Re: [PATCH mptcp-next v4 0/2] selftests: mptcp: convert iptables to nftables

[Matthieu Baerts <matttbe@kernel.org>]

Hi Hangbin,

On 08/09/2026 13:36, Hangbin Liu wrote:
> iptables has been deprecated for years. The Linux kernel has included
> nftables as the successor to iptables since 2014, and every major
> distribution uses nftables as the default packet filtering framework.
> The iptables command we run on modern systems is actually iptables‑nft,
> a compatibility layer that translates iptables syntax to nftables rules
> behind the scenes.
> 
> There are also some features that can be set easily with nft, while we need
> to convert to BPF code under iptables, such as MPTCP add‑addr and
> remove‑addr suboptions. To make future work easier, convert iptables usage
> in mptcp to nftables.
Thank you for the new version. It looks good to me:

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

Now in our tree (I just fixed the indentation after 'if .* nft' lines
not to align the rest of the nft commands with the conditional code):

New patches for t/upstream:
- 23ac116ea2c4: selftests: mptcp: convert iptables to nftables for
mptcp_sockopt.sh
- 0ae33af3f73f: selftests: mptcp: convert iptables to nftables for
mptcp_join.sh
- Results: ca7966735328..2dc29b34b99a (export)

Tests are now in progress:

- export:
https://github.com/multipath-tcp/mptcp_net-next/commit/b49aa4201a14e200297db9adcde3495e5a778517/checks

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.