[PATCH mptcp-next 0/2] selftests: mptcp: convert iptables to nftables

[PATCH mptcp-next 0/2] selftests: mptcp: convert iptables to nftables

[Hangbin Liu]

iptables has been deprecated for years. The Linux kernel has included
nftables as the successor to iptables since 2014, and every major
distribution uses nftables as the default packet filtering framework.
The iptables command we run on modern systems is actually iptables‑nft,
a compatibility layer that translates iptables syntax to nftables rules
behind the scenes.

There are also some features that can be set easily with nft, while we need
to convert to BPF code under iptables, such as MPTCP add‑addr and
remove‑addr suboptions. To make future work easier, convert iptables usage
in mptcp to nftables.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
Hangbin Liu (2):
      selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh
      selftests: mptcp: convert iptables to nftables for mptcp_join.sh

 tools/testing/selftests/net/mptcp/config           |   3 +
 tools/testing/selftests/net/mptcp/mptcp_join.sh    | 136 ++++++++-------------
 tools/testing/selftests/net/mptcp/mptcp_lib.sh     |   2 +-
 tools/testing/selftests/net/mptcp/mptcp_sockopt.sh |  56 ++++-----
 4 files changed, 77 insertions(+), 120 deletions(-)
---
base-commit: 8dd2802091fbba563abec55e0455d0e5273c7529
change-id: 20260902-mptcp_nft-b892782ef929

Best regards,
-- 
Hangbin Liu <liuhangbin@kylinos.cn>

[PATCH mptcp-next 1/2] selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@kylinos.cn>

The per-AF iptables mark rules are replaced with an inet table
(msock_table) with separate per-AF counter drop rules for IPv4
and IPv6 drop counting.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
 tools/testing/selftests/net/mptcp/mptcp_lib.sh     |  2 +-
 tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 56 ++++++++++------------
 2 files changed, 26 insertions(+), 32 deletions(-)

diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing/selftests/net/mptcp/mptcp_lib.sh
index b9d14647f401..41febb1bbbc7 100644
--- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh
@@ -528,7 +528,7 @@ mptcp_lib_check_tools() {
 				exit ${KSFT_SKIP}
 			fi
 			;;
-		"iptables"* | "ip6tables"*)
+		"iptables"* | "ip6tables"* | "nft"*)
 			if ! "${tool}" -V &> /dev/null; then
 				mptcp_lib_pr_skip "Could not run all tests without ${tool}"
 				exit ${KSFT_SKIP}
diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
index e850a87429b6..4d0af2bf9484 100755
--- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
@@ -15,8 +15,6 @@ cin=""
 cout=""
 timeout_poll=30
 timeout_test=$((timeout_poll * 2 + 1))
-iptables="iptables"
-ip6tables="ip6tables"
 
 ns1=""
 ns2=""
@@ -49,17 +47,23 @@ add_mark_rules()
 	local ns=$1
 	local m=$2
 
-	local t
-	for t in ${iptables} ${ip6tables}; do
-		# just to debug: check we have multiple subflows connection requests
-		ip netns exec $ns $t -A OUTPUT -p tcp --syn -m mark --mark $m -j ACCEPT
-
-		# RST packets might be handled by a internal dummy socket
-		ip netns exec $ns $t -A OUTPUT -p tcp --tcp-flags RST RST -m mark --mark 0 -j ACCEPT
-
-		ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark $m -j ACCEPT
-		ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark 0 -j DROP
-	done
+	ip netns exec "$ns" nft add table inet msock_table
+	ip netns exec "$ns" nft add chain inet msock_table output \
+		'{ type filter hook output priority 0; policy accept; }'
+
+	# just to debug: check we have multiple subflows connection requests
+	ip netns exec "$ns" nft add rule inet msock_table output \
+		 meta mark "$m" tcp flags syn accept
+	# RST packets might be handled by a internal dummy socket
+	ip netns exec "$ns" nft add rule inet msock_table output \
+		meta mark 0 tcp flags rst accept
+	ip netns exec "$ns" nft add rule inet msock_table output \
+		meta mark "$m" meta l4proto tcp accept
+
+	ip netns exec "$ns" nft add rule inet msock_table output \
+		meta nfproto ipv4 meta mark 0 meta l4proto tcp counter drop
+	ip netns exec "$ns" nft add rule inet msock_table output \
+		meta nfproto ipv6 meta mark 0 meta l4proto tcp counter drop
 }
 
 init()
@@ -105,33 +109,23 @@ cleanup()
 
 mptcp_lib_check_mptcp
 mptcp_lib_check_kallsyms
-mptcp_lib_check_tools ip "${iptables}" "${ip6tables}"
+mptcp_lib_check_tools ip nft
 
 check_mark()
 {
 	local ns=$1
 	local af=$2
 
-	local tables=${iptables}
+	drop=$(ip netns exec "$ns" nft list table inet msock_table | \
+		grep "ipv$af.*packets.*drop" | awk '{print $(NF-3)}')
 
-	if [ $af -eq 6 ];then
-		tables=${ip6tables}
+	if [ "$drop" -ne 0 ]; then
+		mptcp_lib_pr_fail "got $drop pkt drops in ns $ns IPv{$af} tables," \
+				  "not 0 - not all expected packets marked"
+		ret=${KSFT_FAIL}
+		return 1
 	fi
 
-	local counters values
-	counters=$(ip netns exec $ns $tables -v -L OUTPUT | grep DROP)
-	values=${counters%DROP*}
-
-	local v
-	for v in $values; do
-		if [ $v -ne 0 ]; then
-			mptcp_lib_pr_fail "got $tables $values in ns $ns," \
-					  "not 0 - not all expected packets marked"
-			ret=${KSFT_FAIL}
-			return 1
-		fi
-	done
-
 	return 0
 }
 

-- 
2.55.0

Re: [PATCH mptcp-next 1/2] selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [Medium] Replacing iptables TCP flag matching with nftables exact matching (`tcp flags rst` and `tcp flags syn`) fails to match packets with multiple flags set, causing spurious test failures.
- [Medium] An empty `$drop` variable causes a Bash syntax error during numeric evaluation, which evaluates to false and silently masks test failures.
- [Low] Typo in string interpolation for the error message (`IPv{$af}` instead of `IPv${af}`).
--

commit af165781f3fb777bc40bc4de19c7d79cd01f51cc
Author: Hangbin Liu <liuhangbin@kylinos.cn>

selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh

This patch converts the mptcp_sockopt.sh selftest to use nftables instead of
iptables. It replaces per-address-family iptables mark rules with an inet
table containing drop counting rules for IPv4 and IPv6.

> diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
> index e850a87429b61..4d0af2bf94840 100755
> --- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
> +++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh

[ ... ]

> @@ -49,17 +47,23 @@ add_mark_rules()
>  	local ns=$1
>  	local m=$2
>  
> -	local t
> -	for t in ${iptables} ${ip6tables}; do
> -		# just to debug: check we have multiple subflows connection requests
> -		ip netns exec $ns $t -A OUTPUT -p tcp --syn -m mark --mark $m -j ACCEPT
> -
> -		# RST packets might be handled by a internal dummy socket
> -		ip netns exec $ns $t -A OUTPUT -p tcp --tcp-flags RST RST -m mark --mark 0 -j ACCEPT

[ ... ]

> +	# just to debug: check we have multiple subflows connection requests
> +	ip netns exec "$ns" nft add rule inet msock_table output \
> +		 meta mark "$m" tcp flags syn accept
> +	# RST packets might be handled by a internal dummy socket
> +	ip netns exec "$ns" nft add rule inet msock_table output \
> +		meta mark 0 tcp flags rst accept

[Severity: Medium]
In add_mark_rules(), the original iptables rules --tcp-flags RST RST and
--syn used bitmasks to allow additional flags like ACK for RST or ECN for
SYN. The new nftables rules tcp flags rst and tcp flags syn enforce an
exact match on the entire TCP flags byte.

Will these exact matches reject packets with multiple flags set, such as
RST+ACK or SYN+ECN, causing them to fall through to the drop rule and fail the
test?

[ ... ]

> @@ -105,33 +109,23 @@ cleanup()
>  
>  mptcp_lib_check_mptcp
>  mptcp_lib_check_kallsyms
> -mptcp_lib_check_tools ip "${iptables}" "${ip6tables}"
> +mptcp_lib_check_tools ip nft
>  
>  check_mark()
>  {
>  	local ns=$1
>  	local af=$2
>  
> -	local tables=${iptables}
> +	drop=$(ip netns exec "$ns" nft list table inet msock_table | \
> +		grep "ipv$af.*packets.*drop" | awk '{print $(NF-3)}')
>  
> -	if [ $af -eq 6 ];then
> -		tables=${ip6tables}
> +	if [ "$drop" -ne 0 ]; then

[Severity: Medium]
If the command extraction for drop fails, or if grep finds no matches,
the $drop variable will be empty.

