[PATCH mptcp-next v2 0/2] mptcp: TCP_MD5SIG support

[PATCH mptcp-next v2 0/2] mptcp: TCP_MD5SIG support

[Geliang Tang]

From: Geliang Tang <tanggeliang@kylinos.cn>

v2:
 - trigger fallback to TCP.
 - check CONFIG_TCP_MD5SIG.
 - update MD5 comment.
 - drop selftests, packetdrill tests will be added later.

This series introduces support for TCP_MD5SIG socket options in MPTCP along
with code improvements:

Patch 1: Refactors TCP_MAXSEG getsockopt handling to improve code
consistency
Patch 2: Adds setsockopt support for TCP_MD5SIG/TCP_MD5SIG_EXT (first
subflow only)

Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/575

Geliang Tang (2):
  mptcp: Handle TCP_MAXSEG getsockopt in common case
  mptcp: setsockopt support for TCP_MD5SIG

 net/mptcp/sockopt.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

-- 
2.48.1

[PATCH mptcp-next v2 1/2] mptcp: Handle TCP_MAXSEG getsockopt in common case

[Geliang Tang]

From: Geliang Tang <tanggeliang@kylinos.cn>

This patch simplifies MPTCP's TCP_MAXSEG getsockopt handling by moving it
to the common case where other TCP options are processed. Previously it
was handled separately after the main switch statement.

The change:

 - Moves TCP_MAXSEG case into the main switch block
 - Removes redundant separate handling
 - Maintains identical functionality

This improves code consistency without altering behavior.

Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
---
 net/mptcp/sockopt.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c
index 2c267aff95be..b264185b810d 100644
--- a/net/mptcp/sockopt.c
+++ b/net/mptcp/sockopt.c
@@ -1404,6 +1404,7 @@ static int mptcp_getsockopt_sol_tcp(struct mptcp_sock *msk, int optname,
 	case TCP_FASTOPEN_CONNECT:
 	case TCP_FASTOPEN_KEY:
 	case TCP_FASTOPEN_NO_COOKIE:
+	case TCP_MAXSEG:
 		return mptcp_getsockopt_first_sf_only(msk, SOL_TCP, optname,
 						      optval, optlen);
 	case TCP_INQ:
@@ -1428,9 +1429,6 @@ static int mptcp_getsockopt_sol_tcp(struct mptcp_sock *msk, int optname,
 		return mptcp_put_int_option(msk, optval, optlen, msk->notsent_lowat);
 	case TCP_IS_MPTCP:
 		return mptcp_put_int_option(msk, optval, optlen, 1);
-	case TCP_MAXSEG:
-		return mptcp_getsockopt_first_sf_only(msk, SOL_TCP, optname,
-						      optval, optlen);
 	}
 	return -EOPNOTSUPP;
 }
-- 
2.48.1

[PATCH mptcp-next v2 2/2] mptcp: setsockopt support for TCP_MD5SIG

[Geliang Tang]

From: Geliang Tang <tanggeliang@kylinos.cn>

This adds setsockopt support for TCP_MD5SIG and TCP_MD5SIG_EXT options.
The implementation:
- Allows setting these options (getsockopt remains unsupported)
- Applies them only to the first subflow
- Forces fallback to TCP (since MD5 isn't compatible with MPTCP)

Setting these options triggers fallback to TCP to maintain MD5
compatibility.

Note that TCP_MD5SIG and TCP_MD5SIG_EXT are unsupported for TCP too.

Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/575
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
---
 net/mptcp/sockopt.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c
index b264185b810d..3ffdeca694be 100644
--- a/net/mptcp/sockopt.c
+++ b/net/mptcp/sockopt.c
@@ -13,6 +13,7 @@
 #include <net/tcp.h>
 #include <net/mptcp.h>
 #include "protocol.h"
+#include "mib.h"
 
 #define MIN_INFO_OPTLEN_SIZE		16
 #define MIN_FULL_INFO_OPTLEN_SIZE	40
@@ -567,11 +568,12 @@ static bool mptcp_supported_sockopt(int level, int optname)
 		case TCP_FASTOPEN_CONNECT:
 		case TCP_FASTOPEN_KEY:
 		case TCP_FASTOPEN_NO_COOKIE:
+		/* MD5 will force a fallback to TCP: OK to set while not connected */
+		case TCP_MD5SIG:
+		case TCP_MD5SIG_EXT:
 			return true;
 		}
 
