From nobody Thu Oct 15 23:36:48 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 482632DBF75; Sat, 26 Sep 2026 15:30:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790436653; cv=none; b=MEBkW7yECj8c4vORwjP1V2QInaklfqeJ/RrT5W8GKb4dDvCK5e4f3jddBXwHJJcVdhGRrVq5IHMN28cB+nB//8fjMZelY7ysh4J1KZLmL3R4QvKnYHy8L830DBMuxtFMrAc+r/XBRegl4kvWbm9ClVctb5+DeQfkCbLvc14Doxg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790436653; c=relaxed/simple; bh=2LpqQ7QmQzukCZTydu4Qhzi/p0rOw9Lkni18IjLNkSw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=hUlWlRlYtQV1atHiDJDny9SbIS3kiKH9Bujefiga5UWanEWvlgr4CX23djRmzn0L3vdz5dqnRWWgO5cS270Tw3mhVkZ50UxEfbb5qwrPFr8qZow63ALDMik7HTEXyoJuDRylzHMycavbK6z2iAoNEmGu4zTNHAl0idQqAJxyRew= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=gQgUIHV4; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="gQgUIHV4" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 209F01F0089D; Sat, 26 Sep 2026 15:30:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1790436651; bh=4XH8V9Su8JHaF3lOt0qHFhwovcLFv8tgWKpGaq+UFz4=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=gQgUIHV4lUfkk9f9bVPqwF/dFaDTZ7dSQgKBgyKJ1gbftBPl0yHH5NhhQLRB5XMpT TvWtBhQBaHrffy3Uh+0R72aTFgEnRx9LQixnuEwjK8HB074lOCAKzEDMvTzTKW2VFQ 5f6w8ukeHRlV+tcqigHP7WAw2IG4SYptndbqZ7XV8JNGGbyXYLAQzI4duaf74nbhzT dxCoBXpybqAXgsxdySSh3wk65QLSCUEHNh9MEs/yYz/bJ0jygBDdn7zsG3oQxqE5+j mx3OljD5hEwqhI3h30pu/h0l7Vg2geA0YH88SmqAVX24M7gTDsxu/hZ+QvfX8vrNRD nro2a+xgO1s6Q== From: "Matthieu Baerts (NGI0)" Date: Sat, 26 Sep 2026 17:30:34 +0200 Subject: [PATCH net-next 1/5] mptcp: remove thmac from subflow ctx Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260926-net-next-mptcp-misc-feat-7-4-v1-1-67af4ab37406@kernel.org> References: <20260926-net-next-mptcp-misc-feat-7-4-v1-0-67af4ab37406@kernel.org> In-Reply-To: <20260926-net-next-mptcp-misc-feat-7-4-v1-0-67af4ab37406@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2814; i=matttbe@kernel.org; h=from:subject:message-id; bh=2LpqQ7QmQzukCZTydu4Qhzi/p0rOw9Lkni18IjLNkSw=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLK2P1VpblTYdn7903m2v/033HaKlIp8r/Vg7X7Z603tH ZO1zY9Gd5SyMIhxMciKKbJIt0Xmz3xexVvi5WcBM4eVCWQIAxenAEzkRjEjw5rJX9nZbDZdPjjn 9aF/jit2KrHPm7h75pIJTpLZPw5u9HNlZLio0WQ950+v4KzSn53XTUpulPfNXSUU8Vlhn397uNi H4ywA X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 This entry is only used in subflow_finish_connect(). Instead, use the original value from mp_opt, and pass it to subflow_thmac_valid() to do the validation with the given truncated hmac. While at it, rename the variables in subflow_thmac_valid() to avoid confusions about the received one vs the expected one. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.h | 1 - net/mptcp/subflow.c | 18 +++++++++--------- 2 files changed, 9 insertions(+), 10 deletions(-) diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 0384d6a023f9..dd9957d334b6 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -593,7 +593,6 @@ struct mptcp_subflow_context { bool fully_established; /* path validated */ u32 lent_mem_frag; u32 remote_nonce; - u64 thmac; u32 local_nonce; u32 remote_token; union { diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index f0a6725d2c37..14aa82647c3d 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -408,20 +408,21 @@ static struct dst_entry *subflow_v6_route_req(const s= truct sock *sk, #endif =20 /* validate received truncated hmac and create hmac for third ACK */ -static bool subflow_thmac_valid(struct mptcp_subflow_context *subflow) +static bool subflow_thmac_valid(struct mptcp_subflow_context *subflow, + u64 thmac) { u8 hmac[SHA256_DIGEST_SIZE]; - u64 thmac; + u64 expected_thmac; =20 subflow_generate_hmac(subflow->remote_key, subflow->local_key, subflow->remote_nonce, subflow->local_nonce, hmac); =20 - thmac =3D get_unaligned_be64(hmac); - pr_debug("subflow=3D%p, token=3D%u, thmac=3D%llu, subflow->thmac=3D%llu\n= ", - subflow, subflow->token, thmac, subflow->thmac); + expected_thmac =3D get_unaligned_be64(hmac); + pr_debug("subflow=3D%p, token=3D%u, expected_thmac=3D%llu, thmac=3D%llu\n= ", + subflow, subflow->token, expected_thmac, thmac); =20 - return thmac =3D=3D subflow->thmac; + return expected_thmac =3D=3D thmac; } =20 void mptcp_subflow_reset(struct sock *ssk) @@ -575,14 +576,13 @@ static void subflow_finish_connect(struct sock *sk, c= onst struct sk_buff *skb) } =20 subflow->backup =3D mp_opt.backup; - subflow->thmac =3D mp_opt.thmac; subflow->remote_nonce =3D mp_opt.nonce; WRITE_ONCE(subflow->remote_id, mp_opt.join_id); pr_debug("subflow=3D%p, thmac=3D%llu, remote_nonce=3D%u backup=3D%d\n", - subflow, subflow->thmac, subflow->remote_nonce, + subflow, mp_opt.thmac, subflow->remote_nonce, subflow->backup); =20 - if (!subflow_thmac_valid(subflow)) { + if (!subflow_thmac_valid(subflow, mp_opt.thmac)) { MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_JOINSYNACKMAC); subflow->reset_reason =3D MPTCP_RST_EMPTCP; goto do_reset; --=20 2.55.0 From nobody Thu Oct 15 23:36:48 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 910B1386C3E; Sat, 26 Sep 2026 15:30:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790436655; cv=none; b=Zr02NIRVkYT6fOm0/wnB2PBnBe4xNozrjmIOa5dx7HVBpeZvu9gz+EAVZgU1n4U+T8xVbyQkdQoz2S1vuUNh9pzRsy5pkeW7lgYPQF6+uLWC9NJ1+BRAwNqm1zh2USSqAiUyNPkZTEO/b3QBiAtSQeBkf9IXu5w40/XWFiUXHdI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790436655; c=relaxed/simple; bh=qha52vBJjcCyclbZxDNMrg06VZm/eryaQRlKah9D8GY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=p+bshSV5W3/3GpyHhGHvq0W8izaytbAzupv6GfhNJc5DEVEsKo/NzAoMwIaUWDesFE0u06rgmusgJoIOg7BS2pHtFGD8oT6jV4HEBK4EA9vwhON6RejverQjyXCJw/xdIpJOTv2zEwsf/+/Q9oJUl9yA5g5Hc615dO6RPWe98zo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=i6ID3MIj; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="i6ID3MIj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 531001F00893; Sat, 26 Sep 2026 15:30:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1790436654; bh=9wwbNo/A7r2bOTwfYEfMAYsDChwd6ivdQ/O4Qm4cbsA=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=i6ID3MIj6F4XhgejoFQOXMbCOF3L5MnBusSDc6zfIEBjGZS0vzo3hJ7yBm7Eruutb dI4p483fxuIFVWJjH6zN6MOxiRIxpr7ib13FVqFoXtrFcB3WH/oXm09AMzvJDZzfvN 4sl98NcGzasal29wb1xS6qYHCCjFTDy7vT3ehIbAquWTjrlwt3FMVheJhboLC8YXpC X2IMmw3w39P7ccJi4txAY9R9H0Iisoopmh+QjyaRKFZVnbXwMbrJfhqVWLgS63jvte YPeTpbWwoCJ2BFlterBqIb1IpFTlBt1KsbY+odoLRSqlaYJyrP3TG295PaYtJCnJcN KfvcVoCAXY7gA== From: "Matthieu Baerts (NGI0)" Date: Sat, 26 Sep 2026 17:30:35 +0200 Subject: [PATCH net-next 2/5] mptcp: split FASTCLOSE key from rcvr_key Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260926-net-next-mptcp-misc-feat-7-4-v1-2-67af4ab37406@kernel.org> References: <20260926-net-next-mptcp-misc-feat-7-4-v1-0-67af4ab37406@kernel.org> In-Reply-To: <20260926-net-next-mptcp-misc-feat-7-4-v1-0-67af4ab37406@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , Quanye Yang X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1978; i=matttbe@kernel.org; h=from:subject:message-id; bh=9DwC0hOI9qsIM1pGI1z+aqCB24lkJOs4U9ywZkuffMM=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLK2P1WpPZXEYxazWrB68oJVkl4/DnwKKbOyZo/cY6J3w OrApN5fHaUsDGJcDLJiiizSbZH5M59X8ZZ4+VnAzGFlAhnCwMUpABO5tZrhv4+6ZaXj/1nThFc/ 53doaItt/BK8eY9TfuKlZu71nMU7ZzH8D2kU+XcsVf52yIQZ747KVi18e7l4yeoJKX+zN6qvOrT 2Hx8A X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Quanye Yang MP_CAPABLE and MP_FASTCLOSE both stored their key in rcvr_key. Give FASTCLOSE a dedicated fc_recv_key overlapped with rcvr_key in a union. This helps shrink struct mptcp_options_received. Signed-off-by: Quanye Yang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/options.c | 6 +++--- net/mptcp/protocol.h | 5 ++++- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/net/mptcp/options.c b/net/mptcp/options.c index ce0de02f5a3a..c2f4d7bd080c 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -374,10 +374,10 @@ static void mptcp_parse_option(const struct sk_buff *= skb, break; =20 ptr +=3D 2; - mp_opt->rcvr_key =3D get_unaligned_be64(ptr); + mp_opt->fc_recv_key =3D get_unaligned_be64(ptr); ptr +=3D 8; mp_opt->suboptions |=3D OPTION_MPTCP_FASTCLOSE; - pr_debug("MP_FASTCLOSE: recv_key=3D%llu\n", mp_opt->rcvr_key); + pr_debug("MP_FASTCLOSE: recv_key=3D%llu\n", mp_opt->fc_recv_key); break; =20 case MPTCPOPT_RST: @@ -1258,7 +1258,7 @@ bool mptcp_incoming_options(struct sock *sk, struct s= k_buff *skb) =20 if (unlikely(mp_opt.suboptions !