13 files changed, 0 insertions, 4524 deletions

diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile
deleted file mode 100644
index a374e10ef506..000000000000
--- a/tools/testing/selftests/netfilter/Makefile
+++ /dev/null
@@ -1,12 +0,0 @@
-# SPDX-License-Identifier: GPL-2.0
-# Makefile for netfilter selftests
-
-TEST_PROGS := nft_trans_stress.sh nft_nat.sh bridge_brouter.sh \
-	conntrack_icmp_related.sh nft_flowtable.sh ipvs.sh \
-	nft_concat_range.sh nft_conntrack_helper.sh \
-	nft_queue.sh nft_meta.sh
-
-LDLIBS = -lmnl
-TEST_GEN_FILES =  nf-queue
-
-include ../lib.mk
diff --git a/tools/testing/selftests/netfilter/bridge_brouter.sh b/tools/testing/selftests/netfilter/bridge_brouter.sh
deleted file mode 100755
index 29f3955b9af7..000000000000
--- a/tools/testing/selftests/netfilter/bridge_brouter.sh
+++ /dev/null
@@ -1,146 +0,0 @@
-#!/bin/bash
-#
-# This test is for bridge 'brouting', i.e. make some packets being routed
-# rather than getting bridged even though they arrive on interface that is
-# part of a bridge.
-
-#           eth0    br0     eth0
-# setup is: ns1 <-> ns0 <-> ns2
-
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-ret=0
-
-ebtables -V > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without ebtables"
-	exit $ksft_skip
-fi
-
-ip -Version > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without ip tool"
-	exit $ksft_skip
-fi
-
-ip netns add ns0
-ip netns add ns1
-ip netns add ns2
-
-ip link add veth0 netns ns0 type veth peer name eth0 netns ns1
-if [ $? -ne 0 ]; then
-	echo "SKIP: Can't create veth device"
-	exit $ksft_skip
-fi
-ip link add veth1 netns ns0 type veth peer name eth0 netns ns2
-
-ip -net ns0 link set lo up
-ip -net ns0 link set veth0 up
-ip -net ns0 link set veth1 up
-
-ip -net ns0 link add br0 type bridge
-if [ $? -ne 0 ]; then
-	echo "SKIP: Can't create bridge br0"
-	exit $ksft_skip
-fi
-
-ip -net ns0 link set veth0 master br0
-ip -net ns0 link set veth1 master br0
-ip -net ns0 link set br0 up
-ip -net ns0 addr add 10.0.0.1/24 dev br0
-
-# place both in same subnet, ns1 and ns2 connected via ns0:br0
-for i in 1 2; do
-  ip -net ns$i link set lo up
-  ip -net ns$i link set eth0 up
-  ip -net ns$i addr add 10.0.0.1$i/24 dev eth0
-done
-
-test_ebtables_broute()
-{
-	local cipt
-
-	# redirect is needed so the dstmac is rewritten to the bridge itself,
-	# ip stack won't process OTHERHOST (foreign unicast mac) packets.
-	ip netns exec ns0 ebtables -t broute -A BROUTING -p ipv4 --ip-protocol icmp -j redirect --redirect-target=DROP
-	if [ $? -ne 0 ]; then
-		echo "SKIP: Could not add ebtables broute redirect rule"
-		return $ksft_skip
-	fi
-
-	# ping netns1, expected to not work (ip forwarding is off)
-	ip netns exec ns1 ping -q -c 1 10.0.0.12 > /dev/null 2>&1
-	if [ $? -eq 0 ]; then
-		echo "ERROR: ping works, should have failed" 1>&2
-		return 1
-	fi
-
-	# enable forwarding on both interfaces.
-	# neither needs an ip address, but at least the bridge needs
-	# an ip address in same network segment as ns1 and ns2 (ns0
-	# needs to be able to determine route for to-be-forwarded packet).
-	ip netns exec ns0 sysctl -q net.ipv4.conf.veth0.forwarding=1
-	ip netns exec ns0 sysctl -q net.ipv4.conf.veth1.forwarding=1
-
-	sleep 1
-
-	ip netns exec ns1 ping -q -c 1 10.0.0.12 > /dev/null
-	if [ $? -ne 0 ]; then
-		echo "ERROR: ping did not work, but it should (broute+forward)" 1>&2
-		return 1
-	fi
-
-	echo "PASS: ns1/ns2 connectivity with active broute rule"
-	ip netns exec ns0 ebtables -t broute -F
-
-	# ping netns1, expected to work (frames are bridged)
-	ip netns exec ns1 ping -q -c 1 10.0.0.12 > /dev/null
-	if [ $? -ne 0 ]; then
-		echo "ERROR: ping did not work, but it should (bridged)" 1>&2
-		return 1
-	fi
-
-	ip netns exec ns0 ebtables -t filter -A FORWARD -p ipv4 --ip-protocol icmp -j DROP
-
-	# ping netns1, expected to not work (DROP in bridge forward)
-	ip netns exec ns1 ping -q -c 1 10.0.0.12 > /dev/null 2>&1
-	if [ $? -eq 0 ]; then
-		echo "ERROR: ping works, should have failed (icmp forward drop)" 1>&2
-		return 1
-	fi
-
-	# re-activate brouter
-	ip netns exec ns0 ebtables -t broute -A BROUTING -p ipv4 --ip-protocol icmp -j redirect --redirect-target=DROP
-
-	ip netns exec ns2 ping -q -c 1 10.0.0.11 > /dev/null
-	if [ $? -ne 0 ]; then
-		echo "ERROR: ping did not work, but it should (broute+forward 2)" 1>&2
-		return 1
-	fi
-
-	echo "PASS: ns1/ns2 connectivity with active broute rule and bridge forward drop"
-	return 0
-}
-
-# test basic connectivity
-ip netns exec ns1 ping -c 1 -q 10.0.0.12 > /dev/null
-if [ $? -ne 0 ]; then
-    echo "ERROR: Could not reach ns2 from ns1" 1>&2
-    ret=1
-fi
-
-ip netns exec ns2 ping -c 1 -q 10.0.0.11 > /dev/null
-if [ $? -ne 0 ]; then
-    echo "ERROR: Could not reach ns1 from ns2" 1>&2
-    ret=1
-fi
-
-if [ $ret -eq 0 ];then
-    echo "PASS: netns connectivity: ns1 and ns2 can reach each other"
-fi
-
-test_ebtables_broute
-ret=$?
-for i in 0 1 2; do ip netns del ns$i;done
-
-exit $ret
diff --git a/tools/testing/selftests/netfilter/config b/tools/testing/selftests/netfilter/config
deleted file mode 100644
index 4faf2ce021d9..000000000000
--- a/tools/testing/selftests/netfilter/config
+++ /dev/null
@@ -1,8 +0,0 @@
-CONFIG_NET_NS=y
-CONFIG_NF_TABLES_INET=y
-CONFIG_NFT_QUEUE=m
-CONFIG_NFT_NAT=m
-CONFIG_NFT_REDIR=m
-CONFIG_NFT_MASQ=m
-CONFIG_NFT_FLOW_OFFLOAD=m
-CONFIG_NF_CT_NETLINK=m
diff --git a/tools/testing/selftests/netfilter/conntrack_icmp_related.sh b/tools/testing/selftests/netfilter/conntrack_icmp_related.sh
deleted file mode 100755
index b48e1833bc89..000000000000
--- a/tools/testing/selftests/netfilter/conntrack_icmp_related.sh
+++ /dev/null
@@ -1,283 +0,0 @@
-#!/bin/bash
-#
-# check that ICMP df-needed/pkttoobig icmp are set are set as related
-# state
-#
-# Setup is:
-#
-# nsclient1 -> nsrouter1 -> nsrouter2 -> nsclient2
-# MTU 1500, except for nsrouter2 <-> nsclient2 link (1280).
-# ping nsclient2 from nsclient1, checking that conntrack did set RELATED
-# 'fragmentation needed' icmp packet.
-#
-# In addition, nsrouter1 will perform IP masquerading, i.e. also
-# check the icmp errors are propagated to the correct host as per
-# nat of "established" icmp-echo "connection".
-
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-ret=0
-
-nft --version > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without nft tool"
-	exit $ksft_skip
-fi
-
-ip -Version > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without ip tool"
-	exit $ksft_skip
-fi
-
-cleanup() {
-	for i in 1 2;do ip netns del nsclient$i;done
-	for i in 1 2;do ip netns del nsrouter$i;done
-}
-
-ipv4() {
-    echo -n 192.168.$1.2
-}
-
-ipv6 () {
-    echo -n dead:$1::2
-}
-
-check_counter()
-{
-	ns=$1
-	name=$2
-	expect=$3
-	local lret=0
-
-	cnt=$(ip netns exec $ns nft list counter inet filter "$name" | grep -q "$expect")
-	if [ $? -ne 0 ]; then
-		echo "ERROR: counter $name in $ns has unexpected value (expected $expect)" 1>&2
-		ip netns exec $ns nft list counter inet filter "$name" 1>&2
-		lret=1
-	fi
-
-	return $lret
-}
-
-check_unknown()
-{
-	expect="packets 0 bytes 0"
-	for n in nsclient1 nsclient2 nsrouter1 nsrouter2; do
-		check_counter $n "unknown" "$expect"
-		if [ $? -ne 0 ] ;then
-			return 1
-		fi
-	done
-
-	return 0
-}
-
-for n in nsclient1 nsclient2 nsrouter1 nsrouter2; do
-  ip netns add $n
-  ip -net $n link set lo up
-done
-
-DEV=veth0
-ip link add $DEV netns nsclient1 type veth peer name eth1 netns nsrouter1
-DEV=veth0
-ip link add $DEV netns nsclient2 type veth peer name eth1 netns nsrouter2
-
-DEV=veth0
-ip link add $DEV netns nsrouter1 type veth peer name eth2 netns nsrouter2
-
-DEV=veth0
-for i in 1 2; do
-    ip -net nsclient$i link set $DEV up
-    ip -net nsclient$i addr add $(ipv4 $i)/24 dev $DEV
-    ip -net nsclient$i addr add $(ipv6 $i)/64 dev $DEV
-done
-
-ip -net nsrouter1 link set eth1 up
-ip -net nsrouter1 link set veth0 up
-
-ip -net nsrouter2 link set eth1 up
-ip -net nsrouter2 link set eth2 up
-
-ip -net nsclient1 route add default via 192.168.1.1
-ip -net nsclient1 -6 route add default via dead:1::1
-
-ip -net nsclient2 route add default via 192.168.2.1
-ip -net nsclient2 route add default via dead:2::1
-
-i=3
-ip -net nsrouter1 addr add 192.168.1.1/24 dev eth1
-ip -net nsrouter1 addr add 192.168.3.1/24 dev veth0
-ip -net nsrouter1 addr add dead:1::1/64 dev eth1
-ip -net nsrouter1 addr add dead:3::1/64 dev veth0
-ip -net nsrouter1 route add default via 192.168.3.10
-ip -net nsrouter1 -6 route add default via dead:3::10
-
-ip -net nsrouter2 addr add 192.168.2.1/24 dev eth1
-ip -net nsrouter2 addr add 192.168.3.10/24 dev eth2
-ip -net nsrouter2 addr add dead:2::1/64 dev eth1
-ip -net nsrouter2 addr add dead:3::10/64 dev eth2
-ip -net nsrouter2 route add default via 192.168.3.1
-ip -net nsrouter2 route add default via dead:3::1
-
-sleep 2
-for i in 4 6; do
-	ip netns exec nsrouter1 sysctl -q net.ipv$i.conf.all.forwarding=1
-	ip netns exec nsrouter2 sysctl -q net.ipv$i.conf.all.forwarding=1
-done
-
-for netns in nsrouter1 nsrouter2; do
-ip netns exec $netns nft -f - <<EOF
-table inet filter {
-	counter unknown { }
-	counter related { }
-	chain forward {
-		type filter hook forward priority 0; policy accept;
-		meta l4proto icmpv6 icmpv6 type "packet-too-big" ct state "related" counter name "related" accept
-		meta l4proto icmp icmp type "destination-unreachable" ct state "related" counter name "related" accept
-		meta l4proto { icmp, icmpv6 } ct state new,established accept
-		counter name "unknown" drop
-	}
-}
-EOF
-done
-
-ip netns exec nsclient1 nft -f - <<EOF
-table inet filter {
-	counter unknown { }
-	counter related { }
-	chain input {
-		type filter hook input priority 0; policy accept;
-		meta l4proto { icmp, icmpv6 } ct state established,untracked accept
-
-		meta l4proto { icmp, icmpv6 } ct state "related" counter name "related" accept
-		counter name "unknown" drop
-	}
-}
-EOF
-
-ip netns exec nsclient2 nft -f - <<EOF
-table inet filter {
-	counter unknown { }
-	counter new { }
-	counter established { }
-
-	chain input {
-		type filter hook input priority 0; policy accept;
-		meta l4proto { icmp, icmpv6 } ct state established,untracked accept
-
-		meta l4proto { icmp, icmpv6 } ct state "new" counter name "new" accept
-		meta l4proto { icmp, icmpv6 } ct state "established" counter name "established" accept
-		counter name "unknown" drop
-	}
-	chain output {
-		type filter hook output priority 0; policy accept;
-		meta l4proto { icmp, icmpv6 } ct state established,untracked accept
-
-		meta l4proto { icmp, icmpv6 } ct state "new" counter name "new"
-		meta l4proto { icmp, icmpv6 } ct state "established" counter name "established"
-		counter name "unknown" drop
-	}
-}
-EOF
-
-
-# make sure NAT core rewrites adress of icmp error if nat is used according to
-# conntrack nat information (icmp error will be directed at nsrouter1 address,
-# but it needs to be routed to nsclient1 address).
-ip netns exec nsrouter1 nft -f - <<EOF
-table ip nat {
-	chain postrouting {
-		type nat hook postrouting priority 0; policy accept;
-		ip protocol icmp oifname "veth0" counter masquerade
-	}
-}
-table ip6 nat {
-	chain postrouting {
-		type nat hook postrouting priority 0; policy accept;
-		ip6 nexthdr icmpv6 oifname "veth0" counter masquerade
-	}
-}
-EOF
-
-ip netns exec nsrouter2 ip link set eth1  mtu 1280
-ip netns exec nsclient2 ip link set veth0 mtu 1280
-sleep 1
-
-ip netns exec nsclient1 ping -c 1 -s 1000 -q -M do 192.168.2.2 >/dev/null
-if [ $? -ne 0 ]; then
-	echo "ERROR: netns ip routing/connectivity broken" 1>&2
-	cleanup
-	exit 1
-fi
-ip netns exec nsclient1 ping6 -q -c 1 -s 1000 dead:2::2 >/dev/null
-if [ $? -ne 0 ]; then
-	echo "ERROR: netns ipv6 routing/connectivity broken" 1>&2
-	cleanup
-	exit 1
-fi
-
-check_unknown
-if [ $? -ne 0 ]; then
-	ret=1
-fi
-
-expect="packets 0 bytes 0"
-for netns in nsrouter1 nsrouter2 nsclient1;do
-	check_counter "$netns" "related" "$expect"
-	if [ $? -ne 0 ]; then
-		ret=1
-	fi
-done
-
-expect="packets 2 bytes 2076"
-check_counter nsclient2 "new" "$expect"
-if [ $? -ne 0 ]; then
-	ret=1
-fi
-
-ip netns exec nsclient1 ping -q -c 1 -s 1300 -M do 192.168.2.2 > /dev/null
-if [ $? -eq 0 ]; then
-	echo "ERROR: ping should have failed with PMTU too big error" 1>&2
-	ret=1
-fi
-
-# nsrouter2 should have generated the icmp error, so
-# related counter should be 0 (its in forward).
-expect="packets 0 bytes 0"
-check_counter "nsrouter2" "related" "$expect"
-if [ $? -ne 0 ]; then
-	ret=1
-fi
-
-# but nsrouter1 should have seen it, same for nsclient1.
