iptables has been deprecated for years. The Linux kernel has included
nftables as the successor to iptables since 2014, and every major
distribution uses nftables as the default packet filtering framework.
The iptables command we run on modern systems is actually iptables‑nft,
a compatibility layer that translates iptables syntax to nftables rules
behind the scenes.

There are also some features that can be set easily with nft, while we need
to convert to BPF code under iptables, such as MPTCP add‑addr and
remove‑addr suboptions. To make future work easier, convert iptables usage
in mptcp to nftables.

Tested with iptables-translate to make sure each nft conversion is the same
with previous one. e.g. for mptcp_sockopt.sh, the ip6tables shows

bash-5.3# ip6tables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere             tcp flags:FIN,SYN,RST,ACK/SYN mark match 0x1
ACCEPT     tcp  --  anywhere             anywhere             tcp flags:RST/RST mark match 0x0
ACCEPT     tcp  --  anywhere             anywhere             mark match 0x1
DROP       tcp  --  anywhere             anywhere             mark match 0x0

And the backend nft shows like

bash-5.3# nft list tables
table ip6 filter
bash-5.3# nft list table ip6 filter
table ip6 filter {
        chain OUTPUT {
                type filter hook output priority filter; policy accept;
                tcp flags & (fin | syn | rst | ack) == syn meta mark 0x00000001 counter packets 0 bytes 0 accept
                tcp flags & rst == rst meta mark 0x00000000 counter packets 0 bytes 0 accept
                meta l4proto tcp meta mark 0x00000001 counter packets 0 bytes 0 accept
                meta l4proto tcp meta mark 0x00000000 counter packets 0 bytes 0 drop
        }
}

Which matches what we change in the script, except the counter.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
Changes in v2:
- Fix --sync and --tcp-flags RST convert not match issue (sashiko)
- make sure drop is a number in check_mark. (sashiko)
- Other than using one inet table, use ip/ip6 tables to retain the same
  table and chain names used by the original iptables/ip6tables setup.
- Link to v1: https://lore.kernel.org/r/20260902-mptcp_nft-v1-0-559caa16f410@kylinos.cn

---
Hangbin Liu (2):
      selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh
      selftests: mptcp: convert iptables to nftables for mptcp_join.sh

 tools/testing/selftests/net/mptcp/config           |   3 +
 tools/testing/selftests/net/mptcp/mptcp_join.sh    | 142 ++++++++-------------
 tools/testing/selftests/net/mptcp/mptcp_lib.sh     |   2 +-
 tools/testing/selftests/net/mptcp/mptcp_sockopt.sh |  51 ++++----
 4 files changed, 84 insertions(+), 114 deletions(-)
---
base-commit: 8dd2802091fbba563abec55e0455d0e5273c7529
change-id: 20260902-mptcp_nft-b892782ef929

Best regards,
-- 
Hangbin Liu <liuhangbin@kylinos.cn>

Hello,

On 03/09/2026 03:12, Hangbin Liu wrote:
> iptables has been deprecated for years. The Linux kernel has included
> nftables as the successor to iptables since 2014, and every major
> distribution uses nftables as the default packet filtering framework.
> The iptables command we run on modern systems is actually iptables‑nft,
> a compatibility layer that translates iptables syntax to nftables rules
> behind the scenes.
> 
> There are also some features that can be set easily with nft, while we need
> to convert to BPF code under iptables, such as MPTCP add‑addr and
> remove‑addr suboptions. To make future work easier, convert iptables usage
> in mptcp to nftables.
> 
> Tested with iptables-translate to make sure each nft conversion is the same
> with previous one. e.g. for mptcp_sockopt.sh, the ip6tables shows
FYI, Hangbin is working on a new version addressing my comments from v1.
The new version(s) will be sent to the MPTCP list only, and I will sent
these patches to Netdev when ready.

Updating here the PW status:

pw-bot: cr

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Hi Hangbin,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf: 
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/33704019089

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/22c271f5ff5e
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1156594


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)

Hi,

Sorry everyone. Please ignore this version patch as it was post before
I catch up Matthieu's feedback. I will update the patch with a next version.

Hangbin
On Thu, Sep 03, 2026 at 09:12:19AM +0800, Hangbin Liu wrote:
> iptables has been deprecated for years. The Linux kernel has included
> nftables as the successor to iptables since 2014, and every major
> distribution uses nftables as the default packet filtering framework.
> The iptables command we run on modern systems is actually iptables‑nft,
> a compatibility layer that translates iptables syntax to nftables rules
> behind the scenes.
> 
> There are also some features that can be set easily with nft, while we need
> to convert to BPF code under iptables, such as MPTCP add‑addr and
> remove‑addr suboptions. To make future work easier, convert iptables usage
> in mptcp to nftables.
> 
> Tested with iptables-translate to make sure each nft conversion is the same
> with previous one. e.g. for mptcp_sockopt.sh, the ip6tables shows
> 
> bash-5.3# ip6tables -L
> Chain INPUT (policy ACCEPT)
> target     prot opt source               destination
> 
> Chain FORWARD (policy ACCEPT)
> target     prot opt source               destination
> 
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
> ACCEPT     tcp  --  anywhere             anywhere             tcp flags:FIN,SYN,RST,ACK/SYN mark match 0x1
> ACCEPT     tcp  --  anywhere             anywhere             tcp flags:RST/RST mark match 0x0
> ACCEPT     tcp  --  anywhere             anywhere             mark match 0x1
> DROP       tcp  --  anywhere             anywhere             mark match 0x0
> 
> And the backend nft shows like
> 
> bash-5.3# nft list tables
> table ip6 filter
> bash-5.3# nft list table ip6 filter
> table ip6 filter {
>         chain OUTPUT {
>                 type filter hook output priority filter; policy accept;
>                 tcp flags & (fin | syn | rst | ack) == syn meta mark 0x00000001 counter packets 0 bytes 0 accept
>                 tcp flags & rst == rst meta mark 0x00000000 counter packets 0 bytes 0 accept
>                 meta l4proto tcp meta mark 0x00000001 counter packets 0 bytes 0 accept
>                 meta l4proto tcp meta mark 0x00000000 counter packets 0 bytes 0 drop
>         }
> }
> 
> Which matches what we change in the script, except the counter.
> 
> Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
> ---
> Changes in v2:
> - Fix --sync and --tcp-flags RST convert not match issue (sashiko)
> - make sure drop is a number in check_mark. (sashiko)
> - Other than using one inet table, use ip/ip6 tables to retain the same
>   table and chain names used by the original iptables/ip6tables setup.
> - Link to v1: https://lore.kernel.org/r/20260902-mptcp_nft-v1-0-559caa16f410@kylinos.cn
> 
> ---
> Hangbin Liu (2):
>       selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh
>       selftests: mptcp: convert iptables to nftables for mptcp_join.sh
> 
>  tools/testing/selftests/net/mptcp/config           |   3 +
>  tools/testing/selftests/net/mptcp/mptcp_join.sh    | 142 ++++++++-------------
>  tools/testing/selftests/net/mptcp/mptcp_lib.sh     |   2 +-
>  tools/testing/selftests/net/mptcp/mptcp_sockopt.sh |  51 ++++----
>  4 files changed, 84 insertions(+), 114 deletions(-)
> ---
> base-commit: 8dd2802091fbba563abec55e0455d0e5273c7529
> change-id: 20260902-mptcp_nft-b892782ef929
> 
> Best regards,
> -- 
> Hangbin Liu <liuhangbin@kylinos.cn>
>