From nobody Thu Oct 15 23:37:20 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5C45A52ED4B; Tue, 13 Oct 2026 17:57:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791914221; cv=none; b=ZUMvhX2jQryxD5jZS84iQ2ftdyke2hFVCPiZpA0qCjUqMjuqZLErMUAcHXe0xC6Z0pOFli1i8v+edaputi1d+T2tozaRf/5/x18pHlMpRR72Ba9mTY5BqU3KjJHsXpte9dFt+qQ/wh2+aLf7MmQjaWKLCHIKCzwGkrsLQTXggfQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791914221; c=relaxed/simple; bh=DiHQ+EWWKklHPdVqsQyelET/NENiIqy3TpBtMbM26z0=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Xr2LR0CyUYVBZg5mxE/xLXjyCdxDBu0pjzi7KJKm3uluXq6zKB0pc/hMRQw52fZEZjuc/MMzHbRoKMKJDYsgd3zGK905pXbDRBU6Ffll8QLeWKJ919D/yiaXYlmIL4sqJHcZWLCz6ZIkmVmRR5hAzssfHMwnq2SIHpnk3cZVHM4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=OKse0huj; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="OKse0huj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F059C1F00893; Tue, 13 Oct 2026 17:56:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1791914219; bh=9B7pt7nyxfILBvMjbly9lwcrsCo1KpVnZ3MB3VsWDgo=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=OKse0hujKKMLpRzT+CXJCRN/VF9JXU5pkHSTz/hGacKUBdw8FUqiqqZnIWVNVG2WJ Bh0OQa49uOO7jLlp9ApEgMEDBWbtoneVtDYOyMIyF1RdVvKtFWs/Q/DBJUX9DFk8Q4 HRKghbM8lFXuqLtCzpGqKW645xn4yG1jNf6OT08VgwRmcA3rfaZjzEyt3kDD+TitEq fS5TGRO/UpoklRbPT1EFtov/bvNFsmhlTWycHICcRp7CBmkBAGN8mdQLZ5JAGNy5yV F/kfuhsoy3R5ujznzNexnrUsidHgSXHicBaorC1azUwDM0W0OzQLMjdQQeeUHSOyc4 mj3UpClaYx1Ng== From: "Matthieu Baerts (NGI0)" Date: Tue, 13 Oct 2026 19:56:38 +0200 Subject: [PATCH net-next 1/4] mptcp: options: mpc: avoid printing uninit data Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261013-net-next-mptcp-misc-feat-7-4-part2-v1-1-1181e5d2fda4@kernel.org> References: <20261013-net-next-mptcp-misc-feat-7-4-part2-v1-0-1181e5d2fda4@kernel.org> In-Reply-To: <20261013-net-next-mptcp-misc-feat-7-4-part2-v1-0-1181e5d2fda4@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Christoph Paasch Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1527; i=matttbe@kernel.org; h=from:subject:message-id; bh=DiHQ+EWWKklHPdVqsQyelET/NENiIqy3TpBtMbM26z0=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLLOFTx5Ol1Xr17YizUofm13yOn6U1nzlyWfevJss0D2l jzbB1eMO0pZGMS4GGTFFFmk2yLzZz6v4i3x8rOAmcPKBDKEgYtTACYy6R7DH85Fb1IX9pZdyVp2 1Fadz9fz5KQb7RwHF9vcFBS8xJB63Jfhn8rdxJdH857znbc1F87efcy5xlNy2URdu/WKqcwuMc5 X2AE= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 When parsing the MP_CAPABLE suboption, this pr_debug() might read and print uninitialised values. That's mostly harmless, but that's also confusing. Fixing that also avoids some tools to complain about accessing uninit data. So read these fields only if they have been set. Note: this was initially reported by Clashiko as an existing issue. The code has been analysed by a human and confirmed. This is a non-urgent fix. Fixes: cc7972ea1932 ("mptcp: parse and emit MP_CAPABLE option according to = v1 spec") Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/options.