From nobody Sat Oct 11 05:56:19 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 757AF2D6604; Fri, 19 Sep 2025 22:38:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758321517; cv=none; b=tt/0vqZnD8gWD5o//cjL73BoK/rFw4fWMfQwbKWUVlY9x8ZFIKK4DFRuCUDMiJY/6YsoI4ikEqUmixn177Pnk3DYrFi420RwNwcvqs7M0ZPRmUaIuFEJGSVi4KZ2uOVs4anH7cqmKQYw0TzE5YGol5ZzD+8dsolMRk3svwpFLUg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758321517; c=relaxed/simple; bh=XMIFzGqkR2k4A363T4IAId9E8rXgz5W/2zq+W0QBN/c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=i+gSgAckQLyr4RbR+xddjQyDcuYxD8CAQnGf3s2zmdHXa8cGeXnogiuij9hSiakb5n6QjFzCCy0lC0TBy6HJ+DXIZVVImpdxaRWFl56ATd9sPr7d/te2ijSHDwKmy6zcgqd1mt6Zn8/WEmZh/mABKjDonDz2mCbyGSmA/xcRWR0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=dIkpt4lI; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="dIkpt4lI" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7CB60C4CEF0; Fri, 19 Sep 2025 22:38:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1758321517; bh=XMIFzGqkR2k4A363T4IAId9E8rXgz5W/2zq+W0QBN/c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dIkpt4lI+kR6D8s/bUZh0xDGhrUEPkzn/yv/XORJGYQ4itfidLdwZvEmoSFm9+n8Z l3G+W1/XdTZE8K/PPTBUmdLSnlqtuwrpWmtHyBjPW0mF8unwP10cx+S/dr7X1s3QhM 9HrMIqGgMgOAU0z4dAxZb+ulqwEN2ykjbWk0WVDcPz8zVvP/p2fnM5xYHQ46lHfYle t2Gd0TXZvcP6Na4QhCOhTOax5/At5H+BnYkSOImOuasKKfc5utRIPs3voARTppSODg f69lggY1wwZzFOm2nESW01MKu3kijUABv60aKsmoNDYN7oq1p5bFqJL3Ees9FaneKR 7eZDXZLRVLP7w== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: "Matthieu Baerts (NGI0)" , sashal@kernel.org, Marek Majkowski , Mat Martineau , Jakub Kicinski Subject: [PATCH 6.6.y 1/2] mptcp: pm: nl: announce deny-join-id0 flag Date: Sat, 20 Sep 2025 00:38:21 +0200 Message-ID: <20250919223819.3679521-5-matttbe@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20250919223819.3679521-4-matttbe@kernel.org> References: <20250919223819.3679521-4-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4446; i=matttbe@kernel.org; h=from:subject; bh=XMIFzGqkR2k4A363T4IAId9E8rXgz5W/2zq+W0QBN/c=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGDLO3o6bm6NiYGw7VdpQ2/RT+uF7f1Y4spS8mt6te+Dnt UVuh5y+dJSyMIhxMciKKbJIt0Xmz3xexVvi5WcBM4eVCWQIAxenAExknykjQ69bWn76orOvr1+X K5kWK6f45nML76F/gQp+bOd3F+au3cTI0BJ4U7+G83nRh7wnMUukJv+22pyhOoNFbm9d1I1FrR9 3cAIA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" commit 2293c57484ae64c9a3c847c8807db8c26a3a4d41 upstream. During the connection establishment, a peer can tell the other one that it cannot establish new subflows to the initial IP address and port by setting the 'C' flag [1]. Doing so makes sense when the sender is behind a strict NAT, operating behind a legacy Layer 4 load balancer, or using anycast IP address for example. When this 'C' flag is set, the path-managers must then not try to establish new subflows to the other peer's initial IP address and port. The in-kernel PM has access to this info, but the userspace PM didn't. The RFC8684 [1] is strict about that: (...) therefore the receiver MUST NOT try to open any additional subflows toward this address and port. So it is important to tell the userspace about that as it is responsible for the respect of this flag. When