commit a5a5990c099dd354e05e89ee77cd2dbf6655d4a1 upstream.
IPTables commands using 'iptables-nft' fail on old kernels, at least on v5.15 because it doesn't see the default IPTables chains:
$ iptables -L iptables/1.8.2 Failed to initialize nft: Protocol not supported
As a first step before switching to NFTables, we can use iptables-legacy if available.
Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: dc65fe82fb07 ("selftests: mptcp: add packet mark test case") Cc: stable@vger.kernel.org Acked-by: Paolo Abeni pabeni@redhat.com Signed-off-by: Matthieu Baerts matthieu.baerts@tessares.net Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Matthieu Baerts matthieu.baerts@tessares.net --- Backport notes: - it was conflicting with some cleanup patches: b71dd705179c ("selftests: mptcp: removed defined but unused vars"), de2392028a19 ("selftests: mptcp: clearly declare global ns vars") and 5f17f8e315ad ("selftests: mptcp: declare var as local"). - conflicts were in the same context but not with the code that needed to be adapted. - an extra adaptation was needed because 'ip(6)tables' is used directly in TCP INQ tests, a code remove later in commit b4e0df4cafe1 ("selftests: mptcp: run mptcp_inq from a clean netns") --- .../selftests/net/mptcp/mptcp_sockopt.sh | 24 ++++++++++--------- 1 file changed, 13 insertions(+), 11 deletions(-)
diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh index af4fccd4f5cc..114c4ce719c7 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh @@ -13,13 +13,15 @@ timeout_poll=30 timeout_test=$((timeout_poll * 2 + 1)) mptcp_connect="" do_all_tests=1 +iptables="iptables" +ip6tables="ip6tables"
add_mark_rules() { local ns=$1 local m=$2
- for t in iptables ip6tables; do + for t in ${iptables} ${ip6tables}; do # just to debug: check we have multiple subflows connection requests ip netns exec $ns $t -A OUTPUT -p tcp --syn -m mark --mark $m -j ACCEPT
@@ -92,14 +94,14 @@ if [ $? -ne 0 ];then exit $ksft_skip fi
-iptables -V > /dev/null 2>&1 -if [ $? -ne 0 ];then +# Use the legacy version if available to support old kernel versions +if iptables-legacy -V &> /dev/null; then + iptables="iptables-legacy" + ip6tables="ip6tables-legacy" +elif ! iptables -V &> /dev/null; then echo "SKIP: Could not run all tests without iptables tool" exit $ksft_skip -fi - -ip6tables -V > /dev/null 2>&1 -if [ $? -ne 0 ];then +elif ! ip6tables -V &> /dev/null; then echo "SKIP: Could not run all tests without ip6tables tool" exit $ksft_skip fi @@ -109,10 +111,10 @@ check_mark() local ns=$1 local af=$2
- tables=iptables + tables=${iptables}
if [ $af -eq 6 ];then - tables=ip6tables + tables=${ip6tables} fi
counters=$(ip netns exec $ns $tables -v -L OUTPUT | grep DROP) @@ -314,8 +316,8 @@ do_tcpinq_tests() { local lret=0
- ip netns exec "$ns1" iptables -F - ip netns exec "$ns1" ip6tables -F + ip netns exec "$ns1" ${iptables} -F + ip netns exec "$ns1" ${ip6tables} -F
if ! mptcp_lib_kallsyms_has "mptcp_ioctl$"; then echo "INFO: TCP_INQ not supported: SKIP"