iptables has been deprecated for years. The Linux kernel has included
nftables as the successor to iptables since 2014, and every major
distribution uses nftables as the default packet filtering framework.
The iptables command we run on modern systems is actually iptables‑nft,
a compatibility layer that translates iptables syntax to nftables rules
behind the scenes.

There are also some features that can be set easily with nft, while we need
to convert to BPF code under iptables, such as MPTCP add‑addr and
remove‑addr suboptions. To make future work easier, convert iptables usage
in mptcp to nftables.

For mptcp_join.sh, I add an init_nftables() function so we can only init
nftables when needed. With debug kernel on my 4 cpu vm, Here is the
total running time of mptcp_join.sh.

With iptables

real    35m44.460s
user    0m22.455s
sys     25m17.923s

With nft init on each init_partial (Last patch version)
real    43m37.393s
user    0m29.183s
sys     32m15.354s

With nft init only called needed (This patch version)
real    37m6.645s
user    0m25.325s
sys     27m10.385s

We only increase 1m22s compared with iptables.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
Changes in v3:
- Use jq to get the nft handle and drop count (Matthieu Baerts)
- Remove iptables/ip6tables and CONFIG_NFT_COMPAT since no one use it
  after the conversion. (Matthieu Baerts)
- Add init_nftables() so we can only init the nf tables when needed (Matthieu Baerts)
- Bundle the nft init steps so we only need to call the nft binary once (Florian Westphal)
- Only get the nft_handle when needed and reset it before using (Matthieu Baerts)
- Link to v2: https://lore.kernel.org/r/20260903-mptcp_nft-v2-0-66283e4b9c3b@kylinos.cn

Changes in v2:
- Fix --sync and --tcp-flags RST convert not match issue (sashiko)
- make sure drop is a number in check_mark. (sashiko)
- Other than using one inet table, use ip/ip6 tables to retain the same
  table and chain names used by the original iptables/ip6tables setup.
- Link to v1: https://lore.kernel.org/r/20260902-mptcp_nft-v1-0-559caa16f410@kylinos.cn

---
Hangbin Liu (2):
      selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh
      selftests: mptcp: convert iptables to nftables for mptcp_join.sh

 tools/testing/selftests/net/mptcp/config           |   4 +-
 tools/testing/selftests/net/mptcp/mptcp_join.sh    | 158 +++++++++------------
 tools/testing/selftests/net/mptcp/mptcp_lib.sh     |   2 +-
 tools/testing/selftests/net/mptcp/mptcp_sockopt.sh |  64 +++++----
 4 files changed, 107 insertions(+), 121 deletions(-)
---
base-commit: e9b3407fa4686e58a862f6889b18a4f422199261
change-id: 20260902-mptcp_nft-b892782ef929

Best regards,
-- 
Hangbin Liu <liuhangbin@kylinos.cn>

Hi Hangbin,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Unstable: 1 failed test(s): selftest_mptcp_connect ⚠️ 
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf: 
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/33850602816

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/54e93a0f92b7
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1157667


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)