a new connection is created and established, the Netlink events now contain the existing but not currently used 'flags' attribute. When MPTCP_PM_EV_FLAG_DENY_JOIN_ID0 is set, it means no other subflows to the initial IP address and port -- info that are also part of the event -- can be established. Link: https://datatracker.ietf.org/doc/html/rfc8684#section-3.1-20.6 [1] Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establ= ishment") Reported-by: Marek Majkowski Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/532 Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250912-net-mptcp-pm-uspace-deny_join_id0-v= 1-2-40171884ade8@kernel.org Signed-off-by: Jakub Kicinski [ Conflicts in mptcp_pm.yaml, and mptcp_pm.h, because these files have been added later by commit bc8aeb2045e2 ("Documentation: netlink: add a YAML spec for mptcp"), and commit 9d1ed17f93ce ("uapi: mptcp: use header file generated from YAML spec"), which are not in this version. Applying the same modifications, but only in mptcp.h. Conflict in pm_netlink.c, because of a difference in the context, introduced by commit b9f4554356f6 ("mptcp: annotate lockless access for token"), which is not in this version. ] Signed-off-by: Matthieu Baerts (NGI0) --- include/uapi/linux/mptcp.h | 6 ++++-- net/mptcp/pm_netlink.c | 7 +++++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/include/uapi/linux/mptcp.h b/include/uapi/linux/mptcp.h index ee9c49f949a2..00d622121673 100644 --- a/include/uapi/linux/mptcp.h +++ b/include/uapi/linux/mptcp.h @@ -81,6 +81,8 @@ enum { =20 #define MPTCP_PM_ADDR_ATTR_MAX (__MPTCP_PM_ADDR_ATTR_MAX - 1) =20 +#define MPTCP_PM_EV_FLAG_DENY_JOIN_ID0 _BITUL(0) + #define MPTCP_PM_ADDR_FLAG_SIGNAL (1 << 0) #define MPTCP_PM_ADDR_FLAG_SUBFLOW (1 << 1) #define MPTCP_PM_ADDR_FLAG_BACKUP (1 << 2) @@ -132,13 +134,13 @@ struct mptcp_info { =20 /* * MPTCP_EVENT_CREATED: token, family, saddr4 | saddr6, daddr4 | daddr6, - * sport, dport + * sport, dport, server-side, [flags] * A new MPTCP connection has been created. It is the good time to allocate * memory and send ADD_ADDR if needed. Depending on the traffic-patterns * it can take a long time until the MPTCP_EVENT_ESTABLISHED is sent. * * MPTCP_EVENT_ESTABLISHED: token, family, saddr4 | saddr6, daddr4 | daddr= 6, - * sport, dport + * sport, dport, server-side, [flags] * A MPTCP connection is established (can start new subflows). * * MPTCP_EVENT_CLOSED: token diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index e8042014bd5f..de24989b05a6 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -2252,6 +2252,7 @@ static int mptcp_event_created(struct sk_buff *skb, const struct sock *ssk) { int err =3D nla_put_u32(skb, MPTCP_ATTR_TOKEN, msk->token); + u16 flags =3D 0; =20 if (err) return err; @@ -2259,6 +2260,12 @@ static int mptcp_event_created(struct sk_buff *skb, if (nla_put_u8(skb, MPTCP_ATTR_SERVER_SIDE, READ_ONCE(msk->pm.server_side= ))) return -EMSGSIZE; =20 + if (READ_ONCE(msk->pm.remote_deny_join_id0)) + flags |=3D MPTCP_PM_EV_FLAG_DENY_JOIN_ID0; + + if (flags && nla_put_u16(skb, MPTCP_ATTR_FLAGS, flags)) + return -EMSGSIZE; + return mptcp_event_add_subflow(skb, ssk); } =20 --=20 2.51.0 From