On Sun, Mar 23, 2025 at 10:10:33PM +0100, Phil Sutter wrote:
On Sat, Mar 22, 2025 at 09:30:15AM +0000, Hangbin Liu wrote:
Convert iptabels to nft as it is the replacement for iptables, which is used
~~~~~~~~Typo, but I would write "Convert the selftest to nft ..." instead since that is what you're converting, iptables is just replaced. :)
Hi Jason, I saw net-next is closed. Should I wait for net-next re-open to post the new version and fix the typo? I'm not sure about the wg branch policy.
Thanks Hangbin
by default in most releases.
Signed-off-by: Hangbin Liu liuhangbin@gmail.com
tools/testing/selftests/wireguard/netns.sh | 29 ++++++++++++++-------- 1 file changed, 19 insertions(+), 10 deletions(-)
diff --git a/tools/testing/selftests/wireguard/netns.sh b/tools/testing/selftests/wireguard/netns.sh index 55500f901fbc..8b840fef90af 100755 --- a/tools/testing/selftests/wireguard/netns.sh +++ b/tools/testing/selftests/wireguard/netns.sh @@ -75,6 +75,11 @@ pp ip netns add $netns1 pp ip netns add $netns2 ip0 link set up dev lo +# init nft tables +n0 nft add table ip wgtest +n1 nft add table ip wgtest +n2 nft add table ip wgtest
ip0 link add dev wg0 type wireguard ip0 link set wg0 netns $netns1 ip0 link add dev wg0 type wireguard @@ -196,13 +201,14 @@ ip1 link set wg0 mtu 1300 ip2 link set wg0 mtu 1300 n1 wg set wg0 peer "$pub2" endpoint 127.0.0.1:2 n2 wg set wg0 peer "$pub1" endpoint 127.0.0.1:1 -n0 iptables -A INPUT -m length --length 1360 -j DROP +n0 nft add chain ip wgtest INPUT { type filter hook input priority filter ; policy accept ; }
You may skip the 'policy accept ;' part in all 'add chain' commands as this is the default for all chains. Unless you prefer to explicitly state the chain policy, of course.
Cheers, Phil