From nobody Sat Sep 26 12:37:22 2026 Received: from mta0.migadu.com (out-152.mta0.migadu.com [91.218.175.152]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EE70A52E067 for ; Tue, 8 Sep 2026 11:36:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.152 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788867389; cv=none; b=jtVdFuJrcolB7KRVsvswZfiC8SUG3gwX7LTLzb2nuI3AuSeLkPelznXWeBk5+vRFPco6uurnMYmL1JeI7cUXJsP+1ZDsdPYWmbzN1XN8MVeqdnDkrAJMHf0qL7geKcOz2i1Y8dSWLv2cSioYEfxHD7oiOCL3MlMoAT1xI6NmdsY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788867389; c=relaxed/simple; bh=+lO92OrHcWgDX+XMuJSe/7Ve7jUamRR+HCwitMSwB6I=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=RpPauWVtTWzZ9Gl4VRp/7iwsuMMorfJbk1XWZQIr0/6IBW9bfQCl3P0ujSfEL1iRvwUNK0Y5tn6xt7O3t4p5y/SaSoVpmNei9zt9zq59rX5rBuM0/Ii8+MUw7ko3a/6TvFJVTsrVErFsGOpQmBKCypwGqrrHENzEOCOSv+GEVpQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=lO65s5LL; arc=none smtp.client-ip=91.218.175.152 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="lO65s5LL" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=+lO92OrHcWgDX+XMuJSe/7Ve7jUamRR+HCwitMSwB6I=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1788867378; v=1; x=1789472178; b=lO65s5LLMQ6CGyPfc1xS5e/FMfJC+SgS8VuXetoQNjex/4gDz/PHwaRctCb3jhYaakMVgfBF mUjFWhS6OekYw+rsU9WQleaxQJ4jZ3iDGCpuE03weuZ83U7SSpSzd+tdJuDdAp8EbWxLAvX//6t oaFlkFEFCvEOK1pp/3uuOFjE= X-Envelope-To: mptcp@lists.linux.dev Received: by smtp.migadu.com with ESMTPS id dd09b7ab0a27b898; Tue, 08 Sep 2026 11:36:18 +0000 X-Mizu-Trace-ID: dd09b7ab0a27b898 X-Migadu-Flow: FLOW_OUT From: Hangbin Liu Date: Tue, 08 Sep 2026 19:36:09 +0800 Subject: [PATCH mptcp-next v4 1/2] selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-mptcp_nft-v4-1-af0a6120240b@kylinos.cn> References: <20260908-mptcp_nft-v4-0-af0a6120240b@kylinos.cn> In-Reply-To: <20260908-mptcp_nft-v4-0-af0a6120240b@kylinos.cn> To: MPTCP Linux Cc: Hangbin Liu , Hangbin Liu X-Mailer: b4 0.14.3 From: Hangbin Liu During the conversion, we retain the same filter and chain names previously used by iptables/ip6tables. Counters are not added to accept rules because the test does not inspect them. After conversion, the generated output matches the original iptables/ip6tables behavior. Signed-off-by: Hangbin Liu Reviewed-by: Matthieu Baerts (NGI0) --- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 2 +- tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 64 ++++++++++++------= ---- 2 files changed, 37 insertions(+), 29 deletions(-) diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing= /selftests/net/mptcp/mptcp_lib.sh index b9d14647f401..e65b4ebee06a 100644 --- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh @@ -528,7 +528,7 @@ mptcp_lib_check_tools() { exit ${KSFT_SKIP} fi ;; - "iptables"* | "ip6tables"*) + "iptables"* | "ip6tables"* | "nft" | "jq") if ! "${tool}" -V &> /dev/null; then mptcp_lib_pr_skip "Could not run all tests without ${tool}" exit ${KSFT_SKIP} diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/tes= ting/selftests/net/mptcp/mptcp_sockopt.sh index e850a87429b6..b4e3eddc9cf2 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh @@ -15,8 +15,6 @@ cin=3D"" cout=3D"" timeout_poll=3D30 timeout_test=3D$((timeout_poll * 2 + 1)) -iptables=3D"iptables" -ip6tables=3D"ip6tables" =20 ns1=3D"" ns2=3D"" @@ -49,16 +47,27 @@ add_mark_rules() local ns=3D$1 local m=3D$2 =20 - local t - for t in ${iptables} ${ip6tables}; do - # just to debug: check we have multiple subflows connection requests - ip netns exec $ns $t -A OUTPUT -p tcp --syn -m mark --mark $m -j ACCEPT - - # RST packets might be handled by a internal dummy socket - ip netns exec $ns $t -A OUTPUT -p tcp --tcp-flags RST RST -m mark --mark= 0 -j ACCEPT - - ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark $m -j ACCEPT - ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark 0 -j DROP + local table + for table in ip ip6; do + ip netns exec "$ns" nft -f - <<-EOF + add table $table filter + add chain $table filter OUTPUT \ + { type filter hook output priority 0; policy accept; } + + # just to debug: check we have multiple subflows connection requests + add rule $table filter OUTPUT \ + tcp flags & (fin | syn | rst | ack) =3D=3D syn \ + meta mark $m accept + + # RST packets might be handled by a internal dummy socket + add rule $table filter OUTPUT \ + tcp flags & rst =3D=3D rst meta mark 0x0 accept + + add rule $table filter OUTPUT \ + meta l4proto tcp meta mark $m accept + add rule $table filter OUTPUT \ + meta l4proto tcp meta mark 0 counter drop + EOF done } =20 @@ -105,32 +114,31 @@ cleanup() =20 mptcp_lib_check_mptcp mptcp_lib_check_kallsyms -mptcp_lib_check_tools ip "${iptables}" "${ip6tables}" +mptcp_lib_check_tools ip nft jq =20 check_mark() { local ns=3D$1 local af=3D$2 =20 - local tables=3D${iptables} + local tables=3D"ip" =20 if [ $af -eq 6 ];then - tables=3D${ip6tables} + tables=3D"ip6" fi =20 - local counters values - counters=3D$(ip netns exec $ns $tables -v -L OUTPUT | grep DROP) - values=3D${counters%DROP*} - - local v - for v in $values; do - if [ $v -ne 0 ]; then - mptcp_lib_pr_fail "got $tables $values in ns $ns," \ - "not 0 - not all expected packets marked" - ret=3D${KSFT_FAIL} - return 1 - fi - done + local drops + drops=3D$(ip netns exec "$ns" nft -j list table "$tables" filter | \ + jq '.nftables[] | select(has("rule")) | .rule | + select (.chain=3D=3D"OUTPUT" and any(.expr[]; has("drop"))) | + .expr[] | select(has("counter")) | .counter.packets') + + if [ -z "$drops" ] || [ "$drops" -ne 0 ]; then + mptcp_lib_pr_fail "got $tables $drops in ns $ns," \ + "not 0 - not all expected packets marked" + ret=3D${KSFT_FAIL} + return 1 + fi =20 return 0 } --=20 2.55.0 From nobody Sat Sep 26 12:37:22 2026 Received: from mta1.migadu.com (out-13.mta1.migadu.com [95.215.58.13]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F120552ED3E for ; Tue, 8 Sep 2026 11:36:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.13 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788867390; cv=none; b=mLI++J0SKaLAieY1VAd4ce5dOYeu05za5renuySquZnK7gC5JZADdXv4Gxo/oSYAP9ReTPJT+n/hh/YahpIRdrcysnlUixX6fSUxlYF+0i0aBQMQrKzGxu+PvL2LBBlEWHVAAHw3gHMrwAM7TdGCCKvc/v3oxqIdsJd32Yb/ezs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788867390; c=relaxed/simple; bh=cosR8WopIO+c6B8/hOajoJg6k9ILLLkI1H1xF/4GUXk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ZLjcPSDvI1Ps9fppdNjBJSJISfvmIqNkCJ+rjRtwddLan7WhxVjcMsNqnYyQPw0vSVGGSTC/f7GD9W9F/2fw2jGBnqohg/2Ja/jkRq6QVfmZQg1I8zvnD+6MP5GW5h5cltPlCqKHO7wwIp0/t9rDUf0l0jFq8DDRQ/VnZjEarrQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=SShdFSC+; arc=none smtp.client-ip=95.215.58.13 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="SShdFSC+" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=cosR8WopIO+c6B8/hOajoJg6k9ILLLkI1H1xF/4GUXk=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1788867380; v=1; x=1789472180; b=SShdFSC+96HFojzMSI6z8VEURI0K3RCgACBVbe2emZTaO/0TTHb5rupns16x9ztyxW8joaTd