-expect="packets 1 bytes 576"
-for netns in nsrouter1 nsclient1;do
-	check_counter "$netns" "related" "$expect"
-	if [ $? -ne 0 ]; then
-		ret=1
-	fi
-done
-
-ip netns exec nsclient1 ping6 -c 1 -s 1300 dead:2::2 > /dev/null
-if [ $? -eq 0 ]; then
-	echo "ERROR: ping6 should have failed with PMTU too big error" 1>&2
-	ret=1
-fi
-
-expect="packets 2 bytes 1856"
-for netns in nsrouter1 nsclient1;do
-	check_counter "$netns" "related" "$expect"
-	if [ $? -ne 0 ]; then
-		ret=1
-	fi
-done
-
-if [ $ret -eq 0 ];then
-	echo "PASS: icmp mtu error had RELATED state"
-else
-	echo "ERROR: icmp error RELATED state test has failed"
-fi
-
-cleanup
-exit $ret
diff --git a/tools/testing/selftests/netfilter/ipvs.sh b/tools/testing/selftests/netfilter/ipvs.sh
deleted file mode 100755
index c3b8f90c497e..000000000000
--- a/tools/testing/selftests/netfilter/ipvs.sh
+++ /dev/null
@@ -1,228 +0,0 @@
-#!/bin/sh
-# SPDX-License-Identifier: GPL-2.0
-#
-# End-to-end ipvs test suite
-# Topology:
-#--------------------------------------------------------------+
-#                      |                                       |
-#         ns0          |         ns1                           |
-#      -----------     |     -----------    -----------        |
-#      | veth01  | --------- | veth10  |    | veth12  |        |
-#      -----------    peer   -----------    -----------        |
-#           |          |                        |              |
-#      -----------     |                        |              |
-#      |  br0    |     |-----------------  peer |--------------|
-#      -----------     |                        |              |
-#           |          |                        |              |
-#      ----------     peer   ----------      -----------       |
-#      |  veth02 | --------- |  veth20 |     | veth21  |       |
-#      ----------      |     ----------      -----------       |
-#                      |         ns2                           |
-#                      |                                       |
-#--------------------------------------------------------------+
-#
-# We assume that all network driver are loaded
-#
-
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-ret=0
-GREEN='\033[0;92m'
-RED='\033[0;31m'
-NC='\033[0m' # No Color
-
-readonly port=8080
-
-readonly vip_v4=207.175.44.110
-readonly cip_v4=10.0.0.2
-readonly gip_v4=10.0.0.1
-readonly dip_v4=172.16.0.1
-readonly rip_v4=172.16.0.2
-readonly sip_v4=10.0.0.3
-
-readonly infile="$(mktemp)"
-readonly outfile="$(mktemp)"
-readonly datalen=32
-
-sysipvsnet="/proc/sys/net/ipv4/vs/"
-if [ ! -d $sysipvsnet ]; then
-	modprobe -q ip_vs
-	if [ $? -ne 0 ]; then
-		echo "skip: could not run test without ipvs module"
-		exit $ksft_skip
-	fi
-fi
-
-ip -Version > /dev/null 2>&1
-if [ $? -ne 0 ]; then
-	echo "SKIP: Could not run test without ip tool"
-	exit $ksft_skip
-fi
-
-ipvsadm -v > /dev/null 2>&1
-if [ $? -ne 0 ]; then
-	echo "SKIP: Could not run test without ipvsadm"
-	exit $ksft_skip
-fi
-
-setup() {
-	ip netns add ns0
-	ip netns add ns1
-	ip netns add ns2
-
-	ip link add veth01 netns ns0 type veth peer name veth10 netns ns1
-	ip link add veth02 netns ns0 type veth peer name veth20 netns ns2
-	ip link add veth12 netns ns1 type veth peer name veth21 netns ns2
-
-	ip netns exec ns0 ip link set veth01 up
-	ip netns exec ns0 ip link set veth02 up
-	ip netns exec ns0 ip link add br0 type bridge
-	ip netns exec ns0 ip link set veth01 master br0
-	ip netns exec ns0 ip link set veth02 master br0
-	ip netns exec ns0 ip link set br0 up
-	ip netns exec ns0 ip addr add ${cip_v4}/24 dev br0
-
-	ip netns exec ns1 ip link set lo up
-	ip netns exec ns1 ip link set veth10 up
-	ip netns exec ns1 ip addr add ${gip_v4}/24 dev veth10
-	ip netns exec ns1 ip link set veth12 up
-	ip netns exec ns1 ip addr add ${dip_v4}/24 dev veth12
-
-	ip netns exec ns2 ip link set lo up
-	ip netns exec ns2 ip link set veth21 up
-	ip netns exec ns2 ip addr add ${rip_v4}/24 dev veth21
-	ip netns exec ns2 ip link set veth20 up
-	ip netns exec ns2 ip addr add ${sip_v4}/24 dev veth20
-
-	sleep 1
-
-	dd if=/dev/urandom of="${infile}" bs="${datalen}" count=1 status=none
-}
-
-cleanup() {
-	for i in 0 1 2
-	do
-		ip netns del ns$i > /dev/null 2>&1
-	done
-
-	if [ -f "${outfile}" ]; then
-		rm "${outfile}"
-	fi
-	if [ -f "${infile}" ]; then
-		rm "${infile}"
-	fi
-}
-
-server_listen() {
-	ip netns exec ns2 nc -l -p 8080 > "${outfile}" &
-	server_pid=$!
-	sleep 0.2
-}
-
-client_connect() {
-	ip netns exec ns0 timeout 2 nc -w 1 ${vip_v4} ${port} < "${infile}"
-}
-
-verify_data() {
-	wait "${server_pid}"
-	cmp "$infile" "$outfile" 2>/dev/null
-}
-
-test_service() {
-	server_listen
-	client_connect
-	verify_data
-}
-
-
-test_dr() {
-	ip netns exec ns0 ip route add ${vip_v4} via ${gip_v4} dev br0
-
-	ip netns exec ns1 sysctl -qw net.ipv4.ip_forward=1
-	ip netns exec ns1 ipvsadm -A -t ${vip_v4}:${port} -s rr
-	ip netns exec ns1 ipvsadm -a -t ${vip_v4}:${port} -r ${rip_v4}:${port}
-	ip netns exec ns1 ip addr add ${vip_v4}/32 dev lo:1
-
-	# avoid incorrect arp response
-	ip netns exec ns2 sysctl -qw net.ipv4.conf.all.arp_ignore=1
-	ip netns exec ns2 sysctl -qw net.ipv4.conf.all.arp_announce=2
-	# avoid reverse route lookup
-	ip netns exec ns2 sysctl -qw  net.ipv4.conf.all.rp_filter=0
-	ip netns exec ns2 sysctl -qw  net.ipv4.conf.veth21.rp_filter=0
-	ip netns exec ns2 ip addr add ${vip_v4}/32 dev lo:1
-
-	test_service
-}
-
-test_nat() {
-	ip netns exec ns0 ip route add ${vip_v4} via ${gip_v4} dev br0
-
-	ip netns exec ns1 sysctl -qw net.ipv4.ip_forward=1
-	ip netns exec ns1 ipvsadm -A -t ${vip_v4}:${port} -s rr
-	ip netns exec ns1 ipvsadm -a -m -t ${vip_v4}:${port} -r ${rip_v4}:${port}
-	ip netns exec ns1 ip addr add ${vip_v4}/32 dev lo:1
-
-	ip netns exec ns2 ip link del veth20
-	ip netns exec ns2 ip route add default via ${dip_v4} dev veth21
-
-	test_service
-}
-
-test_tun() {
-	ip netns exec ns0 ip route add ${vip_v4} via ${gip_v4} dev br0
-
-	ip netns exec ns1 modprobe ipip
-	ip netns exec ns1 ip link set tunl0 up
-	ip netns exec ns1 sysctl -qw net.ipv4.ip_forward=0
-	ip netns exec ns1 sysctl -qw net.ipv4.conf.all.send_redirects=0
-	ip netns exec ns1 sysctl -qw net.ipv4.conf.default.send_redirects=0
-	ip netns exec ns1 ipvsadm -A -t ${vip_v4}:${port} -s rr
-	ip netns exec ns1 ipvsadm -a -i -t ${vip_v4}:${port} -r ${rip_v4}:${port}
-	ip netns exec ns1 ip addr add ${vip_v4}/32 dev lo:1
-
-	ip netns exec ns2 modprobe ipip
-	ip netns exec ns2 ip link set tunl0 up
-	ip netns exec ns2 sysctl -qw net.ipv4.conf.all.arp_ignore=1
-	ip netns exec ns2 sysctl -qw net.ipv4.conf.all.arp_announce=2
-	ip netns exec ns2 sysctl -qw net.ipv4.conf.all.rp_filter=0
-	ip netns exec ns2 sysctl -qw net.ipv4.conf.tunl0.rp_filter=0
-	ip netns exec ns2 sysctl -qw net.ipv4.conf.veth21.rp_filter=0
-	ip netns exec ns2 ip addr add ${vip_v4}/32 dev lo:1
-
-	test_service
-}
-
-run_tests() {
-	local errors=
-
-	echo "Testing DR mode..."
-	cleanup
-	setup
-	test_dr
-	errors=$(( $errors + $? ))
-
-	echo "Testing NAT mode..."
-	cleanup
-	setup
-	test_nat
-	errors=$(( $errors + $? ))
-
-	echo "Testing Tunnel mode..."
-	cleanup
-	setup
-	test_tun
-	errors=$(( $errors + $? ))
-
-	return $errors
-}
-
-trap cleanup EXIT
-
-run_tests
-
-if [ $? -ne 0 ]; then
-	echo -e "$(basename $0): ${RED}FAIL${NC}"
-	exit 1
-fi
-echo -e "$(basename $0): ${GREEN}PASS${NC}"
-exit 0
diff --git a/tools/testing/selftests/netfilter/nf-queue.c b/tools/testing/selftests/netfilter/nf-queue.c
deleted file mode 100644
index 29c73bce38fa..000000000000
--- a/tools/testing/selftests/netfilter/nf-queue.c
+++ /dev/null
@@ -1,352 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-
-#include <errno.h>
-#include <stdbool.h>
-#include <stdio.h>
-#include <stdint.h>
-#include <stdlib.h>
-#include <unistd.h>
-#include <string.h>
-#include <time.h>
-#include <arpa/inet.h>
-
-#include <libmnl/libmnl.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter/nfnetlink.h>
-#include <linux/netfilter/nfnetlink_queue.h>
-
-struct options {
-	bool count_packets;
-	int verbose;
-	unsigned int queue_num;
-	unsigned int timeout;
-};
-
-static unsigned int queue_stats[5];
-static struct options opts;
-
-static void help(const char *p)
-{
-	printf("Usage: %s [-c|-v [-vv] ] [-t timeout] [-q queue_num]\n", p);
-}
-
-static int parse_attr_cb(const struct nlattr *attr, void *data)
-{
-	const struct nlattr **tb = data;
-	int type = mnl_attr_get_type(attr);
-
-	/* skip unsupported attribute in user-space */
-	if (mnl_attr_type_valid(attr, NFQA_MAX) < 0)
-		return MNL_CB_OK;
-
-	switch (type) {
-	case NFQA_MARK:
-	case NFQA_IFINDEX_INDEV:
-	case NFQA_IFINDEX_OUTDEV:
-	case NFQA_IFINDEX_PHYSINDEV:
-	case NFQA_IFINDEX_PHYSOUTDEV:
-		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) {
-			perror("mnl_attr_validate");
-			return MNL_CB_ERROR;
-		}
-		break;
-	case NFQA_TIMESTAMP:
-		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
-		    sizeof(struct nfqnl_msg_packet_timestamp)) < 0) {
-			perror("mnl_attr_validate2");
-			return MNL_CB_ERROR;
-		}
-		break;
-	case NFQA_HWADDR:
-		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
-		    sizeof(struct nfqnl_msg_packet_hw)) < 0) {
-			perror("mnl_attr_validate2");
-			return MNL_CB_ERROR;
-		}
-		break;
-	case NFQA_PAYLOAD:
-		break;
-	}
-	tb[type] = attr;
-	return MNL_CB_OK;
-}
-
-static int queue_cb(const struct nlmsghdr *nlh, void *data)
-{
-	struct nlattr *tb[NFQA_MAX+1] = { 0 };
-	struct nfqnl_msg_packet_hdr *ph = NULL;
-	uint32_t id = 0;
-
-	(void)data;
-
-	mnl_attr_parse(nlh, sizeof(struct nfgenmsg), parse_attr_cb, tb);
-	if (tb[NFQA_PACKET_HDR]) {
-		ph = mnl_attr_get_payload(tb[NFQA_PACKET_HDR]);
-		id = ntohl(ph->packet_id);
-
-		if (opts.verbose > 0)
-			printf("packet hook=%u, hwproto 0x%x",
-				ntohs(ph->hw_protocol), ph->hook);
-
-		if (ph->hook >= 5) {
-			fprintf(stderr, "Unknown hook %d\n", ph->hook);
-			return MNL_CB_ERROR;
-		}
-
-		if (opts.verbose > 0) {
-			uint32_t skbinfo = 0;
-
-			if (tb[NFQA_SKB_INFO])
-				skbinfo = ntohl(mnl_attr_get_u32(tb[NFQA_SKB_INFO]));
-			if (skbinfo & NFQA_SKB_CSUMNOTREADY)
-				printf(" csumnotready");
-			if (skbinfo & NFQA_SKB_GSO)
-				printf(" gso");
-			if (skbinfo & NFQA_SKB_CSUM_NOTVERIFIED)
-				printf(" csumnotverified");
-			puts("");
-		}
-
-		if (opts.count_packets)
-			queue_stats[ph->hook]++;
-	}
-
-	return MNL_CB_OK + id;
-}
-
-static struct nlmsghdr *
-nfq_build_cfg_request(char *buf, uint8_t command, int queue_num)
-{
-	struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);
-	struct nfqnl_msg_config_cmd cmd = {
-		.command = command,
-		.pf = htons(AF_INET),
-	};
-	struct nfgenmsg *nfg;
-
-	nlh->nlmsg_type	= (NFNL_SUBSYS_QUEUE << 8) | NFQNL_MSG_CONFIG;
-	nlh->nlmsg_flags = NLM_F_REQUEST;
-
-	nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
-
-	nfg->nfgen_family = AF_UNSPEC;
-	nfg->version = NFNETLINK_V0;
-	nfg->res_id = htons(queue_num);
-
-	mnl_attr_put(nlh, NFQA_CFG_CMD, sizeof(cmd), &cmd);
-
-	return nlh;
-}
-
-static struct nlmsghdr *
-nfq_build_cfg_params(char *buf, uint8_t mode, int range, int queue_num)
-{
-	struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);
-	struct nfqnl_msg_config_params params = {
-		.copy_range = htonl(range),
-		.copy_mode = mode,
-	};
-	struct nfgenmsg *nfg;
-
-	nlh->nlmsg_type	= (NFNL_SUBSYS_QUEUE << 8) | NFQNL_MSG_CONFIG;
-	nlh->nlmsg_flags = NLM_F_REQUEST;
-
-	nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
-	nfg->nfgen_family = AF_UNSPEC;
-	nfg->version = NFNETLINK_V0;
-	nfg->res_id = htons(queue_num);
-
-	mnl_attr_put(nlh, NFQA_CFG_PARAMS, sizeof(params), &params);
-
-	return nlh;
-}
-
-static struct nlmsghdr *
-nfq_build_verdict(char *buf, int id, int queue_num, int verd)
-{
-	struct nfqnl_msg_verdict_hdr vh = {
-		.verdict = htonl(verd),
-		.id = htonl(id),
-	};
-	struct nlmsghdr *nlh;
-	struct nfgenmsg *nfg;
-
-	nlh = mnl_nlmsg_put_header(buf);
-	nlh->nlmsg_type = (NFNL_SUBSYS_QUEUE << 8) | NFQNL_MSG_VERDICT;
-	nlh->nlmsg_flags = NLM_F_REQUEST;
-	nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
-	nfg->nfgen_family = AF_UNSPEC;
-	nfg->version = NFNETLINK_V0;
-	nfg->res_id = htons(queue_num);
-
-	mnl_attr_put(nlh, NFQA_VERDICT_HDR, sizeof(vh), &vh);
-
-	return nlh;
-}
-
-static void print_stats(void)
-{
-	unsigned int last, total;
-	int i;
-
-	if (!opts.count_packets)
-		return;
-
-	total = 0;
-	last = queue_stats[0];
-
-	for (i = 0; i < 5; i++) {
-		printf("hook %d packets %08u\n", i, queue_stats[i]);
-		last = queue_stats[i];
-		total += last;
-	}
-
-	printf("%u packets total\n", total);
-}
-
-struct mnl_socket *open_queue(void)
-{
-	char buf[MNL_SOCKET_BUFFER_SIZE];
-	unsigned int queue_num;
-	struct mnl_socket *nl;
-	struct nlmsghdr *nlh;
-	struct timeval tv;
-	uint32_t flags;
-
-	nl = mnl_socket_open(NETLINK_NETFILTER);
-	if (nl == NULL) {
-		perror("mnl_socket_open");
-		exit(EXIT_FAILURE);
-	}
-
-	if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {
-		perror("mnl_socket_bind");
-		exit(EXIT_FAILURE);
-	}
-
-	queue_num = opts.queue_num;
-	nlh = nfq_build_cfg_request(buf, NFQNL_CFG_CMD_BIND, queue_num);
-
-	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
-		perror("mnl_socket_sendto");
-		exit(EXIT_FAILURE);
-	}
-
-	nlh = nfq_build_cfg_params(buf, NFQNL_COPY_PACKET, 0xFFFF, queue_num);
-
-	flags = NFQA_CFG_F_GSO | NFQA_CFG_F_UID_GID;
-	mnl_attr_put_u32(nlh, NFQA_CFG_FLAGS, htonl(flags));
-	mnl_attr_put_u32(nlh, NFQA_CFG_MASK, htonl(flags));
-
-	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
-		perror("mnl_socket_sendto");
-		exit(EXIT_FAILURE);
-	}
-
-	memset(&tv, 0, sizeof(tv));
-	tv.tv_sec = opts.timeout;
-	if (opts.timeout && setsockopt(mnl_socket_get_fd(nl),
-				       SOL_SOCKET, SO_RCVTIMEO,
-				       &tv, sizeof(tv))) {
-		perror("setsockopt(SO_RCVTIMEO)");
-		exit(EXIT_FAILURE);
-	}
-
-	return nl;
-}
-
-static int mainloop(void)
-{
-	unsigned int buflen = 64 * 1024 + MNL_SOCKET_BUFFER_SIZE;
-	struct mnl_socket *nl;
-	struct nlmsghdr *nlh;
-	unsigned int portid;
-	char *buf;
-	int ret;
-
-	buf = malloc(buflen);
-	if (!buf) {
-		perror("malloc");
-		exit(EXIT_FAILURE);
-	}
-
-	nl = open_queue();
-	portid = mnl_socket_get_portid(nl);
-
-	for (;;) {
-		uint32_t id;
-
-		ret = mnl_socket_recvfrom(nl, buf, buflen);
-		if (ret == -1) {
-			if (errno == ENOBUFS)
-				continue;
-
-			if (errno == EAGAIN) {
-				errno = 0;
-				ret = 0;
-				break;
-			}
-
-			perror("mnl_socket_recvfrom");
-			exit(EXIT_FAILURE);
-		}
-
-		ret = mnl_cb_run(buf, ret, 0, portid, queue_cb, NULL);
-		if (ret < 0) {
-			perror("mnl_cb_run");
-			exit(EXIT_FAILURE);
-		}
-
-		id = ret - MNL_CB_OK;
-		nlh = nfq_build_verdict(buf, id, opts.queue_num, NF_ACCEPT);
-		if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
-			perror("mnl_socket_sendto");
-			exit(EXIT_FAILURE);
-		}
-	}
-
-	mnl_socket_close(nl);
-
-	return ret;
-}
-
-static void parse_opts(int argc, char **argv)
-{
-	int c;
-
-	while ((c = getopt(argc, argv, "chvt:q:")) != -1) {
-		switch (c) {
-		case 'c':
-			opts.count_packets = true;
-			break;
-		case 'h':
-			help(argv[0]);
-			exit(0);
-			break;
-		case 'q':
-			opts.queue_num = atoi(optarg);
-			if (opts.queue_num > 0xffff)
-				opts.queue_num = 0;
-			break;
-		case 't':
-			opts.timeout = atoi(optarg);
-			break;
-		case 'v':
-			opts.verbose++;
-			break;
-		}
-	}
-}
-
-int main(int argc, char *argv[])
-{
-	int ret;
-
-	parse_opts(argc, argv);
-
-	ret = mainloop();
-	if (opts.count_packets)
-		print_stats();
-
-	return ret;
-}
diff --git a/tools/testing/selftests/netfilter/nft_concat_range.sh b/tools/testing/selftests/netfilter/nft_concat_range.sh