When bash evaluates [ "$drop" -ne 0 ] with an empty string, it triggers a
syntax error. This error evaluates to false and skips the failure block.

Does this risk silently masking test failures if the extraction logic ever
fails to produce a number?

> +		mptcp_lib_pr_fail "got $drop pkt drops in ns $ns IPv{$af} tables," \

[Severity: Low]
Is the string interpolation IPv{$af} a typo?

Bash interpolates the $af variable but leaves the literal braces, printing
IPv{4} instead of IPv4. Should this be IPv${af} or IPv$af instead?

> +				  "not 0 - not all expected packets marked"
> +		ret=${KSFT_FAIL}
> +		return 1
>  	fi

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902-mptcp_nft-v1-0-559caa16f410@kylinos.cn?part=1

Re: [PATCH mptcp-next 1/2] selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh

[Hangbin Liu]

On Wed, Sep 02, 2026 at 07:02:31AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
> - [Medium] Replacing iptables TCP flag matching with nftables exact matching (`tcp flags rst` and `tcp flags syn`) fails to match packets with multiple flags set, causing spurious test failures.
> - [Medium] An empty `$drop` variable causes a Bash syntax error during numeric evaluation, which evaluates to false and silently masks test failures.
> - [Low] Typo in string interpolation for the error message (`IPv{$af}` instead of `IPv${af}`).
> --
> 
> commit af165781f3fb777bc40bc4de19c7d79cd01f51cc
> Author: Hangbin Liu <liuhangbin@kylinos.cn>
> 
> selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh
> 
> This patch converts the mptcp_sockopt.sh selftest to use nftables instead of
> iptables. It replaces per-address-family iptables mark rules with an inet
> table containing drop counting rules for IPv4 and IPv6.
> 
> > diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
> > index e850a87429b61..4d0af2bf94840 100755
> > --- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
> > +++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
> 
> [ ... ]
> 
> > @@ -49,17 +47,23 @@ add_mark_rules()
> >  	local ns=$1
> >  	local m=$2
> >  
> > -	local t
> > -	for t in ${iptables} ${ip6tables}; do
> > -		# just to debug: check we have multiple subflows connection requests
> > -		ip netns exec $ns $t -A OUTPUT -p tcp --syn -m mark --mark $m -j ACCEPT
> > -
> > -		# RST packets might be handled by a internal dummy socket
> > -		ip netns exec $ns $t -A OUTPUT -p tcp --tcp-flags RST RST -m mark --mark 0 -j ACCEPT
> 
> [ ... ]
> 
> > +	# just to debug: check we have multiple subflows connection requests
> > +	ip netns exec "$ns" nft add rule inet msock_table output \
> > +		 meta mark "$m" tcp flags syn accept
> > +	# RST packets might be handled by a internal dummy socket
> > +	ip netns exec "$ns" nft add rule inet msock_table output \
> > +		meta mark 0 tcp flags rst accept
> 
> [Severity: Medium]
> In add_mark_rules(), the original iptables rules --tcp-flags RST RST and
> --syn used bitmasks to allow additional flags like ACK for RST or ECN for
> SYN. The new nftables rules tcp flags rst and tcp flags syn enforce an
> exact match on the entire TCP flags byte.
> 
> Will these exact matches reject packets with multiple flags set, such as
> RST+ACK or SYN+ECN, causing them to fall through to the drop rule and fail the
> test?

Thanks, I just find a tool iptables-translate and I will recheck each
translation.

> 
> [ ... ]
> 
> > @@ -105,33 +109,23 @@ cleanup()
> >  
> >  mptcp_lib_check_mptcp
> >  mptcp_lib_check_kallsyms
> > -mptcp_lib_check_tools ip "${iptables}" "${ip6tables}"
> > +mptcp_lib_check_tools ip nft
> >  
> >  check_mark()
> >  {
> >  	local ns=$1
> >  	local af=$2
> >  
> > -	local tables=${iptables}
> > +	drop=$(ip netns exec "$ns" nft list table inet msock_table | \
> > +		grep "ipv$af.*packets.*drop" | awk '{print $(NF-3)}')
> >  
> > -	if [ $af -eq 6 ];then
> > -		tables=${ip6tables}
> > +	if [ "$drop" -ne 0 ]; then
> 
> [Severity: Medium]
> If the command extraction for drop fails, or if grep finds no matches,
> the $drop variable will be empty.
> 
> When bash evaluates [ "$drop" -ne 0 ] with an empty string, it triggers a
> syntax error. This error evaluates to false and skips the failure block.
> 
> Does this risk silently masking test failures if the extraction logic ever
> fails to produce a number?

OK, I will add a regex to check if drop is number or not.

> 
> > +		mptcp_lib_pr_fail "got $drop pkt drops in ns $ns IPv{$af} tables," \
> 
> [Severity: Low]
> Is the string interpolation IPv{$af} a typo?
> 
> Bash interpolates the $af variable but leaves the literal braces, printing
> IPv{4} instead of IPv4. Should this be IPv${af} or IPv$af instead?
> 
> > +				  "not 0 - not all expected packets marked"
> > +		ret=${KSFT_FAIL}
> > +		return 1
> >  	fi

Thanks, I will fix this.

Hangbin

Re: [PATCH mptcp-next 1/2] selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh

[Matthieu Baerts]

Hi Hangbin,

On 02/09/2026 08:52, Hangbin Liu wrote:
> From: Hangbin Liu <liuhangbin@kylinos.cn>
> 
> The per-AF iptables mark rules are replaced with an inet table
> (msock_table) with separate per-AF counter drop rules for IPv4
> and IPv6 drop counting.

Thank you for looking at that!

> diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
> index e850a87429b6..4d0af2bf9484 100755
> --- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
> +++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh

(...)

> @@ -105,33 +109,23 @@ cleanup()
>  
>  mptcp_lib_check_mptcp
>  mptcp_lib_check_kallsyms
> -mptcp_lib_check_tools ip "${iptables}" "${ip6tables}"
> +mptcp_lib_check_tools ip nft
>  
>  check_mark()
>  {
>  	local ns=$1
>  	local af=$2
>  
> -	local tables=${iptables}
> +	drop=$(ip netns exec "$ns" nft list table inet msock_table | \
> +		grep "ipv$af.*packets.*drop" | awk '{print $(NF-3)}')

Would it not be cleaner to use 'nft -j' and 'jq' to get all the
(non-zero) drop counters?

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH mptcp-next 1/2] selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh

[Hangbin Liu]

On Wed, Sep 02, 2026 at 11:17:48AM +0200, Matthieu Baerts wrote:
> > @@ -105,33 +109,23 @@ cleanup()
> >  
> >  mptcp_lib_check_mptcp
> >  mptcp_lib_check_kallsyms
> > -mptcp_lib_check_tools ip "${iptables}" "${ip6tables}"
> > +mptcp_lib_check_tools ip nft
> >  
> >  check_mark()
> >  {
> >  	local ns=$1
> >  	local af=$2
> >  
> > -	local tables=${iptables}
> > +	drop=$(ip netns exec "$ns" nft list table inet msock_table | \
> > +		grep "ipv$af.*packets.*drop" | awk '{print $(NF-3)}')
> 
> Would it not be cleaner to use 'nft -j' and 'jq' to get all the
> (non-zero) drop counters?

We can get with this rule:

nft -j list table filter | jq -r '.nftables[] | select(has("rule")) |
				.rule | select (.chain=="OUTPUT" and any(.expr[]; has("drop"))) |
				.expr[] | select(has("counter")) |
				.counter.packets'

Thanks
Hangbin

[PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@kylinos.cn>

Replace the per-address-family iptables rules with a single inet table
(mjoin_table) that handles both IPv4 and IPv6. The BPF bytecode for
matching MPTCP add-addr and remove-addr suboptions is replaced with
native nft matching via "tcp option mptcp subtype". Rule handles are
captured via "nft -e --handle" so that rules can be selectively removed
during tests.

The config file adds CONFIG_NFT_NUMGEN (replaces iptables statistic nth),
CONFIG_NFT_REJECT and CONFIG_NFT_REJECT_IPV4 for reject‑related rules.

