* [PATCH mptcp-next 0/2] mptcp: MIB counter for invalid option
@ 2026-08-12 10:05 Gang Yan
2026-08-12 10:05 ` [PATCH mptcp-next 1/2] mptcp: pass net namespace to options parser Gang Yan
` (3 more replies)
0 siblings, 4 replies; 6+ messages in thread
From: Gang Yan @ 2026-08-12 10:05 UTC (permalink / raw)
To: mptcp; +Cc: Gang Yan
From: Gang Yan <yangang@kylinos.cn>
This series is designed for [1].
Patch 1 passes the 'net' to options parser, I used to use
dev_net(skb->dev) for MIB counters, but the AI reported it is not
suitable for this. This patch has no functional change.
Patch 2 adds the InvalidOptionRx counter, and increments it when
receive the invalid options.
The packetdill testcase is submitted, and can be reviewed in [2].
[1] https://github.com/multipath-tcp/mptcp_net-next/issues/628
[2] https://github.com/multipath-tcp/packetdrill/pull/205
Gang Yan (2):
mptcp: pass net namespace to options parser
mptcp: add MIB counter for received invalid options
net/mptcp/mib.c | 1 +
net/mptcp/mib.h | 1 +
net/mptcp/options.c | 107 +++++++++++++++++++++++++++++++------------
net/mptcp/protocol.h | 2 +-
net/mptcp/subflow.c | 10 ++--
5 files changed, 85 insertions(+), 36 deletions(-)
--
2.43.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH mptcp-next 1/2] mptcp: pass net namespace to options parser
2026-08-12 10:05 [PATCH mptcp-next 0/2] mptcp: MIB counter for invalid option Gang Yan
@ 2026-08-12 10:05 ` Gang Yan
2026-08-12 10:05 ` [PATCH mptcp-next 2/2] mptcp: add MIB counter for received invalid options Gang Yan
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Gang Yan @ 2026-08-12 10:05 UTC (permalink / raw)
To: mptcp; +Cc: Gang Yan
From: Gang Yan <yangang@kylinos.cn>
The MPTCP options parser will need access to the per-netns MIB counters
to track received invalid options. To prepare for this, pass the net
namespace down to mptcp_get_options() and mptcp_parse_option().
This is a pure refactor with no functional change.
Assisted-by: Claude:GLM-5.2
Signed-off-by: Gang Yan <yangang@kylinos.cn>
---
net/mptcp/options.c | 9 +++++----
net/mptcp/protocol.h | 2 +-
net/mptcp/subflow.c | 10 +++++-----
3 files changed, 11 insertions(+), 10 deletions(-)
diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 97da22668dbe..dfdcc888efe3 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -20,7 +20,8 @@ static bool mptcp_cap_flag_sha256(u8 flags)
return (flags & MPTCP_CAP_FLAG_MASK) == MPTCP_CAP_HMAC_SHA256;
}
-static void mptcp_parse_option(const struct sk_buff *skb,
+static void mptcp_parse_option(struct net *net,
+ const struct sk_buff *skb,
const unsigned char *ptr, int opsize,
struct mptcp_options_received *mp_opt)
{
@@ -419,7 +420,7 @@ static void mptcp_parse_option(const struct sk_buff *skb,
}
}
-void mptcp_get_options(const struct sk_buff *skb,
+void mptcp_get_options(struct net *net, const struct sk_buff *skb,
struct mptcp_options_received *mp_opt)
{
const struct tcphdr *th = tcp_hdr(skb);
@@ -454,7 +455,7 @@ void mptcp_get_options(const struct sk_buff *skb,
if (opsize > length)
return; /* don't parse partial options */
if (opcode == TCPOPT_MPTCP)
- mptcp_parse_option(skb, ptr, opsize, mp_opt);
+ mptcp_parse_option(net, skb, ptr, opsize, mp_opt);
ptr += opsize - 2;
length -= opsize;
}
@@ -1247,7 +1248,7 @@ bool mptcp_incoming_options(struct sock *sk, struct sk_buff *skb)
return !mptcp_over_limit(subflow->conn, sk, skb);
}
- mptcp_get_options(skb, &mp_opt);
+ mptcp_get_options(sock_net(sk), skb, &mp_opt);
/* The subflow can be in close state only if check_fully_established()
* just sent a reset. If so, tell the caller to ignore the current packet.