-		/* TCP_MD5SIG, TCP_MD5SIG_EXT are not supported, MD5 is not compatible with MPTCP */
-
 		/* TCP_REPAIR, TCP_REPAIR_QUEUE, TCP_QUEUE_SEQ, TCP_REPAIR_OPTIONS,
 		 * TCP_REPAIR_WINDOW are not supported, better avoid this mess
 		 */
@@ -830,6 +832,12 @@ static int mptcp_setsockopt_sol_tcp(struct mptcp_sock *msk, int optname,
 		/* See tcp.c: TCP_DEFER_ACCEPT does not fail */
 		mptcp_setsockopt_first_sf_only(msk, SOL_TCP, optname, optval, optlen);
 		return 0;
+#ifdef CONFIG_TCP_MD5SIG
+	case TCP_MD5SIG:
+	case TCP_MD5SIG_EXT:
+		__mptcp_try_fallback(msk, MPTCP_MIB_MD5SIGFALLBACK);
+		fallthrough;
+#endif
 	case TCP_FASTOPEN:
 	case TCP_FASTOPEN_CONNECT:
 	case TCP_FASTOPEN_KEY:
-- 
2.48.1

Re: [PATCH mptcp-next v2 2/2] mptcp: setsockopt support for TCP_MD5SIG

[Matthieu Baerts]

Hi Geliang,

Thank you for the new version.

On 31/07/2025 09:27, Geliang Tang wrote:
> From: Geliang Tang <tanggeliang@kylinos.cn>
> 
> This adds setsockopt support for TCP_MD5SIG and TCP_MD5SIG_EXT options.
> The implementation:
> - Allows setting these options (getsockopt remains unsupported)
> - Applies them only to the first subflow
> - Forces fallback to TCP (since MD5 isn't compatible with MPTCP)
> 
> Setting these options triggers fallback to TCP to maintain MD5
> compatibility.
> 
> Note that TCP_MD5SIG and TCP_MD5SIG_EXT are unsupported for TCP too.
> 
> Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/575
> Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
> ---
>  net/mptcp/sockopt.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c
> index b264185b810d..3ffdeca694be 100644
> --- a/net/mptcp/sockopt.c
> +++ b/net/mptcp/sockopt.c
> @@ -13,6 +13,7 @@
>  #include <net/tcp.h>
>  #include <net/mptcp.h>
>  #include "protocol.h"
> +#include "mib.h"
>  
>  #define MIN_INFO_OPTLEN_SIZE		16
>  #define MIN_FULL_INFO_OPTLEN_SIZE	40
> @@ -567,11 +568,12 @@ static bool mptcp_supported_sockopt(int level, int optname)
>  		case TCP_FASTOPEN_CONNECT:
>  		case TCP_FASTOPEN_KEY:
>  		case TCP_FASTOPEN_NO_COOKIE:
> +		/* MD5 will force a fallback to TCP: OK to set while not connected */
> +		case TCP_MD5SIG:
> +		case TCP_MD5SIG_EXT:
>  			return true;
>  		}
>  
> -		/* TCP_MD5SIG, TCP_MD5SIG_EXT are not supported, MD5 is not compatible with MPTCP */
> -
>  		/* TCP_REPAIR, TCP_REPAIR_QUEUE, TCP_QUEUE_SEQ, TCP_REPAIR_OPTIONS,
>  		 * TCP_REPAIR_WINDOW are not supported, better avoid this mess
>  		 */
> @@ -830,6 +832,12 @@ static int mptcp_setsockopt_sol_tcp(struct mptcp_sock *msk, int optname,
>  		/* See tcp.c: TCP_DEFER_ACCEPT does not fail */
>  		mptcp_setsockopt_first_sf_only(msk, SOL_TCP, optname, optval, optlen);
>  		return 0;
> +#ifdef CONFIG_TCP_MD5SIG
> +	case TCP_MD5SIG:
> +	case TCP_MD5SIG_EXT:
> +		__mptcp_try_fallback(msk, MPTCP_MIB_MD5SIGFALLBACK);

I don't think that's a good idea to do just that: here, you will do a
fallback even if the options are not correct. Please this helper can
return false if a fallback is not possible, and a reset will be needed.

I think it would be easier to simply limit the use of this option for
listened and closed state: a fallback will be done in mptcp_connect()
and subflow_check_req().

If I'm not mistaken, mptcp_setsockopt_first_sf_only() will limit to the
first subflow, before the establishment of the connection
(__mptcp_nmpc_sk() is explicitly checking the state), no?