The iptables/ip6tables check inside mptcp_lib.sh is kept in case any
one still need them.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
 tools/testing/selftests/net/mptcp/config        |   3 +
 tools/testing/selftests/net/mptcp/mptcp_join.sh | 136 +++++++++---------------
 2 files changed, 51 insertions(+), 88 deletions(-)

diff --git a/tools/testing/selftests/net/mptcp/config b/tools/testing/selftests/net/mptcp/config
index 59051ee2a986..0d0a744c4ca8 100644
--- a/tools/testing/selftests/net/mptcp/config
+++ b/tools/testing/selftests/net/mptcp/config
@@ -30,6 +30,9 @@ CONFIG_NET_SCH_NETEM=m
 CONFIG_NF_TABLES=m
 CONFIG_NF_TABLES_INET=y
 CONFIG_NFT_COMPAT=m
+CONFIG_NFT_NUMGEN=y
+CONFIG_NFT_REJECT=m
+CONFIG_NFT_REJECT_IPV4=m
 CONFIG_NFT_SOCKET=m
 CONFIG_NFT_TPROXY=m
 CONFIG_SYN_COOKIES=y
diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
index 18ce7136a2b0..05cbaddb8261 100755
--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
@@ -26,8 +26,6 @@ capout=""
 cappid=""
 ns1=""
 ns2=""
-iptables="iptables"
-ip6tables="ip6tables"
 timeout_poll=30
 timeout_test=$((timeout_poll * 2 + 1))
 capture=false
@@ -50,6 +48,7 @@ declare -A failed_tests
 MPTCP_LIB_TEST_FORMAT="%03u %s\n"
 TEST_NAME=""
 nr_blank=6
+nft_handle=""
 
 # These var are used only in some tests, make sure they are not already set
 unset FAILING_LINKS
@@ -99,42 +98,6 @@ unset add_addr_tx_nr
 unset add_addr_echo_tx_nr
 unset add_addr_drop_tx_nr
 
-# generated using "nfbpf_compile '(ip && (ip[54] & 0xf0) == 0x30) ||
-#				  (ip6 && (ip6[74] & 0xf0) == 0x30)'"
-CBPF_MPTCP_SUBOPTION_ADD_ADDR="14,
-			       48 0 0 0,
-			       84 0 0 240,
-			       21 0 3 64,
-			       48 0 0 54,
-			       84 0 0 240,
-			       21 6 7 48,
-			       48 0 0 0,
-			       84 0 0 240,
-			       21 0 4 96,
-			       48 0 0 74,
-			       84 0 0 240,
-			       21 0 1 48,
-			       6 0 0 65535,
-			       6 0 0 0"
-
-# IPv4: TCP hdr of 48B, a first suboption of 12B (DACK8), the RM_ADDR suboption
-# generated using "nfbpf_compile '(ip[32] & 0xf0) == 0xc0 && ip[53] == 0x0c &&
-#				  (ip[66] & 0xf0) == 0x40'"
-CBPF_MPTCP_SUBOPTION_RM_ADDR="13,
-			      48 0 0 0,
-			      84 0 0 240,
-			      21 0 9 64,
-			      48 0 0 32,
-			      84 0 0 240,
-			      21 0 6 192,
-			      48 0 0 53,
-			      21 0 4 12,
-			      48 0 0 66,
-			      84 0 0 240,
-			      21 0 1 64,
-			      6 0 0 65535,
-			      6 0 0 0"
-
 init_partial()
 {
 	capout=$(mktemp)
@@ -147,6 +110,14 @@ init_partial()
 		if $checksum; then
 			ip netns exec $netns sysctl -q net.mptcp.checksum_enabled=1
 		fi
+
+		ip netns exec "$netns" nft add table inet mjoin_table
+		ip netns exec "$netns" nft add chain inet mjoin_table input \
+			'{ type filter hook input priority filter; policy accept; }'
+		ip netns exec "$netns" nft add chain inet mjoin_table output \
+			'{ type filter hook output priority filter; policy accept; }'
+		ip netns exec "$netns" nft add chain inet mjoin_table mangle \
+			'{ type filter hook output priority mangle; policy accept; }'
 	done
 
 	check_invert=0
@@ -196,7 +167,7 @@ init() {
 
 	mptcp_lib_check_mptcp
 	mptcp_lib_check_kallsyms
-	mptcp_lib_check_tools ip tc ss "${iptables}" "${ip6tables}"
+	mptcp_lib_check_tools ip tc ss nft
 
 	sin=$(mktemp)
 	sout=$(mktemp)
@@ -381,23 +352,18 @@ reset_with_cookies()
 reset_with_add_addr_timeout()
 {
 	local ip="${2:-4}"
-	local tables
 
 	reset "${1}" || return 1
 
-	tables="${iptables}"
-	if [ $ip -eq 6 ]; then
-		tables="${ip6tables}"
-	fi
-
 	# set a maximum, to avoid too long timeout with exponential backoff
 	ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=1
 
-	if ! ip netns exec $ns2 $tables -A OUTPUT -p tcp \
-			-m tcp --tcp-option 30 \
-			-m bpf --bytecode \
-			"$CBPF_MPTCP_SUBOPTION_ADD_ADDR" \
-			-j DROP; then
+
+	nft_handle=$(ip netns exec "$ns2" nft -e --handle add rule \
+		inet mjoin_table output meta nfproto ipv${ip} \
+		tcp option mptcp subtype add-addr \
+		drop | head -n1 | awk '{print $NF}')
+	if [ -z "$nft_handle" ]; then
 		mark_as_skipped "unable to set the 'add addr' rule"
 		return 1
 	fi
@@ -450,22 +416,16 @@ setup_fail_rules()
 	validate_checksum=true
 	local i="$1"
 	local ip="${2:-4}"
-	local tables
 
-	tables="${iptables}"
-	if [ $ip -eq 6 ]; then
-		tables="${ip6tables}"
+	nft_handle=$(ip netns exec "$ns2" nft -e --handle add rule \
+		inet mjoin_table mangle oifname ns2eth$i \
+		meta nfproto ipv${ip} meta l4proto tcp \
+		meta length 150-9999 numgen inc mod 99999 == 1 \
+		meta mark set 42 | head -n1 | awk '{print $NF}')
+	if [ -z "$nft_handle" ]; then
+		return ${KSFT_SKIP}
 	fi
 
-	ip netns exec $ns2 $tables \
-		-t mangle \
-		-A OUTPUT \
-		-o ns2eth$i \
-		-p tcp \
-		-m length --length 150:9999 \
-		-m statistic --mode nth --packet 1 --every 99999 \
-		-j MARK --set-mark 42 || return ${KSFT_SKIP}
-
 	tc -n $ns2 qdisc add dev ns2eth$i clsact || return ${KSFT_SKIP}
 	tc -n $ns2 filter add dev ns2eth$i egress \
 		protocol ip prio 1000 \
@@ -515,11 +475,11 @@ reset_with_tcp_filter()
 	local target="${3}"
 	local chain="${4:-INPUT}"
 
-	if ! ip netns exec "${ns}" ${iptables} \
-			-A "${chain}" \
-			-s "${src}" \
-			-p tcp \
-			-j "${target}"; then
+	nft_handle=$(ip netns exec "$ns" nft -e --handle add rule \
+		inet mjoin_table "${chain,,}" \
+		ip saddr "{ ${src} }" meta l4proto tcp "${target,,}" | \
+		head -n1 | awk '{print $NF}')
+	if [ -z "$nft_handle" ]; then
 		mark_as_skipped "unable to set the filter rules"
 		return 1
 	fi
@@ -4315,10 +4275,12 @@ userspace_tests()
 
 		# force quick loss
 		ip netns exec $ns2 sysctl -q net.ipv4.tcp_syn_retries=1
-		if ip netns exec "${ns1}" ${iptables} -A INPUT -s "10.0.1.2" \
-		      -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset &&
-		   ip netns exec "${ns2}" ${iptables} -A INPUT -d "10.0.1.2" \
-		      -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset; then
+		if ip netns exec "${ns1}" nft add rule inet mjoin_table \
+			input ip saddr "10.0.1.2" meta l4proto tcp \
+			tcp option mptcp exists reject with tcp reset &&
+		   ip netns exec "${ns2}" nft add rule inet mjoin_table \
+			input ip daddr "10.0.1.2" meta l4proto tcp \
+			tcp option mptcp exists reject with tcp reset; then
 			wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 1
 			wait_event ns1 MPTCP_LIB_EVENT_SUB_CLOSED 1
 			chk_subflows_total 1 1
@@ -4393,7 +4355,7 @@ endpoint_tests()
 		chk_subflow_nr "after new reject" 2
 		chk_mptcp_info subflows 1 subflows 1
 