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/mptcp/options.c b/net/mptcp/options.c index c2f4d7bd080c..3b4a22846055 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -126,8 +126,11 @@ static void mptcp_parse_option(const struct sk_buff *s= kb, ptr +=3D 2; } pr_debug("MP_CAPABLE version=3D%x, flags=3D%x, optlen=3D%d sndr=3D%llu, = rcvr=3D%llu len=3D%d csum=3D%u\n", - version, flags, opsize, mp_opt->sndr_key, - mp_opt->rcvr_key, mp_opt->data_len, mp_opt->csum); + version, flags, opsize, + opsize >=3D TCPOLEN_MPTCP_MPC_SYNACK ? mp_opt->sndr_key : 0, + opsize >=3D TCPOLEN_MPTCP_MPC_ACK ? mp_opt->rcvr_key : 0, + opsize >=3D TCPOLEN_MPTCP_MPC_ACK_DATA ? mp_opt->data_len : 0, + opsize =3D=3D TCPOLEN_MPTCP_MPC_ACK_DATA_CSUM ? mp_opt->csum : 0); break; =20 case MPTCPOPT_MP_JOIN: --=20 2.55.0 From nobody Thu Oct 15 23:37:20 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BDD55531626; Tue, 13 Oct 2026 17:57:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791914223; cv=none; b=g78UL1CdaXfRfeNdHbQLe38k5BALjKIV6Lhi4BS5+WweXW9QLSfqhtsZsXkzzlguELrsEBjWVTruWlU+vCr0spI0DWCHG2HgeT9L7ItX6vTP8mKViy1BSFLA+TsuQTfe2gEEXvyRM2Zc9eZRoVfg/O/E77jQ6/kmEGHDSHacLKY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791914223; c=relaxed/simple; bh=5G3PTa9hbd7RXa/CWpMrArq5NOwRQO0Y20KCA1few7U=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=WirPo9pePniH8s0BpRCw4c1vCdyf1l/FBU1F39DPQC5hsvm0/+1YpoCeYKl7j94wn8WWi3VaGMf5HcddHt5sT8ZYPKW4jmorbQUx8So+uVmgJa1A06XziRFGrE4KMtlrcBAmeC6K+4HdMfq8zH8hBNyqNsZtN9mrRN0dBPNvrZ8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=eLS/vWLN; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="eLS/vWLN" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 57B091F0089A; Tue, 13 Oct 2026 17:57:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1791914222; bh=nZ4NLWObKhXX589fAh4UKiTeEKN9HN93nK5DqJUebHY=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=eLS/vWLNQodTq88mg0XtLDscVeliOuk5/QQHH82R+EX1hLz9HV0ZSysHoU/M5PmVu u++dnYMC8xFSIM7q7N8xWbKs9j7m7ce+9dwJuN/Ctft62bSHLP2FsfaEw7Fsi+ewwu Tcu5nB86bU0qWlAZmCCinjJPaCt7uAx319Wor/0lK7CON9V4Zt9BIGtY7rXx+vMiWU Kp6eksm+PHYMEpf5oXjRKNOAXa9S2FXfIY2+wPmySpelwUh+XB/ofj469nJdzSSBoy 8MWx6ZKde5gMrV2ButnPl8neBAQ1UhKjUBrM380k9K40YXKC/nc96T/AbXbgKbSwJP H48tHTCNUlBqg== From: "Matthieu Baerts (NGI0)" Date: Tue, 13 Oct 2026 19:56:39 +0200 Subject: [PATCH net-next 2/4] mptcp: options: dss: avoid printing uninit csum Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261013-net-next-mptcp-misc-feat-7-4-part2-v1-2-1181e5d2fda4@kernel.org> References: <20261013-net-next-mptcp-misc-feat-7-4-part2-v1-0-1181e5d2fda4@kernel.org> In-Reply-To: <20261013-net-next-mptcp-misc-feat-7-4-part2-v1-0-1181e5d2fda4@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Christoph Paasch Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1240; i=matttbe@kernel.org; h=from:subject:message-id; bh=5G3PTa9hbd7RXa/CWpMrArq5NOwRQO0Y20KCA1few7U=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLLOFTwtn/KYy+tpQrt3qHP9XmvfwIXnvD8mTt/H28B45 qnYZ4aJHaUsDGJcDLJiiizSbZH5M59X8ZZ4+VnAzGFlAhnCwMUpABNx62RkWPj11rpzbJyn3x28 l9dT3J4xr21V5YOq5U6Kr8JeNTzdmsXI0DrvDW/DhOksX7/a/7v5cs7qGff23ZZfumhB9iRB0ae V0UwA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 When parsing the DSS suboption, this pr_debug() might read and print uninitialised checksum value. That's mostly harmless, but that's also confusing. Fixing that also avoids some tools to complain about accessing uninit data. So read this csum field only if it has been set. Note: this was initially reported by Clashiko as an existing issue. The code has been analysed by a human and confirmed. This is a non-urgent fix. Fixes: 390b95a5fb84 ("mptcp: receive checksum for DSS") Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/options.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mptcp/options.c b/net/mptcp/options.c index 3b4a22846055..64aa7a516a23 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -259,7 +259,7 @@ static void mptcp_parse_option(const struct sk_buff *sk= b, pr_debug("data_seq=3D%llu subflow_seq=3D%u data_len=3D%u csum=3D%d:%u\n= ", mp_opt->data_seq, mp_opt->subflow_seq, mp_opt->data_len, !!