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 7e168e450fb0..333fb5c89c59 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -927,7 +927,7 @@ struct sock *mptcp_sk_clone_init(const struct sock *sk,
const struct mptcp_options_received *mp_opt,
struct sock *ssk,
struct request_sock *req);
-void mptcp_get_options(const struct sk_buff *skb,
+void mptcp_get_options(struct net *net, const struct sk_buff *skb,
struct mptcp_options_received *mp_opt);
void mptcp_finish_connect(struct sock *sk);
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index af81ad5e699d..9a8a39b23fcb 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -167,7 +167,7 @@ static int subflow_check_req(struct request_sock *req,
}
#endif
- mptcp_get_options(skb, &mp_opt);
+ mptcp_get_options(sock_net(sk_listener), skb, &mp_opt);
opt_mp_capable = !!(mp_opt.suboptions & OPTION_MPTCP_MPC_SYN);
opt_mp_join = !!(mp_opt.suboptions & OPTION_MPTCP_MPJ_SYN);
@@ -273,7 +273,7 @@ int mptcp_subflow_init_cookie_req(struct request_sock *req,
int err;
subflow_init_req(req, sk_listener);
- mptcp_get_options(skb, &mp_opt);
+ mptcp_get_options(sock_net(sk_listener), skb, &mp_opt);
opt_mp_capable = !!(mp_opt.suboptions & OPTION_MPTCP_MPC_ACK);
opt_mp_join = !!(mp_opt.suboptions & OPTION_MPTCP_MPJ_ACK);
@@ -539,7 +539,7 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb)
subflow->ssn_offset = TCP_SKB_CB(skb)->seq;
pr_debug("subflow=%p synack seq=%x\n", subflow, subflow->ssn_offset);
- mptcp_get_options(skb, &mp_opt);
+ mptcp_get_options(sock_net(sk), skb, &mp_opt);
if (subflow->request_mptcp) {
if (!(mp_opt.suboptions & OPTION_MPTCP_MPC_SYNACK)) {
if (!mptcp_try_fallback(sk,
@@ -842,13 +842,13 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
* reordered MPC will cause fallback, but we don't have other
* options.
*/
- mptcp_get_options(skb, &mp_opt);
+ mptcp_get_options(sock_net(sk), skb, &mp_opt);
if (!(mp_opt.suboptions &
(OPTION_MPTCP_MPC_SYN | OPTION_MPTCP_MPC_ACK)))
fallback = true;
} else if (subflow_req->mp_join) {
- mptcp_get_options(skb, &mp_opt);
+ mptcp_get_options(sock_net(sk), skb, &mp_opt);
if (!(mp_opt.suboptions & OPTION_MPTCP_MPJ_ACK))
fallback = true;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH mptcp-next 2/2] mptcp: add MIB counter for received invalid options
2026-08-12 10:05 [PATCH mptcp-next 0/2] mptcp: MIB counter for invalid option Gang Yan
2026-08-12 10:05 ` [PATCH mptcp-next 1/2] mptcp: pass net namespace to options parser Gang Yan
@ 2026-08-12 10:05 ` Gang Yan
2026-08-12 10:16 ` sashiko-bot
2026-08-12 11:17 ` [PATCH mptcp-next 0/2] mptcp: MIB counter for invalid option MPTCP CI
2026-08-12 15:03 ` Matthieu Baerts
3 siblings, 1 reply; 6+ messages in thread
From: Gang Yan @ 2026-08-12 10:05 UTC (permalink / raw)
To: mptcp; +Cc: Gang Yan
From: Gang Yan <yangang@kylinos.cn>
In mptcp_parse_option(), an MPTCP option is silently ignored via a
'break' under a number of conditions.