-		ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJECT
+		ip netns exec "${ns2}" nft delete rule inet mjoin_table output handle "$nft_handle"
 		pm_nl_del_endpoint $ns2 3 10.0.3.2
 		pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow
 		wait_mpj 3
@@ -4402,12 +4364,10 @@ endpoint_tests()
 
 		# To make sure RM_ADDR are sent over a different subflow, but
 		# allow the rest to quickly and cleanly close the subflow
-		local ipt=1
-		ip netns exec "${ns2}" ${iptables} -I OUTPUT -s "10.0.1.2" \
-			-p tcp -m tcp --tcp-option 30 \
-			-m bpf --bytecode \
-			"$CBPF_MPTCP_SUBOPTION_RM_ADDR" \
-			-j DROP || ipt=0
+		nft_handle=$(ip netns exec "${ns2}" nft -e --handle insert rule \
+			inet mjoin_table output ip saddr 10.0.1.2 meta l4proto tcp \
+			tcp option mptcp subtype remove-addr \
+			drop | head -n1 | awk '{print $NF}')
 		local i
 		for i in $(seq 3); do
 			pm_nl_del_endpoint $ns2 1 10.0.1.2
@@ -4420,7 +4380,8 @@ endpoint_tests()
 			chk_subflow_nr "after re-add id 0 ($i)" 3
 			chk_mptcp_info subflows 3 subflows 3
 		done
-		[ ${ipt} = 1 ] && ip netns exec "${ns2}" ${iptables} -D OUTPUT 1
+		[ -n "${nft_handle}" ] && ip netns exec "${ns2}" nft delete rule \
+			inet mjoin_table output handle "${nft_handle}"
 
 		mptcp_lib_kill_group_wait $tests_pid
 
@@ -4482,18 +4443,17 @@ endpoint_tests()
 
 		# To make sure RM_ADDR are sent over a different subflow, but
 		# allow the rest to quickly and cleanly close the subflow
-		local ipt=1
-		ip netns exec "${ns1}" ${iptables} -I OUTPUT -s "10.0.1.1" \
-			-p tcp -m tcp --tcp-option 30 \
-			-m bpf --bytecode \
-			"$CBPF_MPTCP_SUBOPTION_RM_ADDR" \
-			-j DROP || ipt=0
+		nft_handle=$(ip netns exec "${ns1}" nft -e --handle insert rule \
+			inet mjoin_table output ip saddr 10.0.1.1 meta l4proto tcp \
+			tcp option mptcp subtype remove-addr \
+			drop | head -n1 | awk '{print $NF}')
 		pm_nl_del_endpoint $ns1 42 10.0.1.1
 		sleep 0.5
 		chk_subflow_nr "after delete ID 0" 2
 		chk_mptcp_info subflows 2 subflows 2
 		chk_mptcp_info add_addr_signal 2 add_addr_accepted 2
-		[ ${ipt} = 1 ] && ip netns exec "${ns1}" ${iptables} -D OUTPUT 1
+		[ -n "${nft_handle}" ] && ip netns exec "${ns1}" nft delete rule \
+			inet mjoin_table output handle "${nft_handle}"
 
 		pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal
 		wait_mpj 4
@@ -4555,7 +4515,7 @@ endpoint_tests()
 		pm_nl_flush_endpoint $ns2
 		pm_nl_flush_endpoint $ns1
 		wait_rm_addr $ns2 0
-		ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJECT
+		ip netns exec "${ns2}" nft delete rule inet mjoin_table output handle "$nft_handle"
 		pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow
 		wait_mpj 1
 		pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal

-- 
2.55.0

Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Matthieu Baerts]

Hi Hangbin,

On 02/09/2026 08:52, Hangbin Liu wrote:
> From: Hangbin Liu <liuhangbin@kylinos.cn>
> 
> Replace the per-address-family iptables rules with a single inet table
> (mjoin_table) that handles both IPv4 and IPv6. The BPF bytecode for
> matching MPTCP add-addr and remove-addr suboptions is replaced with
> native nft matching via "tcp option mptcp subtype". Rule handles are

Good idea!

> captured via "nft -e --handle" so that rules can be selectively removed
> during tests.
> 
> The config file adds CONFIG_NFT_NUMGEN (replaces iptables statistic nth),
> CONFIG_NFT_REJECT and CONFIG_NFT_REJECT_IPV4 for reject‑related rules.
> 
> The iptables/ip6tables check inside mptcp_lib.sh is kept in case any
> one still need them.

Please remove them, not to be tempted to use them.

> Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
> ---
>  tools/testing/selftests/net/mptcp/config        |   3 +
>  tools/testing/selftests/net/mptcp/mptcp_join.sh | 136 +++++++++---------------
>  2 files changed, 51 insertions(+), 88 deletions(-)
> 
> diff --git a/tools/testing/selftests/net/mptcp/config b/tools/testing/selftests/net/mptcp/config
> index 59051ee2a986..0d0a744c4ca8 100644
> --- a/tools/testing/selftests/net/mptcp/config
> +++ b/tools/testing/selftests/net/mptcp/config
> @@ -30,6 +30,9 @@ CONFIG_NET_SCH_NETEM=m
>  CONFIG_NF_TABLES=m
>  CONFIG_NF_TABLES_INET=y
>  CONFIG_NFT_COMPAT=m
> +CONFIG_NFT_NUMGEN=y
> +CONFIG_NFT_REJECT=m
> +CONFIG_NFT_REJECT_IPV4=m

Even if we currently don't need the v6 version, I wonder if we shouldn't
add it here. Up to you, when we will need it, we can also add it here, fine.

I wonder if we shouldn't remove the ones linked to IPTables. I was
thinking that maybe we could keep them for debug purposes, but same as
the reject v6, we can add them when required instead of guessing which
ones would be useful, "just in case". So yes, do you mind removing the
ones that are no longer needed, please?

>  CONFIG_NFT_SOCKET=m
>  CONFIG_NFT_TPROXY=m
>  CONFIG_SYN_COOKIES=y
> diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> index 18ce7136a2b0..05cbaddb8261 100755
> --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
> +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> @@ -26,8 +26,6 @@ capout=""
>  cappid=""
>  ns1=""
>  ns2=""
> -iptables="iptables"
> -ip6tables="ip6tables"
>  timeout_poll=30
>  timeout_test=$((timeout_poll * 2 + 1))
>  capture=false
> @@ -50,6 +48,7 @@ declare -A failed_tests
>  MPTCP_LIB_TEST_FORMAT="%03u %s\n"
>  TEST_NAME=""
>  nr_blank=6
> +nft_handle=""
>  
>  # These var are used only in some tests, make sure they are not already set
>  unset FAILING_LINKS
> @@ -99,42 +98,6 @@ unset add_addr_tx_nr
>  unset add_addr_echo_tx_nr
>  unset add_addr_drop_tx_nr
>  
> -# generated using "nfbpf_compile '(ip && (ip[54] & 0xf0) == 0x30) ||
> -#				  (ip6 && (ip6[74] & 0xf0) == 0x30)'"
> -CBPF_MPTCP_SUBOPTION_ADD_ADDR="14,
> -			       48 0 0 0,
> -			       84 0 0 240,
> -			       21 0 3 64,
> -			       48 0 0 54,
> -			       84 0 0 240,
> -			       21 6 7 48,
> -			       48 0 0 0,
> -			       84 0 0 240,
> -			       21 0 4 96,
> -			       48 0 0 74,
> -			       84 0 0 240,
> -			       21 0 1 48,
> -			       6 0 0 65535,
> -			       6 0 0 0"
> -
> -# IPv4: TCP hdr of 48B, a first suboption of 12B (DACK8), the RM_ADDR suboption
> -# generated using "nfbpf_compile '(ip[32] & 0xf0) == 0xc0 && ip[53] == 0x0c &&
> -#				  (ip[66] & 0xf0) == 0x40'"
> -CBPF_MPTCP_SUBOPTION_RM_ADDR="13,
> -			      48 0 0 0,
> -			      84 0 0 240,
> -			      21 0 9 64,
> -			      48 0 0 32,
> -			      84 0 0 240,
> -			      21 0 6 192,
> -			      48 0 0 53,
> -			      21 0 4 12,
> -			      48 0 0 66,
> -			      84 0 0 240,
> -			      21 0 1 64,
> -			      6 0 0 65535,
> -			      6 0 0 0"

Good to get rid of that. Also not to have get_maintainer.pl cc'ing the
BPF ML just for that :)

>  init_partial()
>  {
>  	capout=$(mktemp)
> @@ -147,6 +110,14 @@ init_partial()
>  		if $checksum; then
>  			ip netns exec $netns sysctl -q net.mptcp.checksum_enabled=1
>  		fi
> +
> +		ip netns exec "$netns" nft add table inet mjoin_table
> +		ip netns exec "$netns" nft add chain inet mjoin_table input \
> +			'{ type filter hook input priority filter; policy accept; }'
> +		ip netns exec "$netns" nft add chain inet mjoin_table output \
> +			'{ type filter hook output priority filter; policy accept; }'
> +		ip netns exec "$netns" nft add chain inet mjoin_table mangle \
> +			'{ type filter hook output priority mangle; policy accept; }'

I hope having this done by default for all subtests will not have a big
impact at the end when using a debug kernel. Do you mind checking the
impact, please? Just not to add a few seconds for each of the 130+
subtest if it is only needed in some of them.