(mp_opt->suboptions & OPTION_MPTCP_CSUMREQD), - mp_opt->csum); + (mp_opt->suboptions & OPTION_MPTCP_CSUMREQD) ? mp_opt->csum : 0); } =20 break; --=20 2.55.0 From nobody Thu Oct 15 23:37:20 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 455585326B8; Tue, 13 Oct 2026 17:57:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791914226; cv=none; b=Dc/w9KR2whSlXD7+QHA7GiPMY8gTuaCfhKRVnPzR83UcZ6XEleArxKRbvMTYLVkOP/l6FcIiWm6vj1Jmz2Ss/HMd2RiRtgxofl+dj3poY5VCvEMp4/GVm0srp714zYEjspEZgoePsdhd3gIEwpV5pWtYJm1cm8i9RsTZplrCTQM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791914226; c=relaxed/simple; bh=Cgwqg8k87XtQLYdUfKNb5fkZ2rFrep1kyKFtwZd1/jI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=N+IqVZVjhVcq5fvVBJqNR6eGmSe30Qvx92QKBeTjoySAJpkxRTNuZa59gecl+u4CcOHwJ/BoFg7S2WsfKzRw6klAdwE3yv/ygPyXvEaOVOSUFp9mLbeSTWb7yuvgWixwnkLpkBzVwv3gGWl5IaKFe7s/MvRxdb0yPnW74U+3DLQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Gd7/jOpj; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Gd7/jOpj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B77B81F000FF; Tue, 13 Oct 2026 17:57:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1791914225; bh=xTf7kueW9qPRwT8ws74L3f5EtnyGCz82/LoFMQUYZY8=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=Gd7/jOpjw/JD0O9Qy25KjaznC21xdZqI1HrWcOe4ag9QrC1CSvHurdnCBDdr/Bzql d8niwikvbkh4EZP/2n3ExSAbMcUY6Qg2d2EaeLBXw1VuzDS8iy8pjpeDSqwv8ho/ec x/AB4opSIajIRbEIGmoB/YTzbKXSoaEsBYUuGQGJL8QHGIzsDes/TS42qnqFBEecqC 6GWbc9JPSj1VpnkDrwcTHmDZj2Dh8028CFsPQrBucXOnuWFOghQOQIiyaj6RLxHor8 TvxukxYn/PhRVwuERWhSye1EfUMBIjZXs9zqgfWAzP3uNOgQPCqhn+KH4Rt5BPNLWL bCxPWYkJwaPhg== From: "Matthieu Baerts (NGI0)" Date: Tue, 13 Oct 2026 19:56:40 +0200 Subject: [PATCH net-next 3/4] selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261013-net-next-mptcp-misc-feat-7-4-part2-v1-3-1181e5d2fda4@kernel.org> References: <20261013-net-next-mptcp-misc-feat-7-4-part2-v1-0-1181e5d2fda4@kernel.org> In-Reply-To: <20261013-net-next-mptcp-misc-feat-7-4-part2-v1-0-1181e5d2fda4@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Christoph Paasch Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , Hangbin Liu , Shuah Khan , linux-kselftest@vger.kernel.org X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4443; i=matttbe@kernel.org; h=from:subject:message-id; bh=gCbPE43kyl+ubgh1kiYXtyHCBCPGJQ1dZeR7jw3idF0=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLLOFTxVS9nw6bdz37GIQy+/FExc8uHFw8en8/VVPbiFW Y/Od1qf3lHKwiDGxSArpsgi3RaZP/N5FW+Jl58FzBxWJpAhDFycAjCRnJMMf+Vc2rVnBDjWxAZw 9fNd+33lXPePR0z/xX4KVce9/J+nUc3wP81k8/Kc3su2D5juTsuabLb54N6/C6wmTqwoinRQe7L zLgsA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Hangbin Liu During the conversion, we retain the same filter and chain names previously used by iptables/ip6tables. Counters are not added to accept rules because the test does not inspect them. The syn mark rule is removed as it is only for debugging, which could be added easily when needed. After conversion, the generated output matches the original iptables/ip6tables behavior. Signed-off-by: Hangbin Liu Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- To: Shuah Khan Cc: linux-kselftest@vger.kernel.org v2: - Use nft --version + JSON to support old/weird versions. (Clashiko) - Remove syn mark