1. Patchew
  2. MPTCP
  3. View series

[PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"

Hangbin Liu posted 1 patch 6 days, 15 hours ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/multipath-tcp/mptcp_net-next tags/patchew/20261009-mptcp._5Fremove._5Faddr-v1-1-4471d460e026@kylinos.cn
tools/testing/selftests/net/mptcp/mptcp_join.sh | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
[PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"
Posted by Hangbin Liu 6 days, 15 hours ago 
From: Hangbin Liu <liuhangbin@kylinos.cn>

After squash, the new commit description could be:

During conversion, we retain the same table and chain names used by the
original iptables/ip6tables setup, so rule output is identical to the
former iptables/ip6tables output. Add new function init_nftables so we
only do nft table setup when test need set nft rules.

Unlike iptables, nftables cannot match rules based on their full
specification. Since endpoint_tests is the only test that delete rules,
which inserts and deletes rules one by one. Flushing the table
directly is safe and easier than using nft_handle.

The cBPF bytecode matching MPTCP add‑addr is replaced with native nft
matching using "tcp option mptcp subtype add-addr". But the RM_ADDR
suboption is added after the MPTCP DSS option, and nft is unable to
handle this because it stops parsing further TCP options once it matches
the first one. We therefore use hard-coded offsets to match the RM_ADDR
suboption.

The config file adds CONFIG_NFT_NUMGEN (replaces iptables statistic nth),
CONFIG_NFT_REJECT and CONFIG_NFT_REJECT_INET for reject‑related rules.
Remove other unneeded configs.

Remove the iptables/ip6tables check in mptcp_lib.sh since no script use
it now.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
Tested with this nft rule and I can see it captures the rm-addr pkts

chain OUTPUT {
        type filter hook output priority filter; policy accept;
        ip saddr 10.0.2.2 tcp doff 12 @th,256,16 0x1e0c @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 counter packets 3 bytes 204 accept
        ip saddr 10.0.1.2 tcp doff 12 @th,256,16 0x1e0c @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 drop
}
---
 tools/testing/selftests/net/mptcp/mptcp_join.sh | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
index b16e24418e73..cf079c18af12 100755
--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
@@ -97,6 +97,20 @@ unset add_addr_tx_nr
 unset add_addr_echo_tx_nr
 unset add_addr_drop_tx_nr
 
+# A tcpdump capture of the RM_ADDR message looks like:
+#
+#   [TCP header: 20 bytes] [nop] [nop] [timestamp: 10 bytes] \
+#         [MPTCP DSS: 12 bytes] [MPTCP RM_ADDR: 4 bytes]
+#
+# nft cannot process the RM_ADDR option because it stops parsing after
+# matching the first DSS option. Use hard-coded byte offsets to match
+# RM_ADDR messages. We verify:
+#
+# TCP Data Offset (12 x 4 = 48 bytes), DSS (TCP[32] x 8) kind (MPTCP 0x1e)
+# and length (0x0c). RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e) and subtype (4)
+
+RM_ADDR_OFFSETS="tcp doff 12 @th,256,16 == 0x1e0c @th,352,8 == 0x1e @th,368,4 == 4"
+
 init_partial()
 {
 	capout=$(mktemp)
@@ -4375,7 +4389,7 @@ endpoint_tests()
 		local nft=1
 		ip netns exec "${ns2}" nft insert rule ip filter OUTPUT \
 			ip saddr 10.0.1.2 meta l4proto tcp \
-			tcp option mptcp subtype remove-addr drop || nft=0
+			"${RM_ADDR_OFFSETS}" drop || nft=0
 		local i
 		for i in $(seq 3); do
 			pm_nl_del_endpoint $ns2 1 10.0.1.2
@@ -4454,7 +4468,7 @@ endpoint_tests()
 		local nft=1
 		ip netns exec "${ns1}" nft insert rule ip filter OUTPUT \
 			ip saddr 10.0.1.1 meta l4proto tcp \
-			tcp option mptcp subtype remove-addr drop || nft=0
+			"${RM_ADDR_OFFSETS}" drop || nft=0
 		pm_nl_del_endpoint $ns1 42 10.0.1.1
 		sleep 0.5
 		chk_subflow_nr "after delete ID 0" 2

---
base-commit: 5ac58fb7c561392ec051c390479ca746c42ca989
change-id: 20261009-mptcp_remove_addr-6777ff1041c6

Best regards,
-- 
Hangbin Liu <liuhangbin@kylinos.cn>
Re: [PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"
Posted by Matthieu Baerts 6 days, 13 hours ago 
Hi Hangbin,

