From nobody Sat Aug 15 20:31:14 2026 Received: from mta0.migadu.com (out-204.mta0.migadu.com [91.218.175.204]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5CDFA3939A9 for ; Wed, 12 Aug 2026 10:06:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.204 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786529195; cv=none; b=D8gjkCL+ujMLCs1nNVMjJzRBwGY01GjBKvJDGvo//esseZIUQhmBSg0m9mieaKCwf4/WFmYXhfp4ktmxCGyQwRcz3B/wgVgOJrcV7oV4qItY6ot3sltmDEkDA8H6cuUyNlNtBEOhYaf7uhEfSNoJFZW67/HBCQXb8mzU+pO0HJk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786529195; c=relaxed/simple; bh=6NTkhoQBUivGYDUENf6SectqtTze71990xlbTKqOl1c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uqdcEIcxA2jPDkf2K7iaTM0q5F9cpuHbpl60ZD4eJbayfdbjiOnEwmrV+vml1FaOn3iN9zs0GBxouBAHJFfRcbNuMdTDYcqVtZX5R1ewolkYd9A+gse/66Bfm66itHbVEaG0lw1+5HZ6TjH1igrtag4as5w+B2hz2QtPkLMS6n8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=AwhppazS; arc=none smtp.client-ip=91.218.175.204 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="AwhppazS" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=6NTkhoQBUivGYDUENf6SectqtTze71990xlbTKqOl1c=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1786529191; v=1; x=1787133991; b=AwhppazSl3fY1ddX99Naof5RKMRdjNgXlsLMHSgjFnuSfgtTdt1r5aE6fvOwzndHVO4W//7n lsP+6XD41TaMRVxnPOaiB4P38vL1A7tDWh6zC6/m8X+5xjtoTX9glin4G9ZIcz5L4sBqWtZqZ3l 8Mb/P8zmRgJXQIQLRq4bqlLE= X-Envelope-To: mptcp@lists.linux.dev Received: from thinkbook16p.. (120.244.49.214) by smtp.migadu.com with ESMTPS id ffa7ce9c9f2a2c7f; Wed, 12 Aug 2026 10:06:31 +0000 X-Migadu-Scanner: mta10.migadu.com Authentication-Results: mta10.migadu.com; none From: Gang Yan To: mptcp@lists.linux.dev Cc: Gang Yan Subject: [PATCH mptcp-next 1/2] mptcp: pass net namespace to options parser Date: Wed, 12 Aug 2026 18:05:49 +0800 Message-ID: <20260812100550.148670-2-gang.yan@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260812100550.148670-1-gang.yan@linux.dev> References: <20260812100550.148670-1-gang.yan@linux.dev> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Gang Yan The MPTCP options parser will need access to the per-netns MIB counters to track received invalid options. To prepare for this, pass the net namespace down to mptcp_get_options() and mptcp_parse_option(). This is a pure refactor with no functional change. Assisted-by: Claude:GLM-5.2 Signed-off-by: Gang Yan --- net/mptcp/options.c | 9 +++++---- net/mptcp/protocol.h | 2 +- net/mptcp/subflow.c | 10 +++++----- 3 files changed, 11 insertions(+), 10 deletions(-) diff --git a/net/mptcp/options.c b/net/mptcp/options.c index 97da22668dbe..dfdcc888efe3 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -20,7 +20,8 @@ static bool mptcp_cap_flag_sha256(u8 flags) return (flags & MPTCP_CAP_FLAG_MASK) =3D=3D MPTCP_CAP_HMAC_SHA256; } =20 -static void mptcp_parse_option(const struct sk_buff *skb, +static void mptcp_parse_option(struct net *net, + const struct sk_buff *skb, const unsigned char *ptr, int opsize, struct mptcp_options_received *mp_opt) { @@ -419,7 +420,7 @@ static void mptcp_parse_option(const struct sk_buff *sk= b, } } =20 -void mptcp_get_options(const struct sk_buff *skb, +void mptcp_get_options(struct net *net, const struct sk_buff *skb, struct mptcp_options_received *mp_opt) { const struct tcphdr *th =3D tcp_hdr(skb); @@ -454,7 +455,7 @@ void mptcp_get_options(const struct sk_buff *skb, if (opsize > length) return; /* don't parse partial options */ if (opcode =3D=3D TCPOPT_MPTCP) - mptcp_parse_option(skb, ptr, opsize, mp_opt); + mptcp_parse_option(net, skb, ptr, opsize, mp_opt); ptr +=3D opsize - 2; length -=3D opsize; } @@ -1247,7 +1248,7 @@ bool mptcp_incoming_options(struct sock *sk, struct s= k_buff *skb) return !mptcp_over_limit(subflow->conn, sk, skb); } =20 - mptcp_get_options(skb, &mp_opt); + mptcp_get_options(sock_net(sk), skb, &mp_opt); =20 /* The subflow can be in close state only if check_fully_established() * just sent a reset. If so, tell the caller to ignore the current packet. diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 7e168e450fb0..333fb5c89c59 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -927,7 +927,7 @@ struct sock *mptcp_sk_clone_init(const struct sock *sk, const struct mptcp_options_received *mp_opt, struct sock *ssk, struct request_sock *req); -void mptcp_get_options(const struct sk_buff *skb, +void mptcp_get_options(struct net *net, const struct sk_buff *skb, struct mptcp_options_received *mp_opt); =20 void mptcp_finish_connect(struct sock *sk); diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index af81ad5e699d..9a8a39b23fcb 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -167,7 +167,7 @@ static int subflow_check_req(struct request_sock *req, } #endif =20 - mptcp_get_options(skb, &mp_opt); + mptcp_get_options(sock_net(sk_listener), skb, &mp_opt); =20 opt_mp_capable =3D !!(mp_opt.suboptions & OPTION_MPTCP_MPC_SYN); opt_mp_join =3D !!(mp_opt.suboptions & OPTION_MPTCP_MPJ_SYN); @@ -273,7 +273,7 @@ int mptcp_subflow_init_cookie_req(struct request_sock *= req, int err; =20 subflow_init_req(req, sk_listener); - mptcp_get_options(skb, &mp_opt); + mptcp_get_options(sock_net(sk_listener), skb, &mp_opt); =20 opt_mp_capable =3D !!(mp_opt.suboptions & OPTION_MPTCP_MPC_ACK); opt_mp_join =3D !!(mp_opt.suboptions & OPTION_MPTCP_MPJ_ACK); @@ -539,7 +539,7 @@ static void subflow_finish_connect(struct sock *sk, con= st struct sk_buff *skb) subflow->ssn_offset =3D TCP_SKB_CB(skb)->seq; pr_debug("subflow=3D%p synack seq=3D%x\n", subflow, subflow->ssn_offset); =20 - mptcp_get_options(skb, &mp_opt); + mptcp_get_options(sock_net(sk), skb, &mp_opt); if (subflow->request_mptcp) { if (!(mp_opt.suboptions & OPTION_MPTCP_MPC_SYNACK)) { if (!mptcp_try_fallback(sk, @@ -842,13 +842,13 @@ static struct sock *subflow_syn_recv_sock(const struc= t sock *sk, * reordered MPC will cause fallback, but we don't have other * options. */ - mptcp_get_options(skb, &mp_opt); + mptcp_get_options(sock_net(sk), skb, &mp_opt); if (!(mp_opt.suboptions & (OPTION_MPTCP_MPC_SYN | OPTION_MPTCP_MPC_ACK))) fallback =3D true; =20 } else if (subflow_req->mp_join) { - mptcp_get_options(skb, &mp_opt); + mptcp_get_options(sock_net(sk), skb, &mp_opt); if (!(mp_opt.suboptions & OPTION_MPTCP_MPJ_ACK)) fallback =3D true; } --=20 2.43.0 From nobody Sat Aug 15 20:31:14 2026 Received: from mta1.migadu.com (out-227.mta1.migadu.com [95.215.58.227]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9CD0B33B97D for ; Wed, 12 Aug 2026 10:06:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.227 