rule. (Clashiko) --- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 9 +++- tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 53 ++++++++++++------= ---- 2 files changed, 36 insertions(+), 26 deletions(-) diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing= /selftests/net/mptcp/mptcp_lib.sh index b9d14647f401..20853d0198ff 100644 --- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh @@ -528,7 +528,14 @@ mptcp_lib_check_tools() { exit ${KSFT_SKIP} fi ;; - "iptables"* | "ip6tables"*) + "nft") + if ! nft --version &> /dev/null || \ + ! nft -j list ruleset &> /dev/null; then + mptcp_lib_pr_skip "Could not run all tests without nft -j" + exit ${KSFT_SKIP} + fi + ;; + "iptables"* | "ip6tables"* | "jq") if ! "${tool}" -V &> /dev/null; then mptcp_lib_pr_skip "Could not run all tests without ${tool}" exit ${KSFT_SKIP} diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/tes= ting/selftests/net/mptcp/mptcp_sockopt.sh index e850a87429b6..ef2738720e24 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh @@ -15,8 +15,6 @@ cin=3D"" cout=3D"" timeout_poll=3D30 timeout_test=3D$((timeout_poll * 2 + 1)) -iptables=3D"iptables" -ip6tables=3D"ip6tables" =20 ns1=3D"" ns2=3D"" @@ -49,16 +47,22 @@ add_mark_rules() local ns=3D$1 local m=3D$2 =20 - local t - for t in ${iptables} ${ip6tables}; do - # just to debug: check we have multiple subflows connection requests - ip netns exec $ns $t -A OUTPUT -p tcp --syn -m mark --mark $m -j ACCEPT + local table + for table in ip ip6; do + ip netns exec "$ns" nft -f - <<-EOF + add table $table filter + add chain $table filter OUTPUT \ + { type filter hook output priority 0; policy accept; } =20 - # RST packets might be handled by a internal dummy socket - ip netns exec $ns $t -A OUTPUT -p tcp --tcp-flags RST RST -m mark --mark= 0 -j ACCEPT + # RST packets might be handled by a internal dummy socket + add rule $table filter OUTPUT \ + tcp flags & rst =3D=3D rst meta mark 0x0 accept =20 - ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark $m -j ACCEPT - ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark 0 -j DROP + add rule $table filter OUTPUT \ + meta l4proto tcp meta mark $m accept + add rule $table filter OUTPUT \ + meta l4proto tcp meta mark 0 counter drop + EOF done } =20 @@ -105,32 +109,31 @@ cleanup() =20 mptcp_lib_check_mptcp mptcp_lib_check_kallsyms -mptcp_lib_check_tools ip "${iptables}" "${ip6tables}" +mptcp_lib_check_tools ip nft jq =20 check_mark() { local ns=3D$1 local af=3D$2 =20 - local tables=3D${iptables} + local tables=3D"ip" =20 if [ $af -eq 6 ];then - tables=3D${ip6tables} + tables=3D"ip6" fi =20 - local counters values - counters=3D$(ip netns exec $ns $tables -v -L OUTPUT | grep DROP) - values=3D${counters%DROP*} + local drops + drops=3D$(ip netns exec "$ns" nft -j list table "$tables" filter | \ + jq '.nftables[] | select(has("rule")) | .rule | + select (.chain=3D=3D"OUTPUT" and any(.expr[]; has("drop"))) | + .expr[] | select(has("counter")) | .counter.packets') =20 - local v - for v in $values; do - if [ $v -ne 0 ]; then - mptcp_lib_pr_fail "got $tables $values in ns $ns," \ - "not 0 - not all expected packets marked" - ret=3D${KSFT_FAIL} - return 1 - fi - done + if [ -z "$drops" ] || [ "$drops" -ne 0 ]; then + mptcp_lib_pr_fail "got $tables $drops in ns $ns," \ + "not 0 - not all expected packets marked" + ret=3D${KSFT_FAIL} + return 1 + fi =20 return 0 } --=20 2.55.0 From nobody Thu Oct 15 23:37:20 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9725751A135; Tue, 13 