Then all you require is to add the two 'case', no? If yes, please add a
Fixes tag:

Fixes: d9e4c1291810 ("mptcp: only admit explicitly supported sockopt")

And add something like this in the commit message:

  Supporting TCP_MD5 socket option is required when MPTCP is used by
  default when creating a socket, to keep the same behaviour as with
  TCP. TCP_MD5 is not compatible with MPTCP, and it will cause a
  fallback to TCP at the connection request, if MPTCP was requested.
  This then fixes a "regression" compared to TCP.


One last thing, please also send the new packetdrill test on GitHub when
sending a next version.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH mptcp-next v2 2/2] mptcp: setsockopt support for TCP_MD5SIG

[Geliang Tang]

Hi Matt,

On Thu, 2025-07-31 at 11:59 +0200, Matthieu Baerts wrote:
> Hi Geliang,
> 
> Thank you for the new version.
> 
> On 31/07/2025 09:27, Geliang Tang wrote:
> > From: Geliang Tang <tanggeliang@kylinos.cn>
> > 
> > This adds setsockopt support for TCP_MD5SIG and TCP_MD5SIG_EXT
> > options.
> > The implementation:
> > - Allows setting these options (getsockopt remains unsupported)
> > - Applies them only to the first subflow
> > - Forces fallback to TCP (since MD5 isn't compatible with MPTCP)
> > 
> > Setting these options triggers fallback to TCP to maintain MD5
> > compatibility.
> > 
> > Note that TCP_MD5SIG and TCP_MD5SIG_EXT are unsupported for TCP
> > too.
> > 
> > Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/575
> > Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
> > ---
> >  net/mptcp/sockopt.c | 12 ++++++++++--
> >  1 file changed, 10 insertions(+), 2 deletions(-)
> > 
> > diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c
> > index b264185b810d..3ffdeca694be 100644
> > --- a/net/mptcp/sockopt.c
> > +++ b/net/mptcp/sockopt.c
> > @@ -13,6 +13,7 @@
> >  #include <net/tcp.h>
> >  #include <net/mptcp.h>
> >  #include "protocol.h"
> > +#include "mib.h"
> >  
> >  #define MIN_INFO_OPTLEN_SIZE		16
> >  #define MIN_FULL_INFO_OPTLEN_SIZE	40
> > @@ -567,11 +568,12 @@ static bool mptcp_supported_sockopt(int
> > level, int optname)
> >  		case TCP_FASTOPEN_CONNECT:
> >  		case TCP_FASTOPEN_KEY:
> >  		case TCP_FASTOPEN_NO_COOKIE:
> > +		/* MD5 will force a fallback to TCP: OK to set
> > while not connected */
> > +		case TCP_MD5SIG:
> > +		case TCP_MD5SIG_EXT:
> >  			return true;
> >  		}
> >  
> > -		/* TCP_MD5SIG, TCP_MD5SIG_EXT are not supported,
> > MD5 is not compatible with MPTCP */
> > -
> >  		/* TCP_REPAIR, TCP_REPAIR_QUEUE, TCP_QUEUE_SEQ,
> > TCP_REPAIR_OPTIONS,
> >  		 * TCP_REPAIR_WINDOW are not supported, better
> > avoid this mess
> >  		 */
> > @@ -830,6 +832,12 @@ static int mptcp_setsockopt_sol_tcp(struct
> > mptcp_sock *msk, int optname,
> >  		/* See tcp.c: TCP_DEFER_ACCEPT does not fail */
> >  		mptcp_setsockopt_first_sf_only(msk, SOL_TCP,
> > optname, optval, optlen);
> >  		return 0;
> > +#ifdef CONFIG_TCP_MD5SIG
> > +	case TCP_MD5SIG:
> > +	case TCP_MD5SIG_EXT:
> > +		__mptcp_try_fallback(msk,
> > MPTCP_MIB_MD5SIGFALLBACK);
> 
> I don't think that's a good idea to do just that: here, you will do a
> fallback even if the options are not correct. Please this helper can
> return false if a fallback is not possible, and a reset will be
> needed.

Yes, here the return value of __mptcp_try_fallback() needs to be
checked:

 if (!__mptcp_try_fallback(msk, MPTCP_MIB_MD5SIGFALLBACK))
	 return 0;

> 
> I think it would be easier to simply limit the use of this option for
> listened and closed state: 

Yes, the state of sk needs to be checked too:

 if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ||
     !__mptcp_try_fallback(msk, MPTCP_MIB_MD5SIGFALLBACK))
 	return 0;

Do you think this will work?