This patch adds a MIB counter tracking this as an evidence to show
someone is trying to attack the peer
Assisted-by: Claude:GLM-5.2
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/628
Signed-off-by: Gang Yan <yangang@kylinos.cn>
---
net/mptcp/mib.c | 1 +
net/mptcp/mib.h | 1 +
net/mptcp/options.c | 98 +++++++++++++++++++++++++++++++++------------
3 files changed, 74 insertions(+), 26 deletions(-)
diff --git a/net/mptcp/mib.c b/net/mptcp/mib.c
index 608cb568897c..10e8870dd985 100644
--- a/net/mptcp/mib.c
+++ b/net/mptcp/mib.c
@@ -95,6 +95,7 @@ static const struct snmp_mib mptcp_snmp_list[] = {
SNMP_MIB_ITEM("BacklogDrop", MPTCP_MIB_BACKLOGDROP),
SNMP_MIB_ITEM("RcvPruned", MPTCP_MIB_RCVPRUNED),
SNMP_MIB_ITEM("OFOPruned", MPTCP_MIB_OFOPRUNED),
+ SNMP_MIB_ITEM("InvalidOptionRx", MPTCP_MIB_INVALDOPTIONRX),
};
/* mptcp_mib_alloc - allocate percpu mib counters
diff --git a/net/mptcp/mib.h b/net/mptcp/mib.h
index 1ebdb55e9534..ae0751addd64 100644
--- a/net/mptcp/mib.h
+++ b/net/mptcp/mib.h
@@ -98,6 +98,7 @@ enum linux_mptcp_mib_field {
MPTCP_MIB_BACKLOGDROP, /* Backlog over memory limit */
MPTCP_MIB_RCVPRUNED, /* Dropped due to memory constraints */
MPTCP_MIB_OFOPRUNED, /* MPTCP-level OoO queue pruned */
+ MPTCP_MIB_INVALDOPTIONRX, /* Received an invalid MPTCP option */
__MPTCP_MIB_MAX
};
diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index dfdcc888efe3..e9deea0e483a 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -53,9 +53,12 @@ static void mptcp_parse_option(struct net *net,
/* Only the MPC + ACK can be used with a RM_ADDR */
if (subopt == OPTION_MPTCP_MPC_ACK) {
- if ((mp_opt->suboptions & ~OPTION_MPTCP_RM_ADDR) != 0)
+ if ((mp_opt->suboptions & ~OPTION_MPTCP_RM_ADDR) != 0) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
} else if (mp_opt->suboptions != 0) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
}
@@ -71,22 +74,29 @@ static void mptcp_parse_option(struct net *net,
*/
if (opsize != expected_opsize &&
(expected_opsize != TCPOLEN_MPTCP_MPC_ACK_DATA ||
- opsize != TCPOLEN_MPTCP_MPC_ACK_DATA_CSUM))
+ opsize != TCPOLEN_MPTCP_MPC_ACK_DATA_CSUM)) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
/* try to be gentle vs future versions on the initial syn */
version = *ptr++ & MPTCP_VERSION_MASK;
if (opsize != TCPOLEN_MPTCP_MPC_SYN) {
- if (version != MPTCP_SUPPORTED_VERSION)
+ if (version != MPTCP_SUPPORTED_VERSION) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
} else if (version < MPTCP_SUPPORTED_VERSION) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
}
flags = *ptr++;
if (!mptcp_cap_flag_sha256(flags) ||
- (flags & MPTCP_CAP_EXTENSIBILITY))
+ (flags & MPTCP_CAP_EXTENSIBILITY)) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
/* RFC 6824, Section 3.1:
* "For the Checksum Required bit (labeled "A"), if either
@@ -133,8 +143,10 @@ static void mptcp_parse_option(struct net *net,
case MPTCPOPT_MP_JOIN:
/* Can be used with a restricted number of other options */
if ((mp_opt->suboptions & ~(OPTION_MPTCP_RM_ADDR |
- OPTION_MPTCP_PRIO)) != 0)
+ OPTION_MPTCP_PRIO)) != 0) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
if (opsize == TCPOLEN_MPTCP_MPJ_SYN) {
mp_opt->suboptions |= OPTION_MPTCP_MPJ_SYN;
@@ -163,6 +175,8 @@ static void mptcp_parse_option(struct net *net,
ptr += 2;
memcpy(mp_opt->hmac, ptr, MPTCPOPT_HMAC_LEN);
pr_debug("MP_JOIN hmac\n");
+ } else {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
}
break;
@@ -172,8 +186,10 @@ static void mptcp_parse_option(struct net *net,
