Re: [PATCH mptcp-next 1/2] selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh

[Hangbin Liu]

On Wed, Sep 02, 2026 at 11:17:48AM +0200, Matthieu Baerts wrote:
> > @@ -105,33 +109,23 @@ cleanup()
> >  
> >  mptcp_lib_check_mptcp
> >  mptcp_lib_check_kallsyms
> > -mptcp_lib_check_tools ip "${iptables}" "${ip6tables}"
> > +mptcp_lib_check_tools ip nft
> >  
> >  check_mark()
> >  {
> >     local ns=$1
> >     local af=$2
> >  
> > -   local tables=${iptables}
> > +   drop=$(ip netns exec "$ns" nft list table inet msock_table | \
> > +           grep "ipv$af.*packets.*drop" | awk '{print $(NF-3)}')
> 
> Would it not be cleaner to use 'nft -j' and 'jq' to get all the
> (non-zero) drop counters?

We can get with this rule:

nft -j list table filter | jq -r '.nftables[] | select(has("rule")) |
                                .rule | select (.chain=="OUTPUT" and 
any(.expr[]; has("drop"))) |
                                .expr[] | select(has("counter")) |
                                .counter.packets'

Thanks
Hangbin