deleted file mode 100755
index 5a4938d6dcf2..000000000000
--- a/tools/testing/selftests/netfilter/nft_concat_range.sh
+++ /dev/null
@@ -1,1516 +0,0 @@
-#!/bin/sh
-# SPDX-License-Identifier: GPL-2.0
-#
-# nft_concat_range.sh - Tests for sets with concatenation of ranged fields
-#
-# Copyright (c) 2019 Red Hat GmbH
-#
-# Author: Stefano Brivio <sbrivio@redhat.com>
-#
-# shellcheck disable=SC2154,SC2034,SC2016,SC2030,SC2031
-# ^ Configuration and templates sourced with eval, counters reused in subshells
-
-KSELFTEST_SKIP=4
-
-# Available test groups:
-# - reported_issues: check for issues that were reported in the past
-# - correctness: check that packets match given entries, and only those
-# - concurrency: attempt races between insertion, deletion and lookup
-# - timeout: check that packets match entries until they expire
-# - performance: estimate matching rate, compare with rbtree and hash baselines
-TESTS="reported_issues correctness concurrency timeout"
-[ "${quicktest}" != "1" ] && TESTS="${TESTS} performance"
-
-# Set types, defined by TYPE_ variables below
-TYPES="net_port port_net net6_port port_proto net6_port_mac net6_port_mac_proto
-       net_port_net net_mac net_mac_icmp net6_mac_icmp net6_port_net6_port
-       net_port_mac_proto_net"
-
-# Reported bugs, also described by TYPE_ variables below
-BUGS="flush_remove_add"
-
-# List of possible paths to pktgen script from kernel tree for performance tests
-PKTGEN_SCRIPT_PATHS="
-	../../../samples/pktgen/pktgen_bench_xmit_mode_netif_receive.sh
-	pktgen/pktgen_bench_xmit_mode_netif_receive.sh"
-
-# Definition of set types:
-# display	display text for test report
-# type_spec	nftables set type specifier
-# chain_spec	nftables type specifier for rules mapping to set
-# dst		call sequence of format_*() functions for destination fields
-# src		call sequence of format_*() functions for source fields
-# start		initial integer used to generate addresses and ports
-# count		count of entries to generate and match
-# src_delta	number summed to destination generator for source fields
-# tools		list of tools for correctness and timeout tests, any can be used
-# proto		L4 protocol of test packets
-#
-# race_repeat	race attempts per thread, 0 disables concurrency test for type
-# flood_tools	list of tools for concurrency tests, any can be used
-# flood_proto	L4 protocol of test packets for concurrency tests
-# flood_spec	nftables type specifier for concurrency tests
-#
-# perf_duration	duration of single pktgen injection test
-# perf_spec	nftables type specifier for performance tests
-# perf_dst	format_*() functions for destination fields in performance test
-# perf_src	format_*() functions for source fields in performance test
-# perf_entries	number of set entries for performance test
-# perf_proto	L3 protocol of test packets
-TYPE_net_port="
-display		net,port
-type_spec	ipv4_addr . inet_service
-chain_spec	ip daddr . udp dport
-dst		addr4 port
-src		 
-start		1
-count		5
-src_delta	2000
-tools		sendip nc bash
-proto		udp
-
-race_repeat	3
-flood_tools	iperf3 iperf netperf
-flood_proto	udp
-flood_spec	ip daddr . udp dport
-
-perf_duration	5
-perf_spec	ip daddr . udp dport
-perf_dst	addr4 port
-perf_src	 
-perf_entries	1000
-perf_proto	ipv4
-"
-
-TYPE_port_net="
-display		port,net
-type_spec	inet_service . ipv4_addr
-chain_spec	udp dport . ip daddr
-dst		port addr4
-src		 
-start		1
-count		5
-src_delta	2000
-tools		sendip nc bash
-proto		udp
-
-race_repeat	3
-flood_tools	iperf3 iperf netperf
-flood_proto	udp
-flood_spec	udp dport . ip daddr
-
-perf_duration	5
-perf_spec	udp dport . ip daddr
-perf_dst	port addr4
-perf_src	 
-perf_entries	100
-perf_proto	ipv4
-"
-
-TYPE_net6_port="
-display		net6,port
-type_spec	ipv6_addr . inet_service
-chain_spec	ip6 daddr . udp dport
-dst		addr6 port
-src		 
-start		10
-count		5
-src_delta	2000
-tools		sendip nc bash
-proto		udp6
-
-race_repeat	3
-flood_tools	iperf3 iperf netperf
-flood_proto	tcp6
-flood_spec	ip6 daddr . udp dport
-
-perf_duration	5
-perf_spec	ip6 daddr . udp dport
-perf_dst	addr6 port
-perf_src	 
-perf_entries	1000
-perf_proto	ipv6
-"
-
-TYPE_port_proto="
-display		port,proto
-type_spec	inet_service . inet_proto
-chain_spec	udp dport . meta l4proto
-dst		port proto
-src		 
-start		1
-count		5
-src_delta	2000
-tools		sendip nc bash
-proto		udp
-
-race_repeat	0
-
-perf_duration	5
-perf_spec	udp dport . meta l4proto
-perf_dst	port proto
-perf_src	 
-perf_entries	30000
-perf_proto	ipv4
-"
-
-TYPE_net6_port_mac="
-display		net6,port,mac
-type_spec	ipv6_addr . inet_service . ether_addr
-chain_spec	ip6 daddr . udp dport . ether saddr
-dst		addr6 port
-src		mac
-start		10
-count		5
-src_delta	2000
-tools		sendip nc bash
-proto		udp6
-
-race_repeat	0
-
-perf_duration	5
-perf_spec	ip6 daddr . udp dport . ether daddr
-perf_dst	addr6 port mac
-perf_src	 
-perf_entries	10
-perf_proto	ipv6
-"
-
-TYPE_net6_port_mac_proto="
-display		net6,port,mac,proto
-type_spec	ipv6_addr . inet_service . ether_addr . inet_proto
-chain_spec	ip6 daddr . udp dport . ether saddr . meta l4proto
-dst		addr6 port
-src		mac proto
-start		10
-count		5
-src_delta	2000
-tools		sendip nc bash
-proto		udp6
-
-race_repeat	0
-
-perf_duration	5
-perf_spec	ip6 daddr . udp dport . ether daddr . meta l4proto
-perf_dst	addr6 port mac proto
-perf_src	 
-perf_entries	1000
-perf_proto	ipv6
-"
-
-TYPE_net_port_net="
-display		net,port,net
-type_spec	ipv4_addr . inet_service . ipv4_addr
-chain_spec	ip daddr . udp dport . ip saddr
-dst		addr4 port
-src		addr4
-start		1
-count		5
-src_delta	2000
-tools		sendip nc bash
-proto		udp
-
-race_repeat	3
-flood_tools	iperf3 iperf netperf
-flood_proto	tcp
-flood_spec	ip daddr . udp dport . ip saddr
-
-perf_duration	0
-"
-
-TYPE_net6_port_net6_port="
-display		net6,port,net6,port
-type_spec	ipv6_addr . inet_service . ipv6_addr . inet_service
-chain_spec	ip6 daddr . udp dport . ip6 saddr . udp sport
-dst		addr6 port
-src		addr6 port
-start		10
-count		5
-src_delta	2000
-tools		sendip nc
-proto		udp6
-
-race_repeat	3
-flood_tools	iperf3 iperf netperf
-flood_proto	tcp6
-flood_spec	ip6 daddr . tcp dport . ip6 saddr . tcp sport
-
-perf_duration	0
-"
-
-TYPE_net_port_mac_proto_net="
-display		net,port,mac,proto,net
-type_spec	ipv4_addr . inet_service . ether_addr . inet_proto . ipv4_addr
-chain_spec	ip daddr . udp dport . ether saddr . meta l4proto . ip saddr
-dst		addr4 port
-src		mac proto addr4
-start		1
-count		5
-src_delta	2000
-tools		sendip nc bash
-proto		udp
-
-race_repeat	0
-
-perf_duration	0
-"
-
-TYPE_net_mac="
-display		net,mac
-type_spec	ipv4_addr . ether_addr
-chain_spec	ip daddr . ether saddr
-dst		addr4
-src		mac
-start		1
-count		5
-src_delta	2000
-tools		sendip nc bash
-proto		udp
-
-race_repeat	0
-
-perf_duration	5
-perf_spec	ip daddr . ether daddr
-perf_dst	addr4 mac
-perf_src	 
-perf_entries	1000
-perf_proto	ipv4
-"
-
-TYPE_net_mac_icmp="
-display		net,mac - ICMP
-type_spec	ipv4_addr . ether_addr
-chain_spec	ip daddr . ether saddr
-dst		addr4
-src		mac
-start		1
-count		5
-src_delta	2000
-tools		ping
-proto		icmp
-
-race_repeat	0
-
-perf_duration	0
-"
-
-TYPE_net6_mac_icmp="
-display		net6,mac - ICMPv6
-type_spec	ipv6_addr . ether_addr
-chain_spec	ip6 daddr . ether saddr
-dst		addr6
-src		mac
-start		10
-count		50
-src_delta	2000
-tools		ping
-proto		icmp6
-
-race_repeat	0
-
-perf_duration	0
-"
-
-TYPE_net_port_proto_net="
-display		net,port,proto,net
-type_spec	ipv4_addr . inet_service . inet_proto . ipv4_addr
-chain_spec	ip daddr . udp dport . meta l4proto . ip saddr
-dst		addr4 port proto
-src		addr4
-start		1
-count		5
-src_delta	2000
-tools		sendip nc
-proto		udp
-
-race_repeat	3
-flood_tools	iperf3 iperf netperf
-flood_proto	tcp
-flood_spec	ip daddr . tcp dport . meta l4proto . ip saddr
-
-perf_duration	0
-"
-
-# Definition of tests for bugs reported in the past:
-# display	display text for test report
-TYPE_flush_remove_add="
-display		Add two elements, flush, re-add
-"
-
-# Set template for all tests, types and rules are filled in depending on test
-set_template='
-flush ruleset
-
-table inet filter {
-	counter test {
-		packets 0 bytes 0
-	}
-
-	set test {
-		type ${type_spec}
-		flags interval,timeout
-	}
-
-	chain input {
-		type filter hook prerouting priority 0; policy accept;
-		${chain_spec} @test counter name \"test\"
-	}
-}
-
-table netdev perf {
-	counter test {
-		packets 0 bytes 0
-	}
-
-	counter match {
-		packets 0 bytes 0
-	}
-
-	set test {
-		type ${type_spec}
-		flags interval
-	}
-
-	set norange {
-		type ${type_spec}
-	}
-
-	set noconcat {
-		type ${type_spec%% *}
-		flags interval
-	}
-
-	chain test {
-		type filter hook ingress device veth_a priority 0;
-	}
-}
-'
-
-err_buf=
-info_buf=
-
-# Append string to error buffer
-err() {
-	err_buf="${err_buf}${1}
-"
-}
-
-# Append string to information buffer
-info() {
-	info_buf="${info_buf}${1}
-"
-}
-
-# Flush error buffer to stdout
-err_flush() {
-	printf "%s" "${err_buf}"
-	err_buf=
-}
-
-# Flush information buffer to stdout
-info_flush() {
-	printf "%s" "${info_buf}"
-	info_buf=
-}
-
-# Setup veth pair: this namespace receives traffic, B generates it
-setup_veth() {
-	ip netns add B
-	ip link add veth_a type veth peer name veth_b || return 1
-
-	ip link set veth_a up
-	ip link set veth_b netns B
-
-	ip -n B link set veth_b up
-
-	ip addr add dev veth_a 10.0.0.1
-	ip route add default dev veth_a
-
-	ip -6 addr add fe80::1/64 dev veth_a nodad
-	ip -6 addr add 2001:db8::1/64 dev veth_a nodad
-	ip -6 route add default dev veth_a
-
-	ip -n B route add default dev veth_b
-
-	ip -6 -n B addr add fe80::2/64 dev veth_b nodad
-	ip -6 -n B addr add 2001:db8::2/64 dev veth_b nodad
-	ip -6 -n B route add default dev veth_b
-
-	B() {
-		ip netns exec B "$@" >/dev/null 2>&1
-	}
-
-	sleep 2
-}
-
-# Fill in set template and initialise set
-setup_set() {
-	eval "echo \"${set_template}\"" | nft -f -
-}
-
-# Check that at least one of the needed tools is available
-check_tools() {
-	[ -z "${tools}" ] && return 0
-
-	__tools=
-	for tool in ${tools}; do
-		if [ "${tool}" = "nc" ] && [ "${proto}" = "udp6" ] && \
-		   ! nc -u -w0 1.1.1.1 1 2>/dev/null; then
-			# Some GNU netcat builds might not support IPv6
-			__tools="${__tools} netcat-openbsd"
-			continue
-		fi
-		__tools="${__tools} ${tool}"
-
-		command -v "${tool}" >/dev/null && return 0
-	done
-	err "need one of:${__tools}, skipping" && return 1
-}
-
-# Set up function to send ICMP packets
-setup_send_icmp() {
-	send_icmp() {
-		B ping -c1 -W1 "${dst_addr4}" >/dev/null 2>&1
-	}
-}
-
-# Set up function to send ICMPv6 packets
-setup_send_icmp6() {
-	if command -v ping6 >/dev/null; then
-		send_icmp6() {
-			ip -6 addr add "${dst_addr6}" dev veth_a nodad \
-				2>/dev/null
-			B ping6 -q -c1 -W1 "${dst_addr6}"
-		}
-	else
-		send_icmp6() {
-			ip -6 addr add "${dst_addr6}" dev veth_a nodad \
-				2>/dev/null
-			B ping -q -6 -c1 -W1 "${dst_addr6}"
-		}
-	fi
-}
-
-# Set up function to send single UDP packets on IPv4
-setup_send_udp() {
-	if command -v sendip >/dev/null; then
-		send_udp() {
-			[ -n "${src_port}" ] && src_port="-us ${src_port}"
-			[ -n "${dst_port}" ] && dst_port="-ud ${dst_port}"
-			[ -n "${src_addr4}" ] && src_addr4="-is ${src_addr4}"
-
-			# shellcheck disable=SC2086 # sendip needs split options
-			B sendip -p ipv4 -p udp ${src_addr4} ${src_port} \
-						${dst_port} "${dst_addr4}"
-
-			src_port=
-			dst_port=
-			src_addr4=
-		}
-	elif command -v nc >/dev/null; then
-		if nc -u -w0 1.1.1.1 1 2>/dev/null; then
-			# OpenBSD netcat
-			nc_opt="-w0"
-		else
-			# GNU netcat
-			nc_opt="-q0"
-		fi
-
-		send_udp() {
-			if [ -n "${src_addr4}" ]; then
-				B ip addr add "${src_addr4}" dev veth_b
-				__src_addr4="-s ${src_addr4}"
-			fi
-			ip addr add "${dst_addr4}" dev veth_a 2>/dev/null
-			[ -n "${src_port}" ] && src_port="-p ${src_port}"
-
-			echo "" | B nc -u "${nc_opt}" "${__src_addr4}" \
-				  "${src_port}" "${dst_addr4}" "${dst_port}"
-
-			src_addr4=
-			src_port=
-		}
-	elif [ -z "$(bash -c 'type -p')" ]; then
-		send_udp() {
-			ip addr add "${dst_addr4}" dev veth_a 2>/dev/null
-			if [ -n "${src_addr4}" ]; then
-				B ip addr add "${src_addr4}/16" dev veth_b
-				B ip route add default dev veth_b
-			fi
-
-			B bash -c "echo > /dev/udp/${dst_addr4}/${dst_port}"
-
-			if [ -n "${src_addr4}" ]; then
-				B ip addr del "${src_addr4}/16" dev veth_b
-			fi
-			src_addr4=
-		}
-	else
-		return 1
-	fi
-}
-
-# Set up function to send single UDP packets on IPv6
-setup_send_udp6() {
-	if command -v sendip >/dev/null; then
-		send_udp6() {
-			[ -n "${src_port}" ] && src_port="-us ${src_port}"
-			[ -n "${dst_port}" ] && dst_port="-ud ${dst_port}"
-			if [ -n "${src_addr6}" ]; then
-				src_addr6="-6s ${src_addr6}"
-			else
-				src_addr6="-6s 2001:db8::2"
-			fi
-			ip -6 addr add "${dst_addr6}" dev veth_a nodad \
-				2>/dev/null
-
-			# shellcheck disable=SC2086 # this needs split options
-			B sendip -p ipv6 -p udp ${src_addr6} ${src_port} \
-						${dst_port} "${dst_addr6}"
-
-			src_port=
-			dst_port=
-			src_addr6=
-		}
-	elif command -v nc >/dev/null && nc -u -w0 1.1.1.1 1 2>/dev/null; then
-		# GNU netcat might not work with IPv6, try next tool
-		send_udp6() {
-			ip -6 addr add "${dst_addr6}" dev veth_a nodad \
-				2>/dev/null
-			if [ -n "${src_addr6}" ]; then
-				B ip addr add "${src_addr6}" dev veth_b nodad
-			else
-				src_addr6="2001:db8::2"
-			fi
-			[ -n "${src_port}" ] && src_port="-p ${src_port}"
-
-			# shellcheck disable=SC2086 # this needs split options
-			echo "" | B nc -u w0 "-s${src_addr6}" ${src_port} \
-					       ${dst_addr6} ${dst_port}
-
-			src_addr6=
-			src_port=
-		}
-	elif [ -z "$(bash -c 'type -p')" ]; then
-		send_udp6() {
-			ip -6 addr add "${dst_addr6}" dev veth_a nodad \
-				2>/dev/null
-			B ip addr add "${src_addr6}" dev veth_b nodad
-			B bash -c "echo > /dev/udp/${dst_addr6}/${dst_port}"
-			ip -6 addr del "${dst_addr6}" dev veth_a 2>/dev/null
-		}
-	else
-		return 1
-	fi
-}
-
-# Set up function to send TCP traffic on IPv4
-setup_flood_tcp() {
-	if command -v iperf3 >/dev/null; then
-		flood_tcp() {
-			[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
-			if [ -n "${src_addr4}" ]; then
-				B ip addr add "${src_addr4}/16" dev veth_b
-				src_addr4="-B ${src_addr4}"
-			else
-				B ip addr add dev veth_b 10.0.0.2
-				src_addr4="-B 10.0.0.2"
-			fi
-			if [ -n "${src_port}" ]; then
-				src_port="--cport ${src_port}"
-			fi
-			B ip route add default dev veth_b 2>/dev/null
-			ip addr add "${dst_addr4}" dev veth_a 2>/dev/null
-
-			# shellcheck disable=SC2086 # this needs split options
-			iperf3 -s -DB "${dst_addr4}" ${dst_port} >/dev/null 2>&1
-			sleep 2
-
-			# shellcheck disable=SC2086 # this needs split options
-			B iperf3 -c "${dst_addr4}" ${dst_port} ${src_port} \
-				${src_addr4} -l16 -t 1000
-
-			src_addr4=
-			src_port=
-			dst_port=
-		}
-	elif command -v iperf >/dev/null; then
-		flood_tcp() {
-			[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
-			if [ -n "${src_addr4}" ]; then
-				B ip addr add "${src_addr4}/16" dev veth_b
-				src_addr4="-B ${src_addr4}"
-			else
-				B ip addr add dev veth_b 10.0.0.2 2>/dev/null
-				src_addr4="-B 10.0.0.2"
-			fi
-			if [ -n "${src_port}" ]; then
-				src_addr4="${src_addr4}:${src_port}"
-			fi
-			B ip route add default dev veth_b
-			ip addr add "${dst_addr4}" dev veth_a 2>/dev/null
-
-			# shellcheck disable=SC2086 # this needs split options
-			iperf -s -DB "${dst_addr4}" ${dst_port} >/dev/null 2>&1
-			sleep 2
-
-			# shellcheck disable=SC2086 # this needs split options
