[PATCH testsuite v2] tests: make kernel iptables support optional

[Ondrej Mosnacek <omosnace@xxxxxxxxxx>]

The legacy iptables API is being deprecated in favor of netfilter and
some distributions are starting to disable it in their kernels (e.g.
Fedora ELN, RHEL 10+). To allow getting a clean run of the testsuite on
such kernels, detect the availability of the ip_tables kernel module and
skip the iptables tests if it's not available (either as a loadable
module or built in).

Signed-off-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
---

v2: do the same also in tests/sctp, not just tests/inet_socket

 tests/inet_socket/test | 21 ++++++++++++++++-----
 tests/sctp/test        | 21 ++++++++++++++++-----
 2 files changed, 32 insertions(+), 10 deletions(-)

diff --git a/tests/inet_socket/test b/tests/inet_socket/test
index 56a947b..f09b4e3 100755
--- a/tests/inet_socket/test
+++ b/tests/inet_socket/test
@@ -5,7 +5,7 @@ BEGIN {
     $basedir = $0;
     $basedir =~ s|(.*)/[^/]*|$1|;
 
-    $test_count = 38;
+    $test_count = 30;
 
     $test_ipsec = 0;
     if ( system("ip xfrm policy help 2>&1 | grep -q ctx") eq 0 ) {
@@ -27,6 +27,15 @@ BEGIN {
         $test_calipso_stream = 1;
     }
 
+    # Determine if kernel has legacy iptables support
+    $test_iptables = 0;
+
+    $rc = system("modprobe ip_tables 2>/dev/null");
+    if ( $rc == 0 ) {
+        $test_count += 8;
+        $test_iptables = 1;
+    }
+
     # Determine if nftables has secmark support
     $test_nft = 0;
 
@@ -415,10 +424,12 @@ sub test_tables {
     server_end($pid);
 }
 
-print "Testing iptables (IPv4/IPv6).\n";
-system "/bin/sh $basedir/iptables-load";
-test_tables();
-system "/bin/sh $basedir/iptables-flush";
+if ($test_iptables) {
+    print "Testing iptables (IPv4/IPv6).\n";
+    system "/bin/sh $basedir/iptables-load";
+    test_tables();
+    system "/bin/sh $basedir/iptables-flush";
+}
 
 if ($test_nft) {
     print "Testing nftables (IPv4/IPv6).\n";
diff --git a/tests/sctp/test b/tests/sctp/test
index 1170921..0f017e8 100755
--- a/tests/sctp/test
+++ b/tests/sctp/test
@@ -33,7 +33,7 @@ BEGIN {
         plan skip_all => "SCTP not supported";
     }
     else {
-        $test_count = 75;
+        $test_count = 67;
 
         # Set up a GRE tunnel over loopback to ensure we have enough addresses
         # for the ASCONF tests.
@@ -74,6 +74,15 @@ BEGIN {
             $test_calipso = 1;
         }
 
+        # Determine if kernel has legacy iptables support
+        $test_iptables = 0;
+
+        $rc = system("modprobe ip_tables 2>/dev/null");
+        if ( $rc == 0 ) {
+            $test_count += 8;
+            $test_iptables = 1;
+        }
+
         # Determine if nftables has secmark support
         $test_nft = 0;
 
@@ -903,10 +912,12 @@ sub test_tables {
     server_end($pid);
 }
 
-print "# Testing iptables (IPv4/IPv6).\n";
-system "/bin/sh $basedir/iptables-load";
-test_tables();
-system "/bin/sh $basedir/iptables-flush";
+if ($test_iptables) {
+    print "# Testing iptables (IPv4/IPv6).\n";
+    system "/bin/sh $basedir/iptables-load";
+    test_tables();
+    system "/bin/sh $basedir/iptables-flush";
+}
 
 if ($test_nft) {
     print "# Testing nftables (IPv4/IPv6).\n";
-- 
2.31.1