From: Hangbin Liu <liuhangbin@kylinos.cn>

Use --version to check for nft presence, as older nft versions reject -V.
Ensure the nft tool has JSON support, since we need JSON output for
parsing with jq.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
 tools/testing/selftests/net/mptcp/mptcp_lib.sh | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing/selftests/net/mptcp/mptcp_lib.sh
index 0559bb168203..e5896bfc75d6 100644
--- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh
@@ -528,7 +528,14 @@ mptcp_lib_check_tools() {
 				exit ${KSFT_SKIP}
 			fi
 			;;
-		"nft" | "jq")
+		"nft")
+			if ! nft --version &> /dev/null || \
+				! nft -j list ruleset &> /dev/null; then
+				mptcp_lib_pr_skip "nft tool does not support MPTCP"
+				exit ${KSFT_SKIP}
+			fi
+			;;
+		"jq")
 			if ! "${tool}" -V &> /dev/null; then
 				mptcp_lib_pr_skip "Could not run all tests without ${tool}"
 				exit ${KSFT_SKIP}

---
base-commit: 9651c766735c19e7a6b90d731bab53ef7959def8
change-id: 20261008-mptcp_nft_version-9865d63066bf

Best regards,
-- 
Hangbin Liu <liuhangbin@kylinos.cn>

Hi Hangbin,

On 08/10/2026 12:00, Hangbin Liu wrote:
> Use --version to check for nft presence, as older nft versions reject -V.
> Ensure the nft tool has JSON support, since we need JSON output for
> parsing with jq.
Thank you for the patch. But do you think it is really needed? 'nft -V'
as been introduced before MPTCP being upstream, and who is building nft
without JSON support?

As an alternative, I can squash this in "selftests: mptcp: convert
iptables to nftables for mptcp_sockopt.sh", just to silence Clashiko.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

October 8, 2026 at 7:09 PM, "Matthieu Baerts" <matttbe@kernel.org> wrote:
> 
> Hi Hangbin,
> 
> On 08/10/2026 12:00, Hangbin Liu wrote:
> 
> > 
> > Use --version to check for nft presence, as older nft versions reject -V.
> >  Ensure the nft tool has JSON support, since we need JSON output for
> >  parsing with jq.
> > 
> Thank you for the patch. But do you think it is really needed? 'nft -V'
> as been introduced before MPTCP being upstream, and who is building nft
> without JSON support?

Not really, but ...

> 
> As an alternative, I can squash this in "selftests: mptcp: convert
> iptables to nftables for mptcp_sockopt.sh", just to silence Clashiko.

Yes, this is just to silence Clashiko, which report this issue as medium.
Jakub asks to take action for medium+ reports.

And I see you have squashed this. Thanks for your works!

Thanks
Hangbin

On 08/10/2026 15:45, hangbin.liu@linux.dev wrote:
> October 8, 2026 at 7:09 PM, "Matthieu Baerts" <matttbe@kernel.org> wrote:
>>
>> Hi Hangbin,
>>
>> On 08/10/2026 12:00, Hangbin Liu wrote:
>>
>>>
>>> Use --version to check for nft presence, as older nft versions reject -V.
>>>  Ensure the nft tool has JSON support, since we need JSON output for
>>>  parsing with jq.
>>>
>> Thank you for the patch. But do you think it is really needed? 'nft -V'
>> as been introduced before MPTCP being upstream, and who is building nft
>> without JSON support?
> 
> Not really, but ...
> 
>>
>> As an alternative, I can squash this in "selftests: mptcp: convert
>> iptables to nftables for mptcp_sockopt.sh", just to silence Clashiko.
> 
> Yes, this is just to silence Clashiko, which report this issue as medium.
> Jakub asks to take action for medium+ reports.

Note that we can also do that by adding a note in the commit message, or
reply to the reports. But yes, because we need to send a new version for
these patches, let's fix that too.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

On 08/10/2026 13:09, Matthieu Baerts wrote:
> On 08/10/2026 12:00, Hangbin Liu wrote:
>> Use --version to check for nft presence, as older nft versions reject -V.
>> Ensure the nft tool has JSON support, since we need JSON output for
>> parsing with jq.
> Thank you for the patch. But do you think it is really needed? 'nft -V'
> as been introduced before MPTCP being upstream, and who is building nft
> without JSON support?
> 
> As an alternative, I can squash this in "selftests: mptcp: convert
> iptables to nftables for mptcp_sockopt.sh", just to silence Clashiko.

I just did that:

New patches for t/upstream:
- 7b299bd2ff08: "squashed" (with conflicts) in "selftests: mptcp:
convert iptables to nftables for mptcp_sockopt.sh"
- 585585efcf69: conflict in
t/selftests-mptcp-convert-iptables-to-nftables-for-mptcp_join.sh
- Results: 1b9bfe42c3a5..5b1d535dc33e (export)

Tests are now in progress:

- export:
https://github.com/multipath-tcp/mptcp_net-next/commit/a467f29c9a787c2d2d970fcd60116bb19ade259a/checks

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

October 8, 2026 at 7:55 PM, "Matthieu Baerts" <matttbe@kernel.org> wrote:
> 
> On 08/10/2026 13:09, Matthieu Baerts wrote:
> 
> > 
> > On 08/10/2026 12:00, Hangbin Liu wrote:
> > 
> > > 
> > > Use --version to check for nft presence, as older nft versions reject -V.
> > >  Ensure the nft tool has JSON support, since we need JSON output for
> > >  parsing with jq.
> > > 
> >  Thank you for the patch. But do you think it is really needed? 'nft -V'
> >  as been introduced before MPTCP being upstream, and who is building nft
> >  without JSON support?
> >  
> >  As an alternative, I can squash this in "selftests: mptcp: convert
> >  iptables to nftables for mptcp_sockopt.sh", just to silence Clashiko.
> > 
> I just did that:
> 
> New patches for t/upstream:
> - 7b299bd2ff08: "squashed" (with conflicts) in "selftests: mptcp:
> convert iptables to nftables for mptcp_sockopt.sh"
> - 585585efcf69: conflict in
> t/selftests-mptcp-convert-iptables-to-nftables-for-mptcp_join.sh
> - Results: 1b9bfe42c3a5..5b1d535dc33e (export)
> 

Thanks for updating the previous patches and fixing the conflicts.

Regards
Hangbin

Hi Hangbin,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf: Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/37761677185

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/4b8f2b367488
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1181524


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)