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786529204; cv=none; b=hthgmCBLV0bN//D7NCad7Tlw8Ut5eofV8qzUfPFpsZebNbtyZwOnpILfeEslaFNWpkhHw0i/QUDZP7tIRCC++uLl5pQjj/ZVbLBLaAMQlO49bkfq4QZC4I2nLNzRJKRpjLcPpYXR5MV8qKQNXTZnQNnKGKaZ1V8Rd3qrUfiO5iE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786529204; c=relaxed/simple; bh=MQkQwga6nNuR+PE09NLyd493bEQDdpxETdpTt2o99XY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=aePB+pwiowvGddquqQhNvdSOizgpV7Ta7YdQRmr0u0ZS3l52sP6B4mkMNSqKiqV8ZwmV33mrnCLKmCVUd/lK4fGu4YPUWKBXvxMjVKE6djiRYOXu9v/LNOAz3C3wOvwV/Vm8wKKsR61qfgzeBMxadb0DJosvDy0utFby54B23iM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=hTkNcpCO; arc=none smtp.client-ip=95.215.58.227 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="hTkNcpCO" X-Envelope-To: mptcp@lists.linux.dev DKIM-Signature: a=rsa-sha256; bh=MQkQwga6nNuR+PE09NLyd493bEQDdpxETdpTt2o99XY=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1786529200; v=1; x=1787134000; b=hTkNcpCOTEowMVt/9Vl540HAOyHFWwLzXGTeTfNNmeHbnJxOkFfQrwU2AUO3TSuUJeUqg4Oa WG455qlHDYfX5vQFSYKUg3nPvP782ntd42WBT9NheGoMjCjpekJgL6OnPAmVNopbMVFyMjDUKQR n1bSk1/sb2ZQjzdThcmBrpXc= X-Envelope-To: mptcp@lists.linux.dev Received: from thinkbook16p.. (120.244.49.214) by smtp.migadu.com with ESMTPS id 4bae616b51b72218; Wed, 12 Aug 2026 10:06:40 +0000 Authentication-Results: mta10.migadu.com; none X-Migadu-Scanner: mta10.migadu.com From: Gang Yan To: mptcp@lists.linux.dev Cc: Gang Yan Subject: [PATCH mptcp-next 2/2] mptcp: add MIB counter for received invalid options Date: Wed, 12 Aug 2026 18:05:50 +0800 Message-ID: <20260812100550.148670-3-gang.yan@linux.dev> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260812100550.148670-1-gang.yan@linux.dev> References: <20260812100550.148670-1-gang.yan@linux.dev> Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Gang Yan In mptcp_parse_option(), an MPTCP option is silently ignored via a 'break' under a number of conditions. This patch adds a MIB counter tracking this as an evidence to show someone is trying to attack the peer Assisted-by: Claude:GLM-5.2 Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/628 Signed-off-by: Gang Yan --- net/mptcp/mib.c | 1 + net/mptcp/mib.h | 1 + net/mptcp/options.c | 98 +++++++++++++++++++++++++++++++++------------ 3 files changed, 74 insertions(+), 26 deletions(-) diff --git a/net/mptcp/mib.c b/net/mptcp/mib.c index 608cb568897c..10e8870dd985 100644 --- a/net/mptcp/mib.c +++ b/net/mptcp/mib.c @@ -95,6 +95,7 @@ static const struct snmp_mib mptcp_snmp_list[] =3D { SNMP_MIB_ITEM("BacklogDrop", MPTCP_MIB_BACKLOGDROP), SNMP_MIB_ITEM("RcvPruned", MPTCP_MIB_RCVPRUNED), SNMP_MIB_ITEM("OFOPruned", MPTCP_MIB_OFOPRUNED), + SNMP_MIB_ITEM("InvalidOptionRx", MPTCP_MIB_INVALDOPTIONRX), }; =20 /* mptcp_mib_alloc - allocate percpu mib counters diff --git a/net/mptcp/mib.h b/net/mptcp/mib.h index 1ebdb55e9534..ae0751addd64 100644 --- a/net/mptcp/mib.h +++ b/net/mptcp/mib.h @@ -98,6 +98,7 @@ enum linux_mptcp_mib_field { MPTCP_MIB_BACKLOGDROP, /* Backlog over memory limit */ MPTCP_MIB_RCVPRUNED, /* Dropped due to memory constraints */ MPTCP_MIB_OFOPRUNED, /* MPTCP-level OoO queue pruned */ + MPTCP_MIB_INVALDOPTIONRX, /* Received an invalid MPTCP option */ __MPTCP_MIB_MAX }; =20 diff --git a/net/mptcp/options.c b/net/mptcp/options.c index dfdcc888efe3..e9deea0e483a 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -53,9 +53,12 @@ static void mptcp_parse_option(struct net *net, =20 /* Only the MPC + ACK can be used with a RM_ADDR */ if (subopt =3D=3D OPTION_MPTCP_MPC_ACK) { - if ((mp_opt->suboptions & ~OPTION_MPTCP_RM_ADDR) !