From nobody Sat Sep 5 05:52:11 2026 Received: from mta0.migadu.com (out-24.mta0.migadu.com [91.218.175.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4F5C7387590 for ; Fri, 4 Sep 2026 07:31:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.24 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788507111; cv=none; b=OuZc6Ejf5124LCY2UW7/kEfE6U0nFfA36YKoXsCVnrSHtSnh5MX8QefRAePIzhGPqkSKNRv9G4bQjPxppIbEqbmpAOzqwMjUgyoOjfyVDgWz6WYKeUyYbsiZX30t18dki3v2ZOwq4ESLLR92l0ayISkg/mWl6qRF0CJwbzGdHDU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788507111; c=relaxed/simple; bh=+lO92OrHcWgDX+XMuJSe/7Ve7jUamRR+HCwitMSwB6I=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ZdeQ/Ps1dn15/AzDr0Fm6RFq43N3NoyCaNlEdnz9TwXPpvW3ub+FL4z39ZN+u8d9Muh9YwrYraPQJAA0LUFo+hnPrGAn6C5wP6+LHwb98ZIBXJ03O6mI744eTINh8P/ezGAxoGw6KbSOK73jIhR8PAVMMTjMEWe1tO38MsNt7io= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=r87a9R3Y; arc=none smtp.client-ip=91.218.175.24 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="r87a9R3Y" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=+lO92OrHcWgDX+XMuJSe/7Ve7jUamRR+HCwitMSwB6I=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1788507107; v=1; x=1789111907; b=r87a9R3YSACgY/HmTti8BwruJkxAkF+Wkm+hKQ8A4jnMBmjM5qBTeBwIDph0TMHmySxHyKMf EQt5RE5paDyyefhv0Q+Yxvc6N+sjJgGHgPmc7DQneAd/oW5owyrq3+6yS8aLtjLcOOkOflfPhR9 UukYJHg7rSTBFbg8Sr4tt5N0= X-Envelope-To: mptcp@lists.linux.dev Received: by smtp.migadu.com with ESMTPS id e755e7489f86e25c; Fri, 04 Sep 2026 07:31:47 +0000 X-Mizu-Trace-ID: e755e7489f86e25c X-Migadu-Flow: FLOW_OUT From: Hangbin Liu Date: Fri, 04 Sep 2026 15:31:17 +0800 Subject: [PATCH mptcp-next v3 1/2] selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-mptcp_nft-v3-1-4abedaf00bf9@kylinos.cn> References: <20260904-mptcp_nft-v3-0-4abedaf00bf9@kylinos.cn> In-Reply-To: <20260904-mptcp_nft-v3-0-4abedaf00bf9@kylinos.cn> To: MPTCP Linux Cc: Hangbin Liu , Hangbin Liu X-Mailer: b4 0.14.3 From: Hangbin Liu During the conversion, we retain the same filter and chain names previously used by iptables/ip6tables. Counters are not added to accept rules because the test does not inspect them. After conversion, the generated output matches the original iptables/ip6tables behavior. Signed-off-by: Hangbin Liu --- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 2 +- tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 64 ++++++++++++------= ---- 2 files changed, 37 insertions(+), 29 deletions(-) diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing= /selftests/net/mptcp/mptcp_lib.sh index b9d14647f401..e65b4ebee06a 100644 --- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh @@ -528,7 +528,7 @@ mptcp_lib_check_tools() { exit ${KSFT_SKIP} fi ;; - "iptables"* | "ip6tables"*) + "iptables"* | "ip6tables"* | "nft" | "jq") if ! "${tool}" -V &> /dev/null; then mptcp_lib_pr_skip "Could not run all tests without ${tool}" exit ${KSFT_SKIP} diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/tes= ting/selftests/net/mptcp/mptcp_sockopt.sh