OPTION_MPTCP_RM_ADDR |
OPTION_MPTCP_PRIO |
OPTION_MPTCP_FASTCLOSE |
- OPTION_MPTCP_FAIL)) != 0)
+ OPTION_MPTCP_FAIL)) != 0) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
pr_debug("DSS\n");
ptr++;
@@ -216,6 +232,7 @@ static void mptcp_parse_option(struct net *net,
mp_opt->ack64 = 0;
mp_opt->use_ack = 0;
mp_opt->data_fin = 0;
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
}
@@ -265,32 +282,38 @@ static void mptcp_parse_option(struct net *net,
/* Can be used with a restricted number of other options */
if ((mp_opt->suboptions & ~(OPTIONS_MPTCP_DSS |
OPTION_MPTCP_RM_ADDR |
- OPTION_MPTCP_PRIO)) != 0)
+ OPTION_MPTCP_PRIO)) != 0) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
mp_opt->echo = (*ptr++) & MPTCP_ADDR_ECHO;
if (!mp_opt->echo) {
if (opsize == TCPOLEN_MPTCP_ADD_ADDR ||
- opsize == TCPOLEN_MPTCP_ADD_ADDR_PORT)
+ opsize == TCPOLEN_MPTCP_ADD_ADDR_PORT) {
mp_opt->addr.family = AF_INET;
#if IS_ENABLED(CONFIG_MPTCP_IPV6)
- else if (opsize == TCPOLEN_MPTCP_ADD_ADDR6 ||
- opsize == TCPOLEN_MPTCP_ADD_ADDR6_PORT)
+ } else if (opsize == TCPOLEN_MPTCP_ADD_ADDR6 ||
+ opsize == TCPOLEN_MPTCP_ADD_ADDR6_PORT) {
mp_opt->addr.family = AF_INET6;
#endif
- else
+ } else {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
} else {
if (opsize == TCPOLEN_MPTCP_ADD_ADDR_BASE ||
- opsize == TCPOLEN_MPTCP_ADD_ADDR_BASE_PORT)
+ opsize == TCPOLEN_MPTCP_ADD_ADDR_BASE_PORT) {
mp_opt->addr.family = AF_INET;
#if IS_ENABLED(CONFIG_MPTCP_IPV6)
- else if (opsize == TCPOLEN_MPTCP_ADD_ADDR6_BASE ||
- opsize == TCPOLEN_MPTCP_ADD_ADDR6_BASE_PORT)
+ } else if (opsize == TCPOLEN_MPTCP_ADD_ADDR6_BASE ||
+ opsize == TCPOLEN_MPTCP_ADD_ADDR6_BASE_PORT) {
mp_opt->addr.family = AF_INET6;
#endif
- else
+ } else {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
}
mp_opt->suboptions |= OPTION_MPTCP_ADD_ADDR;
@@ -332,12 +355,16 @@ static void mptcp_parse_option(struct net *net,
OPTIONS_MPTCP_MPJ |
OPTIONS_MPTCP_DSS |
OPTION_MPTCP_ADD_ADDR |
- OPTION_MPTCP_PRIO)) != 0)
+ OPTION_MPTCP_PRIO)) != 0) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
if (opsize < TCPOLEN_MPTCP_RM_ADDR_BASE + 1 ||
- opsize > TCPOLEN_MPTCP_RM_ADDR_BASE + MPTCP_RM_IDS_MAX)
+ opsize > TCPOLEN_MPTCP_RM_ADDR_BASE + MPTCP_RM_IDS_MAX) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
ptr++;
@@ -353,11 +380,15 @@ static void mptcp_parse_option(struct net *net,
if ((mp_opt->suboptions & ~(OPTIONS_MPTCP_MPJ |
OPTIONS_MPTCP_DSS |
OPTION_MPTCP_ADD_ADDR |
- OPTION_MPTCP_RM_ADDR)) != 0)
+ OPTION_MPTCP_RM_ADDR)) != 0) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
- if (opsize != TCPOLEN_MPTCP_PRIO)
+ if (opsize != TCPOLEN_MPTCP_PRIO) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
mp_opt->suboptions |= OPTION_MPTCP_PRIO;
mp_opt->backup = *ptr++ & MPTCP_PRIO_BKUP;
@@ -367,11 +398,15 @@ static void mptcp_parse_option(struct net *net,
case MPTCPOPT_MP_FASTCLOSE:
/* Can be used with a restricted number of other options */
if ((mp_opt->suboptions & ~(OPTIONS_MPTCP_DSS |
- OPTION_MPTCP_RST)) != 0)
+ OPTION_MPTCP_RST)) != 0) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
- if (opsize != TCPOLEN_MPTCP_FASTCLOSE)
+ if (opsize != TCPOLEN_MPTCP_FASTCLOSE) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
ptr += 2;
mp_opt->rcvr_key = get_unaligned_be64(ptr);
@@ -383,14 +418,20 @@ static void mptcp_parse_option(struct net *net,
case MPTCPOPT_RST:
/* Can be used with a restricted number of other options */
if ((mp_opt->suboptions & ~(OPTION_MPTCP_FAIL |
- OPTION_MPTCP_FASTCLOSE)) != 0)