-			B iperf -c "${dst_addr4}" ${dst_port} ${src_addr4} \
-				-l20 -t 1000
-
-			src_addr4=
-			src_port=
-			dst_port=
-		}
-	elif command -v netperf >/dev/null; then
-		flood_tcp() {
-			[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
-			if [ -n "${src_addr4}" ]; then
-				B ip addr add "${src_addr4}/16" dev veth_b
-			else
-				B ip addr add dev veth_b 10.0.0.2
-				src_addr4="10.0.0.2"
-			fi
-			if [ -n "${src_port}" ]; then
-				dst_port="${dst_port},${src_port}"
-			fi
-			B ip route add default dev veth_b
-			ip addr add "${dst_addr4}" dev veth_a 2>/dev/null
-
-			# shellcheck disable=SC2086 # this needs split options
-			netserver -4 ${dst_port} -L "${dst_addr4}" \
-				>/dev/null 2>&1
-			sleep 2
-
-			# shellcheck disable=SC2086 # this needs split options
-			B netperf -4 -H "${dst_addr4}" ${dst_port} \
-				-L "${src_addr4}" -l 1000 -t TCP_STREAM
-
-			src_addr4=
-			src_port=
-			dst_port=
-		}
-	else
-		return 1
-	fi
-}
-
-# Set up function to send TCP traffic on IPv6
-setup_flood_tcp6() {
-	if command -v iperf3 >/dev/null; then
-		flood_tcp6() {
-			[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
-			if [ -n "${src_addr6}" ]; then
-				B ip addr add "${src_addr6}" dev veth_b nodad
-				src_addr6="-B ${src_addr6}"
-			else
-				src_addr6="-B 2001:db8::2"
-			fi
-			if [ -n "${src_port}" ]; then
-				src_port="--cport ${src_port}"
-			fi
-			B ip route add default dev veth_b
-			ip -6 addr add "${dst_addr6}" dev veth_a nodad \
-				2>/dev/null
-
-			# shellcheck disable=SC2086 # this needs split options
-			iperf3 -s -DB "${dst_addr6}" ${dst_port} >/dev/null 2>&1
-			sleep 2
-
-			# shellcheck disable=SC2086 # this needs split options
-			B iperf3 -c "${dst_addr6}" ${dst_port} \
-				${src_port} ${src_addr6} -l16 -t 1000
-
-			src_addr6=
-			src_port=
-			dst_port=
-		}
-	elif command -v iperf >/dev/null; then
-		flood_tcp6() {
-			[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
-			if [ -n "${src_addr6}" ]; then
-				B ip addr add "${src_addr6}" dev veth_b nodad
-				src_addr6="-B ${src_addr6}"
-			else
-				src_addr6="-B 2001:db8::2"
-			fi
-			if [ -n "${src_port}" ]; then
-				src_addr6="${src_addr6}:${src_port}"
-			fi
-			B ip route add default dev veth_b
-			ip -6 addr add "${dst_addr6}" dev veth_a nodad \
-				2>/dev/null
-
-			# shellcheck disable=SC2086 # this needs split options
-			iperf -s -VDB "${dst_addr6}" ${dst_port} >/dev/null 2>&1
-			sleep 2
-
-			# shellcheck disable=SC2086 # this needs split options
-			B iperf -c "${dst_addr6}" -V ${dst_port} \
-				${src_addr6} -l1 -t 1000
-
-			src_addr6=
-			src_port=
-			dst_port=
-		}
-	elif command -v netperf >/dev/null; then
-		flood_tcp6() {
-			[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
-			if [ -n "${src_addr6}" ]; then
-				B ip addr add "${src_addr6}" dev veth_b nodad
-			else
-				src_addr6="2001:db8::2"
-			fi
-			if [ -n "${src_port}" ]; then
-				dst_port="${dst_port},${src_port}"
-			fi
-			B ip route add default dev veth_b
-			ip -6 addr add "${dst_addr6}" dev veth_a nodad \
-				2>/dev/null
-
-			# shellcheck disable=SC2086 # this needs split options
-			netserver -6 ${dst_port} -L "${dst_addr6}" \
-				>/dev/null 2>&1
-			sleep 2
-
-			# shellcheck disable=SC2086 # this needs split options
-			B netperf -6 -H "${dst_addr6}" ${dst_port} \
-				-L "${src_addr6}" -l 1000 -t TCP_STREAM
-
-			src_addr6=
-			src_port=
-			dst_port=
-		}
-	else
-		return 1
-	fi
-}
-
-# Set up function to send UDP traffic on IPv4
-setup_flood_udp() {
-	if command -v iperf3 >/dev/null; then
-		flood_udp() {
-			[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
-			if [ -n "${src_addr4}" ]; then
-				B ip addr add "${src_addr4}/16" dev veth_b
-				src_addr4="-B ${src_addr4}"
-			else
-				B ip addr add dev veth_b 10.0.0.2 2>/dev/null
-				src_addr4="-B 10.0.0.2"
-			fi
-			if [ -n "${src_port}" ]; then
-				src_port="--cport ${src_port}"
-			fi
-			B ip route add default dev veth_b
-			ip addr add "${dst_addr4}" dev veth_a 2>/dev/null
-
-			# shellcheck disable=SC2086 # this needs split options
-			iperf3 -s -DB "${dst_addr4}" ${dst_port}
-			sleep 2
-
-			# shellcheck disable=SC2086 # this needs split options
-			B iperf3 -u -c "${dst_addr4}" -Z -b 100M -l16 -t1000 \
-				${dst_port} ${src_port} ${src_addr4}
-
-			src_addr4=
-			src_port=
-			dst_port=
-		}
-	elif command -v iperf >/dev/null; then
-		flood_udp() {
-			[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
-			if [ -n "${src_addr4}" ]; then
-				B ip addr add "${src_addr4}/16" dev veth_b
-				src_addr4="-B ${src_addr4}"
-			else
-				B ip addr add dev veth_b 10.0.0.2
-				src_addr4="-B 10.0.0.2"
-			fi
-			if [ -n "${src_port}" ]; then
-				src_addr4="${src_addr4}:${src_port}"
-			fi
-			B ip route add default dev veth_b
-			ip addr add "${dst_addr4}" dev veth_a 2>/dev/null
-
-			# shellcheck disable=SC2086 # this needs split options
-			iperf -u -sDB "${dst_addr4}" ${dst_port} >/dev/null 2>&1
-			sleep 2
-
-			# shellcheck disable=SC2086 # this needs split options
-			B iperf -u -c "${dst_addr4}" -b 100M -l1 -t1000 \
-				${dst_port} ${src_addr4}
-
-			src_addr4=
-			src_port=
-			dst_port=
-		}
-	elif command -v netperf >/dev/null; then
-		flood_udp() {
-			[ -n "${dst_port}" ] && dst_port="-p ${dst_port}"
-			if [ -n "${src_addr4}" ]; then
-				B ip addr add "${src_addr4}/16" dev veth_b
-			else
-				B ip addr add dev veth_b 10.0.0.2
-				src_addr4="10.0.0.2"
-			fi
-			if [ -n "${src_port}" ]; then
-				dst_port="${dst_port},${src_port}"
-			fi
-			B ip route add default dev veth_b
-			ip addr add "${dst_addr4}" dev veth_a 2>/dev/null
-
-			# shellcheck disable=SC2086 # this needs split options
-			netserver -4 ${dst_port} -L "${dst_addr4}" \
-				>/dev/null 2>&1
-			sleep 2
-
-			# shellcheck disable=SC2086 # this needs split options
-			B netperf -4 -H "${dst_addr4}" ${dst_port} \
-				-L "${src_addr4}" -l 1000 -t UDP_STREAM
-
-			src_addr4=
-			src_port=
-			dst_port=
-		}
-	else
-		return 1
-	fi
-}
-
-# Find pktgen script and set up function to start pktgen injection
-setup_perf() {
-	for pktgen_script_path in ${PKTGEN_SCRIPT_PATHS} __notfound; do
-		command -v "${pktgen_script_path}" >/dev/null && break
-	done
-	[ "${pktgen_script_path}" = "__notfound" ] && return 1
-
-	perf_ipv4() {
-		${pktgen_script_path} -s80 \
-			-i veth_a -d "${dst_addr4}" -p "${dst_port}" \
-			-m "${dst_mac}" \
-			-t $(($(nproc) / 5 + 1)) -b10000 -n0 2>/dev/null &
-		perf_pid=$!
-	}
-	perf_ipv6() {
-		IP6=6 ${pktgen_script_path} -s100 \
-			-i veth_a -d "${dst_addr6}" -p "${dst_port}" \
-			-m "${dst_mac}" \
-			-t $(($(nproc) / 5 + 1)) -b10000 -n0 2>/dev/null &
-		perf_pid=$!
-	}
-}
-
-# Clean up before each test
-cleanup() {
-	nft reset counter inet filter test	>/dev/null 2>&1
-	nft flush ruleset			>/dev/null 2>&1
-	ip link del dummy0			2>/dev/null
-	ip route del default			2>/dev/null
-	ip -6 route del default			2>/dev/null
-	ip netns del B				2>/dev/null
-	ip link del veth_a			2>/dev/null
-	timeout=
-	killall iperf3				2>/dev/null
-	killall iperf				2>/dev/null
-	killall netperf				2>/dev/null
-	killall netserver			2>/dev/null
-	rm -f ${tmp}
-	sleep 2
-}
-
-# Entry point for setup functions
-setup() {
-	if [ "$(id -u)" -ne 0 ]; then
-		echo "  need to run as root"
-		exit ${KSELFTEST_SKIP}
-	fi
-
-	cleanup
-	check_tools || return 1
-	for arg do
-		if ! eval setup_"${arg}"; then
-			err "  ${arg} not supported"
-			return 1
-		fi
-	done
-}
-
-# Format integer into IPv4 address, summing 10.0.0.5 (arbitrary) to it
-format_addr4() {
-	a=$((${1} + 16777216 * 10 + 5))
-	printf "%i.%i.%i.%i"						\
-	       "$((a / 16777216))" "$((a % 16777216 / 65536))"	\
-	       "$((a % 65536 / 256))" "$((a % 256))"
-}
-
-# Format integer into IPv6 address, summing 2001:db8:: to it
-format_addr6() {
-	printf "2001:db8::%04x:%04x" "$((${1} / 65536))" "$((${1} % 65536))"
-}
-
-# Format integer into EUI-48 address, summing 00:01:00:00:00:00 to it
-format_mac() {
-	printf "00:01:%02x:%02x:%02x:%02x" \
-	       "$((${1} / 16777216))" "$((${1} % 16777216 / 65536))"	\
-	       "$((${1} % 65536 / 256))" "$((${1} % 256))"
-}
-
-# Format integer into port, avoid 0 port
-format_port() {
-	printf "%i" "$((${1} % 65534 + 1))"
-}
-
-# Drop suffixed '6' from L4 protocol, if any
-format_proto() {
-	printf "%s" "${proto}" | tr -d 6
-}
-
-# Format destination and source fields into nft concatenated type
-format() {
-	__start=
-	__end=
-	__expr="{ "
-
-	for f in ${dst}; do
-		[ "${__expr}" != "{ " ] && __expr="${__expr} . "
-
-		__start="$(eval format_"${f}" "${start}")"
-		__end="$(eval format_"${f}" "${end}")"
-
-		if [ "${f}" = "proto" ]; then
-			__expr="${__expr}${__start}"
-		else
-			__expr="${__expr}${__start}-${__end}"
-		fi
-	done
-	for f in ${src}; do
-		__expr="${__expr} . "
-		__start="$(eval format_"${f}" "${srcstart}")"
-		__end="$(eval format_"${f}" "${srcend}")"
-
-		if [ "${f}" = "proto" ]; then
-			__expr="${__expr}${__start}"
-		else
-			__expr="${__expr}${__start}-${__end}"
-		fi
-	done
-
-	if [ -n "${timeout}" ]; then
-		echo "${__expr} timeout ${timeout}s }"
-	else
-		echo "${__expr} }"
-	fi
-}
-
-# Format destination and source fields into nft type, start element only
-format_norange() {
-	__expr="{ "
-
-	for f in ${dst}; do
-		[ "${__expr}" != "{ " ] && __expr="${__expr} . "
-
-		__expr="${__expr}$(eval format_"${f}" "${start}")"
-	done
-	for f in ${src}; do
-		__expr="${__expr} . $(eval format_"${f}" "${start}")"
-	done
-
-	echo "${__expr} }"
-}
-
-# Format first destination field into nft type
-format_noconcat() {
-	for f in ${dst}; do
-		__start="$(eval format_"${f}" "${start}")"
-		__end="$(eval format_"${f}" "${end}")"
-
-		if [ "${f}" = "proto" ]; then
-			echo "{ ${__start} }"
-		else
-			echo "{ ${__start}-${__end} }"
-		fi
-		return
-	done
-}
-
-# Add single entry to 'test' set in 'inet filter' table
-add() {
-	if ! nft add element inet filter test "${1}"; then
-		err "Failed to add ${1} given ruleset:"
-		err "$(nft -a list ruleset)"
-		return 1
-	fi
-}
-
-# Format and output entries for sets in 'netdev perf' table
-add_perf() {
-	if [ "${1}" = "test" ]; then
-		echo "add element netdev perf test $(format)"
-	elif [ "${1}" = "norange" ]; then
-		echo "add element netdev perf norange $(format_norange)"
-	elif [ "${1}" = "noconcat" ]; then
-		echo "add element netdev perf noconcat $(format_noconcat)"
-	fi
-}
-
-# Add single entry to 'norange' set in 'netdev perf' table
-add_perf_norange() {
-	if ! nft add element netdev perf norange "${1}"; then
-		err "Failed to add ${1} given ruleset:"
-		err "$(nft -a list ruleset)"
-		return 1
-	fi
-}
-
-# Add single entry to 'noconcat' set in 'netdev perf' table
-add_perf_noconcat() {
-	if ! nft add element netdev perf noconcat "${1}"; then
-		err "Failed to add ${1} given ruleset:"
-		err "$(nft -a list ruleset)"
-		return 1
-	fi
-}
-
-# Delete single entry from set
-del() {
-	if ! nft delete element inet filter test "${1}"; then
-		err "Failed to delete ${1} given ruleset:"
-		err "$(nft -a list ruleset)"
-		return 1
-	fi
-}
-
-# Return packet count from 'test' counter in 'inet filter' table
-count_packets() {
-	found=0
-	for token in $(nft list counter inet filter test); do
-		[ ${found} -eq 1 ] && echo "${token}" && return
-		[ "${token}" = "packets" ] && found=1
-	done
-}
-
-# Return packet count from 'test' counter in 'netdev perf' table
-count_perf_packets() {
-	found=0
-	for token in $(nft list counter netdev perf test); do
-		[ ${found} -eq 1 ] && echo "${token}" && return
-		[ "${token}" = "packets" ] && found=1
-	done
-}
-
-# Set MAC addresses, send traffic according to specifier
-flood() {
-	ip link set veth_a address "$(format_mac "${1}")"
-	ip -n B link set veth_b address "$(format_mac "${2}")"
-
-	for f in ${dst}; do
-		eval dst_"$f"=\$\(format_\$f "${1}"\)
-	done
-	for f in ${src}; do
-		eval src_"$f"=\$\(format_\$f "${2}"\)
-	done
-	eval flood_\$proto
-}
-
-# Set MAC addresses, start pktgen injection
-perf() {
-	dst_mac="$(format_mac "${1}")"
-	ip link set veth_a address "${dst_mac}"
-
-	for f in ${dst}; do
-		eval dst_"$f"=\$\(format_\$f "${1}"\)
-	done
-	for f in ${src}; do
-		eval src_"$f"=\$\(format_\$f "${2}"\)
-	done
-	eval perf_\$perf_proto
-}
-
-# Set MAC addresses, send single packet, check that it matches, reset counter
-send_match() {
-	ip link set veth_a address "$(format_mac "${1}")"
-	ip -n B link set veth_b address "$(format_mac "${2}")"
-
-	for f in ${dst}; do
-		eval dst_"$f"=\$\(format_\$f "${1}"\)
-	done
-	for f in ${src}; do
-		eval src_"$f"=\$\(format_\$f "${2}"\)
-	done
-	eval send_\$proto
-	if [ "$(count_packets)" != "1" ]; then
-		err "${proto} packet to:"
-		err "  $(for f in ${dst}; do
-			 eval format_\$f "${1}"; printf ' '; done)"
-		err "from:"
-		err "  $(for f in ${src}; do
-			 eval format_\$f "${2}"; printf ' '; done)"
-		err "should have matched ruleset:"
-		err "$(nft -a list ruleset)"
-		return 1
-	fi
-	nft reset counter inet filter test >/dev/null
-}
-
-# Set MAC addresses, send single packet, check that it doesn't match
-send_nomatch() {
-	ip link set veth_a address "$(format_mac "${1}")"
-	ip -n B link set veth_b address "$(format_mac "${2}")"
-
-	for f in ${dst}; do
-		eval dst_"$f"=\$\(format_\$f "${1}"\)
-	done
-	for f in ${src}; do
-		eval src_"$f"=\$\(format_\$f "${2}"\)
-	done
-	eval send_\$proto
-	if [ "$(count_packets)" != "0" ]; then
-		err "${proto} packet to:"
-		err "  $(for f in ${dst}; do
-			 eval format_\$f "${1}"; printf ' '; done)"
-		err "from:"
-		err "  $(for f in ${src}; do
-			 eval format_\$f "${2}"; printf ' '; done)"
-		err "should not have matched ruleset:"
-		err "$(nft -a list ruleset)"
-		return 1
-	fi
-}
-
-# Correctness test template:
-# - add ranged element, check that packets match it
-# - check that packets outside range don't match it
-# - remove some elements, check that packets don't match anymore
-test_correctness() {
-	setup veth send_"${proto}" set || return ${KSELFTEST_SKIP}
-
-	range_size=1
-	for i in $(seq "${start}" $((start + count))); do
-		end=$((start + range_size))
-
-		# Avoid negative or zero-sized port ranges
-		if [ $((end / 65534)) -gt $((start / 65534)) ]; then
-			start=${end}
-			end=$((end + 1))
-		fi
-		srcstart=$((start + src_delta))
-		srcend=$((end + src_delta))
-
-		add "$(format)" || return 1
-		for j in $(seq ${start} $((range_size / 2 + 1)) ${end}); do
-			send_match "${j}" $((j + src_delta)) || return 1
-		done
-		send_nomatch $((end + 1)) $((end + 1 + src_delta)) || return 1
-
-		# Delete elements now and then
-		if [ $((i % 3)) -eq 0 ]; then
-			del "$(format)" || return 1
-			for j in $(seq ${start} \
-				   $((range_size / 2 + 1)) ${end}); do
-				send_nomatch "${j}" $((j + src_delta)) \
-					|| return 1
-			done
-		fi
-
-		range_size=$((range_size + 1))
-		start=$((end + range_size))
-	done
-}
-
-# Concurrency test template:
-# - add all the elements
-# - start a thread for each physical thread that:
-#   - adds all the elements
-#   - flushes the set
-#   - adds all the elements
-#   - flushes the entire ruleset
-#   - adds the set back
-#   - adds all the elements
-#   - delete all the elements
-test_concurrency() {
-	proto=${flood_proto}
-	tools=${flood_tools}
-	chain_spec=${flood_spec}
-	setup veth flood_"${proto}" set || return ${KSELFTEST_SKIP}
-
-	range_size=1
-	cstart=${start}
-	flood_pids=
-	for i in $(seq ${start} $((start + count))); do
-		end=$((start + range_size))
-		srcstart=$((start + src_delta))
-		srcend=$((end + src_delta))
-
-		add "$(format)" || return 1
-
-		flood "${i}" $((i + src_delta)) & flood_pids="${flood_pids} $!"
