On Sat, Mar 22, 2025 at 09:30:15AM +0000, Hangbin Liu wrote:
> Convert iptabels to nft as it is the replacement for iptables, which is used
~~~~~~~~
Typo, but I would write "Convert the selftest to nft ..." instead since
that is what you're converting, iptables is just replaced. :)
> by default in most releases.
>
> Signed-off-by: Hangbin Liu <liuhang...@gmail.com>
> ---
> tools/testing/selftests/wireguard/netns.sh | 29 ++++++++++++++--------
> 1 file changed, 19 insertions(+), 10 deletions(-)
>
> diff --git a/tools/testing/selftests/wireguard/netns.sh
> b/tools/testing/selftests/wireguard/netns.sh
> index 55500f901fbc..8b840fef90af 100755
> --- a/tools/testing/selftests/wireguard/netns.sh
> +++ b/tools/testing/selftests/wireguard/netns.sh
> @@ -75,6 +75,11 @@ pp ip netns add $netns1
> pp ip netns add $netns2
> ip0 link set up dev lo
>
> +# init nft tables
> +n0 nft add table ip wgtest
> +n1 nft add table ip wgtest
> +n2 nft add table ip wgtest
> +
> ip0 link add dev wg0 type wireguard
> ip0 link set wg0 netns $netns1
> ip0 link add dev wg0 type wireguard
> @@ -196,13 +201,14 @@ ip1 link set wg0 mtu 1300
> ip2 link set wg0 mtu 1300
> n1 wg set wg0 peer "$pub2" endpoint 127.0.0.1:2
> n2 wg set wg0 peer "$pub1" endpoint 127.0.0.1:1
> -n0 iptables -A INPUT -m length --length 1360 -j DROP
> +n0 nft add chain ip wgtest INPUT { type filter hook input priority filter \;
> policy accept \; }
You may skip the 'policy accept \;' part in all 'add chain' commands as
this is the default for all chains. Unless you prefer to explicitly
state the chain policy, of course.
Cheers, Phil