bXZufxK/ACkSNAnPFeERabPFxK867wUK7B40H8oPtmiEfLjSlxBTIr+cmW+5n5l6UkTcDkUXVCd 4oSFREWIDkPVtAjYlwAmuDGw= X-Envelope-To: mptcp@lists.linux.dev Received: by smtp.migadu.com with ESMTPS id bd73114efc33a5df; Tue, 08 Sep 2026 11:36:20 +0000 X-Mizu-Trace-ID: bd73114efc33a5df X-Migadu-Flow: FLOW_OUT From: Hangbin Liu Date: Tue, 08 Sep 2026 19:36:10 +0800 Subject: [PATCH mptcp-next v4 2/2] selftests: mptcp: convert iptables to nftables for mptcp_join.sh Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-mptcp_nft-v4-2-af0a6120240b@kylinos.cn> References: <20260908-mptcp_nft-v4-0-af0a6120240b@kylinos.cn> In-Reply-To: <20260908-mptcp_nft-v4-0-af0a6120240b@kylinos.cn> To: MPTCP Linux Cc: Hangbin Liu , Hangbin Liu X-Mailer: b4 0.14.3 From: Hangbin Liu During conversion, we retain the same table and chain names used by the original iptables/ip6tables setup, so rule output is identical to the former iptables/ip6tables output. Add new function init_nftables so we only do nft table setup when test need set nft rules. Unlike iptables, nftables cannot match rules based on their full specification. Since endpoint_tests is the only test that delete rules, which inserts and deletes rules one by one. Flushing the table directly is safe and easier than using nft_handle. The BPF bytecode matching MPTCP add=E2=80=91addr and remove=E2=80=91addr su= boptions is replaced with native nft matching using "tcp option mptcp subtype". The config file adds CONFIG_NFT_NUMGEN (replaces iptables statistic nth), CONFIG_NFT_REJECT and CONFIG_NFT_REJECT_INET for reject=E2=80=91related rul= es. Remove CONFIG_NFT_COMPAT since we don't need it now. Remove the iptables/ip6tables check in mptcp_lib.sh since no script use it now. Signed-off-by: Hangbin Liu Reviewed-by: Matthieu Baerts (NGI0) --- tools/testing/selftests/net/mptcp/config | 4 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 149 +++++++++-----------= ---- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 2 +- 3 files changed, 62 insertions(+), 93 deletions(-) diff --git a/tools/testing/selftests/net/mptcp/config b/tools/testing/selft= ests/net/mptcp/config index 59051ee2a986..25dd134b9907 100644 --- a/tools/testing/selftests/net/mptcp/config +++ b/tools/testing/selftests/net/mptcp/config @@ -29,7 +29,9 @@ CONFIG_NET_SCH_INGRESS=3Dm CONFIG_NET_SCH_NETEM=3Dm CONFIG_NF_TABLES=3Dm CONFIG_NF_TABLES_INET=3Dy -CONFIG_NFT_COMPAT=3Dm +CONFIG_NFT_NUMGEN=3Dm +CONFIG_NFT_REJECT=3Dm +CONFIG_NFT_REJECT_INET=3Dm CONFIG_NFT_SOCKET=3Dm CONFIG_NFT_TPROXY=3Dm CONFIG_SYN_COOKIES=3Dy diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testin= g/selftests/net/mptcp/mptcp_join.sh index 18ce7136a2b0..d267a678383b 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh @@ -26,8 +26,6 @@ capout=3D"" cappid=3D"" ns1=3D"" ns2=3D"" -iptables=3D"iptables" -ip6tables=3D"ip6tables" timeout_poll=3D30 timeout_test=3D$((timeout_poll * 2 + 1)) capture=3Dfalse @@ -99,42 +97,6 @@ unset add_addr_tx_nr unset add_addr_echo_tx_nr unset add_addr_drop_tx_nr =20 -# generated using "nfbpf_compile '(ip && (ip[54] & 0xf0) =3D=3D 0x30) || -# (ip6 && (ip6[74] & 0xf0) =3D=3D 0x30)'" -CBPF_MPTCP_SUBOPTION_ADD_ADDR=3D"14, - 48 0 0 0, - 84 0 0 240, - 21 0 3 64, - 48 0 0 54, - 84 0 0 240, - 21 6 7 48, - 48 0 0 0, - 84 0 0 240, - 21 0 4 96, - 48 0 0 74, - 84 0 0 240, - 21 0 1 48, - 6 0 0 65535, - 6 0 0 0" - -# IPv4: TCP hdr of 48B, a first suboption of 12B (DACK8), the RM_ADDR subo= ption -# generated using "nfbpf_compile '(ip[32] & 0xf0) =3D=3D 0xc0 && ip[53] = =3D=3D 0x0c && -# (ip[66] & 0xf0) =3D=3D 