index e850a87429b6..b4e3eddc9cf2 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh @@ -15,8 +15,6 @@ cin=3D"" cout=3D"" timeout_poll=3D30 timeout_test=3D$((timeout_poll * 2 + 1)) -iptables=3D"iptables" -ip6tables=3D"ip6tables" =20 ns1=3D"" ns2=3D"" @@ -49,16 +47,27 @@ add_mark_rules() local ns=3D$1 local m=3D$2 =20 - local t - for t in ${iptables} ${ip6tables}; do - # just to debug: check we have multiple subflows connection requests - ip netns exec $ns $t -A OUTPUT -p tcp --syn -m mark --mark $m -j ACCEPT - - # RST packets might be handled by a internal dummy socket - ip netns exec $ns $t -A OUTPUT -p tcp --tcp-flags RST RST -m mark --mark= 0 -j ACCEPT - - ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark $m -j ACCEPT - ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark 0 -j DROP + local table + for table in ip ip6; do + ip netns exec "$ns" nft -f - <<-EOF + add table $table filter + add chain $table filter OUTPUT \ + { type filter hook output priority 0; policy accept; } + + # just to debug: check we have multiple subflows connection requests + add rule $table filter OUTPUT \ + tcp flags & (fin | syn | rst | ack) =3D=3D syn \ + meta mark $m accept + + # RST packets might be handled by a internal dummy socket + add rule $table filter OUTPUT \ + tcp flags & rst =3D=3D rst meta mark 0x0 accept + + add rule $table filter OUTPUT \ + meta l4proto tcp meta mark $m accept + add rule $table filter OUTPUT \ + meta l4proto tcp meta mark 0 counter drop + EOF done } =20 @@ -105,32 +114,31 @@ cleanup() =20 mptcp_lib_check_mptcp mptcp_lib_check_kallsyms -mptcp_lib_check_tools ip "${iptables}" "${ip6tables}" +mptcp_lib_check_tools ip nft jq =20 check_mark() { local ns=3D$1 local af=3D$2 =20 - local tables=3D${iptables} + local tables=3D"ip" =20 if [ $af -eq 6 ];then - tables=3D${ip6tables} + tables=3D"ip6" fi =20 - local counters values - counters=3D$(ip netns exec $ns $tables -v -L OUTPUT | grep DROP) - values=3D${counters%DROP*} - - local v - for v in $values; do - if [ $v -ne 0 ]; then - mptcp_lib_pr_fail "got $tables $values in ns $ns," \ - "not 0 - not all expected packets marked" - ret=3D${KSFT_FAIL} - return 1 - fi - done + local drops + drops=3D$(ip netns exec "$ns" nft -j list table "$tables" filter | \ + jq '.nftables[] | select(has("rule")) | .rule | + select (.chain=3D=3D"OUTPUT" and any(.expr[]; has("drop"))) | + .expr[] | select(has("counter")) | .counter.packets') + + if [ -z "$drops" ] || [ "$drops" -ne 0 ]; then + mptcp_lib_pr_fail "got $tables $drops in ns $ns," \ + "not 0 - not all expected packets marked" + ret=3D${KSFT_FAIL} + return 1 + fi =20 return 0 } --=20 2.55.0 From nobody Sat Sep 5 05:52:11 2026 Received: from mta1.migadu.com (out-78.mta1.migadu.com [95.215.58.