nobody Sat Oct 11 05:56:19 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 20A042E0921; Fri, 19 Sep 2025 22:38:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758321519; cv=none; b=GL4aYo1Mty/e32pERSYhAvktlHVo06Bm1xyefn7lWJr3tNMxta0qqilpW0YwC1nuPtctYBxGYcBxt/uanPDZNGuxtNvK8/ItJwWBovhc+AxKrt06Sr30TaHYqq+U6MbonFiJmVBvALvqIISsPhYJ01WYoLnitgPUtuO+PHrca8k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758321519; c=relaxed/simple; bh=b6clr2qvnYAkxpKplu9ZTxNVwliKvXTRMmCQ+0H88K0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jsD1NepDkK1g7NhUf6WzYm1VGxHkASiBw0Eg4RMDzdavgpT66GzFjwjPjmG+VKO+8KxYfcvBizbyvRojGdzhnrjH2EkA0pXHCXGL5jA/6xmn2rTfO+fJNTTn+Ds8KxDn34Nd7pWtZOS5LrEtOE2dLdlFZwQN/PELH6O4iHO9M7c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=N0K+JyL8; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="N0K+JyL8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 80DE1C4CEF1; Fri, 19 Sep 2025 22:38:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1758321519; bh=b6clr2qvnYAkxpKplu9ZTxNVwliKvXTRMmCQ+0H88K0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=N0K+JyL8dOU7R93VuDNaNU+Y6YkTbkQ5WtaWAiC3rcKJgiRHsb/MqSTrLko/C9m0P VN9Dy30ufnhT0J4aobuiRasqSNE12y8u3XH2hv9mlk9PeYIm4wyapuyr2jSez+Eaka lgK1/enoHGf6hZ6PlkuVeP+A50DJ7DLl9VmyE+c2mhO9kXnUnTbQYA+8WDJtOkB3l+ Jgt+P4XDWS95Ka227blDqWh03O7yhda2dtejtQF5NAEqgopldvIKRkvMU1P8U0ysWR CDHwXYYkSPYejkgJ30CcELfCsAvNF5rtYInTgdUKXnUJ+8RoTMn5BVDhtfqc0NsvYe frwtPldwCjf8g== From: "Matthieu Baerts (NGI0)" To: mptcp@lists.linux.dev, stable@vger.kernel.org, gregkh@linuxfoundation.org Cc: "Matthieu Baerts (NGI0)" , sashal@kernel.org, Mat Martineau , Jakub Kicinski Subject: [PATCH 6.6.y 2/2] selftests: mptcp: userspace pm: validate deny-join-id0 flag Date: Sat, 20 Sep 2025 00:38:22 +0200 Message-ID: <20250919223819.3679521-6-matttbe@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20250919223819.3679521-4-matttbe@kernel.org> References: <20250919223819.3679521-4-matttbe@kernel.org> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4468; i=matttbe@kernel.org; h=from:subject; bh=b6clr2qvnYAkxpKplu9ZTxNVwliKvXTRMmCQ+0H88K0=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGDLO3o5fa31pXurb6+7fTbpOLLxpw/rs9XOuD5P8TGz9V lhaeV0K7ihlYRDjYpAVU2SRbovMn/m8irfEy88CZg4rE8gQBi5OAZjI28MM/4u/n6y5tHeSJyOv 5tfcPde+TTny/mD9ac9ryuvczKdcmP2PkWHdLIttCs81kqc/01m0YXZ2/QNOMVFhLxaNUvNWN9O j/7kB X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" commit 24733e193a0d68f20d220e86da0362460c9aa812 upstream. The previous commit adds the MPTCP_PM_EV_FLAG_DENY_JOIN_ID0 flag. Make sure it is correctly announced by the other peer when it has been received. pm_nl_ctl will now display 'deny_join_id0:1' when monitoring the events, and when this flag was set by the other peer. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establ= ishment") Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250912-net-mptcp-pm-uspace-deny_join_id0-v= 1-3-40171884ade8@kernel.org Signed-off-by: Jakub Kicinski [ Conflict in userspace_pm.sh, because of a difference in the context, introduced by commit c66fb480a330 ("selftests: userspace pm: avoid relaunching pm events"), which is not in this version. The same lines can still be added at the same place. ] Signed-off-by: Matthieu Baerts (NGI0) --- tools/testing/selftests/net/mptcp/pm_nl_ctl.c | 7 +++++++ tools/testing/selftests/net/mptcp/userspace_pm.sh | 14 +++++++++++--- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/tools/testing/selftests/net/mptcp/pm_nl_ctl.c b/tools/testing/= selftests/net/mptcp/pm_nl_ctl.c index 763402dd1774..234c267dd2aa 100644 --- a/tools/testing/selftests/net/mptcp/pm_nl_ctl.c +++ b/tools/testing/selftests/net/mptcp/pm_nl_ctl.c @@ -194,6 +194,13 @@ static int capture_events(int fd, int event_group) fprintf(stderr, ",error:%u", *(__u8 *)RTA_DATA(attrs)); else if (attrs->rta_type =3D=3D MPTCP_ATTR_SERVER_SIDE) fprintf(stderr, ",server_side:%u", *(__u8 *)RTA_DATA(attrs)); + else if (attrs->rta_type =3D=3D MPTCP_ATTR_FLAGS) { + __u16 flags =3D *(__u16 *)RTA_DATA(attrs); + + /* only print when present, easier */ + if (flags & MPTCP_PM_EV_FLAG_DENY_JOIN_ID0) + fprintf(stderr, ",deny_join_id0:1"); + } =20 attrs =3D RTA_NEXT(attrs, msg_len); } diff --git a/tools/testing/selftests/net/mptcp/userspace_pm.sh b/tools/test= ing/selftests/net/mptcp/userspace_pm.sh index c5d7af8e8efd..4e966a9e3738 100755 --- a/tools/testing/selftests/net/mptcp/userspace_pm.sh +++ b/tools/testing/selftests/net/mptcp/userspace_pm.sh @@ -196,6 +196,9 @@ make_connection() is_v6=3D"v4" fi =20 + # set this on the client side only: will not affect the rest + ip netns exec "$ns2" sysctl -q net.mptcp.allow_join_initial_addr_port=3D0 + # Capture netlink events over the two network namespaces running # the MPTCP client and server if [ -z "$client_evts" ]; then @@ -227,23 +230,28 @@ make_connection() local client_token local client_port local client_serverside + local client_nojoin local server_token local server_serverside + local server_nojoin =20 client_token=3D$(mptcp_lib_evts_get_info token "$client_evts") client_port=3D$(mptcp_lib_evts_get_info sport "$client_evts") client_serverside=3D$(mptcp_lib_evts_get_info server_side "$client_evts") + client_nojoin=3D$(mptcp_lib_evts_get_info deny_join_id0 "$client_evts") server_token=3D$(mptcp_lib_evts_get_info token "$server_evts") server_serverside=3D$(mptcp_lib_evts_get_info server_side "$server_evts") + server_nojoin=3D$(mptcp_lib_evts_get_info deny_join_id0 "$server_evts") =20 print_test "Established IP${is_v6} MPTCP Connection ns2 =3D> ns1" - if [ "$client_token" !=3D "" ] && [ "$server_token" !=3D "" ] && [ "$clie= nt_serverside" =3D 0 ] && - [ "$server_serverside" =3D 1 ] + if [ "${client_token}" !=3D "" ] && [ "${server_token}" !=3D "" ] && + [ "${client_serverside}" =3D 0 ] && [ "${server_serverside}" =3D 1 ] && + [ "${client_nojoin:-0}" =3D 0 ] && [ "${server_nojoin:-0}" =3D 1 ] then test_pass print_title "Connection info: ${client_addr}:${client_port} -> ${connect= _addr}:${app_port}" else - test_fail "Expected tokens (c:${client_token} - s:${server_token}) and s= erver (c:${client_serverside} - s:${server_serverside})" + test_fail "Expected tokens (c:${client_token} - s:${server_token}), serv= er (c:${client_serverside} - s:${server_serverside}), nojoin (c:${client_no= join} - s:${server_nojoin})" mptcp_lib_result_print_all_tap exit 1 fi --=20 2.51.0