Re: [PATCH net-next 4/4] selftests: mptcp: convert iptables to nftables for mptcp_join.sh

[netdev-bot+sashiko@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider.

Critical: 0 · High: 0 · Medium: 1 · Low: 0

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [Medium] mptcp_join.sh init() now calls `mptcp_lib_check_tools ip tc ss
  nft` (mptcp_join.sh:192).

--

selftests: mptcp: convert iptables to nftables for mptcp_join.sh

This converts the iptables/ip6tables rules in mptcp_join.sh to nftables.
The cBPF bytecode matches are replaced with native nft matching, and
hard-coded offsets are used for RM_ADDR. The config file is updated to
match, and the iptables/ip6tables tool check is removed from
mptcp_lib.sh.

> diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> index 18ce7136a2b0e..f4d8afaeda4f3 100755
> --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
> +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh

[ ... ]

> @@ -196,7 +189,7 @@ init() {
>  
>  	mptcp_lib_check_mptcp
>  	mptcp_lib_check_kallsyms
> -	mptcp_lib_check_tools ip tc ss "${iptables}" "${ip6tables}"
> +	mptcp_lib_check_tools ip tc ss nft

[Severity: Medium]
Will this skip the whole mptcp_join.sh suite when nft has no JSON
support?

The shared "nft" case in mptcp_lib_check_tools() in mptcp_lib.sh also
requires JSON output:

tools/testing/selftests/net/mptcp/mptcp_lib.sh:mptcp_lib_check_tools() {
    ...
		"nft")
			if ! nft --version &> /dev/null || \
			   ! nft -j list ruleset &> /dev/null; then
				mptcp_lib_pr_skip "Could not run all tests without nft -j"
				exit ${KSFT_SKIP}
			fi
			;;
    ...
}

As far as I can tell, that JSON requirement is there for
mptcp_sockopt.sh, which pipes "nft -j list table ... filter" into jq.

mptcp_join.sh never uses JSON output. It only runs "nft -f -" from
init_nftables(), plus "nft add rule", "nft insert rule" and "nft flush
chain".

If nft was built without JSON support, init() would exit with
KSFT_SKIP. Every join, PM, endpoint and userspace subtest would then be
skipped, including the many that do not use nft at all. The skip
message would also point at "nft -j", which this script does not need.

Before this patch, mptcp_join.sh only checked for iptables/ip6tables, so
nft JSON support did not matter here.

Would it make sense to check only for plain nft in mptcp_join.sh, for
example with a separate non-JSON case in mptcp_lib_check_tools()?

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261013-net-next-mptcp-misc-feat-7-4-part2-v1-0-1181e5d2fda4%40kernel.org