From: Geliang Tang <tanggeliang@kylinos.cn>

Add self tests for TCP_MD5SIG and TCP_MD5SIG_EXT:
- IPv4/IPv6 test cases
- VRF interface handling for extended MD5 tests
- Integration into existing test suite

Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
---
 tools/testing/selftests/net/mptcp/config      |  3 ++
 .../selftests/net/mptcp/mptcp_sockopt.sh      | 51 +++++++++++++++++++
 2 files changed, 54 insertions(+)

diff --git a/tools/testing/selftests/net/mptcp/config b/tools/testing/selftests/net/mptcp/config
index 59051ee2a986..44e3523bc8c3 100644
--- a/tools/testing/selftests/net/mptcp/config
+++ b/tools/testing/selftests/net/mptcp/config
@@ -34,3 +34,6 @@ CONFIG_NFT_SOCKET=m
 CONFIG_NFT_TPROXY=m
 CONFIG_SYN_COOKIES=y
 CONFIG_VETH=y
+CONFIG_TCP_MD5SIG=y
+CONFIG_NET_L3_MASTER_DEV=y
+CONFIG_NET_VRF=y
diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
index f01989be6e9b..dc58bfe88daa 100755
--- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
@@ -348,6 +348,56 @@ do_tcpinq_tests()
 	return $?
 }
 
+do_tcpmd5_test()
+{
+	print_title "TCP_MD5SIG $*" | head -c 53
+	ip netns exec "$ns_sbox" ./mptcp_sockopt "$@"
+	local lret=$?
+	if [ $lret -ne 0 ];then
+		ret=$lret
+		mptcp_lib_pr_fail
+		mptcp_lib_result_fail "TCP_MD5SIG: $*"
+		return $lret
+	fi
+
+	mptcp_lib_pr_ok
+	mptcp_lib_result_pass "TCP_MD5SIG: $*"
+	return $lret
+}
+
+do_tcpmd5_tests()
+{
+	local lret=0
+
+	mptcp_lib_print_info "sockopt TCP_MD5SIG"
+
+	do_tcpmd5_test -m "md5,key=0123456789"
+	lret=$?
+	if [ $lret -ne 0 ] ; then
+		return $lret
+	fi
+	do_tcpmd5_test -6 -m "md5,key=0123456789"
+	lret=$?
+	if [ $lret -ne 0 ] ; then
+		return $lret
+	fi
+
+	ip netns exec "$ns_sbox" ip link add vrf-test type vrf table 100
+	vrf=$(ip netns exec "$ns_sbox" ip link show vrf-test |
+				       awk -F':' '{print $1; exit}')
+	do_tcpmd5_test -m "md5ext,prefixlen=1,ifindex=$vrf,key=0123456789"
+	lret=$?
+	if [ $lret -ne 0 ] ; then
+		ip netns exec "$ns_sbox" ip link del vrf-test
+		return $lret
+	fi
+	do_tcpmd5_test -6 -m "md5ext,prefixlen=1,ifindex=$vrf,key=0123456789"
+	lret=$?
+
+	ip netns exec "$ns_sbox" ip link del vrf-test
+	return $lret
+}
+
 sin=$(mktemp)
 sout=$(mktemp)
 cin=$(mktemp)
@@ -363,6 +413,7 @@ run_tests $ns1 $ns2 dead:beef:1::1
 
 do_mptcp_sockopt_tests
 do_tcpinq_tests
+do_tcpmd5_tests
 
 mptcp_lib_result_print_all_tap
 exit $ret
-- 
2.43.0