On 09/10/2026 09:26, Hangbin Liu wrote:
> From: Hangbin Liu <liuhangbin@kylinos.cn>
> 
> After squash, the new commit description could be:
Thank you, now in our repo:

New patches for t/upstream:
- 8bec9f45285e: squash to "selftests: mptcp: convert iptables to
nftables for mptcp_sockopt.sh"
- 4995527f04f5: tg:msg: add notes from the squash-to commit
  → the other Squash-to patch

- 9ea0a7a5c683: Squash to "selftests: mptcp: convert iptables to
nftables for mptcp_join.sh"
- 3385248cdea7: tg:msg: add notes from the squash-to commit
  → this Squash-to patch

- b5888e236f17: Squash to "selftests: mptcp: convert iptables to
nftables for mptcp_join.sh"
  → an extra modification as discussed in this email thread

- Results: 4edaecd07abe..45035345367c (export)

Tests are now in progress:

- export:
https://github.com/multipath-tcp/mptcp_net-next/commit/916150e52b3520605f54439b34888275cda250ea/checks

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.
Re: [PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"
Posted by Matthieu Baerts 6 days, 13 hours ago 
Hi Hangbin,

On 09/10/2026 09:26, Hangbin Liu wrote:
> From: Hangbin Liu <liuhangbin@kylinos.cn>
> 
> After squash, the new commit description could be:

Thank you for the new version!

> diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> index b16e24418e73..cf079c18af12 100755
> --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
> +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> @@ -97,6 +97,20 @@ unset add_addr_tx_nr
>  unset add_addr_echo_tx_nr
>  unset add_addr_drop_tx_nr
>  
> +# A tcpdump capture of the RM_ADDR message looks like:
> +#
> +#   [TCP header: 20 bytes] [nop] [nop] [timestamp: 10 bytes] \
> +#         [MPTCP DSS: 12 bytes] [MPTCP RM_ADDR: 4 bytes]
> +#
> +# nft cannot process the RM_ADDR option because it stops parsing after
> +# matching the first DSS option. Use hard-coded byte offsets to match
> +# RM_ADDR messages. We verify:
> +#
> +# TCP Data Offset (12 x 4 = 48 bytes), DSS (TCP[32] x 8) kind (MPTCP 0x1e)
> +# and length (0x0c). RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e) and subtype (4)
> +
> +RM_ADDR_OFFSETS="tcp doff 12 @th,256,16 == 0x1e0c @th,352,8 == 0x1e @th,368,4 == 4"

The subtype is on 4 bits. For the moment, the rest are not used, but
would it not be better to compare the 20 first bits of this offset?

So using this: (not tested)

  "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,12 == 0x1e044"

Or maybe we prefer not to be strict for the RM_ADDR size to match
options with multiple IDs? Then having:

  "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,8 == 0x1e @th,368,4 == 4"

and for the comment:

# TCP Data Offset (12 x 4 = 48 bytes).
# DSS (TCP[32] x 8) kind (MPTCP 0x1e), length (0x0c), subtype (2).
# RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e), variable length, subtype (4).

I can modify this when applying if that's OK for you (and validated).

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.
Re: [PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"
Posted by Hangbin Liu 6 days, 13 hours ago 
On Fri, Oct 09, 2026 at 11:03:07AM +0200, Matthieu Baerts wrote:
> Hi Hangbin,
> 
> On 09/10/2026 09:26, Hangbin Liu wrote:
> > From: Hangbin Liu <liuhangbin@kylinos.cn>
> > 
> > After squash, the new commit description could be:
> 
> Thank you for the new version!
> 
> > diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> > index b16e24418e73..cf079c18af12 100755
> > --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
> > +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> > @@ -97,6 +97,20 @@ unset add_addr_tx_nr
> >  unset add_addr_echo_tx_nr
> >  unset add_addr_drop_tx_nr
> >  
> > +# A tcpdump capture of the RM_ADDR message looks like:
> > +#
> > +#   [TCP header: 20 bytes] [nop] [nop] [timestamp: 10 bytes] \
> > +#         [MPTCP DSS: 12 bytes] [MPTCP RM_ADDR: 4 bytes]
> > +#
> > +# nft cannot process the RM_ADDR option because it stops parsing after
> > +# matching the first DSS option. Use hard-coded byte offsets to match
> > +# RM_ADDR messages. We verify:
> > +#
> > +# TCP Data Offset (12 x 4 = 48 bytes), DSS (TCP[32] x 8) kind (MPTCP 0x1e)
> > +# and length (0x0c). RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e) and subtype (4)
> > +
> > +RM_ADDR_OFFSETS="tcp doff 12 @th,256,16 == 0x1e0c @th,352,8 == 0x1e @th,368,4 == 4"
> 
> The subtype is on 4 bits. For the moment, the rest are not used, but
> would it not be better to compare the 20 first bits of this offset?
> 
> So using this: (not tested)
> 
>   "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,12 == 0x1e044"