-
-		range_size=$((range_size + 1))
-		start=$((end + range_size))
-	done
-
-	sleep 10
-
-	pids=
-	for c in $(seq 1 "$(nproc)"); do (
-		for r in $(seq 1 "${race_repeat}"); do
-			range_size=1
-
-			# $start needs to be local to this subshell
-			# shellcheck disable=SC2030
-			start=${cstart}
-			for i in $(seq ${start} $((start + count))); do
-				end=$((start + range_size))
-				srcstart=$((start + src_delta))
-				srcend=$((end + src_delta))
-
-				add "$(format)" 2>/dev/null
-
-				range_size=$((range_size + 1))
-				start=$((end + range_size))
-			done
-
-			nft flush inet filter test 2>/dev/null
-
-			range_size=1
-			start=${cstart}
-			for i in $(seq ${start} $((start + count))); do
-				end=$((start + range_size))
-				srcstart=$((start + src_delta))
-				srcend=$((end + src_delta))
-
-				add "$(format)" 2>/dev/null
-
-				range_size=$((range_size + 1))
-				start=$((end + range_size))
-			done
-
-			nft flush ruleset
-			setup set 2>/dev/null
-
-			range_size=1
-			start=${cstart}
-			for i in $(seq ${start} $((start + count))); do
-				end=$((start + range_size))
-				srcstart=$((start + src_delta))
-				srcend=$((end + src_delta))
-
-				add "$(format)" 2>/dev/null
-
-				range_size=$((range_size + 1))
-				start=$((end + range_size))
-			done
-
-			range_size=1
-			start=${cstart}
-			for i in $(seq ${start} $((start + count))); do
-				end=$((start + range_size))
-				srcstart=$((start + src_delta))
-				srcend=$((end + src_delta))
-
-				del "$(format)" 2>/dev/null
-
-				range_size=$((range_size + 1))
-				start=$((end + range_size))
-			done
-		done
-	) & pids="${pids} $!"
-	done
-
-	# shellcheck disable=SC2046,SC2086 # word splitting wanted here
-	wait $(for pid in ${pids}; do echo ${pid}; done)
-	# shellcheck disable=SC2046,SC2086
-	kill $(for pid in ${flood_pids}; do echo ${pid}; done) 2>/dev/null
-	# shellcheck disable=SC2046,SC2086
-	wait $(for pid in ${flood_pids}; do echo ${pid}; done) 2>/dev/null
-
-	return 0
-}
-
-# Timeout test template:
-# - add all the elements with 3s timeout while checking that packets match
-# - wait 3s after the last insertion, check that packets don't match any entry
-test_timeout() {
-	setup veth send_"${proto}" set || return ${KSELFTEST_SKIP}
-
-	timeout=3
-	range_size=1
-	for i in $(seq "${start}" $((start + count))); do
-		end=$((start + range_size))
-		srcstart=$((start + src_delta))
-		srcend=$((end + src_delta))
-
-		add "$(format)" || return 1
-
-		for j in $(seq ${start} $((range_size / 2 + 1)) ${end}); do
-			send_match "${j}" $((j + src_delta)) || return 1
-		done
-
-		range_size=$((range_size + 1))
-		start=$((end + range_size))
-	done
-	sleep 3
-	for i in $(seq ${start} $((start + count))); do
-		end=$((start + range_size))
-		srcstart=$((start + src_delta))
-		srcend=$((end + src_delta))
-
-		for j in $(seq ${start} $((range_size / 2 + 1)) ${end}); do
-			send_nomatch "${j}" $((j + src_delta)) || return 1
-		done
-
-		range_size=$((range_size + 1))
-		start=$((end + range_size))
-	done
-}
-
-# Performance test template:
-# - add concatenated ranged entries
-# - add non-ranged concatenated entries (for hash set matching rate baseline)
-# - add ranged entries with first field only (for rbhash baseline)
-# - start pktgen injection directly on device rx path of this namespace
-# - measure drop only rate, hash and rbtree baselines, then matching rate
-test_performance() {
-	chain_spec=${perf_spec}
-	dst="${perf_dst}"
-	src="${perf_src}"
-	setup veth perf set || return ${KSELFTEST_SKIP}
-
-	first=${start}
-	range_size=1
-	for set in test norange noconcat; do
-		start=${first}
-		for i in $(seq ${start} $((start + perf_entries))); do
-			end=$((start + range_size))
-			srcstart=$((start + src_delta))
-			srcend=$((end + src_delta))
-
-			if [ $((end / 65534)) -gt $((start / 65534)) ]; then
-				start=${end}
-				end=$((end + 1))
-			elif [ ${start} -eq ${end} ]; then
-				end=$((start + 1))
-			fi
-
-			add_perf ${set}
-
-			start=$((end + range_size))
-		done > "${tmp}"
-		nft -f "${tmp}"
-	done
-
-	perf $((end - 1)) ${srcstart}
-
-	sleep 2
-
-	nft add rule netdev perf test counter name \"test\" drop
-	nft reset counter netdev perf test >/dev/null 2>&1
-	sleep "${perf_duration}"
-	pps="$(printf %10s $(($(count_perf_packets) / perf_duration)))"
-	info "    baseline (drop from netdev hook):            ${pps}pps"
-	handle="$(nft -a list chain netdev perf test | grep counter)"
-	handle="${handle##* }"
-	nft delete rule netdev perf test handle "${handle}"
-
-	nft add rule "netdev perf test ${chain_spec} @norange \
-		counter name \"test\" drop"
-	nft reset counter netdev perf test >/dev/null 2>&1
-	sleep "${perf_duration}"
-	pps="$(printf %10s $(($(count_perf_packets) / perf_duration)))"
-	info "    baseline hash (non-ranged entries):          ${pps}pps"
-	handle="$(nft -a list chain netdev perf test | grep counter)"
-	handle="${handle##* }"
-	nft delete rule netdev perf test handle "${handle}"
-
-	nft add rule "netdev perf test ${chain_spec%%. *} @noconcat \
-		counter name \"test\" drop"
-	nft reset counter netdev perf test >/dev/null 2>&1
-	sleep "${perf_duration}"
-	pps="$(printf %10s $(($(count_perf_packets) / perf_duration)))"
-	info "    baseline rbtree (match on first field only): ${pps}pps"
-	handle="$(nft -a list chain netdev perf test | grep counter)"
-	handle="${handle##* }"
-	nft delete rule netdev perf test handle "${handle}"
-
-	nft add rule "netdev perf test ${chain_spec} @test \
-		counter name \"test\" drop"
-	nft reset counter netdev perf test >/dev/null 2>&1
-	sleep "${perf_duration}"
-	pps="$(printf %10s $(($(count_perf_packets) / perf_duration)))"
-	p5="$(printf %5s "${perf_entries}")"
-	info "    set with ${p5} full, ranged entries:         ${pps}pps"
-	kill "${perf_pid}"
-}
-
-test_bug_flush_remove_add() {
-	set_cmd='{ set s { type ipv4_addr . inet_service; flags interval; }; }'
-	elem1='{ 10.0.0.1 . 22-25, 10.0.0.1 . 10-20 }'
-	elem2='{ 10.0.0.1 . 10-20, 10.0.0.1 . 22-25 }'
-	for i in `seq 1 100`; do
-		nft add table t ${set_cmd}	|| return ${KSELFTEST_SKIP}
-		nft add element t s ${elem1}	2>/dev/null || return 1
-		nft flush set t s		2>/dev/null || return 1
-		nft add element t s ${elem2}	2>/dev/null || return 1
-	done
-	nft flush ruleset
-}
-
-test_reported_issues() {
-	eval test_bug_"${subtest}"
-}
-
-# Run everything in a separate network namespace
-[ "${1}" != "run" ] && { unshare -n "${0}" run; exit $?; }
-tmp="$(mktemp)"
-trap cleanup EXIT
-
-# Entry point for test runs
-passed=0
-for name in ${TESTS}; do
-	printf "TEST: %s\n" "$(echo ${name} | tr '_' ' ')"
-	if [ "${name}" = "reported_issues" ]; then
-		SUBTESTS="${BUGS}"
-	else
-		SUBTESTS="${TYPES}"
-	fi
-
-	for subtest in ${SUBTESTS}; do
-		eval desc=\$TYPE_"${subtest}"
-		IFS='
-'
-		for __line in ${desc}; do
-			# shellcheck disable=SC2086
-			eval ${__line%%	*}=\"${__line##*	}\";
-		done
-		IFS=' 	
-'
-
-		if [ "${name}" = "concurrency" ] && \
-		   [ "${race_repeat}" = "0" ]; then
-			continue
-		fi
-		if [ "${name}" = "performance" ] && \
-		   [ "${perf_duration}" = "0" ]; then
-			continue
-		fi
-
-		printf "  %-60s  " "${display}"
-		eval test_"${name}"
-		ret=$?
-
-		if [ $ret -eq 0 ]; then
-			printf "[ OK ]\n"
-			info_flush
-			passed=$((passed + 1))
-		elif [ $ret -eq 1 ]; then
-			printf "[FAIL]\n"
-			err_flush
-			exit 1
-		elif [ $ret -eq ${KSELFTEST_SKIP} ]; then
-			printf "[SKIP]\n"
-			err_flush
-		fi
-	done
-done
-
-[ ${passed} -eq 0 ] && exit ${KSELFTEST_SKIP}
diff --git a/tools/testing/selftests/netfilter/nft_conntrack_helper.sh b/tools/testing/selftests/netfilter/nft_conntrack_helper.sh
deleted file mode 100755
index edf0a48da6bf..000000000000
--- a/tools/testing/selftests/netfilter/nft_conntrack_helper.sh
+++ /dev/null
@@ -1,175 +0,0 @@
-#!/bin/bash
-#
-# This tests connection tracking helper assignment:
-# 1. can attach ftp helper to a connection from nft ruleset.
-# 2. auto-assign still works.
-#
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-ret=0
-
-sfx=$(mktemp -u "XXXXXXXX")
-ns1="ns1-$sfx"
-ns2="ns2-$sfx"
-testipv6=1
-
-cleanup()
-{
-	ip netns del ${ns1}
-	ip netns del ${ns2}
-}
-
-nft --version > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without nft tool"
-	exit $ksft_skip
-fi
-
-ip -Version > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without ip tool"
-	exit $ksft_skip
-fi
-
-conntrack -V > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without conntrack tool"
-	exit $ksft_skip
-fi
-
-which nc >/dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without netcat tool"
-	exit $ksft_skip
-fi
-
-trap cleanup EXIT
-
-ip netns add ${ns1}
-ip netns add ${ns2}
-
-ip link add veth0 netns ${ns1} type veth peer name veth0 netns ${ns2} > /dev/null 2>&1
-if [ $? -ne 0 ];then
-    echo "SKIP: No virtual ethernet pair device support in kernel"
-    exit $ksft_skip
-fi
-
-ip -net ${ns1} link set lo up
-ip -net ${ns1} link set veth0 up
-
-ip -net ${ns2} link set lo up
-ip -net ${ns2} link set veth0 up
-
-ip -net ${ns1} addr add 10.0.1.1/24 dev veth0
-ip -net ${ns1} addr add dead:1::1/64 dev veth0
-
-ip -net ${ns2} addr add 10.0.1.2/24 dev veth0
-ip -net ${ns2} addr add dead:1::2/64 dev veth0
-
-load_ruleset_family() {
-	local family=$1
-	local ns=$2
-
-ip netns exec ${ns} nft -f - <<EOF
-table $family raw {
-	ct helper ftp {
-             type "ftp" protocol tcp
-        }
-	chain pre {
-		type filter hook prerouting priority 0; policy accept;
-		tcp dport 2121 ct helper set "ftp"
-	}
-	chain output {
-		type filter hook output priority 0; policy accept;
-		tcp dport 2121 ct helper set "ftp"
-	}
-}
-EOF
-	return $?
-}
-
-check_for_helper()
-{
-	local netns=$1
-	local message=$2
-	local port=$3
-
-	ip netns exec ${netns} conntrack -L -p tcp --dport $port 2> /dev/null |grep -q 'helper=ftp'
-	if [ $? -ne 0 ] ; then
-		echo "FAIL: ${netns} did not show attached helper $message" 1>&2
-		ret=1
-	fi
-
-	echo "PASS: ${netns} connection on port $port has ftp helper attached" 1>&2
-	return 0
-}
-
-test_helper()
-{
-	local port=$1
-	local msg=$2
-
-	sleep 3 | ip netns exec ${ns2} nc -w 2 -l -p $port > /dev/null &
-
-	sleep 1
-	sleep 1 | ip netns exec ${ns1} nc -w 2 10.0.1.2 $port > /dev/null &
-
-	check_for_helper "$ns1" "ip $msg" $port
-	check_for_helper "$ns2" "ip $msg" $port
-
-	wait
-
-	if [ $testipv6 -eq 0 ] ;then
-		return 0
-	fi
-
-	ip netns exec ${ns1} conntrack -F 2> /dev/null
-	ip netns exec ${ns2} conntrack -F 2> /dev/null
-
-	sleep 3 | ip netns exec ${ns2} nc -w 2 -6 -l -p $port > /dev/null &
-
-	sleep 1
-	sleep 1 | ip netns exec ${ns1} nc -w 2 -6 dead:1::2 $port > /dev/null &
-
-	check_for_helper "$ns1" "ipv6 $msg" $port
-	check_for_helper "$ns2" "ipv6 $msg" $port
-
-	wait
-}
-
-load_ruleset_family ip ${ns1}
-if [ $? -ne 0 ];then
-	echo "FAIL: ${ns1} cannot load ip ruleset" 1>&2
-	exit 1
-fi
-
-load_ruleset_family ip6 ${ns1}
-if [ $? -ne 0 ];then
-	echo "SKIP: ${ns1} cannot load ip6 ruleset" 1>&2
-	testipv6=0
-fi
-
-load_ruleset_family inet ${ns2}
-if [ $? -ne 0 ];then
-	echo "SKIP: ${ns1} cannot load inet ruleset" 1>&2
-	load_ruleset_family ip ${ns2}
-	if [ $? -ne 0 ];then
-		echo "FAIL: ${ns2} cannot load ip ruleset" 1>&2
-		exit 1
-	fi
-
-	if [ $testipv6 -eq 1 ] ;then
-		load_ruleset_family ip6 ${ns2}
-		if [ $? -ne 0 ];then
-			echo "FAIL: ${ns2} cannot load ip6 ruleset" 1>&2
-			exit 1
-		fi
-	fi
-fi
-
-test_helper 2121 "set via ruleset"
-ip netns exec ${ns1} sysctl -q 'net.netfilter.nf_conntrack_helper=1'
-ip netns exec ${ns2} sysctl -q 'net.netfilter.nf_conntrack_helper=1'
-test_helper 21 "auto-assign"
-
-exit $ret
diff --git a/tools/testing/selftests/netfilter/nft_flowtable.sh b/tools/testing/selftests/netfilter/nft_flowtable.sh
deleted file mode 100755
index d3e0809ab368..000000000000
--- a/tools/testing/selftests/netfilter/nft_flowtable.sh
+++ /dev/null
@@ -1,401 +0,0 @@
-#!/bin/bash
-# SPDX-License-Identifier: GPL-2.0
-#
-# This tests basic flowtable functionality.
-# Creates following topology:
-#
-# Originator (MTU 9000) <-Router1-> MTU 1500 <-Router2-> Responder (MTU 2000)
-# Router1 is the one doing flow offloading, Router2 has no special
-# purpose other than having a link that is smaller than either Originator
-# and responder, i.e. TCPMSS announced values are too large and will still
-# result in fragmentation and/or PMTU discovery.