=3D OPTION_MPTCP_DSS)) { if ((mp_opt.suboptions & OPTION_MPTCP_FASTCLOSE) && - READ_ONCE(msk->local_key) =3D=3D mp_opt.rcvr_key) { + READ_ONCE(msk->local_key) =3D=3D mp_opt.fc_recv_key) { WRITE_ONCE(msk->rcv_fastclose, true); mptcp_schedule_work((struct sock *)msk); MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPFASTCLOSERX); diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index dd9957d334b6..6b9bffc5992b 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -146,7 +146,10 @@ static inline bool before64(__u64 seq1, __u64 seq2) =20 struct mptcp_options_received { u64 sndr_key; - u64 rcvr_key; + union { + u64 rcvr_key; + u64 fc_recv_key; + }; u64 data_ack; u64 data_seq; u32 subflow_seq; --=20 2.55.0 From nobody Thu Oct 15 23:36:48 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC8FC483825; Sat, 26 Sep 2026 15:30:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790436667; cv=none; b=PR0UZx8fgSPDHiMcyy/V/T0ktQJYbx/3+wf/UFBfzqTFpFmb619K/VmJkLFs6HOLGw8PIP7Uwf9MFMd0gaPyhtVnSf0jYSkIpFAzafRKpBNped1eu4pc2hp57v0geFhqCwGAnVbuxvLwxt+VoCfm69mEd53283bzVzFpp2N1E58= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790436667; c=relaxed/simple; bh=4dnmjPKMgvpPoV1XuMAF3hmIKkD1wUAnZAncgZ5bsMQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=jnNmd1cFEguJY1bo2NX3CBW5fPIIEUjq+Jb46wQ1Yf3j/ERsvq0bO2tlcsaXFvRRDbNm+Z36aqhf2kpUcTwbmfKlt6gFYlOur/sNuc7JQl+C3jJNkbiOXT8dhk2CcSheTR2hl7ZtZjffcYc5D54x/RyNB8sAMEKF+BYGtcQqqn8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=BQZ072wT; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="BQZ072wT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AABCC1F000FF; Sat, 26 Sep 2026 15:30:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1790436656; bh=zkOBSfjteipAXDmKPSIjR8Lqk8DWRo/YB1D1TGRtsIE=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=BQZ072wTx4Qe+3s/P8gS2eLDQcrZGgwdTbBNS74ZsLg0D91oQPNB/DYC3HlaiM6hk J9Of0Mb9xTXqOKNEYtC8CGAbV9wPdIZN3/nOstfTtaF4+cEJDAIEu8JuBcLf1ZLL3A nswKXSqeCrBTy7Iax4tzn5hOvurHUMNnHXgzMVmRbJAglM0kyNQpv4De+gcVJQxVk6 x98DGvD0xQ8AGE6zE/QJn4CZjRC/X/NiHhEaANeGaQGBssFiGGTEWVup0VDhhcxObC 763oLf7+PMft/DPn4SgwHZDmyMRSftJuDBCvdm1zOBd6KPouq6tqZ1Q7Oji6iJcd8q x4+S2wnx1gwvQ== From: "Matthieu Baerts (NGI0)" Date: Sat, 26 Sep 2026 17:30:36 +0200 Subject: [PATCH net-next 3/5] mptcp: shrink struct mptcp_options_received Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260926-net-next-mptcp-misc-feat-7-4-v1-3-67af4ab37406@kernel.org> References: <20260926-net-next-mptcp-misc-feat-7-4-v1-0-67af4ab37406@kernel.org> In-Reply-To: <20260926-net-next-mptcp-misc-feat-7-4-v1-0-67af4ab37406@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , Quanye Yang X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2777; i=matttbe@kernel.org; h=from:subject:message-id; bh=v0/cB1TTY50IeKgy7oF8vfX3CvLtPvrhfv/tK3GUpoA=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLK2P1X9Gv50imlVtvB69g+rW3e51YfE/axw2JbZxR/Fl aiuum93RykLgxgXg6yYIot0W2T+zOdVvCVefhYwc1iZQIYwcHEKwETuSDD80/wR9f/4ToP88IbM Vy1PfKxnqXWIiE6fLctyuv7c9ktfFzAyTNmxc9qWOr3dMmUKaZzmqZyPVH5WF0ws23fiV++bpr5 ADgA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Quanye Yang struct mptcp_options_received is allocated on the stack while parsing incoming MPTCP options. Several suboptions are mutually exclusive, as enforced by mptcp_parse_option(), so their payloads can overlap. Group fields by suboption and place the mutually exclusive payloads in an anonymous union. Keep DSS and rm_list outside the union: they can be combined with other suboptions. Move join_id into the MP_JOIN group, and overlap token, thmac and hmac inside that group. Further shrinking would require changing the parser so currently coexisting fields (DSS mapping vs ACK, rm_list, status flags) can overlap. That adds complexity for little gain, since the outer union is already dominated by the MP_JOIN / ADD_ADDR members. This reduces the structure size from 136 to 72 bytes on x86_64. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/625 Signed-off-by: Quanye Yang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- net/mptcp/protocol.h | 45 ++++++++++++++++++++++++++++----------------- 1 file changed, 28 insertions(+), 17 deletions(-) diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 6b9bffc5992b..29b03275a59e 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -145,16 +145,13 @@ static inline bool before64(__u64 seq1, __u64 seq2) #define after64(seq2, seq1) before64(seq1, seq2) =20 struct mptcp_options_received { - u64 sndr_key; - union { - u64 rcvr_key; - u64 fc_recv_key; + struct { /* DSS, also used by MP_CAPABLE with data */ + u64 data_ack; + u64 data_seq; + u32 subflow_seq; + u16 data_len; + __sum16 csum; }; - u64 data_ack; - u64 data_seq; - u32 subflow_seq; - u16 data_len; - __sum16 csum; struct_group(status, u16 suboptions; u16 use_map:1, @@ -170,15 +167,29 @@ struct mptcp_options_received { deny_join_id0:1, __unused:2; ); - u8 join_id; - u32 token; - u32 nonce; - u64 thmac; - u8 hmac[MPTCPOPT_HMAC_LEN]; - struct mptcp_addr_info addr; struct mptcp_rm_list rm_list; - u64 ahmac; - u64 fail_seq; + /* Options below are mutually exclusive, see mptcp_parse_option() */ + union { + struct { /* MP_CAPABLE */ + u64 sndr_key; + u64 rcvr_key; + }; + struct { /* MP_JOIN */ + u32 nonce; + u8 join_id; + union { + u32 token; /* SYN */ + u64 thmac; /* SYN + ACK */ + u8 hmac[MPTCPOPT_HMAC_LEN]; /* ACK */ + }; + }; + struct { /* ADD_ADDR */ + struct mptcp_addr_info addr; + u64 ahmac; + }; + u64 fail_seq; /* MP_FAIL */ + u64 fc_recv_key; /* MP_FASTCLOSE */ + }; }; =20 static inline __be32 mptcp_option(u8 subopt, u8 len, u8 nib, u8 field) --=20 2.55.0 From nobody Thu Oct 15 23:36:48 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D529478E57; Sat, 26 Sep 2026 15:30:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790436665; cv=none; b=HEQBujmsb+Ji/VdTaDMBl/cBgXdsBPgzgw7dzw0HdVvoh18ERGIDey7uoHQd7AAgwKr3yge7Ap6jBqGhymTFd+bNGQqMA+p1aM1TqXgGk+NC6Pw518MGP2NYL8iebjstcsLbzMsAq9Cu2UU9sB9XkxF2nfjwKmXqVYYBX/KrkQg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790436665; c=relaxed/simple; bh=b9sNGhnVKusXFjAnMBLQBl1Fe5gHfrtNeHJf/Z5zEwM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=IKGeyeBX/l+ZEBhbp/GUOw+7XxyvJZ8ZcyOGHUwCMpi9+M2A2Pkdtva1dARorwYydxU2izBCX6EdJ+Pr7Z6tJR2c6BDDVKCWdwrqn9jEKdMdKptPO0NIzgRjFJ0F7ap16kezkcIT0i8FblZ+hjOznYmjX8gFH94NfuzuqiNOSEs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=JrQ2CD6e; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="JrQ2CD6e" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0FF041F00893; Sat, 26 Sep 2026 15:30:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1790436659; bh=+/Bpbjr/84++qbvmxtYkyKTZkI33tXkpSl391AKR3ow=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=JrQ2CD6e8fwTCzvoehD6idTXgji1UakLn41KHYp5D40h7TQ0nE6/ddnQ2d++QizZZ XfZ6oaFllg4uyutgoBgWsTOa1l3TDE3ZdW2WFEi7haOXZFRmu4ktiq/WNe3T8nUgBi NwoqcUHFeJZRXXJatdL8Do2UumVUBqwS9iTQ76GTYJKKuuRtBEcbnAsvCSF1nmio9d OfKh1KL995Dq0uE0BblzX7Fz7fwp4ULmJCwp8j05GHvRSpuB2bmhz10pSjZgw+YkUl K58+cmb+onKLdfifJ2TBeHL1hyhVI/C0ZpTaoXbnEfn71yHX5+S4A3bAe5zymDcy9a LM18wuMjp3hsw== From: "Matthieu Baerts (NGI0)" Date: Sat, 26 Sep 2026 17:30:37 +0200 Subject: [PATCH net-next 4/5] selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260926-net-next-mptcp-misc-feat-7-4-v1-4-67af4ab37406@kernel.org> References: <20260926-net-next-mptcp-misc-feat-7-4-v1-0-67af4ab37406@kernel.org> In-Reply-To: <20260926-net-next-mptcp-misc-feat-7-4-v1-0-67af4ab37406@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , Hangbin Liu , Shuah Khan , linux-kselftest@vger.kernel.org X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4216; i=matttbe@kernel.org; h=from:subject:message-id; bh=LVz5Jekfc735dQxf0j6z2k5jINm6tngouczCLtIhQcs=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLK2P1V7m9QXVZqozLwnpSrkH5OXLIvtsnsP552/ZCe1j X362l1KHaUsDGJcDLJiiizSbZH5M59X8ZZ4+VnAzGFlAhnCwMUpABORV2T4Hzhj31Y2k1l83mIP L/iePls/XchtnSTfJa6VwlFlBoX/rBgZ5pf9nN7fZq6TznygeH5bioDIv2jTdr4c4ecpp9/N6c5 mAgA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Hangbin