Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Matthieu Baerts <matttbe@kernel.org>]

Hi Hangbin,

On 03/09/2026 04:02, Hangbin Liu wrote:
> Hi Matthieu,
> 
> Sorry, My mbsync has some delays and I post v2 too quick before catching
> your feedback.

No problem.

Just in case, maybe korgalore can help?

https://people.kernel.org/monsieuricon/tracking-kernel-development-with-korgalore

> I will update the patch with your feed back and re-post tomorrow.

Thanks!

> On Wed, Sep 02, 2026 at 12:00:40PM +0200, Matthieu Baerts wrote:

(...)

>> If you don't need this one (or any set in helpers), don't set it/them,
>> and don't use a global variable. Or reset it in init_partial, but prefer
>> using local variable with a limited scope.
> 
> Yes, we don't need the handle in other place, which I will remove them.
> But for endpoint_tests(), after adding rules in reset_with_tcp_filter,
> we need to remove the rule outside. I will reset it after each test.

Perhaps you could flush the whole table instead? But if it makes more
sense to assign this variable, fine by me.

>> Also, maybe clearer to use 'nft -j' with 'jq' to get that (if possible)?
> 
> I check the output of `nft -j` (paste an example at the end of mail),
> which looks not each to get the rule handle easily.

I just noticed that in nft's latest release, it is possible to set a
handle when adding the rules. That looks cleaner for our case here, but
it requires the version released 2 days ago, so no :)

Probably best to support the version from Debian Stable, 1.1.3, apparently.

  https://repology.org/project/nftables/versions

>> One last note: for new features linked to MPTCP that might take multiple
>> versions to get ready, it might be better to send these patches only to
>> the MPTCP ML (no need to add anybody else in cc). Then we will apply
>> them in our tree and send them to netdev when we consider them as
>> "ready" (and hope for Clashiko not to get back to them days/weeks later,
>> but that should be a temporally issue :) ).
> 
> Thanks for the notes. I used to rely on `b4 auto-to-cc` too much...

Most of the time, that's fine. It's just for some subsubtrees where
(urgent & simple) fixes can go to the parent tree (netdev here)
directly, but the rest can go only to the subsubtree ML.

BTW, if you are on top of our export(-net) (or for-review(-net)) branch,
there is a .b4-config: you just need to use 'b4 send' then :)

> An example of `nft -j` output:

Thanks for the output!

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.