-
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-ret=0
-
-ns1in=""
-ns2in=""
-ns1out=""
-ns2out=""
-
-log_netns=$(sysctl -n net.netfilter.nf_log_all_netns)
-
-nft --version > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without nft tool"
-	exit $ksft_skip
-fi
-
-ip -Version > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without ip tool"
-	exit $ksft_skip
-fi
-
-which nc > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without nc (netcat)"
-	exit $ksft_skip
-fi
-
-ip netns add nsr1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not create net namespace"
-	exit $ksft_skip
-fi
-
-ip netns add ns1
-ip netns add ns2
-
-ip netns add nsr2
-
-cleanup() {
-	for i in 1 2; do
-		ip netns del ns$i
-		ip netns del nsr$i
-	done
-
-	rm -f "$ns1in" "$ns1out"
-	rm -f "$ns2in" "$ns2out"
-
-	[ $log_netns -eq 0 ] && sysctl -q net.netfilter.nf_log_all_netns=$log_netns
-}
-
-trap cleanup EXIT
-
-sysctl -q net.netfilter.nf_log_all_netns=1
-
-ip link add veth0 netns nsr1 type veth peer name eth0 netns ns1
-ip link add veth1 netns nsr1 type veth peer name veth0 netns nsr2
-
-ip link add veth1 netns nsr2 type veth peer name eth0 netns ns2
-
-for dev in lo veth0 veth1; do
-  for i in 1 2; do
-    ip -net nsr$i link set $dev up
-  done
-done
-
-ip -net nsr1 addr add 10.0.1.1/24 dev veth0
-ip -net nsr1 addr add dead:1::1/64 dev veth0
-
-ip -net nsr2 addr add 10.0.2.1/24 dev veth1
-ip -net nsr2 addr add dead:2::1/64 dev veth1
-
-# set different MTUs so we need to push packets coming from ns1 (large MTU)
-# to ns2 (smaller MTU) to stack either to perform fragmentation (ip_no_pmtu_disc=1),
-# or to do PTMU discovery (send ICMP error back to originator).
-# ns2 is going via nsr2 with a smaller mtu, so that TCPMSS announced by both peers
-# is NOT the lowest link mtu.
-
-ip -net nsr1 link set veth0 mtu 9000
-ip -net ns1 link set eth0 mtu 9000
-
-ip -net nsr2 link set veth1 mtu 2000
-ip -net ns2 link set eth0 mtu 2000
-
-# transfer-net between nsr1 and nsr2.
-# these addresses are not used for connections.
-ip -net nsr1 addr add 192.168.10.1/24 dev veth1
-ip -net nsr1 addr add fee1:2::1/64 dev veth1
-
-ip -net nsr2 addr add 192.168.10.2/24 dev veth0
-ip -net nsr2 addr add fee1:2::2/64 dev veth0
-
-for i in 1 2; do
-  ip netns exec nsr$i sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
-  ip netns exec nsr$i sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
-
-  ip -net ns$i link set lo up
-  ip -net ns$i link set eth0 up
-  ip -net ns$i addr add 10.0.$i.99/24 dev eth0
-  ip -net ns$i route add default via 10.0.$i.1
-  ip -net ns$i addr add dead:$i::99/64 dev eth0
-  ip -net ns$i route add default via dead:$i::1
-  ip netns exec ns$i sysctl net.ipv4.tcp_no_metrics_save=1 > /dev/null
-
-  # don't set ip DF bit for first two tests
-  ip netns exec ns$i sysctl net.ipv4.ip_no_pmtu_disc=1 > /dev/null
-done
-
-ip -net nsr1 route add default via 192.168.10.2
-ip -net nsr2 route add default via 192.168.10.1
-
-ip netns exec nsr1 nft -f - <<EOF
-table inet filter {
-  flowtable f1 {
-     hook ingress priority 0
-     devices = { veth0, veth1 }
-   }
-
-   chain forward {
-      type filter hook forward priority 0; policy drop;
-
-      # flow offloaded? Tag ct with mark 1, so we can detect when it fails.
-      meta oif "veth1" tcp dport 12345 flow offload @f1 counter
-
-      # use packet size to trigger 'should be offloaded by now'.
-      # otherwise, if 'flow offload' expression never offloads, the
-      # test will pass.
-      tcp dport 12345 meta length gt 200 ct mark set 1 counter
-
-      # this turns off flow offloading internally, so expect packets again
-      tcp flags fin,rst ct mark set 0 accept
-
-      # this allows large packets from responder, we need this as long
-      # as PMTUd is off.
-      # This rule is deleted for the last test, when we expect PMTUd
-      # to kick in and ensure all packets meet mtu requirements.
-      meta length gt 1500 accept comment something-to-grep-for
-
-      # next line blocks connection w.o. working offload.
-      # we only do this for reverse dir, because we expect packets to
-      # enter slow path due to MTU mismatch of veth0 and veth1.
-      tcp sport 12345 ct mark 1 counter log prefix "mark failure " drop
-
-      ct state established,related accept
-
-      # for packets that we can't offload yet, i.e. SYN (any ct that is not confirmed)
-      meta length lt 200 oif "veth1" tcp dport 12345 counter accept
-
-      meta nfproto ipv4 meta l4proto icmp accept
-      meta nfproto ipv6 meta l4proto icmpv6 accept
-   }
-}
-EOF
-
-if [ $? -ne 0 ]; then
-	echo "SKIP: Could not load nft ruleset"
-	exit $ksft_skip
-fi
-
-# test basic connectivity
-ip netns exec ns1 ping -c 1 -q 10.0.2.99 > /dev/null
-if [ $? -ne 0 ];then
-  echo "ERROR: ns1 cannot reach ns2" 1>&2
-  bash
-  exit 1
-fi
-
-ip netns exec ns2 ping -c 1 -q 10.0.1.99 > /dev/null
-if [ $? -ne 0 ];then
-  echo "ERROR: ns2 cannot reach ns1" 1>&2
-  exit 1
-fi
-
-if [ $ret -eq 0 ];then
-	echo "PASS: netns routing/connectivity: ns1 can reach ns2"
-fi
-
-ns1in=$(mktemp)
-ns1out=$(mktemp)
-ns2in=$(mktemp)
-ns2out=$(mktemp)
-
-make_file()
-{
-	name=$1
-	who=$2
-
-	SIZE=$((RANDOM % (1024 * 8)))
-	TSIZE=$((SIZE * 1024))
-
-	dd if=/dev/urandom of="$name" bs=1024 count=$SIZE 2> /dev/null
-
-	SIZE=$((RANDOM % 1024))
-	SIZE=$((SIZE + 128))
-	TSIZE=$((TSIZE + SIZE))
-	dd if=/dev/urandom conf=notrunc of="$name" bs=1 count=$SIZE 2> /dev/null
-}
-
-check_transfer()
-{
-	in=$1
-	out=$2
-	what=$3
-
-	cmp "$in" "$out" > /dev/null 2>&1
-	if [ $? -ne 0 ] ;then
-		echo "FAIL: file mismatch for $what" 1>&2
-		ls -l "$in"
-		ls -l "$out"
-		return 1
-	fi
-
-	return 0
-}
-
-test_tcp_forwarding_ip()
-{
-	local nsa=$1
-	local nsb=$2
-	local dstip=$3
-	local dstport=$4
-	local lret=0
-
-	ip netns exec $nsb nc -w 5 -l -p 12345 < "$ns2in" > "$ns2out" &
-	lpid=$!
-
-	sleep 1
-	ip netns exec $nsa nc -w 4 "$dstip" "$dstport" < "$ns1in" > "$ns1out" &
-	cpid=$!
-
-	sleep 3
-
-	kill $lpid
-	kill $cpid
-	wait
-
-	check_transfer "$ns1in" "$ns2out" "ns1 -> ns2"
-	if [ $? -ne 0 ];then
-		lret=1
-	fi
-
-	check_transfer "$ns2in" "$ns1out" "ns1 <- ns2"
-	if [ $? -ne 0 ];then
-		lret=1
-	fi
-
-	return $lret
-}
-
-test_tcp_forwarding()
-{
-	test_tcp_forwarding_ip "$1" "$2" 10.0.2.99 12345
-
-	return $?
-}
-
-test_tcp_forwarding_nat()
-{
-	local lret
-
-	test_tcp_forwarding_ip "$1" "$2" 10.0.2.99 12345
-	lret=$?
-
-	if [ $lret -eq 0 ] ; then
-		test_tcp_forwarding_ip "$1" "$2" 10.6.6.6 1666
-		lret=$?
-	fi
-
-	return $lret
-}
-
-make_file "$ns1in" "ns1"
-make_file "$ns2in" "ns2"
-
-# First test:
-# No PMTU discovery, nsr1 is expected to fragment packets from ns1 to ns2 as needed.
-test_tcp_forwarding ns1 ns2
-if [ $? -eq 0 ] ;then
-	echo "PASS: flow offloaded for ns1/ns2"
-else
-	echo "FAIL: flow offload for ns1/ns2:" 1>&2
-	ip netns exec nsr1 nft list ruleset
-	ret=1
-fi
-
-# delete default route, i.e. ns2 won't be able to reach ns1 and
-# will depend on ns1 being masqueraded in nsr1.
-# expect ns1 has nsr1 address.
-ip -net ns2 route del default via 10.0.2.1
-ip -net ns2 route del default via dead:2::1
-ip -net ns2 route add 192.168.10.1 via 10.0.2.1
-
-# Second test:
-# Same, but with NAT enabled.
-ip netns exec nsr1 nft -f - <<EOF
-table ip nat {
-   chain prerouting {
-      type nat hook prerouting priority 0; policy accept;
-      meta iif "veth0" ip daddr 10.6.6.6 tcp dport 1666 counter dnat ip to 10.0.2.99:12345
-   }
-
-   chain postrouting {
-      type nat hook postrouting priority 0; policy accept;
-      meta oifname "veth1" counter masquerade
-   }
-}
-EOF
-
-test_tcp_forwarding_nat ns1 ns2
-
-if [ $? -eq 0 ] ;then
-	echo "PASS: flow offloaded for ns1/ns2 with NAT"
-else
-	echo "FAIL: flow offload for ns1/ns2 with NAT" 1>&2
-	ip netns exec nsr1 nft list ruleset
-	ret=1
-fi
-
-# Third test:
-# Same as second test, but with PMTU discovery enabled.
-handle=$(ip netns exec nsr1 nft -a list table inet filter | grep something-to-grep-for | cut -d \# -f 2)
-
-ip netns exec nsr1 nft delete rule inet filter forward $handle
-if [ $? -ne 0 ] ;then
-	echo "FAIL: Could not delete large-packet accept rule"
-	exit 1
-fi
-
-ip netns exec ns1 sysctl net.ipv4.ip_no_pmtu_disc=0 > /dev/null
-ip netns exec ns2 sysctl net.ipv4.ip_no_pmtu_disc=0 > /dev/null
-
-test_tcp_forwarding_nat ns1 ns2
-if [ $? -eq 0 ] ;then
-	echo "PASS: flow offloaded for ns1/ns2 with NAT and pmtu discovery"
-else
-	echo "FAIL: flow offload for ns1/ns2 with NAT and pmtu discovery" 1>&2
-	ip netns exec nsr1 nft list ruleset
-fi
-
-KEY_SHA="0x"$(ps -xaf | sha1sum | cut -d " " -f 1)
-KEY_AES="0x"$(ps -xaf | md5sum | cut -d " " -f 1)
-SPI1=$RANDOM
-SPI2=$RANDOM
-
-if [ $SPI1 -eq $SPI2 ]; then
-	SPI2=$((SPI2+1))
-fi
-
-do_esp() {
-    local ns=$1
-    local me=$2
-    local remote=$3
-    local lnet=$4
-    local rnet=$5
-    local spi_out=$6
-    local spi_in=$7
-
-    ip -net $ns xfrm state add src $remote dst $me proto esp spi $spi_in  enc aes $KEY_AES  auth sha1 $KEY_SHA mode tunnel sel src $rnet dst $lnet
-    ip -net $ns xfrm state add src $me  dst $remote proto esp spi $spi_out enc aes $KEY_AES auth sha1 $KEY_SHA mode tunnel sel src $lnet dst $rnet
-
-    # to encrypt packets as they go out (includes forwarded packets that need encapsulation)
-    ip -net $ns xfrm policy add src $lnet dst $rnet dir out tmpl src $me dst $remote proto esp mode tunnel priority 1 action allow
-    # to fwd decrypted packets after esp processing:
-    ip -net $ns xfrm policy add src $rnet dst $lnet dir fwd tmpl src $remote dst $me proto esp mode tunnel priority 1 action allow
-
-}
-
-do_esp nsr1 192.168.10.1 192.168.10.2 10.0.1.0/24 10.0.2.0/24 $SPI1 $SPI2
-
-do_esp nsr2 192.168.10.2 192.168.10.1 10.0.2.0/24 10.0.1.0/24 $SPI2 $SPI1
-
-ip netns exec nsr1 nft delete table ip nat
-
-# restore default routes
-ip -net ns2 route del 192.168.10.1 via 10.0.2.1
-ip -net ns2 route add default via 10.0.2.1
-ip -net ns2 route add default via dead:2::1
-
-test_tcp_forwarding ns1 ns2
-if [ $? -eq 0 ] ;then
-	echo "PASS: ipsec tunnel mode for ns1/ns2"
-else
-	echo "FAIL: ipsec tunnel mode for ns1/ns2"
-	ip netns exec nsr1 nft list ruleset 1>&2
-	ip netns exec nsr1 cat /proc/net/xfrm_stat 1>&2
-fi
-
-exit $ret
diff --git a/tools/testing/selftests/netfilter/nft_meta.sh b/tools/testing/selftests/netfilter/nft_meta.sh
deleted file mode 100755
index d250b84dd5bc..000000000000
--- a/tools/testing/selftests/netfilter/nft_meta.sh
+++ /dev/null
@@ -1,124 +0,0 @@
-#!/bin/bash
-
-# check iif/iifname/oifgroup/iiftype match.
-
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-sfx=$(mktemp -u "XXXXXXXX")
-ns0="ns0-$sfx"
-
-nft --version > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without nft tool"
-	exit $ksft_skip
-fi
-
-cleanup()
-{
-	ip netns del "$ns0"
-}
-
-ip netns add "$ns0"
-ip -net "$ns0" link set lo up
-ip -net "$ns0" addr add 127.0.0.1 dev lo
-
-trap cleanup EXIT
-
-ip netns exec "$ns0" nft -f /dev/stdin <<EOF
-table inet filter {
-	counter iifcount {}
-	counter iifnamecount {}
-	counter iifgroupcount {}
-	counter iiftypecount {}
-	counter infproto4count {}
-	counter il4protocounter {}
-	counter imarkcounter {}
-
-	counter oifcount {}
-	counter oifnamecount {}
-	counter oifgroupcount {}
-	counter oiftypecount {}
-	counter onfproto4count {}
-	counter ol4protocounter {}
-	counter oskuidcounter {}
-	counter oskgidcounter {}
-	counter omarkcounter {}
-
-	chain input {
-		type filter hook input priority 0; policy accept;
-
-		meta iif lo counter name "iifcount"
-		meta iifname "lo" counter name "iifnamecount"
-		meta iifgroup "default" counter name "iifgroupcount"
-		meta iiftype "loopback" counter name "iiftypecount"
-		meta nfproto ipv4 counter name "infproto4count"
-		meta l4proto icmp counter name "il4protocounter"
-		meta mark 42 counter name "imarkcounter"
-	}
-
-	chain output {
-		type filter hook output priority 0; policy accept;
-		meta oif lo counter name "oifcount" counter
-		meta oifname "lo" counter name "oifnamecount"
-		meta oifgroup "default" counter name "oifgroupcount"
-		meta oiftype "loopback" counter name "oiftypecount"
-		meta nfproto ipv4 counter name "onfproto4count"
-		meta l4proto icmp counter name "ol4protocounter"
-		meta skuid 0 counter name "oskuidcounter"
-		meta skgid 0 counter name "oskgidcounter"
-		meta mark 42 counter name "omarkcounter"
-	}
-}
-EOF
-
-if [ $? -ne 0 ]; then
-	echo "SKIP: Could not add test ruleset"
-	exit $ksft_skip
-fi
-
-ret=0
-
-check_one_counter()
-{
-	local cname="$1"
-	local want="packets $2"
-	local verbose="$3"
-
-	cnt=$(ip netns exec "$ns0" nft list counter inet filter $cname | grep -q "$want")
-	if [ $? -ne 0 ];then
-		echo "FAIL: $cname, want \"$want\", got"
-		ret=1
-		ip netns exec "$ns0" nft list counter inet filter $counter
-	fi
-}
-
-check_lo_counters()
-{
-	local want="$1"
-	local verbose="$2"
-	local counter
-
-	for counter in iifcount iifnamecount iifgroupcount iiftypecount infproto4count \
-		       oifcount oifnamecount oifgroupcount oiftypecount onfproto4count \
-		       il4protocounter \
-		       ol4protocounter \
-	     ; do
-		check_one_counter "$counter" "$want" "$verbose"
-	done
-}
-
-check_lo_counters "0" false
-ip netns exec "$ns0" ping -q -c 1 127.0.0.1 -m 42 > /dev/null
-
-check_lo_counters "2" true
-
-check_one_counter oskuidcounter "1" true
-check_one_counter oskgidcounter "1" true
-check_one_counter imarkcounter "1" true
-check_one_counter omarkcounter "1" true
-
-if [ $ret -eq 0 ];then
-	echo "OK: nftables meta iif/oif counters at expected values"
-fi
-
-exit $ret
diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh
deleted file mode 100755
index d7e07f4c3d7f..000000000000
--- a/tools/testing/selftests/netfilter/nft_nat.sh
+++ /dev/null
@@ -1,869 +0,0 @@
-#!/bin/bash
-#
-# This test is for basic NAT functionality: snat, dnat, redirect, masquerade.
