qa: use nft instead iptables

rocky.10 does not support iptables with MASQUERADE targets. (Or maybe it
does with more prodding but it's easier to just switch to nft.)

Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>

diff --git a/qa/tasks/cephfs/mount.py b/qa/tasks/cephfs/mount.py
index 566d8988214acf96c81807c1f92ed03b01cde778..3b634f0fe92b4c8b2e2762c8285753a80ba087f4 100644 (file)
--- a/qa/tasks/cephfs/mount.py
+++ b/qa/tasks/cephfs/mount.py
@@ -308,9 +308,23 @@ class CephFSMountBase(object):
 
         self.run_shell_payload(f"""
             set -e
-            sudo iptables -A FORWARD -o {gw} -i ceph-brx -j ACCEPT
-            sudo iptables -A FORWARD -i {gw} -o ceph-brx -j ACCEPT
-            sudo iptables -t nat -A POSTROUTING -s {ip}/{mask} -o {gw} -j MASQUERADE
+
+            # Ensure filter table exists. Ignore error if it already does.
+            sudo nft add table ip filter > /dev/null 2>&1 || true
+            sudo nft add chain ip filter forward {{ type filter hook forward priority 0 \; }} > /dev/null 2>&1 || true
+
+            # Ensure nat table exists. Ignore error if it already does.
+            sudo nft add table ip nat > /dev/null 2>&1 || true
+
+            # Ensure postrouting chain exists. Ignore error if it already does.
+            sudo nft add chain ip nat postrouting {{ type nat hook postrouting priority 100 \; }} > /dev/null 2>&1 || true
+
+            # Add the forwarding rules (to filter table, forward chain)
+            sudo nft add rule ip filter forward iifname ceph-brx oifname {gw} accept
+            sudo nft add rule ip filter forward iifname {gw} oifname ceph-brx accept
+
+            # Add the NAT rule
+            sudo nft add rule ip nat postrouting ip saddr {ip}/{mask} oifname {gw} masquerade
         """, timeout=(5*60), omit_sudo=False, cwd='/')
 
     def _setup_netns(self):
@@ -450,9 +464,9 @@ class CephFSMountBase(object):
 
         self.run_shell_payload(f"""
             set -e
-            sudo iptables -D FORWARD -o {gw} -i ceph-brx -j ACCEPT
-            sudo iptables -D FORWARD -i {gw} -o ceph-brx -j ACCEPT
-            sudo iptables -t nat -D POSTROUTING -s {ip}/{mask} -o {gw} -j MASQUERADE
+            sudo nft delete rule ip filter forward iifname ceph-brx oifname {gw} accept > /dev/null 2>&1 || true
+            sudo nft delete rule ip filter forward iifname {gw} oifname ceph-brx accept > /dev/null 2>&1 || true
+            sudo nft delete rule ip nat postrouting ip saddr {ip}/{mask} oifname {gw} masquerade > /dev/null 2>&1 || true
         """, timeout=(5*60), omit_sudo=False, cwd='/')
 
     def setup_netns(self):