selftests: mptcp: sockopt: use 'iptables-legacy' if available

commit a5a5990c099dd354e05e89ee77cd2dbf6655d4a1 upstream.

IPTables commands using 'iptables-nft' fail on old kernels, at least
on v5.15 because it doesn't see the default IPTables chains:

  $ iptables -L
  iptables/1.8.2 Failed to initialize nft: Protocol not supported

As a first step before switching to NFTables, we can use iptables-legacy
if available.

Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368
Fixes: dc65fe82fb07 ("selftests: mptcp: add packet mark test case")
Cc: stable@vger.kernel.org
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
index d5c79e4a8f1e854b20f370581c74dd287947ed38..3432d11e0a037ba5f5b155b48694b5ceeed5327b 100755 (executable)
--- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
@@ -13,13 +13,15 @@ timeout_poll=30
 timeout_test=$((timeout_poll * 2 + 1))
 mptcp_connect=""
 do_all_tests=1
+iptables="iptables"
+ip6tables="ip6tables"
 
 add_mark_rules()
 {
        local ns=$1
        local m=$2
 
-       for t in iptables ip6tables; do
+       for t in ${iptables} ${ip6tables}; do
                # just to debug: check we have multiple subflows connection requests
                ip netns exec $ns $t -A OUTPUT -p tcp --syn -m mark --mark $m -j ACCEPT
 
@@ -90,14 +92,14 @@ if [ $? -ne 0 ];then
        exit $ksft_skip
 fi
 
-iptables -V > /dev/null 2>&1
-if [ $? -ne 0 ];then
+# Use the legacy version if available to support old kernel versions
+if iptables-legacy -V &> /dev/null; then
+       iptables="iptables-legacy"
+       ip6tables="ip6tables-legacy"
+elif ! iptables -V &> /dev/null; then
        echo "SKIP: Could not run all tests without iptables tool"
        exit $ksft_skip
-fi
-
-ip6tables -V > /dev/null 2>&1
-if [ $? -ne 0 ];then
+elif ! ip6tables -V &> /dev/null; then
        echo "SKIP: Could not run all tests without ip6tables tool"
        exit $ksft_skip
 fi
@@ -107,10 +109,10 @@ check_mark()
        local ns=$1
        local af=$2
 
-       tables=iptables
+       tables=${iptables}
 
        if [ $af -eq 6 ];then
-               tables=ip6tables
+               tables=${ip6tables}
        fi
 
        counters=$(ip netns exec $ns $tables -v -L OUTPUT | grep DROP)