> a fallback will be done in mptcp_connect()
> and subflow_check_req().

When running the selftests of patch 3 in v1, no fallback is done in
mptcp_connect() and subflow_check_req(). Since both
rcu_access_pointer(tcp_sk(ssk)->md5sig_info) and
rcu_access_pointer(tcp_sk(sk_listener)->md5sig_info) are NULL. So we do
need to fallback in mptcp_setsockopt_sol_tcp().

Thanks,
-Geliang

> 
> If I'm not mistaken, mptcp_setsockopt_first_sf_only() will limit to
> the
> first subflow, before the establishment of the connection
> (__mptcp_nmpc_sk() is explicitly checking the state), no?
> 
> Then all you require is to add the two 'case', no? If yes, please add
> a
> Fixes tag:
> 
> Fixes: d9e4c1291810 ("mptcp: only admit explicitly supported
> sockopt")
> 
> And add something like this in the commit message:
> 
>   Supporting TCP_MD5 socket option is required when MPTCP is used by
>   default when creating a socket, to keep the same behaviour as with
>   TCP. TCP_MD5 is not compatible with MPTCP, and it will cause a
>   fallback to TCP at the connection request, if MPTCP was requested.
>   This then fixes a "regression" compared to TCP.
> 
> 
> One last thing, please also send the new packetdrill test on GitHub
> when
> sending a next version.
> 
> Cheers,
> Matt

Re: [PATCH mptcp-next v2 2/2] mptcp: setsockopt support for TCP_MD5SIG

[Christoph Paasch]

On Thu, Jul 31, 2025 at 12:28 AM Geliang Tang <geliang@kernel.org> wrote:
>
> From: Geliang Tang <tanggeliang@kylinos.cn>
>
> This adds setsockopt support for TCP_MD5SIG and TCP_MD5SIG_EXT options.
> The implementation:
> - Allows setting these options (getsockopt remains unsupported)
> - Applies them only to the first subflow
> - Forces fallback to TCP (since MD5 isn't compatible with MPTCP)
>
> Setting these options triggers fallback to TCP to maintain MD5
> compatibility.
>
> Note that TCP_MD5SIG and TCP_MD5SIG_EXT are unsupported for TCP too.

Just wondering : What does the above line mean ? "unsupported for TCP too" ?


Christoph

>
> Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/575
> Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
> ---
>  net/mptcp/sockopt.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
>
> diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c
> index b264185b810d..3ffdeca694be 100644
> --- a/net/mptcp/sockopt.c
> +++ b/net/mptcp/sockopt.c
> @@ -13,6 +13,7 @@
>  #include <net/tcp.h>
>  #include <net/mptcp.h>
>  #include "protocol.h"
> +#include "mib.h"
>
>  #define MIN_INFO_OPTLEN_SIZE           16
>  #define MIN_FULL_INFO_OPTLEN_SIZE      40
> @@ -567,11 +568,12 @@ static bool mptcp_supported_sockopt(int level, int optname)
>                 case TCP_FASTOPEN_CONNECT:
>                 case TCP_FASTOPEN_KEY:
>                 case TCP_FASTOPEN_NO_COOKIE:
> +               /* MD5 will force a fallback to TCP: OK to set while not connected */
> +               case TCP_MD5SIG:
> +               case TCP_MD5SIG_EXT:
>                         return true;
>                 }
>
> -               /* TCP_MD5SIG, TCP_MD5SIG_EXT are not supported, MD5 is not compatible with MPTCP */
> -
>                 /* TCP_REPAIR, TCP_REPAIR_QUEUE, TCP_QUEUE_SEQ, TCP_REPAIR_OPTIONS,
>                  * TCP_REPAIR_WINDOW are not supported, better avoid this mess
>                  */
> @@ -830,6 +832,12 @@ static int mptcp_setsockopt_sol_tcp(struct mptcp_sock *msk, int optname,
>                 /* See tcp.c: TCP_DEFER_ACCEPT does not fail */
>                 mptcp_setsockopt_first_sf_only(msk, SOL_TCP, optname, optval, optlen);
>                 return 0;
> +#ifdef CONFIG_TCP_MD5SIG
> +       case TCP_MD5SIG:
> +       case TCP_MD5SIG_EXT:
> +               __mptcp_try_fallback(msk, MPTCP_MIB_MD5SIGFALLBACK);
> +               fallthrough;
> +#endif
>         case TCP_FASTOPEN:
>         case TCP_FASTOPEN_CONNECT:
>         case TCP_FASTOPEN_KEY:
> --
> 2.48.1
>
>