Liu During the conversion, we retain the same filter and chain names previously used by iptables/ip6tables. Counters are not added to accept rules because the test does not inspect them. After conversion, the generated output matches the original iptables/ip6tables behavior. Signed-off-by: Hangbin Liu Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- To: Shuah Khan Cc: linux-kselftest@vger.kernel.org --- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 2 +- tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 58 ++++++++++++------= ---- 2 files changed, 34 insertions(+), 26 deletions(-) diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing= /selftests/net/mptcp/mptcp_lib.sh index b9d14647f401..e65b4ebee06a 100644 --- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh @@ -528,7 +528,7 @@ mptcp_lib_check_tools() { exit ${KSFT_SKIP} fi ;; - "iptables"* | "ip6tables"*) + "iptables"* | "ip6tables"* | "nft" | "jq") if ! "${tool}" -V &> /dev/null; then mptcp_lib_pr_skip "Could not run all tests without ${tool}" exit ${KSFT_SKIP} diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/tes= ting/selftests/net/mptcp/mptcp_sockopt.sh index e850a87429b6..b4e3eddc9cf2 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh @@ -15,8 +15,6 @@ cin=3D"" cout=3D"" timeout_poll=3D30 timeout_test=3D$((timeout_poll * 2 + 1)) -iptables=3D"iptables" -ip6tables=3D"ip6tables" =20 ns1=3D"" ns2=3D"" @@ -49,16 +47,27 @@ add_mark_rules() local ns=3D$1 local m=3D$2 =20 - local t - for t in ${iptables} ${ip6tables}; do - # just to debug: check we have multiple subflows connection requests - ip netns exec $ns $t -A OUTPUT -p tcp --syn -m mark --mark $m -j ACCEPT + local table + for table in ip ip6; do + ip netns exec "$ns" nft -f - <<-EOF + add table $table filter + add chain $table filter OUTPUT \ + { type filter hook output priority 0; policy accept; } =20 - # RST packets might be handled by a internal dummy socket - ip netns exec $ns $t -A OUTPUT -p tcp --tcp-flags RST RST -m mark --mark= 0 -j ACCEPT + # just to debug: check we have multiple subflows connection requests + add rule $table filter OUTPUT \ + tcp flags & (fin | syn | rst | ack) =3D=3D syn \ + meta mark $m accept =20 - ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark $m -j ACCEPT - ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark 0 -j DROP + # RST packets might be handled by a internal dummy socket + add rule $table filter OUTPUT \ + tcp flags & rst =3D=3D rst meta mark 0x0 accept + + add rule $table filter OUTPUT \ + meta l4proto tcp meta mark $m accept + add rule $table filter OUTPUT \ + meta l4proto tcp meta mark 0 counter drop + EOF done } =20 @@ -105,32 +114,31 @@ cleanup() =20 mptcp_lib_check_mptcp mptcp_lib_check_kallsyms -mptcp_lib_check_tools ip "${iptables}" "${ip6tables}" +mptcp_lib_check_tools ip nft jq =20 check_mark() { local ns=3D$1 local af=3D$2 =20 - local tables=3D${iptables} + local tables=3D"ip" =20 if [ $af -eq 6 ];then - tables=3D${ip6tables} + tables=3D"ip6" fi =20 - local counters values - counters=3D$(ip netns exec $ns $tables -v -L OUTPUT | grep DROP) - values=3D${counters%DROP*} + local drops + drops=3D$(ip netns exec "$ns" nft -j list table "$tables" filter | \ + jq '.nftables[] | select(has("rule")) | .rule | + select (.chain=3D=3D"OUTPUT" and any(.expr[]; has("drop"))) | + .expr[] | select(has("counter")) | .counter.packets') =20 - local v - for v in $values; do - if [ $v -ne 0 ]; then - mptcp_lib_pr_fail "got $tables $values in ns $ns," \ - "not 0 - not all expected packets marked" - ret=3D${KSFT_FAIL} - return 1 - fi - done + if [ -z "$drops" ] || [ "$drops" -ne 0 ]; then + mptcp_lib_pr_fail "got $tables $drops in ns $ns," \ + "not 0 - not all expected packets marked" + ret=3D${KSFT_FAIL} + return 1 + fi =20 return 0 } --=20 2.55.0 From nobody Thu Oct 15 23:36:48 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 926AF48095B; Sat, 26 Sep 2026 