If it is, we could move that to a new helper and call it when 'nft' is
required, it shouldn't be in many places I guess. This new helper could
also be used to add new rules, or this could be a "reset_" helper, I
didn't check what would be best.

>  	done
>  
>  	check_invert=0
> @@ -196,7 +167,7 @@ init() {
>  
>  	mptcp_lib_check_mptcp
>  	mptcp_lib_check_kallsyms
> -	mptcp_lib_check_tools ip tc ss "${iptables}" "${ip6tables}"
> +	mptcp_lib_check_tools ip tc ss nft
>  
>  	sin=$(mktemp)
>  	sout=$(mktemp)
> @@ -381,23 +352,18 @@ reset_with_cookies()
>  reset_with_add_addr_timeout()
>  {
>  	local ip="${2:-4}"
> -	local tables
>  
>  	reset "${1}" || return 1
>  
> -	tables="${iptables}"
> -	if [ $ip -eq 6 ]; then
> -		tables="${ip6tables}"
> -	fi
> -
>  	# set a maximum, to avoid too long timeout with exponential backoff
>  	ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=1
>  
> -	if ! ip netns exec $ns2 $tables -A OUTPUT -p tcp \
> -			-m tcp --tcp-option 30 \
> -			-m bpf --bytecode \
> -			"$CBPF_MPTCP_SUBOPTION_ADD_ADDR" \
> -			-j DROP; then
> +
> +	nft_handle=$(ip netns exec "$ns2" nft -e --handle add rule \
> +		inet mjoin_table output meta nfproto ipv${ip} \
> +		tcp option mptcp subtype add-addr \

That's clearer, nice!

I just hope devs and CIs will use a recent enough version for nft (>=
1.1.2 from Apr. 25) to support mptcp subtypes. (Fine to use them, no
need to have a fallback mechanism.)

> +		drop | head -n1 | awk '{print $NF}')

Why do you need "head -n1 | awk '{print $NF}'"? Can we not look at the
ret code like we did with IPTables?

Same below with the RM_ADDR subtype, but for the reject ones, you do
check the ret code.

EDIT: mmh, I see you are using "nft_handle" below, but not the one set
here, right?. That's not very clear when it is set in the function and
used later. Plus this field is not reset before/after each subtest. Is
this really needed? I guess you used it for others because it is easier
remove rules, right?

If you don't need this one (or any set in helpers), don't set it/them,
and don't use a global variable. Or reset it in init_partial, but prefer
using local variable with a limited scope.

Also, maybe clearer to use 'nft -j' with 'jq' to get that (if possible)?


One last note: for new features linked to MPTCP that might take multiple
versions to get ready, it might be better to send these patches only to
the MPTCP ML (no need to add anybody else in cc). Then we will apply
them in our tree and send them to netdev when we consider them as
"ready" (and hope for Clashiko not to get back to them days/weeks later,
but that should be a temporally issue :) ).

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Hangbin Liu]

Hi Matthieu,

Sorry, My mbsync has some delays and I post v2 too quick before catching
your feedback. I will update the patch with your feed back and re-post
tomorrow.

On Wed, Sep 02, 2026 at 12:00:40PM +0200, Matthieu Baerts wrote:
> > The iptables/ip6tables check inside mptcp_lib.sh is kept in case any
> > one still need them.
> 
> Please remove them, not to be tempted to use them.

OK, I will.

> 
> > Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
> > ---
> >  tools/testing/selftests/net/mptcp/config        |   3 +
> >  tools/testing/selftests/net/mptcp/mptcp_join.sh | 136 +++++++++---------------
> >  2 files changed, 51 insertions(+), 88 deletions(-)
> > 
> > diff --git a/tools/testing/selftests/net/mptcp/config b/tools/testing/selftests/net/mptcp/config
> > index 59051ee2a986..0d0a744c4ca8 100644
> > --- a/tools/testing/selftests/net/mptcp/config
> > +++ b/tools/testing/selftests/net/mptcp/config
> > @@ -30,6 +30,9 @@ CONFIG_NET_SCH_NETEM=m
> >  CONFIG_NF_TABLES=m
> >  CONFIG_NF_TABLES_INET=y
> >  CONFIG_NFT_COMPAT=m
> > +CONFIG_NFT_NUMGEN=y
> > +CONFIG_NFT_REJECT=m
> > +CONFIG_NFT_REJECT_IPV4=m
> 
> Even if we currently don't need the v6 version, I wonder if we shouldn't
> add it here. Up to you, when we will need it, we can also add it here, fine.
> 
> I wonder if we shouldn't remove the ones linked to IPTables. I was
> thinking that maybe we could keep them for debug purposes, but same as
> the reject v6, we can add them when required instead of guessing which
> ones would be useful, "just in case". So yes, do you mind removing the
> ones that are no longer needed, please?

OK, I will

> > -# IPv4: TCP hdr of 48B, a first suboption of 12B (DACK8), the RM_ADDR suboption
> > -# generated using "nfbpf_compile '(ip[32] & 0xf0) == 0xc0 && ip[53] == 0x0c &&
> > -#				  (ip[66] & 0xf0) == 0x40'"
> > -CBPF_MPTCP_SUBOPTION_RM_ADDR="13,
> > -			      48 0 0 0,
> > -			      84 0 0 240,
> > -			      21 0 9 64,
> > -			      48 0 0 32,
> > -			      84 0 0 240,
> > -			      21 0 6 192,
> > -			      48 0 0 53,
> > -			      21 0 4 12,
> > -			      48 0 0 66,
> > -			      84 0 0 240,
> > -			      21 0 1 64,
> > -			      6 0 0 65535,
> > -			      6 0 0 0"
> 
> Good to get rid of that. Also not to have get_maintainer.pl cc'ing the
> BPF ML just for that :)

Got it.

> 
> >  init_partial()
> >  {
> >  	capout=$(mktemp)
> > @@ -147,6 +110,14 @@ init_partial()
> >  		if $checksum; then
> >  			ip netns exec $netns sysctl -q net.mptcp.checksum_enabled=1
> >  		fi
> > +
> > +		ip netns exec "$netns" nft add table inet mjoin_table
> > +		ip netns exec "$netns" nft add chain inet mjoin_table input \
> > +			'{ type filter hook input priority filter; policy accept; }'
> > +		ip netns exec "$netns" nft add chain inet mjoin_table output \
> > +			'{ type filter hook output priority filter; policy accept; }'
> > +		ip netns exec "$netns" nft add chain inet mjoin_table mangle \
> > +			'{ type filter hook output priority mangle; policy accept; }'
> 
> I hope having this done by default for all subtests will not have a big
> impact at the end when using a debug kernel. Do you mind checking the
> impact, please? Just not to add a few seconds for each of the 130+
> subtest if it is only needed in some of them.

It shouldn't, I will test the running time before/after the change.

> 
> If it is, we could move that to a new helper and call it when 'nft' is
> required, it shouldn't be in many places I guess. This new helper could
> also be used to add new rules, or this could be a "reset_" helper, I
> didn't check what would be best.

I will check if this could be add as a helper.