Re: [PATCH mptcp-next v2 2/2] mptcp: setsockopt support for TCP_MD5SIG

[Geliang Tang]

Hi Christoph,

On Thu, 2025-07-31 at 12:18 -0700, Christoph Paasch wrote:
> On Thu, Jul 31, 2025 at 12:28 AM Geliang Tang <geliang@kernel.org>
> wrote:
> > 
> > From: Geliang Tang <tanggeliang@kylinos.cn>
> > 
> > This adds setsockopt support for TCP_MD5SIG and TCP_MD5SIG_EXT
> > options.
> > The implementation:
> > - Allows setting these options (getsockopt remains unsupported)
> > - Applies them only to the first subflow
> > - Forces fallback to TCP (since MD5 isn't compatible with MPTCP)
> > 
> > Setting these options triggers fallback to TCP to maintain MD5
> > compatibility.
> > 
> > Note that TCP_MD5SIG and TCP_MD5SIG_EXT are unsupported for TCP
> > too.
> 
> Just wondering : What does the above line mean ? "unsupported for TCP
> too" ?

It should be:

TCP_MD5SIG and TCP_MD5SIG_EXT getsockopts are unsupported for TCP too.

Thanks,
-Geliang

> 
> 
> Christoph
> 
> > 
> > Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/575
> > Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
> > ---
> >  net/mptcp/sockopt.c | 12 ++++++++++--
> >  1 file changed, 10 insertions(+), 2 deletions(-)
> > 
> > diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c
> > index b264185b810d..3ffdeca694be 100644
> > --- a/net/mptcp/sockopt.c
> > +++ b/net/mptcp/sockopt.c
> > @@ -13,6 +13,7 @@
> >  #include <net/tcp.h>
> >  #include <net/mptcp.h>
> >  #include "protocol.h"
> > +#include "mib.h"
> > 
> >  #define MIN_INFO_OPTLEN_SIZE           16
> >  #define MIN_FULL_INFO_OPTLEN_SIZE      40
> > @@ -567,11 +568,12 @@ static bool mptcp_supported_sockopt(int
> > level, int optname)
> >                 case TCP_FASTOPEN_CONNECT:
> >                 case TCP_FASTOPEN_KEY:
> >                 case TCP_FASTOPEN_NO_COOKIE:
> > +               /* MD5 will force a fallback to TCP: OK to set
> > while not connected */
> > +               case TCP_MD5SIG:
> > +               case TCP_MD5SIG_EXT:
> >                         return true;
> >                 }
> > 
> > -               /* TCP_MD5SIG, TCP_MD5SIG_EXT are not supported,
> > MD5 is not compatible with MPTCP */
> > -
> >                 /* TCP_REPAIR, TCP_REPAIR_QUEUE, TCP_QUEUE_SEQ,
> > TCP_REPAIR_OPTIONS,
> >                  * TCP_REPAIR_WINDOW are not supported, better
> > avoid this mess
> >                  */
> > @@ -830,6 +832,12 @@ static int mptcp_setsockopt_sol_tcp(struct
> > mptcp_sock *msk, int optname,
> >                 /* See tcp.c: TCP_DEFER_ACCEPT does not fail */
> >                 mptcp_setsockopt_first_sf_only(msk, SOL_TCP,
> > optname, optval, optlen);
> >                 return 0;
> > +#ifdef CONFIG_TCP_MD5SIG
> > +       case TCP_MD5SIG:
> > +       case TCP_MD5SIG_EXT:
> > +               __mptcp_try_fallback(msk,
> > MPTCP_MIB_MD5SIGFALLBACK);
> > +               fallthrough;
> > +#endif
> >         case TCP_FASTOPEN:
> >         case TCP_FASTOPEN_CONNECT:
> >         case TCP_FASTOPEN_KEY:
> > --
> > 2.48.1
> > 
> > 

Re: [PATCH mptcp-next v2 0/2] mptcp: TCP_MD5SIG support

[MPTCP CI]

Hi Geliang,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal: Unstable: 1 failed test(s): packetdrill_sockopts 🔴
- KVM Validation: debug: Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/16643003513

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/af302c9a19a1
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=987252


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)