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5FB493A783F for ; Fri, 4 Sep 2026 07:31:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.78 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788507120; cv=none; b=mLrU0hjgeWl+6eiKOgCFcdg21o/Qe1vjmT/ULSULDZMvmhbvuAusQ0Yu24bKGpuIibVZZSXlxzVoiJzdsXVoJVloMifSTVer9/+PhRgT6LvgNoPpNrJlCF+OzYs3h/CNj1A0h+lSCIv3cKxd8s4ZyU3dzwcMi9TxkY6kkWHlw1M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788507120; c=relaxed/simple; bh=Mk0op9h54tu/1x8Xrws6EqF4cuklcwtSrCqxXQiqsFY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=b0N7T50Hanrvz/j2XuF47jSCfrHX1o0fBSXAAeKwYA5As2hU5r3EmPNr7bhEEwLVUb+lKZCOdRP070Spz4lfXHaPDxODFHVSWAr8+zcFEsqM9Lq4OvanJQ2ojLeEkBoXLVgFpnpKSRVd09yeb5VXHleDlYlFXjLECnSVOykprvc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=fgJE0Y5p; arc=none smtp.client-ip=95.215.58.78 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="fgJE0Y5p" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=Mk0op9h54tu/1x8Xrws6EqF4cuklcwtSrCqxXQiqsFY=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1788507113; v=1; x=1789111913; b=fgJE0Y5pnh6O8qokYt1FUpo97wAwT1gppK43blD/YsX2SpV7Z3+Y/S9qI/L9C9/gM10uoAe/ c191rHFNjVS3OD/fQE7iGxqY0gyWc2q4P3pc+12d0WoxyUui4HQueVSjQ2SaRTUcmKTqH341D8c 5pYQSc0pspkPGceipIbdfw5A= X-Envelope-To: mptcp@lists.linux.dev Received: by smtp.migadu.com with ESMTPS id 0fffaeccc75ffd15; Fri, 04 Sep 2026 07:31:53 +0000 X-Mizu-Trace-ID: 0fffaeccc75ffd15 X-Migadu-Flow: FLOW_OUT From: Hangbin Liu Date: Fri, 04 Sep 2026 15:31:18 +0800 Subject: [PATCH mptcp-next v3 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-mptcp_nft-v3-2-4abedaf00bf9@kylinos.cn> References: <20260904-mptcp_nft-v3-0-4abedaf00bf9@kylinos.cn> In-Reply-To: <20260904-mptcp_nft-v3-0-4abedaf00bf9@kylinos.cn> To: MPTCP Linux Cc: Hangbin Liu , Hangbin Liu X-Mailer: b4 0.14.3 From: Hangbin Liu During conversion, we retain the same table and chain names used by the original iptables/ip6tables setup, so rule output is identical to the former iptables/ip6tables output. Add new function init_nftables so we only do nft table setup when test need set nft rules. Unlike iptables, nftables cannot match rules based on their full specification. Some test need to delete the rules we add, so add variable nft_handle and reset it before adding nf tables. The BPF bytecode matching MPTCP add=E2=80=91addr and remove=E2=80=91addr su= boptions is replaced with native nft matching using "tcp option mptcp subtype". The config file adds CONFIG_NFT_NUMGEN (replaces iptables statistic nth), CONFIG_NFT_REJECT and CONFIG_NFT_REJECT_INET for reject=E2=80=91related rul= es. Remove CONFIG_NFT_COMPAT since we don't need it now. Remove the iptables/ip6tables check in mptcp_lib.sh since no script use it now. Signed-off-by: Hangbin Liu --- tools/testing/selftests/net/mptcp/config | 4 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 158 ++++++++++----------= ---- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 2 +- 3 files changed, 71 insertions(+), 93 deletions(-) diff --git a/tools/testing/selftests/net/mptcp/config b/tools/testing/selft= ests/net/mptcp/config index 59051ee2a986..25dd134b9907 100644 --- a/tools/testing/selftests/net/mptcp/config +++ b/tools/testing/selftests/net/mptcp/config @@ -29,7 +29,9 @@ CONFIG_NET_SCH_INGRESS=3Dm CONFIG_NET_SCH_NETEM=3Dm CONFIG_NF_TABLES=3Dm CONFIG_NF_TABLES_INET=3Dy -CONFIG_NFT_COMPAT=3Dm +CONFIG_NFT_NUMGEN=3Dm +CONFIG_NFT_REJECT=3Dm +CONFIG_NFT_REJECT_INET=3Dm CONFIG_NFT_SOCKET=3Dm CONFIG_NFT_TPROXY=3Dm CONFIG_SYN_COOKIES=3Dy diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testin= g/selftests/net/mptcp/mptcp_join.sh index 18ce7136a2b0..835cb92cab1a 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh @@ -26,8 +26,6 @@ capout=3D"" cappid=3D"" ns1=3D"" ns2=3D"" -iptables=3D"iptables" -ip6tables=3D"ip6tables" timeout_poll=3D30 timeout_test=3D$((timeout_poll * 2 + 1)) capture=3Dfalse @@ -50,6 +48,7 @@ declare -A failed_tests MPTCP_LIB_TEST_FORMAT=3D"%03u %s\n" TEST_NAME=3D"" nr_blank=3D6 +nft_handle=3D"" =20 # These var are used only in some tests, make sure they are not already set unset FAILING_LINKS @@ -99,42 +98,6 @@ unset add_addr_tx_nr unset add_addr_echo_tx_nr unset add_addr_drop_tx_nr =20 -# generated using "nfbpf_compile '(ip && (ip[54] & 0xf0) =3D=3D 0x30) || -# (ip6 && (ip6[74] & 0xf0) =3D=3D 0x30)'" -CBPF_MPTCP_SUBOPTION_ADD_ADDR=3D"14, - 48 0 0 0, - 84 0 0 240, - 21 0 3 64, - 48 0 0 54, - 84 0 0 240, - 21 6 7 48, - 48 0 0 0, - 84 0 0 240, - 21 0 4 96, - 48 0 0 74, - 84 0 0 240, - 21 0 1 48, - 6 0 0 65535, - 6 0 0 0" - -# IPv4: TCP hdr of 48B, a first suboption of 12B (DACK8), the RM_ADDR subo= ption -# generated using "nfbpf_compile '(ip[32] & 0xf0) =3D=3D 0xc0 && ip[53] = =3D=3D 0x0c && -# (ip[66] & 0xf0) =3D=3D 0x40'" -CBPF_MPTCP_SUBOPTION_RM_ADDR=3D"13, - 48 0 0 0, - 84 0 0 240, - 21 0 9 64, - 48 0 0 32, - 84 0 0 240, - 21 0 6 192, - 48 0 0 53, - 21 0 4 12, - 48 0 0 66, - 84 0 0 240, - 21 0 1 64, - 6 0 0 65535, - 6 0 0 0" - init_partial() { capout=3D$(mktemp) @@ -184,6 +147,28 @@ init_shapers() done } =20 +init_nftables() +{ + nft_handle=3D"" + + local netns table + for netns in "$ns1" "$ns2"; do + for table in ip ip6; do + ip netns exec "$netns" nft -f - <<-EOF + add table $table filter + add chain $table filter INPUT \ + { type filter hook input priority filter; policy accept; } + add chain $table filter OUTPUT \ + { type filter hook output priority filter; policy accept; } + + table $table mangle + chain $table mangle OUTPUT \ + { type route hook output priority mangle; policy accept; } + EOF + done + done +} + cleanup_partial() { rm -f "$capout" @@ -196,7 +181,7 @@ init() { =20 mptcp_lib_check_mptcp mptcp_lib_check_kallsyms - mptcp_lib_check_tools ip tc ss "${iptables}" "${ip6tables}" + mptcp_lib_check_tools ip tc ss nft jq =20 sin=3D$(mktemp) sout=3D$(mktemp) @@ -380,24 +365,18 @@ reset_with_cookies() # $1: test name reset_with_add_addr_timeout() { - local ip=3D"${2:-4}" - local tables + local ip=3D"${2:-}" =20 reset "${1}" || return 1 - - tables=3D"${iptables}" - if [ $ip -eq 6 ]; then - tables=3D"${ip6tables}" - fi + init_nftables =20 # set a maximum, to avoid too long timeout with exponential backoff ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=3D1 =20 - if ! ip netns exec $ns2 $tables -A OUTPUT -p tcp \ - -m tcp --tcp-option 30 \ - -m bpf --bytecode \ - "$CBPF_MPTCP_SUBOPTION_ADD_ADDR" \ - -j DROP; then + if ! ip netns exec "$ns2" nft add rule \ + ip"$ip" filter OUTPUT meta l4proto tcp \ + tcp option mptcp subtype add-addr \ + drop; then mark_as_skipped "unable to set the 'add addr' rule" return 1 fi @@ -449,22 +428,14 @@ setup_fail_rules() check_invert=3D1 validate_checksum=3Dtrue local i=3D"$1" - local ip=3D"${2:-4}" - local tables + local ip=3D"${2:-}" =20 - tables=3D"${iptables}" - if [ $ip -eq 6 ]; then - tables=3D"${ip6tables}" - fi - - ip netns exec $ns2 $tables \ - -t mangle \ - -A OUTPUT \ - -o ns2eth$i \ - -p tcp \ - -m length --length 150:9999 \ - -m statistic --mode nth --packet 1 --every 99999 \ - -j MARK --set-mark 42 || return ${KSFT_SKIP} + init_nftables + ip netns exec "$ns2" nft add rule \ + ip"$ip" mangle OUTPUT oifname ns2eth$i \ + meta l4proto tcp \ + meta length 150-9999 numgen inc mod 99999 1 \ + meta mark set 42 || return ${KSFT_SKIP} =20 tc -n $ns2 qdisc add dev ns2eth$i clsact || return ${KSFT_SKIP} tc -n $ns2 filter add dev ns2eth$i egress \ @@ -510,16 +481,19 @@ reset_with_tcp_filter() reset "${1}" || return 1 shift =20 + init_nftables + local ns=3D"${!1}" local src=3D"${2}" local target=3D"${3}" local chain=3D"${4:-INPUT}" =20 - if ! ip netns exec "${ns}" ${iptables} \ - -A "${chain}" \ - -s "${src}" \ - -p tcp \ - -j "${target}"; then + # Capture nft handle as endpoint_tests() need it + nft_handle=3D$(ip netns exec "$ns" nft -e --json add rule \ + ip filter "${chain}" ip saddr "${src}" \ + meta l4proto tcp "${target,,}" | \ + jq '.nftables[] | select(has("add")) | .add.rule.handle') + if [ -z "$nft_handle" ]; then mark_as_skipped "unable to set the filter rules" return 1 fi @@ -4313,12 +4287,15 @@ userspace_tests() chk_mptcp_info subflows 1 subflows 1 chk_subflows_total 2 2 =20 + init_nftables # force quick loss ip netns exec $ns2 sysctl -q net.ipv4.tcp_syn_retries=3D1 - if ip netns exec "${ns1}" ${iptables} -A INPUT -s "10.0.1.2" \ - -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset && - ip netns exec "${ns2}" ${iptables} -A INPUT -d "10.0.1.2" \ - -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset; then + if ip netns exec "${ns1}" nft add rule ip filter INPUT \ + ip saddr "10.0.1.2" meta l4proto tcp \ + tcp option mptcp exists reject with tcp reset && + ip netns exec "${ns2}" nft add rule ip filter INPUT \ + ip daddr "10.0.1.2" meta l4proto tcp \ + tcp option mptcp exists reject with tcp reset; then wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 1 wait_event ns1 MPTCP_LIB_EVENT_SUB_CLOSED 1 chk_subflows_total 1 1 @@ -4393,7 +4370,7 @@ endpoint_tests() chk_subflow_nr "after new reject" 2 chk_mptcp_info subflows 1 subflows 1 =20 - ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJ= ECT + ip netns exec "${ns2}" nft delete rule ip filter OUTPUT handle "$nft_han= dle" pm_nl_del_endpoint $ns2 3 10.0.3.2 pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow wait_mpj 3 @@ -4402,12 +4379,10 @@ endpoint_tests() =20 # To make sure RM_ADDR are sent over a different subflow, but # allow the rest to quickly and cleanly close the subflow - local ipt=3D1 - ip netns exec "${ns2}" ${iptables} -I OUTPUT -s "10.0.1.2" \ - -p tcp -m tcp --tcp-option 30 \ - -m bpf --bytecode \ - "$CBPF_MPTCP_SUBOPTION_RM_ADDR" \ - -j DROP || ipt=3D0 + nft_handle=3D$(ip netns exec "${ns2}" nft -e --json insert rule \ + ip filter OUTPUT ip saddr 10.0.1.2 meta l4proto tcp \ + tcp option mptcp subtype remove-addr drop | \ + jq '.nftables[] | select(has("insert")) | .insert.rule.handle') local i for i in $(seq 3); do pm_nl_del_endpoint $ns2 1 10.0.1.2 @@ -4420,7 +4395,8 @@ endpoint_tests() chk_subflow_nr "after re-add id 0 ($i)" 3 chk_mptcp_info subflows 3 subflows 3 done - [ ${ipt} =3D 1 ] && ip netns exec "${ns2}" ${iptables} -D OUTPUT 1 + [ -n "${nft_handle}" ] && ip netns exec "${ns2}" nft delete rule \ + ip filter OUTPUT handle "${nft_handle}" =20 mptcp_lib_kill_group_wait $tests_pid =20 @@ -4480,20 +4456,20 @@ endpoint_tests() chk_mptcp_info subflows 2 subflows 2 chk_mptcp_info add_addr_signal 2 add_addr_accepted 2 =20 + init_nftables # To make sure RM_ADDR are sent over a different subflow, but # allow the rest to quickly and cleanly close the subflow - local ipt=3D1 - ip netns exec "${ns1}" ${iptables} -I OUTPUT -s "10.0.1.1" \ - -p tcp -m tcp --tcp-option 30 \ - -m bpf --bytecode \ - "$CBPF_MPTCP_SUBOPTION_RM_ADDR" \ - -j DROP || ipt=3D0 + nft_handle=3D$(ip netns exec "${ns1}" nft -e --json insert rule \ + ip filter OUTPUT ip saddr 10.0.1.1 meta l4proto tcp \ + tcp option mptcp subtype remove-addr drop | \ + jq '.nftables[] | select(has("insert")) | .insert.rule.handle') pm_nl_del_endpoint $ns1 42 10.0.1.1 sleep 0.5 chk_subflow_nr "after delete ID 0" 2 chk_mptcp_info subflows 2 subflows 2 chk_mptcp_info add_addr_signal 2 add_addr_accepted 2 - [ ${ipt} =3D 1 ] && ip netns exec "${ns1}" ${iptables} -D OUTPUT 1 + [ -n "${nft_handle}" ] && ip netns exec "${ns1}" nft delete rule \ + ip filter OUTPUT handle "${nft_handle}" =20 pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal wait_mpj 4 @@ -4555,7 +4531,7 @@ endpoint_tests() pm_nl_flush_endpoint $ns2 pm_nl_flush_endpoint $ns1 wait_rm_addr $ns2 0 - ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJ= ECT + ip netns exec "${ns2}" nft delete rule ip filter OUTPUT handle "$nft_han= dle" pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow wait_mpj 1 pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing= /selftests/net/mptcp/mptcp_lib.sh index e65b4ebee06a..0559bb168203 100644 --- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh @@ -528,7 +528,7 @@ mptcp_lib_check_tools() { exit ${KSFT_SKIP} fi ;; - "iptables"* | "ip6tables"* | "nft" | "jq") + "nft" | "jq") if ! "${tool}" -V &> /dev/null; then mptcp_lib_pr_skip "Could not run all tests without ${tool}" exit ${KSFT_SKIP} --=20 2.55.0