iptables has been deprecated for years. The Linux kernel has included
nftables as the successor to iptables since 2014, and every major
distribution uses nftables as the default packet filtering framework.
The iptables command we run on modern systems is actually iptables‑nft,
a compatibility layer that translates iptables syntax to nftables rules
behind the scenes.

There are also some features that can be set easily with nft, while we need
to convert to BPF code under iptables, such as MPTCP add‑addr and
remove‑addr suboptions. To make future work easier, convert iptables usage
in mptcp to nftables.

For mptcp_join.sh, I add an init_nftables() function so we can only init
nftables when needed. With debug kernel on my 4 cpu vm, Here is the
total running time of mptcp_join.sh.

With iptables

real    35m44.460s
user    0m22.455s
sys     25m17.923s

With nft init on each init_partial (Patch v2 version)
real    43m37.393s
user    0m29.183s
sys     32m15.354s

With nft init only called needed (Patch v3 version)
real    37m6.645s
user    0m25.325s
sys     27m10.385s

We only increase 1m22s compared with iptables.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
Changes in v4:
- fix add table typo in init_nftables() (sashiko)
- Flush the nft table(which is safe) instead of using global nft_handle (Matthieu Baerts)
- Link to v3: https://lore.kernel.org/r/20260904-mptcp_nft-v3-0-4abedaf00bf9@kylinos.cn

Changes in v3:
- Use jq to get the nft handle and drop count (Matthieu Baerts)
- Remove iptables/ip6tables and CONFIG_NFT_COMPAT since no one use it
  after the conversion. (Matthieu Baerts)
- Add init_nftables() so we can only init the nf tables when needed (Matthieu Baerts)
- Bundle the nft init steps so we only need to call the nft binary once (Florian Westphal)
- Only get the nft_handle when needed and reset it before using (Matthieu Baerts)
- Link to v2: https://lore.kernel.org/r/20260903-mptcp_nft-v2-0-66283e4b9c3b@kylinos.cn

Changes in v2:
- Fix --sync and --tcp-flags RST convert not match issue (sashiko)
- make sure drop is a number in check_mark. (sashiko)
- Other than using one inet table, use ip/ip6 tables to retain the same
  table and chain names used by the original iptables/ip6tables setup.
- Link to v1: https://lore.kernel.org/r/20260902-mptcp_nft-v1-0-559caa16f410@kylinos.cn

---
Hangbin Liu (2):
      selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh
      selftests: mptcp: convert iptables to nftables for mptcp_join.sh

 tools/testing/selftests/net/mptcp/config           |   4 +-
 tools/testing/selftests/net/mptcp/mptcp_join.sh    | 149 ++++++++-------------
 tools/testing/selftests/net/mptcp/mptcp_lib.sh     |   2 +-
 tools/testing/selftests/net/mptcp/mptcp_sockopt.sh |  64 +++++----
 4 files changed, 98 insertions(+), 121 deletions(-)
---
base-commit: a5ccf9a640b87f84558f35b17b02747380128513
change-id: 20260902-mptcp_nft-b892782ef929

Best regards,
-- 
Hangbin Liu <liuhangbin@kylinos.cn>

Hi Hangbin,

On 08/09/2026 13:36, Hangbin Liu wrote:
> iptables has been deprecated for years. The Linux kernel has included
> nftables as the successor to iptables since 2014, and every major
> distribution uses nftables as the default packet filtering framework.
> The iptables command we run on modern systems is actually iptables‑nft,
> a compatibility layer that translates iptables syntax to nftables rules
> behind the scenes.
> 
> There are also some features that can be set easily with nft, while we need
> to convert to BPF code under iptables, such as MPTCP add‑addr and
> remove‑addr suboptions. To make future work easier, convert iptables usage
> in mptcp to nftables.
Thank you for the new version. It looks good to me:

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

Now in our tree (I just fixed the indentation after 'if .* nft' lines
not to align the rest of the nft commands with the conditional code):

New patches for t/upstream:
- 23ac116ea2c4: selftests: mptcp: convert iptables to nftables for
mptcp_sockopt.sh
- 0ae33af3f73f: selftests: mptcp: convert iptables to nftables for
mptcp_join.sh
- Results: ca7966735328..2dc29b34b99a (export)

Tests are now in progress:

- export:
https://github.com/multipath-tcp/mptcp_net-next/commit/b49aa4201a14e200297db9adcde3495e5a778517/checks

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Hi Hangbin,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Unstable: 1 failed test(s): packetdrill_add_addr ⚠️ 
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf: 
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/34223550098

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/84d6fbfc051a
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1160437


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)