Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Hangbin Liu <hangbin.liu@linux.dev>]

Hi Matthieu,

Here is some update.
On Thu, Sep 03, 2026 at 10:02:52AM +0800, Hangbin Liu wrote:
> > 
> > >  init_partial()
> > >  {
> > >  	capout=$(mktemp)
> > > @@ -147,6 +110,14 @@ init_partial()
> > >  		if $checksum; then
> > >  			ip netns exec $netns sysctl -q net.mptcp.checksum_enabled=1
> > >  		fi
> > > +
> > > +		ip netns exec "$netns" nft add table inet mjoin_table
> > > +		ip netns exec "$netns" nft add chain inet mjoin_table input \
> > > +			'{ type filter hook input priority filter; policy accept; }'
> > > +		ip netns exec "$netns" nft add chain inet mjoin_table output \
> > > +			'{ type filter hook output priority filter; policy accept; }'
> > > +		ip netns exec "$netns" nft add chain inet mjoin_table mangle \
> > > +			'{ type filter hook output priority mangle; policy accept; }'
> > 
> > I hope having this done by default for all subtests will not have a big
> > impact at the end when using a debug kernel. Do you mind checking the
> > impact, please? Just not to add a few seconds for each of the 130+
> > subtest if it is only needed in some of them.
> 
> It shouldn't, I will test the running time before/after the change.

With debug kernel + 4 cpu on my laptop, the time for iptables version is

real    35m44.460s
user    0m22.455s
sys     25m17.923s

The time for nft version is

real    43m37.393s
user    0m29.183s
sys     32m15.354s

I will find a way to only add the table when needed.

> > Also, maybe clearer to use 'nft -j' with 'jq' to get that (if possible)?
> 
> I check the output of `nft -j` (paste an example at the end of mail),
> which looks not each to get the rule handle easily.

I have find a way to get the handle via jq.

nft -e -j add rule ip filter OUTPUT meta l4proto tcp accept | \
	jq '.nftables[] | select(has("add")) | .add.rule.handle'

I will use it in the next version.

Thanks
Hangbin