Oct 2026 17:57:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791914230; cv=none; b=NNuGXeAzXT5NYY8Gub0XSBCKWLHfWs8X6GwvYWEW4+lb2ZUEpqH6Ahm5AVyDFgDsvDjrMHHb6N9qjgpU4QCoxc2TnGGIiMQAF7dkrcpjkyO36Y1cIAgQJCDTD7NNDud/Y76v//RCjAEojvYk/zrv3+pVKSW30PGiRZ9Uyp7Cd8M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791914230; c=relaxed/simple; bh=lybs1dAwbY2sgj6xUu3y4NJZamtFYGNXvwp75VqlUTo=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=qyJ5J/f0SBtQUhY9Ecd8dA2D1BRQjSpuqpCISdppqFNMLD/sZqix9dwZPuTZ80yWNYt9bqgxBZ7QV74oitIIzsS4t+cYYhNPQ6aBXRBxQwfMnTTqWeEOi5qYungr60/9Fwzx414PgGdwQCiwPwQc5ANM4AU9tAH+Xu+78d2FLAo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=TLAxm8dr; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="TLAxm8dr" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8C7E91F00893; Tue, 13 Oct 2026 17:57:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1791914228; bh=QWPl86BnnWgdNeW77g8OTK+3MbbNoQOJ9dGmvrji/fE=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=TLAxm8drzXyj4fQU+O7fNfKLN1ieGyZSsvf5whT+cl9/lQK1mo6LET9tTpAr0vDAy O39Bi9pRZZjOLDih3vdUbPrS51BDNE4ZjwMEarMi4r/43WF/7o2+K8fAD6PuD1bAZI gSRBlCn+Cz7fCMFXZYUMzmovOkw+qUVi7IYsjzjuBaGEjAYDOWXfOY3K7XLzHnIvkC Q/DantxPY/aEd9+7Jj1KF0eZQYbmtBfN7Axt+x4kwobyl2iN+Y9lz90jdpRmI6K1py cxRollIBxJh/UhEO+8EFgy1WQF0tByBKRs3U9KWpjJFVNqHFgA56BVGk74WC2yrR5v 1bi8as9IugnAA== From: "Matthieu Baerts (NGI0)" Date: Tue, 13 Oct 2026 19:56:41 +0200 Subject: [PATCH net-next 4/4] selftests: mptcp: convert iptables to nftables for mptcp_join.sh Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261013-net-next-mptcp-misc-feat-7-4-part2-v1-4-1181e5d2fda4@kernel.org> References: <20261013-net-next-mptcp-misc-feat-7-4-part2-v1-0-1181e5d2fda4@kernel.org> In-Reply-To: <20261013-net-next-mptcp-misc-feat-7-4-part2-v1-0-1181e5d2fda4@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Christoph Paasch Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , Hangbin Liu , Shuah Khan , linux-kselftest@vger.kernel.org, bpf@vger.kernel.org X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=12474; i=matttbe@kernel.org; h=from:subject:message-id; bh=EKSAtJwkMdEMRkn7XXmBnP4n2J6mE5cDkhWz4p88n7M=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLLOFTwzc6p4tMXcaIb/5sdviw9VTuN+bvtrqdnk1NeNY nyM7lMvd5SyMIhxMciKKbJIt0Xmz3xexVvi5WcBM4eVCWQIAxenAEzkbCIjw4uGnLP2whE7eluu fuf6bLzmqeTJIvPO++bvWr5NDvY9q8LI8KVXTjz42/67lkqiy8p/PV//QC8sp2iC1C439xPv4ve +ZwMA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Hangbin Liu During conversion, we retain the same table and chain names used by the original iptables/ip6tables setup, so rule output is identical to the former iptables/ip6tables output. Add new function init_nftables so we only do nft table setup when test need set nft rules. Unlike iptables, nftables cannot match rules based on their full specification. Since endpoint_tests is the only test that delete rules, which inserts and deletes rules one by one. Flushing the table directly is safe and easier than using nft_handle. The cBPF bytecode matching MPTCP add=E2=80=91addr is replaced with native n= ft matching using "tcp option mptcp subtype add-addr". But the RM_ADDR suboption is added after the MPTCP DSS option, and nft is unable to handle this because it stops parsing further TCP options once it matches the first one. We therefore use hard-coded offsets to match the RM_ADDR suboption. The config file adds CONFIG_NFT_NUMGEN (replaces iptables statistic nth), CONFIG_NFT_REJECT and