Run nftable tests on buildkite.

PiperOrigin-RevId: 825239624

Author: konstantin-s-bogom

.buildkite/pipeline.yaml

@@ -483,6 +483,15 @@ steps:
       <<: *ubuntu_agents
       # This test is flaky on old agents.
       cgroup: "v2"
+  - <<: *common
+    <<: *source_test
+    label: ":table: Native NFTable Syscall tests"
+    command: make nftables-syscall-tests
+    agents:
+      <<: *ubuntu_agents
+      # Test is only validated to run on newer agents, older kernels have
+      # different implementation behaviour.
+      cgroup: "v2"
 
   # Runtime tests.
   - <<: *common

Makefile

@@ -435,6 +435,12 @@ nftables-tests: load-nftables $(RUNTIME_BIN)
 	@$(call test_runtime,$(RUNTIME),--test_env=TEST_NET_RAW=true //test/nftables:nftables_test)
 .PHONY: nftables-tests
 
+nftables-syscall-tests: load-basic
+	@sudo modprobe nfnetlink
+	@sudo modprobe nf_tables
+	@$(call sudo,test,--runtime=runc //test/syscalls/linux:socket_netlink_netfilter_test)
+.PHONY: nftables-syscall-tests
+
 packetdrill-tests: load-packetdrill $(RUNTIME_BIN)
 	@$(call install_runtime,$(RUNTIME),) # Clear flags.
 	@$(call test_runtime,$(RUNTIME),//test/packetdrill:all_tests)

test/syscalls/linux/BUILD

@@ -3544,6 +3544,7 @@ cc_binary(
         "//test/util:socket_util",
         "//test/util:test_main",
         "//test/util:test_util",
+        "@com_google_absl//absl/strings",
         "@com_google_absl//absl/strings:str_format",
     ],
 )
@@ -3729,7 +3730,10 @@ cc_library(
         ":socket_netlink_util",
         "//test/util:file_descriptor",
         "//test/util:posix_error",
+        "//test/util:save_util",
+        "//test/util:test_util",
         "@com_google_absl//absl/log",
+        "@com_google_absl//absl/strings:string_view",
     ],
 )