=3D 0) + if ((mp_opt->suboptions & ~OPTION_MPTCP_RM_ADDR) !=3D 0) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } } else if (mp_opt->suboptions !=3D 0) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; } =20 @@ -71,22 +74,29 @@ static void mptcp_parse_option(struct net *net, */ if (opsize !=3D expected_opsize && (expected_opsize !=3D TCPOLEN_MPTCP_MPC_ACK_DATA || - opsize !=3D TCPOLEN_MPTCP_MPC_ACK_DATA_CSUM)) + opsize !=3D TCPOLEN_MPTCP_MPC_ACK_DATA_CSUM)) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } =20 /* try to be gentle vs future versions on the initial syn */ version =3D *ptr++ & MPTCP_VERSION_MASK; if (opsize !=3D TCPOLEN_MPTCP_MPC_SYN) { - if (version !=3D MPTCP_SUPPORTED_VERSION) + if (version !=3D MPTCP_SUPPORTED_VERSION) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } } else if (version < MPTCP_SUPPORTED_VERSION) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; } =20 flags =3D *ptr++; if (!mptcp_cap_flag_sha256(flags) || - (flags & MPTCP_CAP_EXTENSIBILITY)) + (flags & MPTCP_CAP_EXTENSIBILITY)) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } =20 /* RFC 6824, Section 3.1: * "For the Checksum Required bit (labeled "A"), if either @@ -133,8 +143,10 @@ static void mptcp_parse_option(struct net *net, case MPTCPOPT_MP_JOIN: /* Can be used with a restricted number of other options */ if ((mp_opt->suboptions & ~(OPTION_MPTCP_RM_ADDR | - OPTION_MPTCP_PRIO)) !=3D 0) + OPTION_MPTCP_PRIO)) !=3D 0) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } =20 if (opsize =3D=3D TCPOLEN_MPTCP_MPJ_SYN) { mp_opt->suboptions |=3D OPTION_MPTCP_MPJ_SYN; @@ -163,6 +175,8 @@ static void mptcp_parse_option(struct net *net, ptr +=3D 2; memcpy(mp_opt->hmac, ptr, MPTCPOPT_HMAC_LEN); pr_debug("MP_JOIN hmac\n"); + } else { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); } break; =20 @@ -172,8 +186,10 @@ static void mptcp_parse_option(struct net *net, OPTION_MPTCP_RM_ADDR | OPTION_MPTCP_PRIO | OPTION_MPTCP_FASTCLOSE | - OPTION_MPTCP_FAIL)) !=3D 0) + OPTION_MPTCP_FAIL)) !=3D 0) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } =20 pr_debug("DSS\n"); ptr++; @@ -216,6 +232,7 @@ static void mptcp_parse_option(struct net *net, mp_opt->ack64 =3D 0; mp_opt->use_ack =3D 0; mp_opt->data_fin =3D 0; + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; } =20 @@ -265,32 +282,38 @@ static void mptcp_parse_option(struct net *net, /* Can be used with a restricted number of other options */ if ((mp_opt->suboptions & ~(OPTIONS_MPTCP_DSS | OPTION_MPTCP_RM_ADDR | - OPTION_MPTCP_PRIO)) !=3D 0) + OPTION_MPTCP_PRIO)) !=3D 0) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } =20 mp_opt->echo =3D (*ptr++) & MPTCP_ADDR_ECHO; if (!mp_opt->echo) { if (opsize =3D=3D TCPOLEN_MPTCP_ADD_ADDR || - opsize =3D=3D TCPOLEN_MPTCP_ADD_ADDR_PORT) + opsize =3D=3D TCPOLEN_MPTCP_ADD_ADDR_PORT) { mp_opt->addr.family =3D AF_INET; #if IS_ENABLED(CONFIG_MPTCP_IPV6) - else if (opsize =3D=3D TCPOLEN_MPTCP_ADD_ADDR6 || - opsize =3D=3D TCPOLEN_MPTCP_ADD_ADDR6_PORT) + } else if (opsize =3D=3D TCPOLEN_MPTCP_ADD_ADDR6 || + opsize =3D=3D TCPOLEN_MPTCP_ADD_ADDR6_PORT) { mp_opt->addr.family =3D AF_INET6; #endif - else + } else { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } } else { if (opsize =3D=3D TCPOLEN_MPTCP_ADD_ADDR_BASE || - opsize =3D=3D TCPOLEN_MPTCP_ADD_ADDR_BASE_PORT) + opsize =3D=3D TCPOLEN_MPTCP_ADD_ADDR_BASE_PORT) { mp_opt->addr.family =3D AF_INET; #if IS_ENABLED(CONFIG_MPTCP_IPV6) - else if (opsize =3D=3D TCPOLEN_MPTCP_ADD_ADDR6_BASE || - opsize =3D=3D TCPOLEN_MPTCP_ADD_ADDR6_BASE_PORT) + } else if (opsize =3D=3D TCPOLEN_MPTCP_ADD_ADDR6_BASE || + opsize =3D=3D TCPOLEN_MPTCP_ADD_ADDR6_BASE_PORT) { mp_opt->addr.family =3D AF_INET6; #endif - else + } else { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } } =20 mp_opt->suboptions |=3D OPTION_MPTCP_ADD_ADDR; @@ -332,12 +355,16 @@ static void mptcp_parse_option(struct net *net, OPTIONS_MPTCP_MPJ | OPTIONS_MPTCP_DSS | OPTION_MPTCP_ADD_ADDR | - OPTION_MPTCP_PRIO)) !=3D 0) + OPTION_MPTCP_PRIO)) !=3D 0) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } =20 if (opsize < TCPOLEN_MPTCP_RM_ADDR_BASE + 1 || - opsize > TCPOLEN_MPTCP_RM_ADDR_BASE + MPTCP_RM_IDS_MAX) + opsize > TCPOLEN_MPTCP_RM_ADDR_BASE + MPTCP_RM_IDS_MAX) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } =20 ptr++; =20 @@ -353,11 +380,15 @@ static void mptcp_parse_option(struct net *net, if ((mp_opt->suboptions & ~(OPTIONS_MPTCP_MPJ | OPTIONS_MPTCP_DSS | OPTION_MPTCP_ADD_ADDR | - OPTION_MPTCP_RM_ADDR)) !=3D 0) + OPTION_MPTCP_RM_ADDR)) !=3D 0) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } =20 - if (opsize !=3D TCPOLEN_MPTCP_PRIO) + if (opsize !=3D TCPOLEN_MPTCP_PRIO) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } =20 mp_opt->suboptions |=3D OPTION_MPTCP_PRIO; mp_opt->backup =3D *ptr++ & MPTCP_PRIO_BKUP; @@ -367,11 +398,15 @@ static void mptcp_parse_option(struct net *net, case MPTCPOPT_MP_FASTCLOSE: /* Can be used with a restricted number of other options */ if ((mp_opt->suboptions & ~(OPTIONS_MPTCP_DSS | - OPTION_MPTCP_RST)) !=3D 0) + OPTION_MPTCP_RST)) !=3D 0) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } =20 - if (opsize !=3D TCPOLEN_MPTCP_FASTCLOSE) + if (opsize !=3D TCPOLEN_MPTCP_FASTCLOSE) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } =20 ptr +=3D 2; mp_opt->rcvr_key =3D get_unaligned_be64(ptr); @@ -383,14 +418,20 @@ static void mptcp_parse_option(struct net *net, case MPTCPOPT_RST: /* Can be used with a restricted number of other options */ if ((mp_opt->suboptions & ~(OPTION_MPTCP_FAIL | - OPTION_MPTCP_FASTCLOSE)) !=3D 0) + OPTION_MPTCP_FASTCLOSE)) !=3D 0) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } =20 - if (opsize !=3D TCPOLEN_MPTCP_RST) + if (opsize !=3D TCPOLEN_MPTCP_RST) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } =20 - if (!(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_RST)) + if (!(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_RST)) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } =20 mp_opt->suboptions |=3D OPTION_MPTCP_RST; flags =3D *ptr++; @@ -403,11 +444,15 @@ static void mptcp_parse_option(struct net *net, case MPTCPOPT_MP_FAIL: /* Can be used with a restricted number of other options */ if ((mp_opt->suboptions & ~(OPTIONS_MPTCP_DSS | - OPTION_MPTCP_RST)) !=3D 0) + OPTION_MPTCP_RST)) !=3D 0) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } =20 - if (opsize !=3D TCPOLEN_MPTCP_FAIL) + if (opsize !=3D TCPOLEN_MPTCP_FAIL) { + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; + } =20 ptr +=3D 2; mp_opt->suboptions |=3D OPTION_MPTCP_FAIL; @@ -416,6 +461,7 @@ static void mptcp_parse_option(struct net *net, break; =20 default: + MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX); break; } } --=20 2.43.0