CONFIG_NFT_REJECT_INET for reject=E2=80=91related rul= es. Remove other unneeded configs. Remove the iptables/ip6tables check in mptcp_lib.sh since no script use it now. Signed-off-by: Hangbin Liu Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- To: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: bpf@vger.kernel.org v2: - Remove more unused kconfigs. (Clashiko) - Use offset to match RM_ADDR, instead of "mptcp subtype". (Clashiko) --- tools/testing/selftests/net/mptcp/config | 15 +-- tools/testing/selftests/net/mptcp/mptcp_join.sh | 158 ++++++++++----------= ---- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 2 +- 3 files changed, 72 insertions(+), 103 deletions(-) diff --git a/tools/testing/selftests/net/mptcp/config b/tools/testing/selft= ests/net/mptcp/config index bb9c4c97c620..6a96cfbbc461 100644 --- a/tools/testing/selftests/net/mptcp/config +++ b/tools/testing/selftests/net/mptcp/config @@ -1,12 +1,7 @@ CONFIG_INET_DIAG=3Dm CONFIG_INET_MPTCP_DIAG=3Dm -CONFIG_IP6_NF_FILTER=3Dm -CONFIG_IP6_NF_TARGET_REJECT=3Dm CONFIG_IP_ADVANCED_ROUTER=3Dy CONFIG_IP_MULTIPLE_TABLES=3Dy -CONFIG_IP_NF_FILTER=3Dm -CONFIG_IP_NF_MANGLE=3Dm -CONFIG_IP_NF_TARGET_REJECT=3Dm CONFIG_IPV6=3Dy CONFIG_IPV6_MULTIPLE_TABLES=3Dy CONFIG_KALLSYMS=3Dy @@ -19,17 +14,13 @@ CONFIG_NET_CLS_FW=3Dm CONFIG_NETFILTER=3Dy CONFIG_NETFILTER_ADVANCED=3Dy CONFIG_NETFILTER_NETLINK=3Dy -CONFIG_NETFILTER_XTABLES=3Dm -CONFIG_NETFILTER_XTABLES_LEGACY=3Dy -CONFIG_NETFILTER_XT_MATCH_BPF=3Dm -CONFIG_NETFILTER_XT_MATCH_LENGTH=3Dm -CONFIG_NETFILTER_XT_MATCH_STATISTIC=3Dm -CONFIG_NETFILTER_XT_TARGET_MARK=3Dm CONFIG_NET_SCH_INGRESS=3Dm CONFIG_NET_SCH_NETEM=3Dm CONFIG_NF_TABLES=3Dm CONFIG_NF_TABLES_INET=3Dy -CONFIG_NFT_COMPAT=3Dm +CONFIG_NFT_NUMGEN=3Dm +CONFIG_NFT_REJECT=3Dm +CONFIG_NFT_REJECT_INET=3Dm CONFIG_NFT_SOCKET=3Dm CONFIG_NFT_TPROXY=3Dm CONFIG_SYN_COOKIES=3Dy diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testin= g/selftests/net/mptcp/mptcp_join.sh index 18ce7136a2b0..f4d8afaeda4f 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh @@ -26,8 +26,6 @@ capout=3D"" cappid=3D"" ns1=3D"" ns2=3D"" -iptables=3D"iptables" -ip6tables=3D"ip6tables" timeout_poll=3D30 timeout_test=3D$((timeout_poll * 2 + 1)) capture=3Dfalse @@ -99,41 +97,16 @@ unset add_addr_tx_nr unset add_addr_echo_tx_nr unset add_addr_drop_tx_nr =20 -# generated using "nfbpf_compile '(ip && (ip[54] & 0xf0) =3D=3D 0x30) || -# (ip6 && (ip6[74] & 0xf0) =3D=3D 0x30)'" -CBPF_MPTCP_SUBOPTION_ADD_ADDR=3D"14, - 48 0 0 0, - 84 0 0 240, - 21 0 3 64, - 48 0 0 54, - 84 0 0 240, - 21 6 7 48, - 48 0 0 0, - 84 0 0 240, - 21 0 4 96, - 48 0 0 74, - 84 0 0 240, - 21 0 1 48, - 6 0 0 65535, - 6 0 0 0" - -# IPv4: TCP hdr of 48B, a first suboption of 12B (DACK8), the RM_ADDR subo= ption -# generated using "nfbpf_compile '(ip[32] & 0xf0) =3D=3D 0xc0 && ip[53] = =3D=3D 0x0c && -# (ip[66] & 0xf0) =3D=3D 0x40'" -CBPF_MPTCP_SUBOPTION_RM_ADDR=3D"13, - 48 0 0 0, - 84 0 0 240, - 21 0 9 64, - 48 0 0 32, - 84 0 0 240, - 21 0 6 192, - 48 0 0 53, - 21 0 4 12, - 48 0 0 66, - 84 0 0 240, - 21 0 1 64, - 6 0 0 65535, - 6 0 0 0" +# nft cannot process the RM_ADDR option because it stops parsing after mat= ching +# the first DSS option. Use hard-coded byte offsets to match RM_ADDR messa= ges. +# A tcpdump capture of the RM_ADDR message looks like: +# [TCP header: 20 bytes] [nop] [nop] [timestamp: 10 bytes] +# [MPTCP DSS: 12 bytes] [MPTCP RM_ADDR: 4 bytes] +# +# - TCP Data Offset (12 x 4 =3D 48 bytes) +# - DSS (TCP[32] x 