-#
-
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-ret=0
-test_inet_nat=true
-
-sfx=$(mktemp -u "XXXXXXXX")
-ns0="ns0-$sfx"
-ns1="ns1-$sfx"
-ns2="ns2-$sfx"
-
-cleanup()
-{
-	for i in 0 1 2; do ip netns del ns$i-"$sfx";done
-}
-
-nft --version > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without nft tool"
-	exit $ksft_skip
-fi
-
-ip -Version > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without ip tool"
-	exit $ksft_skip
-fi
-
-ip netns add "$ns0"
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not create net namespace $ns0"
-	exit $ksft_skip
-fi
-
-trap cleanup EXIT
-
-ip netns add "$ns1"
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not create net namespace $ns1"
-	exit $ksft_skip
-fi
-
-ip netns add "$ns2"
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not create net namespace $ns2"
-	exit $ksft_skip
-fi
-
-ip link add veth0 netns "$ns0" type veth peer name eth0 netns "$ns1" > /dev/null 2>&1
-if [ $? -ne 0 ];then
-    echo "SKIP: No virtual ethernet pair device support in kernel"
-    exit $ksft_skip
-fi
-ip link add veth1 netns "$ns0" type veth peer name eth0 netns "$ns2"
-
-ip -net "$ns0" link set lo up
-ip -net "$ns0" link set veth0 up
-ip -net "$ns0" addr add 10.0.1.1/24 dev veth0
-ip -net "$ns0" addr add dead:1::1/64 dev veth0
-
-ip -net "$ns0" link set veth1 up
-ip -net "$ns0" addr add 10.0.2.1/24 dev veth1
-ip -net "$ns0" addr add dead:2::1/64 dev veth1
-
-for i in 1 2; do
-  ip -net ns$i-$sfx link set lo up
-  ip -net ns$i-$sfx link set eth0 up
-  ip -net ns$i-$sfx addr add 10.0.$i.99/24 dev eth0
-  ip -net ns$i-$sfx route add default via 10.0.$i.1
-  ip -net ns$i-$sfx addr add dead:$i::99/64 dev eth0
-  ip -net ns$i-$sfx route add default via dead:$i::1
-done
-
-bad_counter()
-{
-	local ns=$1
-	local counter=$2
-	local expect=$3
-	local tag=$4
-
-	echo "ERROR: $counter counter in $ns has unexpected value (expected $expect) at $tag" 1>&2
-	ip netns exec $ns nft list counter inet filter $counter 1>&2
-}
-
-check_counters()
-{
-	ns=$1
-	local lret=0
-
-	cnt=$(ip netns exec $ns nft list counter inet filter ns0in | grep -q "packets 1 bytes 84")
-	if [ $? -ne 0 ]; then
-		bad_counter $ns ns0in "packets 1 bytes 84" "check_counters 1"
-		lret=1
-	fi
-	cnt=$(ip netns exec $ns nft list counter inet filter ns0out | grep -q "packets 1 bytes 84")
-	if [ $? -ne 0 ]; then
-		bad_counter $ns ns0out "packets 1 bytes 84" "check_counters 2"
-		lret=1
-	fi
-
-	expect="packets 1 bytes 104"
-	cnt=$(ip netns exec $ns nft list counter inet filter ns0in6 | grep -q "$expect")
-	if [ $? -ne 0 ]; then
-		bad_counter $ns ns0in6 "$expect" "check_counters 3"
-		lret=1
-	fi
-	cnt=$(ip netns exec $ns nft list counter inet filter ns0out6 | grep -q "$expect")
-	if [ $? -ne 0 ]; then
-		bad_counter $ns ns0out6 "$expect" "check_counters 4"
-		lret=1
-	fi
-
-	return $lret
-}
-
-check_ns0_counters()
-{
-	local ns=$1
-	local lret=0
-
-	cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0in | grep -q "packets 0 bytes 0")
-	if [ $? -ne 0 ]; then
-		bad_counter "$ns0" ns0in "packets 0 bytes 0" "check_ns0_counters 1"
-		lret=1
-	fi
-
-	cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0")
-	if [ $? -ne 0 ]; then
-		bad_counter "$ns0" ns0in6 "packets 0 bytes 0"
-		lret=1
-	fi
-
-	cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0out | grep -q "packets 0 bytes 0")
-	if [ $? -ne 0 ]; then
-		bad_counter "$ns0" ns0out "packets 0 bytes 0" "check_ns0_counters 2"
-		lret=1
-	fi
-	cnt=$(ip netns exec "$ns0" nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0")
-	if [ $? -ne 0 ]; then
-		bad_counter "$ns0" ns0out6 "packets 0 bytes 0" "check_ns0_counters3 "
-		lret=1
-	fi
-
-	for dir in "in" "out" ; do
-		expect="packets 1 bytes 84"
-		cnt=$(ip netns exec "$ns0" nft list counter inet filter ${ns}${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns0" $ns$dir "$expect" "check_ns0_counters 4"
-			lret=1
-		fi
-
-		expect="packets 1 bytes 104"
-		cnt=$(ip netns exec "$ns0" nft list counter inet filter ${ns}${dir}6 | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns0" $ns$dir6 "$expect" "check_ns0_counters 5"
-			lret=1
-		fi
-	done
-
-	return $lret
-}
-
-reset_counters()
-{
-	for i in 0 1 2;do
-		ip netns exec ns$i-$sfx nft reset counters inet > /dev/null
-	done
-}
-
-test_local_dnat6()
-{
-	local family=$1
-	local lret=0
-	local IPF=""
-
-	if [ $family = "inet" ];then
-		IPF="ip6"
-	fi
-
-ip netns exec "$ns0" nft -f /dev/stdin <<EOF
-table $family nat {
-	chain output {
-		type nat hook output priority 0; policy accept;
-		ip6 daddr dead:1::99 dnat $IPF to dead:2::99
-	}
-}
-EOF
-	if [ $? -ne 0 ]; then
-		echo "SKIP: Could not add add $family dnat hook"
-		return $ksft_skip
-	fi
-
-	# ping netns1, expect rewrite to netns2
-	ip netns exec "$ns0" ping -q -c 1 dead:1::99 > /dev/null
-	if [ $? -ne 0 ]; then
-		lret=1
-		echo "ERROR: ping6 failed"
-		return $lret
-	fi
-
-	expect="packets 0 bytes 0"
-	for dir in "in6" "out6" ; do
-		cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat6 1"
-			lret=1
-		fi
-	done
-
-	expect="packets 1 bytes 104"
-	for dir in "in6" "out6" ; do
-		cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat6 2"
-			lret=1
-		fi
-	done
-
-	# expect 0 count in ns1
-	expect="packets 0 bytes 0"
-	for dir in "in6" "out6" ; do
-		cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat6 3"
-			lret=1
-		fi
-	done
-
-	# expect 1 packet in ns2
-	expect="packets 1 bytes 104"
-	for dir in "in6" "out6" ; do
-		cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat6 4"
-			lret=1
-		fi
-	done
-
-	test $lret -eq 0 && echo "PASS: ipv6 ping to $ns1 was $family NATted to $ns2"
-	ip netns exec "$ns0" nft flush chain ip6 nat output
-
-	return $lret
-}
-
-test_local_dnat()
-{
-	local family=$1
-	local lret=0
-	local IPF=""
-
-	if [ $family = "inet" ];then
-		IPF="ip"
-	fi
-
-ip netns exec "$ns0" nft -f /dev/stdin <<EOF 2>/dev/null
-table $family nat {
-	chain output {
-		type nat hook output priority 0; policy accept;
-		ip daddr 10.0.1.99 dnat $IPF to 10.0.2.99
-	}
-}
-EOF
-	if [ $? -ne 0 ]; then
-		if [ $family = "inet" ];then
-			echo "SKIP: inet nat tests"
-			test_inet_nat=false
-			return $ksft_skip
-		fi
-		echo "SKIP: Could not add add $family dnat hook"
-		return $ksft_skip
-	fi
-
-	# ping netns1, expect rewrite to netns2
-	ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null
-	if [ $? -ne 0 ]; then
-		lret=1
-		echo "ERROR: ping failed"
-		return $lret
-	fi
-
-	expect="packets 0 bytes 0"
-	for dir in "in" "out" ; do
-		cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns0" ns1$dir "$expect" "test_local_dnat 1"
-			lret=1
-		fi
-	done
-
-	expect="packets 1 bytes 84"
-	for dir in "in" "out" ; do
-		cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 2"
-			lret=1
-		fi
-	done
-
-	# expect 0 count in ns1
-	expect="packets 0 bytes 0"
-	for dir in "in" "out" ; do
-		cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns1" ns0$dir "$expect" "test_local_dnat 3"
-			lret=1
-		fi
-	done
-
-	# expect 1 packet in ns2
-	expect="packets 1 bytes 84"
-	for dir in "in" "out" ; do
-		cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 4"
-			lret=1
-		fi
-	done
-
-	test $lret -eq 0 && echo "PASS: ping to $ns1 was $family NATted to $ns2"
-
-	ip netns exec "$ns0" nft flush chain $family nat output
-
-	reset_counters
-	ip netns exec "$ns0" ping -q -c 1 10.0.1.99 > /dev/null
-	if [ $? -ne 0 ]; then
-		lret=1
-		echo "ERROR: ping failed"
-		return $lret
-	fi
-
-	expect="packets 1 bytes 84"
-	for dir in "in" "out" ; do
-		cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns1" ns1$dir "$expect" "test_local_dnat 5"
-			lret=1
-		fi
-	done
-	expect="packets 0 bytes 0"
-	for dir in "in" "out" ; do
-		cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns0" ns2$dir "$expect" "test_local_dnat 6"
-			lret=1
-		fi
-	done
-
-	# expect 1 count in ns1
-	expect="packets 1 bytes 84"
-	for dir in "in" "out" ; do
-		cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns0" ns0$dir "$expect" "test_local_dnat 7"
-			lret=1
-		fi
-	done
-
-	# expect 0 packet in ns2
-	expect="packets 0 bytes 0"
-	for dir in "in" "out" ; do
-		cnt=$(ip netns exec "$ns2" nft list counter inet filter ns0${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns2" ns0$dir "$expect" "test_local_dnat 8"
-			lret=1
-		fi
-	done
-
-	test $lret -eq 0 && echo "PASS: ping to $ns1 OK after $family nat output chain flush"
-
-	return $lret
-}
-
-
-test_masquerade6()
-{
-	local family=$1
-	local natflags=$2
-	local lret=0
-
-	ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
-
-	ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
-	if [ $? -ne 0 ] ; then
-		echo "ERROR: cannot ping $ns1 from $ns2 via ipv6"
-		return 1
-		lret=1
-	fi
-
-	expect="packets 1 bytes 104"
-	for dir in "in6" "out6" ; do
-		cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns1" ns2$dir "$expect" "test_masquerade6 1"
-			lret=1
-		fi
-
-		cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 2"
-			lret=1
-		fi
-	done
-
-	reset_counters
-
-# add masquerading rule
-ip netns exec "$ns0" nft -f /dev/stdin <<EOF
-table $family nat {
-	chain postrouting {
-		type nat hook postrouting priority 0; policy accept;
-		meta oif veth0 masquerade $natflags
-	}
-}
-EOF
-	if [ $? -ne 0 ]; then
-		echo "SKIP: Could not add add $family masquerade hook"
-		return $ksft_skip
-	fi
-
-	ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
-	if [ $? -ne 0 ] ; then
-		echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags"
-		lret=1
-	fi
-
-	# ns1 should have seen packets from ns0, due to masquerade
-	expect="packets 1 bytes 104"
-	for dir in "in6" "out6" ; do
-		cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 3"
-			lret=1
-		fi
-
-		cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns2" ns1$dir "$expect" "test_masquerade6 4"
-			lret=1
-		fi
-	done
-
-	# ns1 should not have seen packets from ns2, due to masquerade
-	expect="packets 0 bytes 0"
-	for dir in "in6" "out6" ; do
-		cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns1" ns0$dir "$expect" "test_masquerade6 5"
-			lret=1
-		fi
-
-		cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns0" ns1$dir "$expect" "test_masquerade6 6"
-			lret=1
-		fi
-	done
-
-	ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
-	if [ $? -ne 0 ] ; then
-		echo "ERROR: cannot ping $ns1 from $ns2 with active ipv6 masquerade $natflags (attempt 2)"
-		lret=1
-	fi
-
-	ip netns exec "$ns0" nft flush chain $family nat postrouting
-	if [ $? -ne 0 ]; then
-		echo "ERROR: Could not flush $family nat postrouting" 1>&2
-		lret=1
-	fi
-
-	test $lret -eq 0 && echo "PASS: $family IPv6 masquerade $natflags for $ns2"
-
-	return $lret
-}
-
-test_masquerade()
-{
-	local family=$1
-	local natflags=$2
-	local lret=0
-
-	ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
-	ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
-
-	ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
-	if [ $? -ne 0 ] ; then
-		echo "ERROR: cannot ping $ns1 from "$ns2" $natflags"
-		lret=1
-	fi
-
-	expect="packets 1 bytes 84"
-	for dir in "in" "out" ; do
-		cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns1" ns2$dir "$expect" "test_masquerade 1"
-			lret=1
-		fi
-
-		cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 2"
-			lret=1
-		fi
-	done
-
-	reset_counters
-
-# add masquerading rule
-ip netns exec "$ns0" nft -f /dev/stdin <<EOF
-table $family nat {
-	chain postrouting {
-		type nat hook postrouting priority 0; policy accept;
-		meta oif veth0 masquerade $natflags
-	}
-}
-EOF
-	if [ $? -ne 0 ]; then
-		echo "SKIP: Could not add add $family masquerade hook"
-		return $ksft_skip
-	fi
-
-	ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
-	if [ $? -ne 0 ] ; then
-		echo "ERROR: cannot ping $ns1 from $ns2 with active $family masquerade $natflags"
-		lret=1
-	fi
-
-	# ns1 should have seen packets from ns0, due to masquerade
-	expect="packets 1 bytes 84"
-	for dir in "in" "out" ; do
-		cnt=$(ip netns exec "$ns1" nft list counter inet filter ns0${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns1" ns0$dir "$expect" "test_masquerade 3"
-			lret=1
-		fi
-
-		cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns2" ns1$dir "$expect" "test_masquerade 4"
-			lret=1
-		fi
-	done
-
-	# ns1 should not have seen packets from ns2, due to masquerade
-	expect="packets 0 bytes 0"
-	for dir in "in" "out" ; do
-		cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns1" ns0$dir "$expect" "test_masquerade 5"
-			lret=1
-		fi
-
-		cnt=$(ip netns exec "$ns0" nft list counter inet filter ns1${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns0" ns1$dir "$expect" "test_masquerade 6"
-			lret=1
-		fi
-	done
-
-	ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
-	if [ $? -ne 0 ] ; then
-		echo "ERROR: cannot ping $ns1 from $ns2 with active ip masquerade $natflags (attempt 2)"
-		lret=1
-	fi
-
-	ip netns exec "$ns0" nft flush chain $family nat postrouting
-	if [ $? -ne 0 ]; then
-		echo "ERROR: Could not flush $family nat postrouting" 1>&2
-		lret=1
-	fi
-
-	test $lret -eq 0 && echo "PASS: $family IP masquerade $natflags for $ns2"
-
-	return $lret
-}
-
-test_redirect6()
-{
-	local family=$1
-	local lret=0
-
-	ip netns exec "$ns0" sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
-
-	ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
-	if [ $? -ne 0 ] ; then
-		echo "ERROR: cannnot ping $ns1 from $ns2 via ipv6"
-		lret=1
-	fi
-
-	expect="packets 1 bytes 104"
-	for dir in "in6" "out6" ; do
-		cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns1" ns2$dir "$expect" "test_redirect6 1"
-			lret=1
-		fi
-
-		cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns2" ns1$dir "$expect" "test_redirect6 2"
-			lret=1
-		fi
-	done
-
-	reset_counters
-
-# add redirect rule
-ip netns exec "$ns0" nft -f /dev/stdin <<EOF
-table $family nat {
-	chain prerouting {
-		type nat hook prerouting priority 0; policy accept;
-		meta iif veth1 meta l4proto icmpv6 ip6 saddr dead:2::99 ip6 daddr dead:1::99 redirect
-	}
-}
-EOF
-	if [ $? -ne 0 ]; then
-		echo "SKIP: Could not add add $family redirect hook"
-		return $ksft_skip
-	fi
-
-	ip netns exec "$ns2" ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1
-	if [ $? -ne 0 ] ; then
-		echo "ERROR: cannot ping $ns1 from $ns2 via ipv6 with active $family redirect"
-		lret=1
-	fi
-
-	# ns1 should have seen no packets from ns2, due to redirection
-	expect="packets 0 bytes 0"
-	for dir in "in6" "out6" ; do
-		cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 3"
-			lret=1
-		fi
-	done
-
-	# ns0 should have seen packets from ns2, due to masquerade
-	expect="packets 1 bytes 104"
-	for dir in "in6" "out6" ; do
-		cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns1" ns0$dir "$expect" "test_redirect6 4"
-			lret=1
-		fi
-	done
-
-	ip netns exec "$ns0" nft delete table $family nat
-	if [ $? -ne 0 ]; then
-		echo "ERROR: Could not delete $family nat table" 1>&2
-		lret=1
-	fi
-
-	test $lret -eq 0 && echo "PASS: $family IPv6 redirection for $ns2"
-
-	return $lret
-}
-
-test_redirect()
-{
-	local family=$1
-	local lret=0
-
-	ip netns exec "$ns0" sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
