[PATCH mptcp-next v2 0/2] selftests: mptcp: convert iptables to nftables

[Hangbin Liu]

iptables has been deprecated for years. The Linux kernel has included
nftables as the successor to iptables since 2014, and every major
distribution uses nftables as the default packet filtering framework.
The iptables command we run on modern systems is actually iptables‑nft,
a compatibility layer that translates iptables syntax to nftables rules
behind the scenes.

There are also some features that can be set easily with nft, while we need
to convert to BPF code under iptables, such as MPTCP add‑addr and
remove‑addr suboptions. To make future work easier, convert iptables usage
in mptcp to nftables.

Tested with iptables-translate to make sure each nft conversion is the same
with previous one. e.g. for mptcp_sockopt.sh, the ip6tables shows

bash-5.3# ip6tables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere             tcp flags:FIN,SYN,RST,ACK/SYN mark match 0x1
ACCEPT     tcp  --  anywhere             anywhere             tcp flags:RST/RST mark match 0x0
ACCEPT     tcp  --  anywhere             anywhere             mark match 0x1
DROP       tcp  --  anywhere             anywhere             mark match 0x0

And the backend nft shows like

bash-5.3# nft list tables
table ip6 filter
bash-5.3# nft list table ip6 filter
table ip6 filter {
        chain OUTPUT {
                type filter hook output priority filter; policy accept;
                tcp flags & (fin | syn | rst | ack) == syn meta mark 0x00000001 counter packets 0 bytes 0 accept
                tcp flags & rst == rst meta mark 0x00000000 counter packets 0 bytes 0 accept
                meta l4proto tcp meta mark 0x00000001 counter packets 0 bytes 0 accept
                meta l4proto tcp meta mark 0x00000000 counter packets 0 bytes 0 drop
        }
}

Which matches what we change in the script, except the counter.

Signed-off-by: Hangbin Liu <liuhangbin@xxxxxxxxxx>
---
Changes in v2:
- Fix --sync and --tcp-flags RST convert not match issue (sashiko)
- make sure drop is a number in check_mark. (sashiko)
- Other than using one inet table, use ip/ip6 tables to retain the same
  table and chain names used by the original iptables/ip6tables setup.
- Link to v1: https://lore.kernel.org/r/20260902-mptcp_nft-v1-0-559caa16f410@xxxxxxxxxx

---
Hangbin Liu (2):
      selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh
      selftests: mptcp: convert iptables to nftables for mptcp_join.sh

 tools/testing/selftests/net/mptcp/config           |   3 +
 tools/testing/selftests/net/mptcp/mptcp_join.sh    | 142 ++++++++-------------
 tools/testing/selftests/net/mptcp/mptcp_lib.sh     |   2 +-
 tools/testing/selftests/net/mptcp/mptcp_sockopt.sh |  51 ++++----
 4 files changed, 84 insertions(+), 114 deletions(-)
---
base-commit: 8dd2802091fbba563abec55e0455d0e5273c7529
change-id: 20260902-mptcp_nft-b892782ef929

Best regards,
-- 
Hangbin Liu <liuhangbin@xxxxxxxxxx>