+ OPTION_MPTCP_FASTCLOSE)) != 0) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
- if (opsize != TCPOLEN_MPTCP_RST)
+ if (opsize != TCPOLEN_MPTCP_RST) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
- if (!(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_RST))
+ if (!(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_RST)) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
mp_opt->suboptions |= OPTION_MPTCP_RST;
flags = *ptr++;
@@ -403,11 +444,15 @@ static void mptcp_parse_option(struct net *net,
case MPTCPOPT_MP_FAIL:
/* Can be used with a restricted number of other options */
if ((mp_opt->suboptions & ~(OPTIONS_MPTCP_DSS |
- OPTION_MPTCP_RST)) != 0)
+ OPTION_MPTCP_RST)) != 0) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
- if (opsize != TCPOLEN_MPTCP_FAIL)
+ if (opsize != TCPOLEN_MPTCP_FAIL) {
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
+ }
ptr += 2;
mp_opt->suboptions |= OPTION_MPTCP_FAIL;
@@ -416,6 +461,7 @@ static void mptcp_parse_option(struct net *net,
break;
default:
+ MPTCP_INC_STATS(net, MPTCP_MIB_INVALDOPTIONRX);
break;
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH mptcp-next 2/2] mptcp: add MIB counter for received invalid options
2026-08-12 10:05 ` [PATCH mptcp-next 2/2] mptcp: add MIB counter for received invalid options Gang Yan
@ 2026-08-12 10:16 ` sashiko-bot
0 siblings, 0 replies; 6+ messages in thread
From: sashiko-bot @ 2026-08-12 10:16 UTC (permalink / raw)
To: Gang Yan; +Cc: mptcp
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Typographical error in the newly added MIB enum name `MPTCP_MIB_INVALDOPTIONRX` which is missing the 'I' (should be `MPTCP_MIB_INVALIDOPTIONRX`).
--
--- Patch [2]: [PATCH mptcp-next 2/2] mptcp: add MIB counter for received invalid options ---
commit 250b62cf8675c7680c8a9a998feb6bec184832c8
Author: Gang Yan <yangang@kylinos.cn>
mptcp: add MIB counter for received invalid options
This commit adds a new MIB counter to track when an MPTCP option is silently
ignored during parsing. This serves as evidence of potential peer attacks.
Link: https://github.com/multipath-tcp/mptcp_net-next/issues/628
> diff --git a/net/mptcp/mib.h b/net/mptcp/mib.h
> index 1ebdb55e95343..ae0751addd64b 100644
> --- a/net/mptcp/mib.h
> +++ b/net/mptcp/mib.h
> @@ -98,6 +98,7 @@ enum linux_mptcp_mib_field {
> MPTCP_MIB_BACKLOGDROP, /* Backlog over memory limit */
> MPTCP_MIB_RCVPRUNED, /* Dropped due to memory constraints */
> MPTCP_MIB_OFOPRUNED, /* MPTCP-level OoO queue pruned */
> + MPTCP_MIB_INVALDOPTIONRX, /* Received an invalid MPTCP option */
[Severity: Low]
This isn't a bug, but is there a typo in this enum name? It looks like it
is missing an 'I' (INVALDOPTIONRX instead of INVALIDOPTIONRX).
> __MPTCP_MIB_MAX
> };
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260812100550.148670-1-gang.yan@linux.dev?part=2
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH mptcp-next 0/2] mptcp: MIB counter for invalid option
2026-08-12 10:05 [PATCH mptcp-next 0/2] mptcp: MIB counter for invalid option Gang Yan
2026-08-12 10:05 ` [PATCH mptcp-next 1/2] mptcp: pass net namespace to options parser Gang Yan
2026-08-12 10:05 ` [PATCH mptcp-next 2/2] mptcp: add MIB counter for received invalid options Gang Yan
@ 2026-08-12 11:17 ` MPTCP CI
2026-08-12 15:03 ` Matthieu Baerts
3 siblings, 0 replies; 6+ messages in thread
From: MPTCP CI @ 2026-08-12 11:17 UTC (permalink / raw)
To: Gang Yan; +Cc: mptcp
Hi Gang,
Thank you for your modifications, that's great!
