
> -			       21 0 1 48,
> -			       6 0 0 65535,
> -			       6 0 0 0"
> -
> -# IPv4: TCP hdr of 48B, a first suboption of 12B (DACK8), the RM_ADDR suboption
> -# generated using "nfbpf_compile '(ip[32] & 0xf0) == 0xc0 && ip[53] == 0x0c &&
> -#				  (ip[66] & 0xf0) == 0x40'"
> -CBPF_MPTCP_SUBOPTION_RM_ADDR="13,
> -			      48 0 0 0,
> -			      84 0 0 240,
> -			      21 0 9 64,
> -			      48 0 0 32,
> -			      84 0 0 240,
> -			      21 0 6 192,
> -			      48 0 0 53,
> -			      21 0 4 12,
> -			      48 0 0 66,
> -			      84 0 0 240,
> -			      21 0 1 64,
> -			      6 0 0 65535,
> -			      6 0 0 0"

Good to get rid of that. Also not to have get_maintainer.pl cc'ing the
BPF ML just for that :)

>  init_partial()
>  {
>  	capout=$(mktemp)
> @@ -147,6 +110,14 @@ init_partial()
>  		if $checksum; then
>  			ip netns exec $netns sysctl -q net.mptcp.checksum_enabled=1
>  		fi
> +
> +		ip netns exec "$netns" nft add table inet mjoin_table
> +		ip netns exec "$netns" nft add chain inet mjoin_table input \
> +			'{ type filter hook input priority filter; policy accept; }'
> +		ip netns exec "$netns" nft add chain inet mjoin_table output \
> +			'{ type filter hook output priority filter; policy accept; }'
> +		ip netns exec "$netns" nft add chain inet mjoin_table mangle \
> +			'{ type filter hook output priority mangle; policy accept; }'

I hope having this done by default for all subtests will not have a big
impact at the end when using a debug kernel. Do you mind checking the
impact, please? Just not to add a few seconds for each of the 130+
subtest if it is only needed in some of them.

If it is, we could move that to a new helper and call it when 'nft' is
required, it shouldn't be in many places I guess. This new helper could
also be used to add new rules, or this could be a "reset_" helper, I
didn't check what would be best.

>  	done
>  
>  	check_invert=0
> @@ -196,7 +167,7 @@ init() {
>  
>  	mptcp_lib_check_mptcp
>  	mptcp_lib_check_kallsyms
> -	mptcp_lib_check_tools ip tc ss "${iptables}" "${ip6tables}"
> +	mptcp_lib_check_tools ip tc ss nft
>  
>  	sin=$(mktemp)
>  	sout=$(mktemp)
> @@ -381,23 +352,18 @@ reset_with_cookies()
>  reset_with_add_addr_timeout()
>  {
>  	local ip="${2:-4}"
> -	local tables
>  
>  	reset "${1}" || return 1
>  
> -	tables="${iptables}"
> -	if [ $ip -eq 6 ]; then
> -		tables="${ip6tables}"
> -	fi
> -
>  	# set a maximum, to avoid too long timeout with exponential backoff
>  	ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=1
>  
> -	if ! ip netns exec $ns2 $tables -A OUTPUT -p tcp \
> -			-m tcp --tcp-option 30 \
> -			-m bpf --bytecode \
> -			"$CBPF_MPTCP_SUBOPTION_ADD_ADDR" \
> -			-j DROP; then
> +
> +	nft_handle=$(ip netns exec "$ns2" nft -e --handle add rule \
> +		inet mjoin_table output meta nfproto ipv${ip} \
> +		tcp option mptcp subtype add-addr \

That's clearer, nice!

I just hope devs and CIs will use a recent enough version for nft (>=
1.1.2 from Apr. 25) to support mptcp subtypes. (Fine to use them, no
need to have a fallback mechanism.)

> +		drop | head -n1 | awk '{print $NF}')

Why do you need "head -n1 | awk '{print $NF}'"? Can we not look at the
ret code like we did with IPTables?

Same below with the RM_ADDR subtype, but for the reject ones, you do
check the ret code.

EDIT: mmh, I see you are using "nft_handle" below, but not the one set
here, right?. That's not very clear when it is set in the function and
used later. Plus this field is not reset before/after each subtest. Is
this really needed? I guess you used it for others because it is easier
remove rules, right?

If you don't need this one (or any set in helpers), don't set it/them,
and don't use a global variable. Or reset it in init_partial, but prefer
using local variable with a limited scope.

Also, maybe clearer to use 'nft -j' with 'jq' to get that (if possible)?


One last note: for new features linked to MPTCP that might take multiple
versions to get ready, it might be better to send these patches only to
the MPTCP ML (no need to add anybody else in cc). Then we will apply
them in our tree and send them to netdev when we consider them as
"ready" (and hope for Clashiko not to get back to them days/weeks later,
but that should be a temporally issue :) ).

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.