-	ip netns exec "$ns0" sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
-
-	ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
-	if [ $? -ne 0 ] ; then
-		echo "ERROR: cannot ping $ns1 from $ns2"
-		lret=1
-	fi
-
-	expect="packets 1 bytes 84"
-	for dir in "in" "out" ; do
-		cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns1" $ns2$dir "$expect" "test_redirect 1"
-			lret=1
-		fi
-
-		cnt=$(ip netns exec "$ns2" nft list counter inet filter ns1${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns2" ns1$dir "$expect" "test_redirect 2"
-			lret=1
-		fi
-	done
-
-	reset_counters
-
-# add redirect rule
-ip netns exec "$ns0" nft -f /dev/stdin <<EOF
-table $family nat {
-	chain prerouting {
-		type nat hook prerouting priority 0; policy accept;
-		meta iif veth1 ip protocol icmp ip saddr 10.0.2.99 ip daddr 10.0.1.99 redirect
-	}
-}
-EOF
-	if [ $? -ne 0 ]; then
-		echo "SKIP: Could not add add $family redirect hook"
-		return $ksft_skip
-	fi
-
-	ip netns exec "$ns2" ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1
-	if [ $? -ne 0 ] ; then
-		echo "ERROR: cannot ping $ns1 from $ns2 with active $family ip redirect"
-		lret=1
-	fi
-
-	# ns1 should have seen no packets from ns2, due to redirection
-	expect="packets 0 bytes 0"
-	for dir in "in" "out" ; do
-
-		cnt=$(ip netns exec "$ns1" nft list counter inet filter ns2${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns1" ns0$dir "$expect" "test_redirect 3"
-			lret=1
-		fi
-	done
-
-	# ns0 should have seen packets from ns2, due to masquerade
-	expect="packets 1 bytes 84"
-	for dir in "in" "out" ; do
-		cnt=$(ip netns exec "$ns0" nft list counter inet filter ns2${dir} | grep -q "$expect")
-		if [ $? -ne 0 ]; then
-			bad_counter "$ns0" ns0$dir "$expect" "test_redirect 4"
-			lret=1
-		fi
-	done
-
-	ip netns exec "$ns0" nft delete table $family nat
-	if [ $? -ne 0 ]; then
-		echo "ERROR: Could not delete $family nat table" 1>&2
-		lret=1
-	fi
-
-	test $lret -eq 0 && echo "PASS: $family IP redirection for $ns2"
-
-	return $lret
-}
-
-
-# ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99
-for i in 0 1 2; do
-ip netns exec ns$i-$sfx nft -f /dev/stdin <<EOF
-table inet filter {
-	counter ns0in {}
-	counter ns1in {}
-	counter ns2in {}
-
-	counter ns0out {}
-	counter ns1out {}
-	counter ns2out {}
-
-	counter ns0in6 {}
-	counter ns1in6 {}
-	counter ns2in6 {}
-
-	counter ns0out6 {}
-	counter ns1out6 {}
-	counter ns2out6 {}
-
-	map nsincounter {
-		type ipv4_addr : counter
-		elements = { 10.0.1.1 : "ns0in",
-			     10.0.2.1 : "ns0in",
-			     10.0.1.99 : "ns1in",
-			     10.0.2.99 : "ns2in" }
-	}
-
-	map nsincounter6 {
-		type ipv6_addr : counter
-		elements = { dead:1::1 : "ns0in6",
-			     dead:2::1 : "ns0in6",
-			     dead:1::99 : "ns1in6",
-			     dead:2::99 : "ns2in6" }
-	}
-
-	map nsoutcounter {
-		type ipv4_addr : counter
-		elements = { 10.0.1.1 : "ns0out",
-			     10.0.2.1 : "ns0out",
-			     10.0.1.99: "ns1out",
-			     10.0.2.99: "ns2out" }
-	}
-
-	map nsoutcounter6 {
-		type ipv6_addr : counter
-		elements = { dead:1::1 : "ns0out6",
-			     dead:2::1 : "ns0out6",
-			     dead:1::99 : "ns1out6",
-			     dead:2::99 : "ns2out6" }
-	}
-
-	chain input {
-		type filter hook input priority 0; policy accept;
-		counter name ip saddr map @nsincounter
-		icmpv6 type { "echo-request", "echo-reply" } counter name ip6 saddr map @nsincounter6
-	}
-	chain output {
-		type filter hook output priority 0; policy accept;
-		counter name ip daddr map @nsoutcounter
-		icmpv6 type { "echo-request", "echo-reply" } counter name ip6 daddr map @nsoutcounter6
-	}
-}
-EOF
-done
-
-sleep 3
-# test basic connectivity
-for i in 1 2; do
-  ip netns exec "$ns0" ping -c 1 -q 10.0.$i.99 > /dev/null
-  if [ $? -ne 0 ];then
-  	echo "ERROR: Could not reach other namespace(s)" 1>&2
-	ret=1
-  fi
-
-  ip netns exec "$ns0" ping -c 1 -q dead:$i::99 > /dev/null
-  if [ $? -ne 0 ];then
-	echo "ERROR: Could not reach other namespace(s) via ipv6" 1>&2
-	ret=1
-  fi
-  check_counters ns$i-$sfx
-  if [ $? -ne 0 ]; then
-	ret=1
-  fi
-
-  check_ns0_counters ns$i
-  if [ $? -ne 0 ]; then
-	ret=1
-  fi
-  reset_counters
-done
-
-if [ $ret -eq 0 ];then
-	echo "PASS: netns routing/connectivity: $ns0 can reach $ns1 and $ns2"
-fi
-
-reset_counters
-test_local_dnat ip
-test_local_dnat6 ip6
-reset_counters
-$test_inet_nat && test_local_dnat inet
-$test_inet_nat && test_local_dnat6 inet
-
-for flags in "" "fully-random"; do
-reset_counters
-test_masquerade ip $flags
-test_masquerade6 ip6 $flags
-reset_counters
-$test_inet_nat && test_masquerade inet $flags
-$test_inet_nat && test_masquerade6 inet $flags
-done
-
-reset_counters
-test_redirect ip
-test_redirect6 ip6
-reset_counters
-$test_inet_nat && test_redirect inet
-$test_inet_nat && test_redirect6 inet
-
-if [ $ret -ne 0 ];then
-	echo -n "FAIL: "
-	nft --version
-fi
-
-exit $ret
diff --git a/tools/testing/selftests/netfilter/nft_queue.sh b/tools/testing/selftests/netfilter/nft_queue.sh
deleted file mode 100755
index 6898448b4266..000000000000
--- a/tools/testing/selftests/netfilter/nft_queue.sh
+++ /dev/null
@@ -1,332 +0,0 @@
-#!/bin/bash
-#
-# This tests nf_queue:
-# 1. can process packets from all hooks
-# 2. support running nfqueue from more than one base chain
-#
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-ret=0
-
-sfx=$(mktemp -u "XXXXXXXX")
-ns1="ns1-$sfx"
-ns2="ns2-$sfx"
-nsrouter="nsrouter-$sfx"
-
-cleanup()
-{
-	ip netns del ${ns1}
-	ip netns del ${ns2}
-	ip netns del ${nsrouter}
-	rm -f "$TMPFILE0"
-	rm -f "$TMPFILE1"
-}
-
-nft --version > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without nft tool"
-	exit $ksft_skip
-fi
-
-ip -Version > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without ip tool"
-	exit $ksft_skip
-fi
-
-ip netns add ${nsrouter}
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not create net namespace"
-	exit $ksft_skip
-fi
-
-TMPFILE0=$(mktemp)
-TMPFILE1=$(mktemp)
-trap cleanup EXIT
-
-ip netns add ${ns1}
-ip netns add ${ns2}
-
-ip link add veth0 netns ${nsrouter} type veth peer name eth0 netns ${ns1} > /dev/null 2>&1
-if [ $? -ne 0 ];then
-    echo "SKIP: No virtual ethernet pair device support in kernel"
-    exit $ksft_skip
-fi
-ip link add veth1 netns ${nsrouter} type veth peer name eth0 netns ${ns2}
-
-ip -net ${nsrouter} link set lo up
-ip -net ${nsrouter} link set veth0 up
-ip -net ${nsrouter} addr add 10.0.1.1/24 dev veth0
-ip -net ${nsrouter} addr add dead:1::1/64 dev veth0
-
-ip -net ${nsrouter} link set veth1 up
-ip -net ${nsrouter} addr add 10.0.2.1/24 dev veth1
-ip -net ${nsrouter} addr add dead:2::1/64 dev veth1
-
-ip -net ${ns1} link set lo up
-ip -net ${ns1} link set eth0 up
-
-ip -net ${ns2} link set lo up
-ip -net ${ns2} link set eth0 up
-
-ip -net ${ns1} addr add 10.0.1.99/24 dev eth0
-ip -net ${ns1} addr add dead:1::99/64 dev eth0
-ip -net ${ns1} route add default via 10.0.1.1
-ip -net ${ns1} route add default via dead:1::1
-
-ip -net ${ns2} addr add 10.0.2.99/24 dev eth0
-ip -net ${ns2} addr add dead:2::99/64 dev eth0
-ip -net ${ns2} route add default via 10.0.2.1
-ip -net ${ns2} route add default via dead:2::1
-
-load_ruleset() {
-	local name=$1
-	local prio=$2
-
-ip netns exec ${nsrouter} nft -f - <<EOF
-table inet $name {
-	chain nfq {
-		ip protocol icmp queue bypass
-		icmpv6 type { "echo-request", "echo-reply" } queue num 1 bypass
-	}
-	chain pre {
-		type filter hook prerouting priority $prio; policy accept;
-		jump nfq
-	}
-	chain input {
-		type filter hook input priority $prio; policy accept;
-		jump nfq
-	}
-	chain forward {
-		type filter hook forward priority $prio; policy accept;
-		tcp dport 12345 queue num 2
-		jump nfq
-	}
-	chain output {
-		type filter hook output priority $prio; policy accept;
-		tcp dport 12345 queue num 3
-		jump nfq
-	}
-	chain post {
-		type filter hook postrouting priority $prio; policy accept;
-		jump nfq
-	}
-}
-EOF
-}
-
-load_counter_ruleset() {
-	local prio=$1
-
-ip netns exec ${nsrouter} nft -f - <<EOF
-table inet countrules {
-	chain pre {
-		type filter hook prerouting priority $prio; policy accept;
-		counter
-	}
-	chain input {
-		type filter hook input priority $prio; policy accept;
-		counter
-	}
-	chain forward {
-		type filter hook forward priority $prio; policy accept;
-		counter
-	}
-	chain output {
-		type filter hook output priority $prio; policy accept;
-		counter
-	}
-	chain post {
-		type filter hook postrouting priority $prio; policy accept;
-		counter
-	}
-}
-EOF
-}
-
-test_ping() {
-  ip netns exec ${ns1} ping -c 1 -q 10.0.2.99 > /dev/null
-  if [ $? -ne 0 ];then
-	return 1
-  fi
-
-  ip netns exec ${ns1} ping -c 1 -q dead:2::99 > /dev/null
-  if [ $? -ne 0 ];then
-	return 1
-  fi
-
-  return 0
-}
-
-test_ping_router() {
-  ip netns exec ${ns1} ping -c 1 -q 10.0.2.1 > /dev/null
-  if [ $? -ne 0 ];then
-	return 1
-  fi
-
-  ip netns exec ${ns1} ping -c 1 -q dead:2::1 > /dev/null
-  if [ $? -ne 0 ];then
-	return 1
-  fi
-
-  return 0
-}
-
-test_queue_blackhole() {
-	local proto=$1
-
-ip netns exec ${nsrouter} nft -f - <<EOF
-table $proto blackh {
-	chain forward {
-	type filter hook forward priority 0; policy accept;
-		queue num 600
-	}
-}
-EOF
-	if [ $proto = "ip" ] ;then
-		ip netns exec ${ns1} ping -c 1 -q 10.0.2.99 > /dev/null
-		lret=$?
-	elif [ $proto = "ip6" ]; then
-		ip netns exec ${ns1} ping -c 1 -q dead:2::99 > /dev/null
-		lret=$?
-	else
-		lret=111
-	fi
-
-	# queue without bypass keyword should drop traffic if no listener exists.
-	if [ $lret -eq 0 ];then
-		echo "FAIL: $proto expected failure, got $lret" 1>&2
-		exit 1
-	fi
-
-	ip netns exec ${nsrouter} nft delete table $proto blackh
-	if [ $? -ne 0 ] ;then
-	        echo "FAIL: $proto: Could not delete blackh table"
-	        exit 1
-	fi
-
-        echo "PASS: $proto: statement with no listener results in packet drop"
-}
-
-test_queue()
-{
-	local expected=$1
-	local last=""
-
-	# spawn nf-queue listeners
-	ip netns exec ${nsrouter} ./nf-queue -c -q 0 -t 3 > "$TMPFILE0" &
-	ip netns exec ${nsrouter} ./nf-queue -c -q 1 -t 3 > "$TMPFILE1" &
-	sleep 1
-	test_ping
-	ret=$?
-	if [ $ret -ne 0 ];then
-		echo "FAIL: netns routing/connectivity with active listener on queue $queue: $ret" 1>&2
-		exit $ret
-	fi
-
-	test_ping_router
-	ret=$?
-	if [ $ret -ne 0 ];then
-		echo "FAIL: netns router unreachable listener on queue $queue: $ret" 1>&2
-		exit $ret
-	fi
-
-	wait
-	ret=$?
-
-	for file in $TMPFILE0 $TMPFILE1; do
-		last=$(tail -n1 "$file")
-		if [ x"$last" != x"$expected packets total" ]; then
-			echo "FAIL: Expected $expected packets total, but got $last" 1>&2
-			cat "$file" 1>&2
-
-			ip netns exec ${nsrouter} nft list ruleset
-			exit 1
-		fi
-	done
-
-	echo "PASS: Expected and received $last"
-}
-
-test_tcp_forward()
-{
-	ip netns exec ${nsrouter} ./nf-queue -q 2 -t 10 &
-	local nfqpid=$!
-
-	tmpfile=$(mktemp) || exit 1
-	dd conv=sparse status=none if=/dev/zero bs=1M count=100 of=$tmpfile
-	ip netns exec ${ns2} nc -w 5 -l -p 12345 <"$tmpfile" >/dev/null &
-	local rpid=$!
-
-	sleep 1
-	ip netns exec ${ns1} nc -w 5 10.0.2.99 12345 <"$tmpfile" >/dev/null &
-
-	rm -f "$tmpfile"
-
-	wait $rpid
-	wait $lpid
-	[ $? -eq 0 ] && echo "PASS: tcp and nfqueue in forward chain"
-}
-
-test_tcp_localhost()
-{
-	tc -net "${nsrouter}" qdisc add dev lo root netem loss random 1%
-
-	tmpfile=$(mktemp) || exit 1
-
-	dd conv=sparse status=none if=/dev/zero bs=1M count=900 of=$tmpfile
-	ip netns exec ${nsrouter} nc -w 5 -l -p 12345 <"$tmpfile" >/dev/null &
-	local rpid=$!
-
-	ip netns exec ${nsrouter} ./nf-queue -q 3 -t 30 &
-	local nfqpid=$!
-
-	sleep 1
-	ip netns exec ${nsrouter} nc -w 5 127.0.0.1 12345 <"$tmpfile" > /dev/null
-	rm -f "$tmpfile"
-
-	wait $rpid
-	[ $? -eq 0 ] && echo "PASS: tcp via loopback"
-}
-
-ip netns exec ${nsrouter} sysctl net.ipv6.conf.all.forwarding=1 > /dev/null
-ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null
-ip netns exec ${nsrouter} sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null
-
-load_ruleset "filter" 0
-
-sleep 3
-
-test_ping
-ret=$?
-if [ $ret -eq 0 ];then
-	# queue bypass works (rules were skipped, no listener)
-	echo "PASS: ${ns1} can reach ${ns2}"
-else
-	echo "FAIL: ${ns1} cannot reach ${ns2}: $ret" 1>&2
-	exit $ret
-fi
-
-test_queue_blackhole ip
-test_queue_blackhole ip6
-
-# dummy ruleset to add base chains between the
-# queueing rules.  We don't want the second reinject
-# to re-execute the old hooks.
-load_counter_ruleset 10
-
-# we are hooking all: prerouting/input/forward/output/postrouting.
-# we ping ${ns2} from ${ns1} via ${nsrouter} using ipv4 and ipv6, so:
-# 1x icmp prerouting,forward,postrouting -> 3 queue events (6 incl. reply).
-# 1x icmp prerouting,input,output postrouting -> 4 queue events incl. reply.
-# so we expect that userspace program receives 10 packets.
-test_queue 10
-
-# same.  We queue to a second program as well.
-load_ruleset "filter2" 20
-test_queue 20
-
-test_tcp_forward
-test_tcp_localhost
-
-exit $ret
diff --git a/tools/testing/selftests/netfilter/nft_trans_stress.sh b/tools/testing/selftests/netfilter/nft_trans_stress.sh
deleted file mode 100755
index f1affd12c4b1..000000000000
--- a/tools/testing/selftests/netfilter/nft_trans_stress.sh
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/bin/bash
-#
-# This test is for stress-testing the nf_tables config plane path vs.
-# packet path processing: Make sure we never release rules that are
-# still visible to other cpus.
-#
-# set -e
-
-# Kselftest framework requirement - SKIP code is 4.
-ksft_skip=4
-
-testns=testns1
-tables="foo bar baz quux"
-
-nft --version > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without nft tool"
-	exit $ksft_skip
-fi
-
-ip -Version > /dev/null 2>&1
-if [ $? -ne 0 ];then
-	echo "SKIP: Could not run test without ip tool"
-	exit $ksft_skip
-fi
-
-tmp=$(mktemp)
-
-for table in $tables; do
-	echo add table inet "$table" >> "$tmp"
-	echo flush table inet "$table" >> "$tmp"
-
-	echo "add chain inet $table INPUT { type filter hook input priority 0; }" >> "$tmp"
-	echo "add chain inet $table OUTPUT { type filter hook output priority 0; }" >> "$tmp"
-	for c in $(seq 1 400); do
-		chain=$(printf "chain%03u" "$c")
-		echo "add chain inet $table $chain" >> "$tmp"
-	done
-
-	for c in $(seq 1 400); do
-		chain=$(printf "chain%03u" "$c")
-		for BASE in INPUT OUTPUT; do
-			echo "add rule inet $table $BASE counter jump $chain" >> "$tmp"
-		done
-		echo "add rule inet $table $chain counter return" >> "$tmp"
-	done
-done
-
-ip netns add "$testns"
-ip -netns "$testns" link set lo up
-
-lscpu | grep ^CPU\(s\): | ( read cpu cpunum ;
-cpunum=$((cpunum-1))
-for i in $(seq 0 $cpunum);do
-	mask=$(printf 0x%x $((1<<$i)))
-        ip netns exec "$testns" taskset $mask ping -4 127.0.0.1 -fq > /dev/null &
-        ip netns exec "$testns" taskset $mask ping -6 ::1 -fq > /dev/null &
-done)
-
-sleep 1
-
-for i in $(seq 1 10) ; do ip netns exec "$testns" nft -f "$tmp" & done
-
-for table in $tables;do
-	randsleep=$((RANDOM%10))
-	sleep $randsleep
-	ip netns exec "$testns" nft delete table inet $table 2>/dev/null
-done
-
-randsleep=$((RANDOM%10))
-sleep $randsleep
-
-pkill -9 ping
-
-wait
-
-rm -f "$tmp"
-ip netns del "$testns"