0x40'" -CBPF_MPTCP_SUBOPTION_RM_ADDR=3D"13, - 48 0 0 0, - 84 0 0 240, - 21 0 9 64, - 48 0 0 32, - 84 0 0 240, - 21 0 6 192, - 48 0 0 53, - 21 0 4 12, - 48 0 0 66, - 84 0 0 240, - 21 0 1 64, - 6 0 0 65535, - 6 0 0 0" - init_partial() { capout=3D$(mktemp) @@ -184,6 +146,26 @@ init_shapers() done } =20 +init_nftables() +{ + local netns table + for netns in "$ns1" "$ns2"; do + for table in ip ip6; do + ip netns exec "$netns" nft -f - <<-EOF + add table $table filter + add chain $table filter INPUT \ + { type filter hook input priority filter; policy accept; } + add chain $table filter OUTPUT \ + { type filter hook output priority filter; policy accept; } + + add table $table mangle + add chain $table mangle OUTPUT \ + { type route hook output priority mangle; policy accept; } + EOF + done + done +} + cleanup_partial() { rm -f "$capout" @@ -196,7 +178,7 @@ init() { =20 mptcp_lib_check_mptcp mptcp_lib_check_kallsyms - mptcp_lib_check_tools ip tc ss "${iptables}" "${ip6tables}" + mptcp_lib_check_tools ip tc ss nft =20 sin=3D$(mktemp) sout=3D$(mktemp) @@ -380,24 +362,18 @@ reset_with_cookies() # $1: test name reset_with_add_addr_timeout() { - local ip=3D"${2:-4}" - local tables + local ip=3D"${2:-}" =20 reset "${1}" || return 1 - - tables=3D"${iptables}" - if [ $ip -eq 6 ]; then - tables=3D"${ip6tables}" - fi + init_nftables =20 # set a maximum, to avoid too long timeout with exponential backoff ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=3D1 =20 - if ! ip netns exec $ns2 $tables -A OUTPUT -p tcp \ - -m tcp --tcp-option 30 \ - -m bpf --bytecode \ - "$CBPF_MPTCP_SUBOPTION_ADD_ADDR" \ - -j DROP; then + if ! ip netns exec "$ns2" nft add rule \ + ip"$ip" filter OUTPUT meta l4proto tcp \ + tcp option mptcp subtype add-addr \ + drop; then mark_as_skipped "unable to set the 'add addr' rule" return 1 fi @@ -449,22 +425,14 @@ setup_fail_rules() check_invert=3D1 validate_checksum=3Dtrue local i=3D"$1" - local ip=3D"${2:-4}" - local tables + local ip=3D"${2:-}" =20 - tables=3D"${iptables}" - if [ $ip -eq 6 ]; then - tables=3D"${ip6tables}" - fi - - ip netns exec $ns2 $tables \ - -t mangle \ - -A OUTPUT \ - -o ns2eth$i \ - -p tcp \ - -m length --length 150:9999 \ - -m statistic --mode nth --packet 1 --every 99999 \ - -j MARK --set-mark 42 || return ${KSFT_SKIP} + init_nftables + ip netns exec "$ns2" nft add rule \ + ip"$ip" mangle OUTPUT oifname ns2eth$i \ + meta l4proto tcp \ + meta length 150-9999 numgen inc mod 99999 1 \ + meta mark set 42 || return ${KSFT_SKIP} =20 tc -n $ns2 qdisc add dev ns2eth$i clsact || return ${KSFT_SKIP} tc -n $ns2 filter add dev ns2eth$i egress \ @@ -510,16 +478,15 @@ reset_with_tcp_filter() reset "${1}" || return 1 shift =20 + init_nftables + local ns=3D"${!1}" local src=3D"${2}" local target=3D"${3}" local chain=3D"${4:-INPUT}" =20 - if ! ip netns exec "${ns}" ${iptables} \ - -A "${chain}" \ - -s "${src}" \ - -p tcp \ - -j "${target}"; then + if ! ip netns exec "$ns" nft add rule ip filter "${chain}" \ + ip saddr "${src}" meta l4proto tcp "${target,,}"; then mark_as_skipped "unable to set the filter rules" return 1 fi @@ -4313,12 +4280,15 @@ userspace_tests() chk_mptcp_info subflows 1 subflows 1 chk_subflows_total 2 2 =20 + init_nftables # force quick loss ip netns exec $ns2 sysctl -q net.ipv4.tcp_syn_retries=3D1 - if ip netns exec "${ns1}" ${iptables} -A INPUT -s "10.0.1.2" \ - -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset && - ip netns exec "${ns2}" ${iptables} -A INPUT -d "10.0.1.2" \ - -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset; then + if ip netns exec "${ns1}" nft add rule ip filter INPUT \ + ip saddr "10.0.1.2" meta l4proto tcp \ + tcp option mptcp exists reject with tcp reset && + ip netns exec "${ns2}" nft add rule ip filter INPUT \ + ip daddr "10.0.1.2" meta l4proto tcp \ + tcp option mptcp exists reject with tcp reset; then wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 1 wait_event ns1 MPTCP_LIB_EVENT_SUB_CLOSED 1 chk_subflows_total 1 1 @@ -4393,7 +4363,7 @@ endpoint_tests() chk_subflow_nr "after new reject" 2 chk_mptcp_info subflows 1 subflows 1 =20 - ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJ= ECT + ip netns exec "${ns2}" nft flush chain ip filter OUTPUT pm_nl_del_endpoint $ns2 3 10.0.3.2 pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow wait_mpj 3 @@ -4402,12 +4372,10 @@ endpoint_tests() =20 # To make sure RM_ADDR are sent over a different subflow, but # allow the rest to quickly and cleanly close the subflow - local ipt=3D1 - ip netns exec "${ns2}" ${iptables} -I OUTPUT -s "10.0.1.2" \ - -p tcp -m tcp --tcp-option 30 \ - -m bpf --bytecode \ - "$CBPF_MPTCP_SUBOPTION_RM_ADDR" \ - -j DROP || ipt=3D0 + local nft=3D1 + ip netns exec "${ns2}" nft insert rule ip filter OUTPUT \ + ip saddr 10.0.1.2 meta l4proto tcp \ + tcp option mptcp subtype remove-addr drop || nft=3D0 local i for i in $(seq 3); do pm_nl_del_endpoint $ns2 1 10.0.1.2 @@ -4420,7 +4388,7 @@ endpoint_tests() chk_subflow_nr "after re-add id 0 ($i)" 3 chk_mptcp_info subflows 3 subflows 3 done - [ ${ipt} =3D 1 ] && ip netns exec "${ns2}" ${iptables} -D OUTPUT 1 + [ "${nft}" =3D 1 ] && ip netns exec "${ns2}" nft flush chain ip filter O= UTPUT =20 mptcp_lib_kill_group_wait $tests_pid =20 @@ -4480,20 +4448,19 @@ endpoint_tests() chk_mptcp_info subflows 2 subflows 2 chk_mptcp_info add_addr_signal 2 add_addr_accepted 2 =20 + init_nftables # To make sure RM_ADDR are sent over a different subflow, but # allow the rest to quickly and cleanly close the subflow - local ipt=3D1 - ip netns exec "${ns1}" ${iptables} -I OUTPUT -s "10.0.1.1" \ - -p tcp -m tcp --tcp-option 30 \ - -m bpf --bytecode \ - "$CBPF_MPTCP_SUBOPTION_RM_ADDR" \ - -j DROP || ipt=3D0 + local nft=3D1 + ip netns exec "${ns1}" nft insert rule ip filter OUTPUT \ + ip saddr 10.0.1.1 meta l4proto tcp \ + tcp option mptcp subtype remove-addr drop || nft=3D0 pm_nl_del_endpoint $ns1 42 10.0.1.1 sleep 0.5 chk_subflow_nr "after delete ID 0" 2 chk_mptcp_info subflows 2 subflows 2 chk_mptcp_info add_addr_signal 2 add_addr_accepted 2 - [ ${ipt} =3D 1 ] && ip netns exec "${ns1}" ${iptables} -D OUTPUT 1 + [ "${nft}" =3D 1 ] && ip netns exec "${ns1}" nft flush chain ip filter O= UTPUT =20 pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal wait_mpj 4 @@ -4555,7 +4522,7 @@ endpoint_tests() pm_nl_flush_endpoint $ns2 pm_nl_flush_endpoint $ns1 wait_rm_addr $ns2 0 - ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJ= ECT + ip netns exec "${ns2}" nft flush chain ip filter OUTPUT pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow wait_mpj 1 pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing= /selftests/net/mptcp/mptcp_lib.sh index e65b4ebee06a..0559bb168203 100644 --- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh @@ -528,7 +528,7 @@ mptcp_lib_check_tools() { exit ${KSFT_SKIP} fi ;; - "iptables"* | "ip6tables"* | "nft" | "jq") + "nft" | "jq") if ! "${tool}" -V &> /dev/null; then mptcp_lib_pr_skip "Could not run all tests without ${tool}" exit ${KSFT_SKIP} --=20 2.55.0