> > +	nft_handle=$(ip netns exec "$ns2" nft -e --handle add rule \
> > +		inet mjoin_table output meta nfproto ipv${ip} \
> > +		tcp option mptcp subtype add-addr \
> 
> That's clearer, nice!
> 
> I just hope devs and CIs will use a recent enough version for nft (>=
> 1.1.2 from Apr. 25) to support mptcp subtypes. (Fine to use them, no
> need to have a fallback mechanism.)
> 
> > +		drop | head -n1 | awk '{print $NF}')
> 
> Why do you need "head -n1 | awk '{print $NF}'"? Can we not look at the
> ret code like we did with IPTables?
> 
> Same below with the RM_ADDR subtype, but for the reject ones, you do
> check the ret code.
> 
> EDIT: mmh, I see you are using "nft_handle" below, but not the one set
> here, right?. That's not very clear when it is set in the function and
> used later. Plus this field is not reset before/after each subtest. Is
> this really needed? I guess you used it for others because it is easier
> remove rules, right?
> 
> If you don't need this one (or any set in helpers), don't set it/them,
> and don't use a global variable. Or reset it in init_partial, but prefer
> using local variable with a limited scope.

Yes, we don't need the handle in other place, which I will remove them.
But for endpoint_tests(), after adding rules in reset_with_tcp_filter,
we need to remove the rule outside. I will reset it after each test.

> 
> Also, maybe clearer to use 'nft -j' with 'jq' to get that (if possible)?

I check the output of `nft -j` (paste an example at the end of mail),
which looks not each to get the rule handle easily.


> 
> One last note: for new features linked to MPTCP that might take multiple
> versions to get ready, it might be better to send these patches only to
> the MPTCP ML (no need to add anybody else in cc). Then we will apply
> them in our tree and send them to netdev when we consider them as
> "ready" (and hope for Clashiko not to get back to them days/weeks later,
> but that should be a temporally issue :) ).

Thanks for the notes. I used to rely on `b4 auto-to-cc` too much...

Regards
Hangbin

An example of `nft -j` output:
{
  "nftables": [
    {
      "metainfo": {
        "version": "1.1.6",
        "release_name": "Commodore Bullmoose #7",
        "json_schema_version": 1
      }
    },
    {
      "table": {
        "family": "ip",
        "name": "filter",
        "handle": 1
      }
    },
    {
      "chain": {
        "family": "ip",
        "table": "filter",
        "name": "OUTPUT",
        "handle": 1,
        "type": "filter",
        "hook": "output",
        "prio": 0,
        "policy": "accept"
      }
    },
    {
      "rule": {
        "family": "ip",
        "table": "filter",
        "chain": "OUTPUT",
        "handle": 2,
        "expr": [
          {
            "match": {
              "op": "==",
              "left": {
                "&": [
                  {
                    "payload": {
                      "protocol": "tcp",
                      "field": "flags"
                    }
                  },
                  {
                    "|": [
                      "fin",
                      "syn",
                      "rst",
                      "ack"
                    ]
                  }
                ]
              },
              "right": "syn"
            }
          },
          {
            "match": {
              "op": "==",
              "left": {
                "meta": {
                  "key": "mark"
                }
              },
              "right": 1
            }
          },
          {
            "counter": {
              "packets": 0,
              "bytes": 0
            }
          },
          {
            "accept": null
          }
        ]
      }
    },
    {
      "rule": {
        "family": "ip",
        "table": "filter",
        "chain": "OUTPUT",
        "handle": 3,
        "expr": [
          {
            "match": {
              "op": "==",
              "left": {
                "&": [
                  {
                    "payload": {
                      "protocol": "tcp",
                      "field": "flags"
                    }
                  },
                  "rst"
                ]
              },
              "right": "rst"
            }
          },
          {
            "match": {
              "op": "==",
              "left": {
                "meta": {
                  "key": "mark"
                }
              },
              "right": 0
            }
          },
          {
            "counter": {
              "packets": 0,
              "bytes": 0
            }
          },
          {
            "accept": null
          }
        ]
      }
    }
  ]
}

Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Hangbin Liu]

Hi Matthieu,

Here is some update.
On Thu, Sep 03, 2026 at 10:02:52AM +0800, Hangbin Liu wrote:
> > 
> > >  init_partial()
> > >  {
> > >  	capout=$(mktemp)
> > > @@ -147,6 +110,14 @@ init_partial()
> > >  		if $checksum; then
> > >  			ip netns exec $netns sysctl -q net.mptcp.checksum_enabled=1
> > >  		fi
> > > +
> > > +		ip netns exec "$netns" nft add table inet mjoin_table
> > > +		ip netns exec "$netns" nft add chain inet mjoin_table input \
> > > +			'{ type filter hook input priority filter; policy accept; }'
> > > +		ip netns exec "$netns" nft add chain inet mjoin_table output \
> > > +			'{ type filter hook output priority filter; policy accept; }'
> > > +		ip netns exec "$netns" nft add chain inet mjoin_table mangle \
> > > +			'{ type filter hook output priority mangle; policy accept; }'
> > 
> > I hope having this done by default for all subtests will not have a big
> > impact at the end when using a debug kernel. Do you mind checking the
> > impact, please? Just not to add a few seconds for each of the 130+
> > subtest if it is only needed in some of them.
> 
> It shouldn't, I will test the running time before/after the change.

With debug kernel + 4 cpu on my laptop, the time for iptables version is

real    35m44.460s
user    0m22.455s
sys     25m17.923s

The time for nft version is

real    43m37.393s
user    0m29.183s
sys     32m15.354s

I will find a way to only add the table when needed.

> > Also, maybe clearer to use 'nft -j' with 'jq' to get that (if possible)?
> 
> I check the output of `nft -j` (paste an example at the end of mail),
> which looks not each to get the rule handle easily.

I have find a way to get the handle via jq.

nft -e -j add rule ip filter OUTPUT meta l4proto tcp accept | \
	jq '.nftables[] | select(has("add")) | .add.rule.handle'

I will use it in the next version.

Thanks
Hangbin

Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Florian Westphal]

Hangbin Liu <hangbin.liu@linux.dev> wrote:
> The time for nft version is
> 
> real    43m37.393s
> user    0m29.183s
> sys     32m15.354s
> 
> I will find a way to only add the table when needed.

If you have to adjust this anyway, can you also change this to

... exec nft -f - <<EOF
add table ..
add chain ..
EOF

?

No need to call the binary for every single action.
Thanks!

Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Hangbin Liu]

Hi Florian,
On Thu, Sep 03, 2026 at 08:54:53AM +0200, Florian Westphal wrote:
> Hangbin Liu <hangbin.liu@linux.dev> wrote:
> > The time for nft version is
> > 
> > real    43m37.393s
> > user    0m29.183s
> > sys     32m15.354s
> > 
> > I will find a way to only add the table when needed.
> 
> If you have to adjust this anyway, can you also change this to
> 
> ... exec nft -f - <<EOF
> add table ..
> add chain ..
> EOF
> 
> ?
> 
> No need to call the binary for every single action.

Good, this could also save some time. Thanks for this tip.

Regards
Hangbin

Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Matthieu Baerts]

Hi Hangbin,

On 03/09/2026 04:02, Hangbin Liu wrote:
> Hi Matthieu,
> 
> Sorry, My mbsync has some delays and I post v2 too quick before catching
> your feedback.

No problem.

Just in case, maybe korgalore can help?

https://people.kernel.org/monsieuricon/tracking-kernel-development-with-korgalore

> I will update the patch with your feed back and re-post tomorrow.

Thanks!

> On Wed, Sep 02, 2026 at 12:00:40PM +0200, Matthieu Baerts wrote:

(...)

>> If you don't need this one (or any set in helpers), don't set it/them,
>> and don't use a global variable. Or reset it in init_partial, but prefer
>> using local variable with a limited scope.
> 
> Yes, we don't need the handle in other place, which I will remove them.
> But for endpoint_tests(), after adding rules in reset_with_tcp_filter,
> we need to remove the rule outside. I will reset it after each test.

Perhaps you could flush the whole table instead? But if it makes more
sense to assign this variable, fine by me.

>> Also, maybe clearer to use 'nft -j' with 'jq' to get that (if possible)?
> 
> I check the output of `nft -j` (paste an example at the end of mail),
> which looks not each to get the rule handle easily.

I just noticed that in nft's latest release, it is possible to set a
handle when adding the rules. That looks cleaner for our case here, but
it requires the version released 2 days ago, so no :)

Probably best to support the version from Debian Stable, 1.1.3, apparently.

  https://repology.org/project/nftables/versions

>> One last note: for new features linked to MPTCP that might take multiple
>> versions to get ready, it might be better to send these patches only to
>> the MPTCP ML (no need to add anybody else in cc). Then we will apply
>> them in our tree and send them to netdev when we consider them as
>> "ready" (and hope for Clashiko not to get back to them days/weeks later,
>> but that should be a temporally issue :) ).
> 
> Thanks for the notes. I used to rely on `b4 auto-to-cc` too much...