Here it should be @th,352,20 == 0x1e044
> 
> Or maybe we prefer not to be strict for the RM_ADDR size to match
> options with multiple IDs? Then having:
> 
>   "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,8 == 0x1e @th,368,4 == 4"
> 
> and for the comment:
> 
> # TCP Data Offset (12 x 4 = 48 bytes).
> # DSS (TCP[32] x 8) kind (MPTCP 0x1e), length (0x0c), subtype (2).
> # RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e), variable length, subtype (4).
> 
> I can modify this when applying if that's OK for you (and validated).

And both works for me. I tested these 2 rules, all are able to capture the
RM_ADDR messages.

        chain OUTPUT {
                type filter hook output priority filter; policy accept;
                ip saddr 10.0.2.1 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,24 & 0xfffff0 == 0x1e0440 counter packets 1 bytes 68 accept
                ip saddr 10.0.1.1 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,24 & 0xfffff0 == 0x1e0440 drop
        }

        chain OUTPUT {
                type filter hook output priority filter; policy accept;
                ip saddr 10.0.2.2 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 counter packets 3 bytes 204 accept
                ip saddr 10.0.1.2 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 drop
        }

Thanks
Hangbin
Re: [PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"
Posted by Matthieu Baerts 6 days, 13 hours ago 
On 09/10/2026 11:26, Hangbin Liu wrote:
> On Fri, Oct 09, 2026 at 11:03:07AM +0200, Matthieu Baerts wrote:
>> Hi Hangbin,
>>
>> On 09/10/2026 09:26, Hangbin Liu wrote:
>>> From: Hangbin Liu <liuhangbin@kylinos.cn>
>>>
>>> After squash, the new commit description could be:
>>
>> Thank you for the new version!
>>
>>> diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
>>> index b16e24418e73..cf079c18af12 100755
>>> --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
>>> +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
>>> @@ -97,6 +97,20 @@ unset add_addr_tx_nr
>>>  unset add_addr_echo_tx_nr
>>>  unset add_addr_drop_tx_nr
>>>  
>>> +# A tcpdump capture of the RM_ADDR message looks like:
>>> +#
>>> +#   [TCP header: 20 bytes] [nop] [nop] [timestamp: 10 bytes] \
>>> +#         [MPTCP DSS: 12 bytes] [MPTCP RM_ADDR: 4 bytes]
>>> +#
>>> +# nft cannot process the RM_ADDR option because it stops parsing after
>>> +# matching the first DSS option. Use hard-coded byte offsets to match
>>> +# RM_ADDR messages. We verify:
>>> +#
>>> +# TCP Data Offset (12 x 4 = 48 bytes), DSS (TCP[32] x 8) kind (MPTCP 0x1e)
>>> +# and length (0x0c). RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e) and subtype (4)
>>> +
>>> +RM_ADDR_OFFSETS="tcp doff 12 @th,256,16 == 0x1e0c @th,352,8 == 0x1e @th,368,4 == 4"
>>
>> The subtype is on 4 bits. For the moment, the rest are not used, but
>> would it not be better to compare the 20 first bits of this offset?
>>
>> So using this: (not tested)
>>
>>   "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,12 == 0x1e044"
> 
> Here it should be @th,352,20 == 0x1e044

Yes indeed, 20, not 12.

>> Or maybe we prefer not to be strict for the RM_ADDR size to match
>> options with multiple IDs? Then having:
>>
>>   "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,8 == 0x1e @th,368,4 == 4"
>>
>> and for the comment:
>>
>> # TCP Data Offset (12 x 4 = 48 bytes).
>> # DSS (TCP[32] x 8) kind (MPTCP 0x1e), length (0x0c), subtype (2).
>> # RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e), variable length, subtype (4).
>>
>> I can modify this when applying if that's OK for you (and validated).
> 
> And both works for me. I tested these 2 rules, all are able to capture the
> RM_ADDR messages.
> 
>         chain OUTPUT {
>                 type filter hook output priority filter; policy accept;
>                 ip saddr 10.0.2.1 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,24 & 0xfffff0 == 0x1e0440 counter packets 1 bytes 68 accept
>                 ip saddr 10.0.1.1 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,24 & 0xfffff0 == 0x1e0440 drop

Did you use 24 for the length because 20 is not accepted?

