Re: [PATCH mptcp-next RFC 2/3] mptcp: reject MP_JOIN earlier

[Matthieu Baerts <matttbe@kernel.org>]

On 16/08/2026 18:12, Matthieu Baerts wrote:
> Hello,
> 
> On 14/08/2026 20:31, Matthieu Baerts (NGI0) wrote:
>> When a SYN + MP_JOIN is received, it is good to check directly if the
>> MP_JOIN is allowed, then checking that later at the establishment of the
>> new subflow.
>>
>> This avoids situations where the 3WHS is done, then the joined subflow
>> is rejected.
>>
>> This changes the behaviour, and the new behaviour is tracked with the
>> MPJoinDisallow MIB counter.
>>
>> TODO: adapt the selftests to be able to run on older kernels: if the new
>> counter is not available, increment syn_ack and syn_rej instead.
> 
> (...)
> 
>> @@ -217,17 +228,19 @@ static int subflow_check_req(struct request_sock *req,
>>  			SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_TOKENFALLBACKINIT);
>>  
>>  	} else if (opt_mp_join && listener->request_mptcp) {
>> +		u8 reason;
>> +
>>  		subflow_req->ssn_offset = TCP_SKB_CB(skb)->seq;
>>  		subflow_req->mp_join = 1;
>>  		subflow_req->backup = mp_opt.backup;
>>  		subflow_req->remote_id = mp_opt.join_id;
>>  		subflow_req->token = mp_opt.token;
>>  		subflow_req->remote_nonce = mp_opt.nonce;
>> -		subflow_req->msk = subflow_token_join_request(req);
>> +		subflow_req->msk = subflow_token_join_request(req, &reason);
>>  
>>  		/* Can't fall back to TCP in this case. */
>>  		if (!subflow_req->msk) {
>> -			subflow_add_reset_reason(skb, MPTCP_RST_EMPTCP);
>> +			subflow_add_reset_reason(skb, reason);
>>  			return -EPERM;
>>  		}
> 
> Note: the call to mptcp_can_accept_new_subflow() here below, when
> handling req->syncookies, is no longer needed as it is now done earlier
> for all cases, in subflow_token_join_request().
I meant to add the diff:

diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 7552abf4c333..c629bcce6ecc 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -258,15 +258,8 @@ static int subflow_check_req(struct request_sock *req,
 
 		subflow_req_create_thmac(subflow_req);
 
-		if (unlikely(req->syncookie)) {
-			if (!mptcp_can_accept_new_subflow(subflow_req->msk)) {
-				SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINREJECTED);
-				subflow_add_reset_reason(skb, MPTCP_RST_EPROHIBIT);
-				return -EPERM;
-			}
-
+		if (unlikely(req->syncookie))
 			subflow_init_req_cookie_join_save(subflow_req, skb);
-		}
 
 		pr_debug("token=%u, remote_nonce=%u msk=%p\n", subflow_req->token,
 			 subflow_req->remote_nonce, subflow_req->msk);


Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.