net/mptcp/mib.c | 1 + net/mptcp/mib.h | 1 + net/mptcp/options.c | 107 +++++++++++++++++++++++++++++++------------ net/mptcp/protocol.h | 2 +- net/mptcp/subflow.c | 10 ++-- 5 files changed, 85 insertions(+), 36 deletions(-)
From: Gang Yan <yangang@kylinos.cn> This series is designed for [1]. Patch 1 passes the 'net' to options parser, I used to use dev_net(skb->dev) for MIB counters, but the AI reported it is not suitable for this. This patch has no functional change. Patch 2 adds the InvalidOptionRx counter, and increments it when receive the invalid options. The packetdill testcase is submitted, and can be reviewed in [2]. [1] https://github.com/multipath-tcp/mptcp_net-next/issues/628 [2] https://github.com/multipath-tcp/packetdrill/pull/205 Gang Yan (2): mptcp: pass net namespace to options parser mptcp: add MIB counter for received invalid options net/mptcp/mib.c | 1 + net/mptcp/mib.h | 1 + net/mptcp/options.c | 107 +++++++++++++++++++++++++++++++------------ net/mptcp/protocol.h | 2 +- net/mptcp/subflow.c | 10 ++-- 5 files changed, 85 insertions(+), 36 deletions(-) -- 2.43.0
Hi Gang,
On 12/08/2026 12:05, Gang Yan wrote:
> From: Gang Yan <yangang@kylinos.cn>
>
> This series is designed for [1].
>
> Patch 1 passes the 'net' to options parser, I used to use
> dev_net(skb->dev) for MIB counters, but the AI reported it is not
> suitable for this. This patch has no functional change.
>
> Patch 2 adds the InvalidOptionRx counter, and increments it when
> receive the invalid options.
>
> The packetdill testcase is submitted, and can be reviewed in [2].
>
> [1] https://github.com/multipath-tcp/mptcp_net-next/issues/628
Thank you for the patches. Please next time add a comment on the GitHub
ticket: I already have the patches ready, but I had to wait (for
administration purposes) before sending them:
============
commit 8173df5a467cac6ed421bb832ac3ee675b490fa6 (b4/mptcp-mib-inval-opt)
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date: Fri Jul 31 14:10:38 2026 +0200
mptcp: options: reset parsing in case of invalidity
When an invalid option is detected -- any unexpected suboptions
combinations or use of invalid sizes -- the current behaviour is to
ignore the currently parsed option.
Receiving such invalid options is suspicious: either this is coming from
a buggy host, or an attacker. In this case, it seems safer to drop any
previously parsed MPTCP option from such packet.
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
commit be5492962195d2988a9c508bc8ce4d3f55ac1da7
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date: Wed Jul 29 20:01:45 2026 +0200
mptcp: options: track invalid ones
Any unexpected suboptions combinations or use of invalid sizes are
suspicious: either it is coming from a buggy host, or an attacker.
Better to track that with a new MIB counter.
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
commit 684c6244b5b76d30aaf30d62597247485b89cdb3
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date: Mon Aug 3 20:24:02 2026 +0200
mptcp: options: use a dedicated bit for csum reqd
Instead of mixing that with suboptions: that's the only non-suboptions
that is present in the 'suboptions' field.
This even cause a workaround with OPTIONS_MPTCP_DSS to exclude this
non-suboptions when checking which other ones are set.
Move it to a dedicated free bit, and adapt the corresponding code.
This is clearer like that.
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
=========
In your version, I see that you increment the counter even when the
suboption is not invalid, e.g. the version or the hmac is not supported.
I don't think we should do that.
If that's OK for you, I can add a co-dev by on my patches.
Cheers,
Matt
--
Sponsored by the NGI0 Core fund.
August 12, 2026 at 11:03 PM, "Matthieu Baerts" <matttbe@kernel.org mailto:matttbe@kernel.org?to=%22Matthieu%20Baerts%22%20%3Cmatttbe%40kernel.org%3E > wrote: > > Hi Gang, > > On 12/08/2026 12:05, Gang Yan wrote: > > > > > From: Gang Yan <yangang@kylinos.cn> > > > > This series is designed for [1]. > > > > Patch 1 passes the 'net' to options parser, I used to use > > dev_net(skb->dev) for MIB counters, but the AI reported it is not > > suitable for this. This patch has no functional change. > > > > Patch 2 adds the InvalidOptionRx counter, and increments it when > > receive the invalid options. > > > > The packetdill testcase is submitted, and can be reviewed in [2]. > > > > [1] https://github.com/multipath-tcp/mptcp_net-next/issues/628 > > Hi Matt > Thank you for the patches. Please next time add a comment on the GitHub > ticket: I already have the patches ready, but I had to wait (for > administration purposes) before sending them: > Sorry for that, no offense intended. And thanks for the review and for the process reminder. > ============ > > commit 8173df5a467cac6ed421bb832ac3ee675b490fa6 (b4/mptcp-mib-inval-opt) > Author: Matthieu Baerts (NGI0) <matttbe@kernel.org> > Date: Fri Jul 31 14:10:38 2026 +0200 > > mptcp: options: reset parsing in case of invalidity > > When an invalid option is detected -- any unexpected suboptions > combinations or use of invalid sizes -- the current behaviour is to > ignore the currently parsed option. > > Receiving such invalid options is suspicious: either this is coming from > a buggy host, or an attacker. In this case, it seems safer to drop any > previously parsed MPTCP option from such packet. > > Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> > > commit be5492962195d2988a9c508bc8ce4d3f55ac1da7 > Author: Matthieu Baerts (NGI0) <matttbe@kernel.org> > Date: Wed Jul 29 20:01:45 2026 +0200 > > mptcp: options: track invalid ones > > Any unexpected suboptions combinations or use of invalid sizes are > suspicious: either it is coming from a buggy host, or an attacker. > > Better to track that with a new MIB counter. > > Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> > > commit 684c6244b5b76d30aaf30d62597247485b89cdb3 > Author: Matthieu Baerts (NGI0) <matttbe@kernel.org> > Date: Mon Aug 3 20:24:02 2026 +0200 > > mptcp: options: use a dedicated bit for csum reqd > > Instead of mixing that with suboptions: that's the only non-suboptions > that is present in the 'suboptions' field. > > This even cause a workaround with OPTIONS_MPTCP_DSS to exclude this > non-suboptions when checking which other ones are set. > > Move it to a dedicated free bit, and adapt the corresponding code. > > This is clearer like that. > > Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> > > ========= > > In your version, I see that you increment the counter even when the > suboption is not invalid, e.g. the version or the hmac is not supported. > I don't think we should do that. > > If that's OK for you, I can add a co-dev by on my patches. Thank you, that’s fine with me Thanks Gang > > Cheers, > Matt > -- > Sponsored by the NGI0 Core fund. >
Hi Gang,
Thank you for your modifications, that's great!
Our CI did some validations and here is its report:
- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/31587859371
Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/cb85dffafd7b
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1144623
If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:
$ cd [kernel source code]
$ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
--pull always mptcp/mptcp-upstream-virtme-docker:latest \
auto-normal
For more details:
https://github.com/multipath-tcp/mptcp-upstream-virtme-docker
Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)
Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)
© 2016 - 2026 Red Hat, Inc.