Re: [PATCH mptcp-next] selftests: mptcp: use offset to match RM_ADDR message

[hangbin.liu@linux.dev]

Hi Matthieu,

October 8, 2026 at 7:46 PM, "Matthieu Baerts" <matttbe@kernel.org> wrote:
> 
> Hi Hangbin,
> 
> Thank you for the follow-up!
> 
> On 08/10/2026 12:06, Hangbin Liu wrote:
> 
> > 
> > From: Hangbin Liu <liuhangbin@kylinos.cn>
> >  
> >  nft cannot match RM_ADDR when it is the second MPTCP option,
> > 
> Do you mind adding a short explanation why or just a ref to:
> 
>  https://lore.kernel.org/a391d81c-0bce-41e6-886e-a558765c6891@kernel.org

OK, I will.

> 
> Also, could you title this patch:
> 
>  Squash to "selftests: mptcp: convert iptables to nftables for
>  mptcp_join.sh"
> 
> And mention what should be added to the original commit message, please?

OK, no problem.

> 
> > 
> > so we rely on hard-coded offsets. A tcpdump capture of the RM_ADDR
> >  message looks like:
> >  
> >  [TCP header: 20 bytes] [nop] [nop] [timestamp: 10 bytes] \
> >  [MPTCP DSS: 12 bytes] [MPTCP RM_ADDR: 4 bytes]
> >  
> >  We verify: TCP Data Offset (TCP[12] × 8) equals 48 bytes (12 x 4),
> >  DSS length (TCP[33] x 8) is 12 bytes, and RM_ADDR subtype (TCP[46] × 8)
> >  is 4. This matches the old cBPF check, which calculated offsets starting
> >  from the IP header:
> >  
> >  (ip[32] & 0xf0) == 0xc0 && ip[53] == 0x0c && (ip[66] & 0xf0) == 0x40
> >  
> >  Also add MPTCP kind (30) checks for the DSS (TCP[32] x 8) and RM_ADDR
> >  (TCP[44] x 8) options.
> > 
> Good idea.
> 
> > 
> > Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
> >  ---
> >  tools/testing/selftests/net/mptcp/mptcp_join.sh | 14 ++++++++++++--
> >  1 file changed, 12 insertions(+), 2 deletions(-)
> >  
> >  diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> >  index b16e24418e73..194b80277ae2 100755
> >  --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
> >  +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> >  @@ -4375,7 +4375,12 @@ endpoint_tests()
> >  local nft=1
> >  ip netns exec "${ns2}" nft insert rule ip filter OUTPUT \
> >  ip saddr 10.0.1.2 meta l4proto tcp \
> >  - tcp option mptcp subtype remove-addr drop || nft=0
> >  + @th,96,4 == 12 \
> >  + @th,256,8 == 30 \
> >  + @th,264,8 == 12 \
> >  + @th,352,8 == 30 \
> >  + @th,368,4 == 4 \
> >  + drop || nft=0
> >  local i
> >  for i in $(seq 3); do
> >  pm_nl_del_endpoint $ns2 1 10.0.1.2
> >  @@ -4454,7 +4459,12 @@ endpoint_tests()
> >  local nft=1
> >  ip netns exec "${ns1}" nft insert rule ip filter OUTPUT \
> >  ip saddr 10.0.1.1 meta l4proto tcp \
> >  - tcp option mptcp subtype remove-addr drop || nft=0
> >  + @th,96,4 == 12 \
> >  + @th,256,8 == 30 \
> >  + @th,264,8 == 12 \
> >  + @th,352,8 == 30 \
> >  + @th,368,4 == 4 \
> > 
> Do you mind just adding this sequence to a global variable (an array?),
> similar to what was done before with the cBPF filter, with a short
> comment, please?
> 
> That would be easier to understand here, and to avoid duplicated code.

Yes, I will.

BTW, For mptcp_sockopt.sh,

    # just to debug: check we have multiple subflows connection requests
    add rule $table filter OUTPUT \
        tcp flags & (fin | syn | rst | ack) == syn \
        meta mark $m accept

do you think if there is a need to add counter or remove this rule?

Thanks
Hangbin