15:31:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790436664; cv=none; b=DHEUEr4WuW0/PZ9A25Wd0Yw9m5y5xj+iPuqIg8F13QfDb5A/mr6REZku1nCoLhEa+uOx5YmiLZIPXSEKmZJYOfu0WN6r0i3+hSG+R7alzzZte1LeO0Pp7dbP2MgaCr4MDAhGoBnK1+KDYmhgstLma2HvXA6tTDqeTk/stLzxqDg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790436664; c=relaxed/simple; bh=G+d0V/9t10yuz3aXzEImDO8GcEREU9NtyOR8OxMXDMo=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=hlK0o/oRfzRmhReXIOQNbYzktW/s1bktIzirN9z4RyVvPW2L3FQi6iF0V4yp1wgh1OimNnsDCoUXXEMhv+p/iInFXiziVU+LIzwj6nxTnjI3Io0U0Hb4hcdid1uZdO6WOC4vxmDcFyzC8q/XOUpz8d7y5XO3S8AGFFjSzSc+A/s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=YpVPRF7T; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="YpVPRF7T" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B47A51F00898; Sat, 26 Sep 2026 15:30:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1790436662; bh=KkBKBVla+x/TWCQFzRb9DXIGSfWyAB8nVYEGpn8OI/0=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=YpVPRF7TjQckfpevCuHKZ/iYrxntJne49346UcBxD56X6XJ5G8YxHvccqxq8VI9jb PL4u3PaBly8CBy0vs1BqeRtRfU3NeJZ+42otKzLlzU8TyQyB+UbtttPQkm7FN1FlK1 /yVxPP1vmvu3lJ3Gpk8D/fw/dIE/LMHNNFn/Mpo3ms7a8MA3LnxVrRFcgjaiXDQPcj cUka0YuEV//pR6chfdY179aftWjswmgSoZlJELWOr6H1xExQ4nUscLhs9V82rnvnu6 pkbNgizVFjPY1fIEzGfjOLUZ8Q/h45A7a3qQ65oI/vUs4ERG5oL14F9DRktHZM1KoJ mEyarVRAP2WNw== From: "Matthieu Baerts (NGI0)" Date: Sat, 26 Sep 2026 17:30:38 +0200 Subject: [PATCH net-next 5/5] selftests: mptcp: convert iptables to nftables for mptcp_join.sh Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260926-net-next-mptcp-misc-feat-7-4-v1-5-67af4ab37406@kernel.org> References: <20260926-net-next-mptcp-misc-feat-7-4-v1-0-67af4ab37406@kernel.org> In-Reply-To: <20260926-net-next-mptcp-misc-feat-7-4-v1-0-67af4ab37406@kernel.org> To: Mat Martineau , Geliang Tang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, "Matthieu Baerts (NGI0)" , Hangbin Liu , Shuah Khan , linux-kselftest@vger.kernel.org X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=10992; i=matttbe@kernel.org; h=from:subject:message-id; bh=Z7i4/RvgZyFGZf7UDI56gpBSOpBBaco4QkC6ZaRP+78=; b=owGbwMvMwCVWo/Th0Gd3rumMp9WSGLK2P1Uzjnqk/vIbe69E8sS3TT9Wd0e6SG4uyuq1vGdqI 5nyYuumjlIWBjEuBlkxRRbptsj8mc+reEu8/Cxg5rAygQxh4OIUgInkWzMytFtvuRhR0e2ZufPB miWCb7Myfqhf2LKuU/JXSfuZmE/6qgz/i9SrZ/kZtG62XL1CxEXzjb3vd+nzS65YVtbZ9M9SK5f jBAA= X-Developer-Key: i=matttbe@kernel.org; a=openpgp; fpr=E8CB85F76877057A6E27F77AF6B7824F4269A073 From: Hangbin Liu During conversion, we retain the same table and chain names used by the original iptables/ip6tables setup, so rule output is identical to the former iptables/ip6tables output. Add new function init_nftables so we only do nft table setup when test need set nft rules. Unlike iptables, nftables cannot match rules based on their full specification. Since endpoint_tests is the only test that delete rules, which inserts and deletes rules one by one. Flushing the table directly is safe and easier than using nft_handle. The cBPF bytecode matching MPTCP add=E2=80=91addr and remove=E2=80=91addr s= uboptions is replaced with native nft matching using "tcp option mptcp subtype". The config file adds CONFIG_NFT_NUMGEN (replaces iptables statistic nth), CONFIG_NFT_REJECT and CONFIG_NFT_REJECT_INET for reject=E2=80=91related rul= es. Remove CONFIG_NFT_COMPAT since we don't need it now. Remove the iptables/ip6tables check in mptcp_lib.sh since no script use it now. Signed-off-by: Hangbin Liu Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) --- To: Shuah Khan Cc: linux-kselftest@vger.kernel.org Cc: bpf@vger.kernel.org ## Note: no eBPF code has been modified --- tools/testing/selftests/net/mptcp/config | 4 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 149 +++++++++-----------= ---- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 2 +- 3 files changed, 62 insertions(+), 93 deletions(-) diff --git a/tools/testing/selftests/net/mptcp/config b/tools/testing/selft= ests/net/mptcp/config index bb9c4c97c620..61057a066719 100644 --- a/tools/testing/selftests/net/mptcp/config +++ b/tools/testing/selftests/net/mptcp/config @@ -29,7 +29,9 @@ CONFIG_NET_SCH_INGRESS=3Dm CONFIG_NET_SCH_NETEM=3Dm CONFIG_NF_TABLES=3Dm CONFIG_NF_TABLES_INET=3Dy -CONFIG_NFT_COMPAT=3Dm +CONFIG_NFT_NUMGEN=3Dm +CONFIG_NFT_REJECT=3Dm +CONFIG_NFT_REJECT_INET=3Dm CONFIG_NFT_SOCKET=3Dm CONFIG_NFT_TPROXY=3Dm CONFIG_SYN_COOKIES=3Dy diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testin= g/selftests/net/mptcp/mptcp_join.sh index 18ce7136a2b0..b16e24418e73 100755 --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh @@ -26,8 +26,6 @@ capout=3D"" cappid=3D"" ns1=3D"" ns2=3D"" -iptables=3D"iptables" -ip6tables=3D"ip6tables" timeout_poll=3D30 timeout_test=3D$((timeout_poll * 2 + 1)) capture=3Dfalse @@ -99,42 +97,6 @@ unset add_addr_tx_nr unset add_addr_echo_tx_nr unset add_addr_drop_tx_nr =20 -# generated using "nfbpf_compile '(ip && (ip[54] & 0xf0) =3D=3D 0x30) || -# (ip6 && (ip6[74] & 0xf0) =3D=3D 0x30)'" -CBPF_MPTCP_SUBOPTION_ADD_ADDR=3D"14, - 48 0 0 0, - 84 0 0 240, - 21 0 3 64, - 48 0 0 54, - 84 0 0 240, - 21 6 7 48, - 48 0 0 0, - 84 0 0 240, - 21 0 4 96, - 48 0 0 74, - 84 0 0 240, - 21 0 1 48, - 6 0 0 65535, - 6 0 0 0" - -# IPv4: TCP hdr of 48B, a first suboption of 12B (DACK8), the RM_ADDR subo= ption -# generated using "nfbpf_compile '(ip[32] & 0xf0) =3D=3D 0xc0 && ip[53] = =3D=3D 0x0c && -# (ip[66] & 0xf0) =3D=3D 0x40'" -CBPF_MPTCP_SUBOPTION_RM_ADDR=3D"13, - 48 0 0 0, - 84 0 0 240, - 21 0 9 64, - 48 0 0 32, - 84 0 0 240, - 21 0 6 192, - 48 0 0 53, - 21 0 4 12, - 48 0 0 66, - 84 0 0 240, - 21 0 1 64, - 6 0 0 65535, - 6 0 0 0" - init_partial() { capout=3D$(mktemp) @@ -184,6 +146,26 @@ init_shapers() done } =20 +init_nftables() +{ + local netns table + for netns in "$ns1" "$ns2"; do + for table in ip ip6; do + ip netns exec "$netns" nft -f - <<-EOF + add table $table filter + add chain $table filter INPUT \ + { type filter hook input priority filter; policy accept; } + add chain $table filter OUTPUT \ + { type filter hook output priority filter; policy accept; } + + add table $table mangle + add chain $table mangle OUTPUT \ + { type route hook output priority mangle; policy accept; } + EOF + done + done +} + cleanup_partial() { rm -f "$capout" @@ -196,7 +178,7 @@ init() { =20 mptcp_lib_check_mptcp mptcp_lib_check_kallsyms - mptcp_lib_check_tools ip tc ss "${iptables}" "${ip6tables}" + mptcp_lib_check_tools ip tc ss nft =20 sin=3D$(mktemp) sout=3D$(mktemp) @@ -380,24 +362,18 @@ reset_with_cookies() # $1: test name reset_with_add_addr_timeout() { - local ip=3D"${2:-4}" - local tables + local ip=3D"${2:-}" =20 reset "${1}" || return 1 - - tables=3D"${iptables}" - if [ $ip -eq 6 ]; then - tables=3D"${ip6tables}" - fi + init_nftables =20 # set a maximum, to avoid too long timeout with exponential backoff ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=3D1 =20 - if ! ip netns exec $ns2 $tables -A OUTPUT -p tcp \ - -m tcp --tcp-option 30 \ - -m bpf --bytecode \ - "$CBPF_MPTCP_SUBOPTION_ADD_ADDR" \ - -j DROP; then + if ! ip netns exec "$ns2" nft add rule \ + ip"$ip" filter OUTPUT meta l4proto tcp \ + tcp option mptcp subtype add-addr \ + drop; then mark_as_skipped "unable to set the 'add addr' rule" return 1 fi @@ -449,22 +425,14 @@ setup_fail_rules() check_invert=3D1 validate_checksum=3Dtrue local i=3D"$1" - local ip=3D"${2:-4}" - local tables + local ip=3D"${2:-}" =20 - tables=3D"${iptables}" - if [ $ip -eq 6 ]; then - tables=3D"${ip6tables}" - fi - - ip netns exec $ns2 $tables \ - -t mangle \ - -A OUTPUT \ - -o ns2eth$i \ - -p tcp \ - -m length --length 150:9999 \ - -m statistic --mode nth --packet 1 --every 99999 \ - -j MARK --set-mark 42 || return ${KSFT_SKIP} + init_nftables + ip netns exec "$ns2" nft add rule \ + ip"$ip" mangle OUTPUT oifname ns2eth$i \ + meta l4proto tcp \ + meta length 150-9999 numgen inc mod 99999 1 \ + meta mark set 42 || return ${KSFT_SKIP} =20 tc -n $ns2 qdisc add dev ns2eth$i clsact || return ${KSFT_SKIP} tc -n $ns2 filter add dev ns2eth$i egress \ @@ -510,16 +478,15 @@ reset_with_tcp_filter() reset "${1}" || return 1 shift =20 + init_nftables + local ns=3D"${!1}" local src=3D"${2}" local target=3D"${3}" local chain=3D"${4:-INPUT}" =20 - if ! ip netns exec "${ns}" ${iptables} \ - -A "${chain}" \ - -s "${src}" \ - -p tcp \ - -j "${target}"; then + if ! ip netns exec "$ns" nft add rule ip filter "${chain}" \ + ip saddr "${src}" meta