Our CI did some validations and here is its report:
- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/31587859371
Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/cb85dffafd7b
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1144623
If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:
$ cd [kernel source code]
$ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
--pull always mptcp/mptcp-upstream-virtme-docker:latest \
auto-normal
For more details:
https://github.com/multipath-tcp/mptcp-upstream-virtme-docker
Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)
Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH mptcp-next 0/2] mptcp: MIB counter for invalid option
2026-08-12 10:05 [PATCH mptcp-next 0/2] mptcp: MIB counter for invalid option Gang Yan
` (2 preceding siblings ...)
2026-08-12 11:17 ` [PATCH mptcp-next 0/2] mptcp: MIB counter for invalid option MPTCP CI
@ 2026-08-12 15:03 ` Matthieu Baerts
3 siblings, 0 replies; 6+ messages in thread
From: Matthieu Baerts @ 2026-08-12 15:03 UTC (permalink / raw)
To: Gang Yan, mptcp; +Cc: Gang Yan
Hi Gang,
On 12/08/2026 12:05, Gang Yan wrote:
> From: Gang Yan <yangang@kylinos.cn>
>
> This series is designed for [1].
>
> Patch 1 passes the 'net' to options parser, I used to use
> dev_net(skb->dev) for MIB counters, but the AI reported it is not
> suitable for this. This patch has no functional change.
>
> Patch 2 adds the InvalidOptionRx counter, and increments it when
> receive the invalid options.
>
> The packetdill testcase is submitted, and can be reviewed in [2].
>
> [1] https://github.com/multipath-tcp/mptcp_net-next/issues/628
Thank you for the patches. Please next time add a comment on the GitHub
ticket: I already have the patches ready, but I had to wait (for
administration purposes) before sending them:
============
commit 8173df5a467cac6ed421bb832ac3ee675b490fa6 (b4/mptcp-mib-inval-opt)
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date: Fri Jul 31 14:10:38 2026 +0200
mptcp: options: reset parsing in case of invalidity
When an invalid option is detected -- any unexpected suboptions
combinations or use of invalid sizes -- the current behaviour is to
ignore the currently parsed option.
Receiving such invalid options is suspicious: either this is coming from
a buggy host, or an attacker. In this case, it seems safer to drop any
previously parsed MPTCP option from such packet.
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
commit be5492962195d2988a9c508bc8ce4d3f55ac1da7
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date: Wed Jul 29 20:01:45 2026 +0200
mptcp: options: track invalid ones
Any unexpected suboptions combinations or use of invalid sizes are
suspicious: either it is coming from a buggy host, or an attacker.
Better to track that with a new MIB counter.
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
commit 684c6244b5b76d30aaf30d62597247485b89cdb3
Author: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Date: Mon Aug 3 20:24:02 2026 +0200
mptcp: options: use a dedicated bit for csum reqd
Instead of mixing that with suboptions: that's the only non-suboptions
that is present in the 'suboptions' field.
This even cause a workaround with OPTIONS_MPTCP_DSS to exclude this
non-suboptions when checking which other ones are set.
Move it to a dedicated free bit, and adapt the corresponding code.
This is clearer like that.
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
=========
In your version, I see that you increment the counter even when the
suboption is not invalid, e.g. the version or the hmac is not supported.
I don't think we should do that.
If that's OK for you, I can add a co-dev by on my patches.
Cheers,
Matt
--
Sponsored by the NGI0 Core fund.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-08-12 15:03 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-12 10:05 [PATCH mptcp-next 0/2] mptcp: MIB counter for invalid option Gang Yan
2026-08-12 10:05 ` [PATCH mptcp-next 1/2] mptcp: pass net namespace to options parser Gang Yan
2026-08-12 10:05 ` [PATCH mptcp-next 2/2] mptcp: add MIB counter for received invalid options Gang Yan
2026-08-12 10:16 ` sashiko-bot
2026-08-12 11:17 ` [PATCH mptcp-next 0/2] mptcp: MIB counter for invalid option MPTCP CI
2026-08-12 15:03 ` Matthieu Baerts
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.