>         }
> 
>         chain OUTPUT {
>                 type filter hook output priority filter; policy accept;
>                 ip saddr 10.0.2.2 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 counter packets 3 bytes 204 accept
>                 ip saddr 10.0.1.2 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 drop

Same here for 8 instead of 4.

Or is it nft which automatically converted the length to a multiple of 8
with a mask?

>         }
> 
> Thanks
> Hangbin

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.
Re: [PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"
Posted by Matthieu Baerts 6 days, 13 hours ago 
On 09/10/2026 11:38, Matthieu Baerts wrote:
> On 09/10/2026 11:26, Hangbin Liu wrote:
>> On Fri, Oct 09, 2026 at 11:03:07AM +0200, Matthieu Baerts wrote:
>>> Hi Hangbin,
>>>
>>> On 09/10/2026 09:26, Hangbin Liu wrote:
>>>> From: Hangbin Liu <liuhangbin@kylinos.cn>
>>>>
>>>> After squash, the new commit description could be:
>>>
>>> Thank you for the new version!
>>>
>>>> diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
>>>> index b16e24418e73..cf079c18af12 100755
>>>> --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
>>>> +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
>>>> @@ -97,6 +97,20 @@ unset add_addr_tx_nr
>>>>  unset add_addr_echo_tx_nr
>>>>  unset add_addr_drop_tx_nr
>>>>  
>>>> +# A tcpdump capture of the RM_ADDR message looks like:
>>>> +#
>>>> +#   [TCP header: 20 bytes] [nop] [nop] [timestamp: 10 bytes] \
>>>> +#         [MPTCP DSS: 12 bytes] [MPTCP RM_ADDR: 4 bytes]
>>>> +#
>>>> +# nft cannot process the RM_ADDR option because it stops parsing after
>>>> +# matching the first DSS option. Use hard-coded byte offsets to match
>>>> +# RM_ADDR messages. We verify:
>>>> +#
>>>> +# TCP Data Offset (12 x 4 = 48 bytes), DSS (TCP[32] x 8) kind (MPTCP 0x1e)
>>>> +# and length (0x0c). RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e) and subtype (4)
>>>> +
>>>> +RM_ADDR_OFFSETS="tcp doff 12 @th,256,16 == 0x1e0c @th,352,8 == 0x1e @th,368,4 == 4"
>>>
>>> The subtype is on 4 bits. For the moment, the rest are not used, but
>>> would it not be better to compare the 20 first bits of this offset?
>>>
>>> So using this: (not tested)
>>>
>>>   "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,12 == 0x1e044"
>>
>> Here it should be @th,352,20 == 0x1e044
> 
> Yes indeed, 20, not 12.
> 
>>> Or maybe we prefer not to be strict for the RM_ADDR size to match
>>> options with multiple IDs? Then having:
>>>
>>>   "tcp doff 12 @th,256,20 == 0x1e0c2 @th,352,8 == 0x1e @th,368,4 == 4"
>>>
>>> and for the comment:
>>>
>>> # TCP Data Offset (12 x 4 = 48 bytes).
>>> # DSS (TCP[32] x 8) kind (MPTCP 0x1e), length (0x0c), subtype (2).
>>> # RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e), variable length, subtype (4).
>>>
>>> I can modify this when applying if that's OK for you (and validated).
>>
>> And both works for me. I tested these 2 rules, all are able to capture the
>> RM_ADDR messages.

Thank you for having checked!

>>
>>         chain OUTPUT {
>>                 type filter hook output priority filter; policy accept;
>>                 ip saddr 10.0.2.1 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,24 & 0xfffff0 == 0x1e0440 counter packets 1 bytes 68 accept
>>                 ip saddr 10.0.1.1 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,24 & 0xfffff0 == 0x1e0440 drop
> 
> Did you use 24 for the length because 20 is not accepted?
> 
>>         }
>>
>>         chain OUTPUT {
>>                 type filter hook output priority filter; policy accept;
>>                 ip saddr 10.0.2.2 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 counter packets 3 bytes 204 accept
>>                 ip saddr 10.0.1.2 tcp doff 12 @th,256,24 & 0xfffff0 == 0x1e0c20 @th,352,8 0x1e @th,368,8 & 0xf0 == 0x40 drop
> 
> Same here for 8 instead of 4.
> 
> Or is it nft which automatically converted the length to a multiple of 8
> with a mask?

Yes it is apparently.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.
Re: [PATCH mptcp-next] Squash to "selftests: mptcp: convert iptables to nftables for mptcp_join.sh"
Posted by MPTCP CI 6 days, 14 hours ago 
Hi Hangbin,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf: Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/37900753671

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/634b3ec4831b
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1182160


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.