l4proto tcp "${target,,}"; then mark_as_skipped "unable to set the filter rules" return 1 fi @@ -4313,12 +4280,15 @@ userspace_tests() chk_mptcp_info subflows 1 subflows 1 chk_subflows_total 2 2 =20 + init_nftables # force quick loss ip netns exec $ns2 sysctl -q net.ipv4.tcp_syn_retries=3D1 - if ip netns exec "${ns1}" ${iptables} -A INPUT -s "10.0.1.2" \ - -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset && - ip netns exec "${ns2}" ${iptables} -A INPUT -d "10.0.1.2" \ - -p tcp --tcp-option 30 -j REJECT --reject-with tcp-reset; then + if ip netns exec "${ns1}" nft add rule ip filter INPUT \ + ip saddr "10.0.1.2" meta l4proto tcp \ + tcp option mptcp exists reject with tcp reset && + ip netns exec "${ns2}" nft add rule ip filter INPUT \ + ip daddr "10.0.1.2" meta l4proto tcp \ + tcp option mptcp exists reject with tcp reset; then wait_event ns2 MPTCP_LIB_EVENT_SUB_CLOSED 1 wait_event ns1 MPTCP_LIB_EVENT_SUB_CLOSED 1 chk_subflows_total 1 1 @@ -4393,7 +4363,7 @@ endpoint_tests() chk_subflow_nr "after new reject" 2 chk_mptcp_info subflows 1 subflows 1 =20 - ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJ= ECT + ip netns exec "${ns2}" nft flush chain ip filter OUTPUT pm_nl_del_endpoint $ns2 3 10.0.3.2 pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow wait_mpj 3 @@ -4402,12 +4372,10 @@ endpoint_tests() =20 # To make sure RM_ADDR are sent over a different subflow, but # allow the rest to quickly and cleanly close the subflow - local ipt=3D1 - ip netns exec "${ns2}" ${iptables} -I OUTPUT -s "10.0.1.2" \ - -p tcp -m tcp --tcp-option 30 \ - -m bpf --bytecode \ - "$CBPF_MPTCP_SUBOPTION_RM_ADDR" \ - -j DROP || ipt=3D0 + local nft=3D1 + ip netns exec "${ns2}" nft insert rule ip filter OUTPUT \ + ip saddr 10.0.1.2 meta l4proto tcp \ + tcp option mptcp subtype remove-addr drop || nft=3D0 local i for i in $(seq 3); do pm_nl_del_endpoint $ns2 1 10.0.1.2 @@ -4420,7 +4388,7 @@ endpoint_tests() chk_subflow_nr "after re-add id 0 ($i)" 3 chk_mptcp_info subflows 3 subflows 3 done - [ ${ipt} =3D 1 ] && ip netns exec "${ns2}" ${iptables} -D OUTPUT 1 + [ "${nft}" =3D 1 ] && ip netns exec "${ns2}" nft flush chain ip filter O= UTPUT =20 mptcp_lib_kill_group_wait $tests_pid =20 @@ -4480,20 +4448,19 @@ endpoint_tests() chk_mptcp_info subflows 2 subflows 2 chk_mptcp_info add_addr_signal 2 add_addr_accepted 2 =20 + init_nftables # To make sure RM_ADDR are sent over a different subflow, but # allow the rest to quickly and cleanly close the subflow - local ipt=3D1 - ip netns exec "${ns1}" ${iptables} -I OUTPUT -s "10.0.1.1" \ - -p tcp -m tcp --tcp-option 30 \ - -m bpf --bytecode \ - "$CBPF_MPTCP_SUBOPTION_RM_ADDR" \ - -j DROP || ipt=3D0 + local nft=3D1 + ip netns exec "${ns1}" nft insert rule ip filter OUTPUT \ + ip saddr 10.0.1.1 meta l4proto tcp \ + tcp option mptcp subtype remove-addr drop || nft=3D0 pm_nl_del_endpoint $ns1 42 10.0.1.1 sleep 0.5 chk_subflow_nr "after delete ID 0" 2 chk_mptcp_info subflows 2 subflows 2 chk_mptcp_info add_addr_signal 2 add_addr_accepted 2 - [ ${ipt} =3D 1 ] && ip netns exec "${ns1}" ${iptables} -D OUTPUT 1 + [ "${nft}" =3D 1 ] && ip netns exec "${ns1}" nft flush chain ip filter O= UTPUT =20 pm_nl_add_endpoint $ns1 10.0.1.1 id 42 flags signal wait_mpj 4 @@ -4555,7 +4522,7 @@ endpoint_tests() pm_nl_flush_endpoint $ns2 pm_nl_flush_endpoint $ns1 wait_rm_addr $ns2 0 - ip netns exec "${ns2}" ${iptables} -D OUTPUT -s "10.0.3.2" -p tcp -j REJ= ECT + ip netns exec "${ns2}" nft flush chain ip filter OUTPUT pm_nl_add_endpoint $ns2 10.0.3.2 id 3 flags subflow wait_mpj 1 pm_nl_add_endpoint $ns1 10.0.3.1 id 2 flags signal diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing= /selftests/net/mptcp/mptcp_lib.sh index e65b4ebee06a..0559bb168203 100644 --- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh +++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh @@ -528,7 +528,7 @@ mptcp_lib_check_tools() { exit ${KSFT_SKIP} fi ;; - "iptables"* | "ip6tables"* | "nft" | "jq") + "nft" | "jq") if ! "${tool}" -V &> /dev/null; then mptcp_lib_pr_skip "Could not run all tests without ${tool}" exit ${KSFT_SKIP} --=20 2.55.0