Most of the time, that's fine. It's just for some subsubtrees where
(urgent & simple) fixes can go to the parent tree (netdev here)
directly, but the rest can go only to the subsubtree ML.

BTW, if you are on top of our export(-net) (or for-review(-net)) branch,
there is a .b4-config: you just need to use 'b4 send' then :)

> An example of `nft -j` output:

Thanks for the output!

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Hangbin Liu]

On Thu, Sep 03, 2026 at 11:28:28AM +0200, Matthieu Baerts wrote:
> Hi Hangbin,
> 
> On 03/09/2026 04:02, Hangbin Liu wrote:
> > Hi Matthieu,
> > 
> > Sorry, My mbsync has some delays and I post v2 too quick before catching
> > your feedback.
> 
> No problem.
> 
> Just in case, maybe korgalore can help?
> 
> https://people.kernel.org/monsieuricon/tracking-kernel-development-with-korgalore

Thanks, learned a new tool.

> >> If you don't need this one (or any set in helpers), don't set it/them,
> >> and don't use a global variable. Or reset it in init_partial, but prefer
> >> using local variable with a limited scope.
> > 
> > Yes, we don't need the handle in other place, which I will remove them.
> > But for endpoint_tests(), after adding rules in reset_with_tcp_filter,
> > we need to remove the rule outside. I will reset it after each test.
> 
> Perhaps you could flush the whole table instead? But if it makes more
> sense to assign this variable, fine by me.

Yes, if not in purpose, I feel flush the whole table is dangerous.
Some rules may still in using in later testing.

> > Thanks for the notes. I used to rely on `b4 auto-to-cc` too much...
> 
> Most of the time, that's fine. It's just for some subsubtrees where
> (urgent & simple) fixes can go to the parent tree (netdev here)
> directly, but the rest can go only to the subsubtree ML.
> 
> BTW, if you are on top of our export(-net) (or for-review(-net)) branch,
> there is a .b4-config: you just need to use 'b4 send' then :)

Thanks. I am working on top of the export branch. I ran into a small issue
while using b4. The export branch is not fast‑forwardable. I used
`git reset --hard` to fall back to the top merge commit, then ran
`git pull` to fetch the latest changes.

However, I cannot perform a reset on the b4 branch, and git rebase also failed.
These steps have blocked me a little. I have to manually recreate the b4 branch,
or perhaps avoid using b4 when working on mptcp changes.

> 
> > An example of `nft -j` output:
> 
> Thanks for the output!

I have post the new version, which use jq to get the handle now.

Thanks
Hangbin

Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Matthieu Baerts]

Hi Hangbin,

On 04/09/2026 10:01, Hangbin Liu wrote:
> On Thu, Sep 03, 2026 at 11:28:28AM +0200, Matthieu Baerts wrote:
>> Hi Hangbin,
>>
>> On 03/09/2026 04:02, Hangbin Liu wrote:
>>> Hi Matthieu,
>>>
>>> Sorry, My mbsync has some delays and I post v2 too quick before catching
>>> your feedback.
>>
>> No problem.
>>
>> Just in case, maybe korgalore can help?
>>
>> https://people.kernel.org/monsieuricon/tracking-kernel-development-with-korgalore
> 
> Thanks, learned a new tool.
> 
>>>> If you don't need this one (or any set in helpers), don't set it/them,
>>>> and don't use a global variable. Or reset it in init_partial, but prefer
>>>> using local variable with a limited scope.
>>>
>>> Yes, we don't need the handle in other place, which I will remove them.
>>> But for endpoint_tests(), after adding rules in reset_with_tcp_filter,
>>> we need to remove the rule outside. I will reset it after each test.
>>
>> Perhaps you could flush the whole table instead? But if it makes more
>> sense to assign this variable, fine by me.
> 
> Yes, if not in purpose, I feel flush the whole table is dangerous.
> Some rules may still in using in later testing.

Indeed. But in our case, each subtest uses a dedicated netns. Plus only
some tests add Netfilter rules. At the end, it is clearer to delete a
specific rule, but I think that makes sense only if the nft_handle var
is set locally, and used a few lines below.

If a global nft_handle var is used, that doesn't seem clear, and I think
it would be clearer/easier to:

- either delete a specific rule (but I don't think that's supported)

- get the handle from the test and use it to delete the rule

- or flush the table.

So up to you, but probably best to avoid using nft_handle as global var.

>>> Thanks for the notes. I used to rely on `b4 auto-to-cc` too much...
>>
>> Most of the time, that's fine. It's just for some subsubtrees where
>> (urgent & simple) fixes can go to the parent tree (netdev here)
>> directly, but the rest can go only to the subsubtree ML.
>>
>> BTW, if you are on top of our export(-net) (or for-review(-net)) branch,
>> there is a .b4-config: you just need to use 'b4 send' then :)
> 
> Thanks. I am working on top of the export branch. I ran into a small issue
> while using b4. The export branch is not fast‑forwardable. I used
> `git reset --hard` to fall back to the top merge commit, then ran
> `git pull` to fetch the latest changes.
> 
> However, I cannot perform a reset on the b4 branch, and git rebase also failed.
> These steps have blocked me a little. I have to manually recreate the b4 branch,
> or perhaps avoid using b4 when working on mptcp changes.

You need to use `|git rebase --onto` instead, e.g.

  git fetch origin  # adapt here and below if needed
  git rebase --onto origin/export "$(b4 prep --show-info base-commit)"

Can you check if it works for you, please? (so I can update the wiki
page if needed)

The alternative is to use `for-review`, with a continuous history, see:

  https://github.com/multipath-tcp/mptcp_net-next/wiki/Git-Branches
|
Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Hangbin Liu]

Hi Matthieu,
On Fri, Sep 04, 2026 at 06:40:02PM +0200, Matthieu Baerts wrote:
> > 
> > Yes, if not in purpose, I feel flush the whole table is dangerous.
> > Some rules may still in using in later testing.
> 
> Indeed. But in our case, each subtest uses a dedicated netns. Plus only
> some tests add Netfilter rules. At the end, it is clearer to delete a
> specific rule, but I think that makes sense only if the nft_handle var
> is set locally, and used a few lines below.
> 
> If a global nft_handle var is used, that doesn't seem clear, and I think
> it would be clearer/easier to:
> 
> - either delete a specific rule (but I don't think that's supported)
> 
> - get the handle from the test and use it to delete the rule
> 
> - or flush the table.
> 
> So up to you, but probably best to avoid using nft_handle as global var.

Thanks, endpoint_tests is the only test that could delete iptables rules.
I use the nft_handle mainly because the iptables also delete rules with
specific match (iptables -D OUTPUT -s .. -p tcp -j REJECT) other than flush
the table directly.

endpoint_tests
  - reset_with_tcp_filter
    - iptables -D
    - iptables -I
    - iptables -D
  - reset_with_events
    - iptables -I
    - iptables -D
  - reset_with_tcp_filter
    - iptables -D

While from the logic it should be safe to flush the tables. I can avoid the
nft_handle in v4 (after v3 review). Just one question, why we use
iptables -I here? Is there any intend? If not I will use "add" instead of
"insert" in nft rules.

> > However, I cannot perform a reset on the b4 branch, and git rebase also failed.
> > These steps have blocked me a little. I have to manually recreate the b4 branch,
> > or perhaps avoid using b4 when working on mptcp changes.
> 
> You need to use `|git rebase --onto` instead, e.g.
> 
>   git fetch origin  # adapt here and below if needed

For export branch, I think git fetch is not enough? I have to reset
to latest net/net-next merge commit and pull on that.