8) kind (MPTCP 0x1e), length (0x0c) and subtype (2) +# - RM_ADDR (TCP[44] x 8) kind (MPTCP 0x1e), variable length and subtype (= 4) +RM_ADDR_OFFSETS=3D"tcp doff 12 @th,256,20 =3D=3D 0x1e0c2 @th,352,8 =3D=3D = 0x1e @th,368,4 =3D=3D 4" =20 init_partial() { @@ -184,6 +157,26 @@ init_shapers() done } =20 +init_nftables() +{ + local netns table + for netns in "$ns1" "$ns2"; do + for table in ip ip6; do + ip netns exec "$netns" nft -f - <<-EOF + add table $table filter + add chain $table filter INPUT \ + { type filter hook input priority filter; policy accept; } + add chain $table filter OUTPUT \ + { type filter hook output priority filter; policy accept; } + + add table $table mangle + add chain $table mangle OUTPUT \ + { type route hook output priority mangle; policy accept; } + EOF + done + done +} + cleanup_partial() { rm -f "$capout" @@ -196,7 +189,7 @@ init() { =20 mptcp_lib_check_mptcp mptcp_lib_check_kallsyms - mptcp_lib_check_tools ip tc ss "${iptables}" "${ip6tables}" + mptcp_lib_check_tools ip tc ss nft =20 sin=3D$(mktemp) sout=3D$(mktemp) @@ -380,24 +373,18 @@ reset_with_cookies() # $1: test name reset_with_add_addr_timeout() { - local ip=3D"${2:-4}" - local tables + local ip=3D"${2:-}" =20 reset "${1}" || return 1 - - tables=3D"${iptables}" - if [ $ip -eq 6 ]; then - tables=3D"${ip6tables}" - fi + init_nftables =20 # set a maximum, to avoid too long timeout with exponential backoff ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=3D1 =20 - if ! ip netns exec $ns2 $tables -A OUTPUT -p tcp \ - -m tcp --tcp-option 30 \ - -m bpf --bytecode \ - "$CBPF_MPTCP_SUBOPTION_ADD_ADDR" \ - -j DROP; then + if ! ip netns exec "$ns2" nft add rule \ + ip"$ip" filter OUTPUT meta l4proto tcp \ + tcp option mptcp subtype add-addr \ + drop; then mark_as_skipped "unable to set the 'add addr' rule" return 1 fi @@ -449,22 +436,14 @@ setup_fail_rules() check_invert=3D1 validate_checksum=3Dtrue local i=3D"$1" - local ip=3D"${2:-4}" - local tables + local ip=3D"${2:-}" =20 - tables=3D"${iptables}" - if [ $ip -eq 6 ]; then - tables=3D"${ip6tables}" - fi - - ip netns exec $ns2 $tables \ - -t mangle \ - -A OUTPUT \ - -o ns2eth$i \ - -p tcp \ - -m length --length 150:9999 \ - -m statistic --mode nth --packet 1 --every 99999 \ - -j MARK --set-mark 42 || return ${KSFT_SKIP} + init_nftables + ip netns exec "$ns2" nft add rule \ + ip"$ip" mangle OUTPUT oifname ns2eth$i \ + meta l4proto tcp \ + meta length 150-9999 numgen inc mod 99999 1 \ + meta mark set 42 || return ${KSFT_SKIP} =20 tc -n $ns2 qdisc add dev ns2eth$i clsact || return ${KSFT_SKIP} tc -n $ns2 filter add dev ns2eth$i egress \ @@ -510,16 +489,15 @@ reset_with_tcp_filter() reset "${1}" || return 1 shift =20 + init_nftables + local ns=3D"${!1}" local src=3D"${2}" local target=3D"${3}" local chain=3D"${4:-INPUT}" =20 - if ! ip netns exec "${ns}" ${iptables} \ - -A "${chain}" \ - -s "${src}" \ - -p tcp \ - -j "${target}"; then + if ! ip netns exec "$ns" nft add rule ip filter "${chain}" \ + ip saddr "${src}" meta l4proto tcp "${target,,}"; then mark_as_skipped "unable to set the filter rules" return 1 fi @@ -4313,12 +4291,15 @@ userspace_tests() chk_mptcp_info subflows 1 subflows 1 chk_subflows_total 2 2 =20 + init_nftables # force quick loss ip netns exec $ns2 sysctl -q net.ipv4.tcp_syn_retries=3D1 - if ip netns exec "${ns1}" ${iptables} -A INPUT -s "10.0.1.2" \ - -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset && - ip netns exec "${ns2}" ${iptables} -A INPUT -d "10.0.1.2" \ - -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset; then + if ip netns exec "${ns1}" nft add rule ip filter INPUT \ + ip saddr "10.0.1.2" meta l4proto tcp \ + tcp option mptcp exists reject with tcp reset && + ip netns exec "${ns2}" nft add rule ip filter INPUT \ + ip daddr "10.0.1.2" meta l4proto tcp \ + tcp option mptcp exists reject with tcp reset; then wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 1 wait_event ns1 MPTCP_LIB_EVENT_SUB_CLOSED 1 chk_subflows_total 1 1 @@ -4393,7 +4374,7 @@ endpoint_tests() chk_subflow_nr "after new reject" 2 chk_mptcp_info subflows 1 subflows 1 =20 - ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJ= ECT + ip netns exec "${ns2}" nft flush chain ip filter OUTPUT pm_nl_del_endpoint $ns2 3 10.0.3.2 pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow wait_mpj 3 @@ -4402,12 +4383,10 @@ endpoint_tests() =20 # To make sure RM_ADDR are sent over a different subflow, but # allow the rest to quickly and cleanly close the subflow - local ipt=3D1 - ip netns exec "${ns2}" ${iptables} -I OUTPUT -s "10.0.1.2" \ - -p tcp -m tcp --tcp-option 30 \ - -m bpf --bytecode \ - "$CBPF_MPTCP_SUBOPTION_RM_ADDR" \ - -j DROP || ipt=3D0 + local nft=3D1 + ip netns exec "${ns2}" nft insert rule ip filter OUTPUT \ + ip saddr 10.0.1.2 meta l4proto tcp \ + "${RM_ADDR_OFFSETS}" drop || nft=3D0 local i for i in $(seq 3); do pm_nl_del_endpoint $ns2 1 10.0.1.2 @@ -4420,7 +4399,7 @@ endpoint_tests() chk_subflow_nr "after re-add id 0 ($i)" 3 chk_mptcp_info subflows 3 subflows 3 done - [ ${ipt} =3D 1 ] && ip netns exec "${ns2}" ${iptables} -D OUTPUT 1 + [ "${nft}" =3D 1 ] && ip netns exec "${ns2}" nft flush chain ip filter O= UTPUT =20 mptcp_lib_kill_group_wait $tests_pid =20 @@ -4480,20 +4459,19 @@ endpoint_tests() chk_mptcp_info subflows 2 subflows 2 chk_mptcp_info add_addr_signal 2 add_addr_accepted 2 =20 + init_nftables # To make sure RM_ADDR are sent over a different subflow, but # allow the rest to quickly and cleanly close the subflow - local ipt=3D1 - ip netns exec "${ns1}" ${iptables} -I OUTPUT -s "10.0.1.1" \ - -p tcp -m tcp --tcp-option 30 \ - -m bpf --bytecode \ - "$CBPF_MPTCP_SUBOPTION_RM_ADDR" \ - -j DROP || ipt=3D0 + local nft=3D1 + ip netns exec "${ns1}" nft insert rule ip filter OUTPUT \ + ip saddr 10.0.1.1 meta l4proto tcp \ + "${RM_ADDR_OFFSETS}" drop || nft=3D0 pm_nl_del_endpoint $ns1 42 10.0.1.1 sleep 0.5 chk_subflow_nr "after delete ID 0" 2 chk_mptcp_info subflows 2 subflows 2 chk_mptcp_info add_addr_signal 2 add_addr_accepted 2 - [ ${ipt} =3D 1 ] && ip netns exec "${ns1}" ${iptables} -D OUTPUT 1 + [ "${nft}" =3D 1 ] && ip netns exec "${ns1}" nft flush chain ip filter O= UTPUT =20 pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal wait_mpj 4 @@ -4555,7 +4533,7 @@ endpoint_tests() pm_nl_flush_endpoint $ns2 pm_nl_flush_endpoint $ns1 wait_rm_addr $ns2 0 - ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJ= ECT + ip netns exec "${ns2}" nft flush chain ip filter OUTPUT pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow wait_mpj 1 pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing= /selftests/net/mptcp/mptcp_lib.sh index 20853d0198ff..e1c8c6fd8820 100644 --- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh @@ -535,7 +535,7 @@ mptcp_lib_check_tools() { exit ${KSFT_SKIP} fi ;; - "iptables"* | "ip6tables"* | "jq") + "jq") if ! "${tool}" -V &> /dev/null; then mptcp_lib_pr_skip "Could not run all tests without ${tool}" exit ${KSFT_SKIP} --=20 2.55.0