>   git rebase --onto origin/export "$(b4 prep --show-info base-commit)"

Yes, it works! New git usage learned :)

> 
> Can you check if it works for you, please? (so I can update the wiki
> page if needed)
> 
> The alternative is to use `for-review`, with a continuous history, see:
> 
>   https://github.com/multipath-tcp/mptcp_net-next/wiki/Git-Branches

I will try this tree next time

Thanks
Hangbin

Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Matthieu Baerts]

Hi Hangbin,

On 07/09/2026 03:02, Hangbin Liu wrote:
> 
> Hi Matthieu,
> On Fri, Sep 04, 2026 at 06:40:02PM +0200, Matthieu Baerts wrote:
>>>
>>> Yes, if not in purpose, I feel flush the whole table is dangerous.
>>> Some rules may still in using in later testing.
>>
>> Indeed. But in our case, each subtest uses a dedicated netns. Plus only
>> some tests add Netfilter rules. At the end, it is clearer to delete a
>> specific rule, but I think that makes sense only if the nft_handle var
>> is set locally, and used a few lines below.
>>
>> If a global nft_handle var is used, that doesn't seem clear, and I think
>> it would be clearer/easier to:
>>
>> - either delete a specific rule (but I don't think that's supported)
>>
>> - get the handle from the test and use it to delete the rule
>>
>> - or flush the table.
>>
>> So up to you, but probably best to avoid using nft_handle as global var.
> 
> Thanks, endpoint_tests is the only test that could delete iptables rules.
> I use the nft_handle mainly because the iptables also delete rules with
> specific match (iptables -D OUTPUT -s .. -p tcp -j REJECT) other than flush
> the table directly.
> 
> endpoint_tests
>   - reset_with_tcp_filter
>     - iptables -D
>     - iptables -I
>     - iptables -D
>   - reset_with_events
>     - iptables -I
>     - iptables -D
>   - reset_with_tcp_filter
>     - iptables -D
> 
> While from the logic it should be safe to flush the tables. I can avoid the
> nft_handle in v4 (after v3 review).

Just to be sure it is clear: nft_handle can be used, just better to
avoid using it globally I think. An alternative could be to pass a local
nft_handle to reset_with_tcp_filter and set it there, but in bash,
that's not very clear either.

> Just one question, why we use
> iptables -I here? Is there any intend? If not I will use "add" instead of
> "insert" in nft rules.

I don't remember. I would say probably best not to change the behaviour
during the transition. We could add a commit switching back to "add",
but if that doesn't change anything, probably easier for the reviewers
to keep "insert" (or add an explicit message in the commit message
explaining why it is better to change).

>>> However, I cannot perform a reset on the b4 branch, and git rebase also failed.
>>> These steps have blocked me a little. I have to manually recreate the b4 branch,
>>> or perhaps avoid using b4 when working on mptcp changes.
>>
>> You need to use `|git rebase --onto` instead, e.g.
>>
>>   git fetch origin  # adapt here and below if needed
> 
> For export branch, I think git fetch is not enough? I have to reset
> to latest net/net-next merge commit and pull on that.

I'm not sure to understand. 'git fetch' with the right remote should get
the latest <remote>/export branch ...

>>   git rebase --onto origin/export "$(b4 prep --show-info base-commit)"

... then this command will use this new ref. Why do you need to reset
net/net-next merge commit?

> Yes, it works! New git usage learned :)
> 
>>
>> Can you check if it works for you, please? (so I can update the wiki
>> page if needed)
>>
>> The alternative is to use `for-review`, with a continuous history, see:
>>
>>   https://github.com/multipath-tcp/mptcp_net-next/wiki/Git-Branches
> 
> I will try this tree next time

Up to you, but "export" is good as well, and required when using "git
blame".

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Hangbin Liu]

On Mon, Sep 07, 2026 at 07:50:04AM +0200, Matthieu Baerts wrote:
> >> If a global nft_handle var is used, that doesn't seem clear, and I think
> >> it would be clearer/easier to:
> >>
> >> - either delete a specific rule (but I don't think that's supported)
> >>
> >> - get the handle from the test and use it to delete the rule
> >>
> >> - or flush the table.
> >>
> >> So up to you, but probably best to avoid using nft_handle as global var.
> > 
> > Thanks, endpoint_tests is the only test that could delete iptables rules.
> > I use the nft_handle mainly because the iptables also delete rules with
> > specific match (iptables -D OUTPUT -s .. -p tcp -j REJECT) other than flush
> > the table directly.
> > 
> > endpoint_tests
> >   - reset_with_tcp_filter
> >     - iptables -D
> >     - iptables -I
> >     - iptables -D
> >   - reset_with_events
> >     - iptables -I
> >     - iptables -D
> >   - reset_with_tcp_filter
> >     - iptables -D
> > 
> > While from the logic it should be safe to flush the tables. I can avoid the
> > nft_handle in v4 (after v3 review).
> 
> Just to be sure it is clear: nft_handle can be used, just better to
> avoid using it globally I think. An alternative could be to pass a local
> nft_handle to reset_with_tcp_filter and set it there, but in bash,
> that's not very clear either.

reset_with_tcp_filter is also used by subflows_error_tests(). It's not easy
to just passing nft_handle to reset_with_tcp_filter for endpoint_tests and
leave subflows_error_tests() not affect. If there is a new version,
I'd prefer to just flush the table if you have no objections.

> >> You need to use `|git rebase --onto` instead, e.g.
> >>
> >>   git fetch origin  # adapt here and below if needed
> > 
> > For export branch, I think git fetch is not enough? I have to reset
> > to latest net/net-next merge commit and pull on that.
> 
> I'm not sure to understand. 'git fetch' with the right remote should get
> the latest <remote>/export branch ...

I get what you mean now. I checked out the export branch, which is not needed.

> 
> >>   git rebase --onto origin/export "$(b4 prep --show-info base-commit)"
> 
> ... then this command will use this new ref. Why do you need to reset
> net/net-next merge commit?
> 
> > Yes, it works! New git usage learned :)
> > 
> >>
> >> Can you check if it works for you, please? (so I can update the wiki
> >> page if needed)
> >>
> >> The alternative is to use `for-review`, with a continuous history, see:
> >>
> >>   https://github.com/multipath-tcp/mptcp_net-next/wiki/Git-Branches
> > 
> > I will try this tree next time
> 
> Up to you, but "export" is good as well, and required when using "git
> blame".

Got it.

Thanks
Hangbin

Re: [PATCH mptcp-next 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[Matthieu Baerts]

On 07/09/2026 08:59, Hangbin Liu wrote:
> On Mon, Sep 07, 2026 at 07:50:04AM +0200, Matthieu Baerts wrote:
>>>> If a global nft_handle var is used, that doesn't seem clear, and I think
>>>> it would be clearer/easier to:
>>>>
>>>> - either delete a specific rule (but I don't think that's supported)
>>>>
>>>> - get the handle from the test and use it to delete the rule
>>>>
>>>> - or flush the table.
>>>>
>>>> So up to you, but probably best to avoid using nft_handle as global var.
>>>
>>> Thanks, endpoint_tests is the only test that could delete iptables rules.
>>> I use the nft_handle mainly because the iptables also delete rules with
>>> specific match (iptables -D OUTPUT -s .. -p tcp -j REJECT) other than flush
>>> the table directly.
>>>
>>> endpoint_tests
>>>   - reset_with_tcp_filter
>>>     - iptables -D
>>>     - iptables -I
>>>     - iptables -D
>>>   - reset_with_events
>>>     - iptables -I
>>>     - iptables -D
>>>   - reset_with_tcp_filter
>>>     - iptables -D
>>>
>>> While from the logic it should be safe to flush the tables. I can avoid the
>>> nft_handle in v4 (after v3 review).
>>
>> Just to be sure it is clear: nft_handle can be used, just better to
>> avoid using it globally I think. An alternative could be to pass a local
>> nft_handle to reset_with_tcp_filter and set it there, but in bash,
>> that's not very clear either.
> 
> reset_with_tcp_filter is also used by subflows_error_tests(). It's not easy
> to just passing nft_handle to reset_with_tcp_filter for endpoint_tests and
> leave subflows_error_tests() not affect. If there is a new version,
> I'd prefer to just flush the table if you have no objections.

Fine by me. Deleting a specific rule doesn't seem to be as easy as with
IPTables. Please mention in the commit message that flushing is fine and
easier/clearer.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH mptcp-next 0/2] selftests: mptcp: convert iptables to nftables

[MPTCP CI]

Hi Hangbin,

Thank you for your modifications, that's great!

But sadly, our CI spotted some issues with it when trying to build it.

You can find more details there:

  https://github.com/multipath-tcp/mptcp_net-next/actions/runs/33602897785

Status: failure
Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/72e85b05cb7b
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1155871

Feel free to reply to this email if you cannot access logs, if you need
some support to fix the error, if this doesn't seem to be caused by your
modifications or if the error is a false positive one.

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)

Re: [PATCH mptcp-next 0/2] selftests: mptcp: convert iptables to nftables

[MPTCP CI]

Hi Hangbin,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Unstable: 1 failed test(s): selftest_mptcp_connect_checksum ⚠️ 
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf: 
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/33602897833

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/72e85b05cb7b
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1155871


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)