[PATCH mptcp-next] selftests: mptcp: use offset to match RM_ADDR message

[PATCH mptcp-next] selftests: mptcp: use offset to match RM_ADDR message

[Hangbin Liu]

From: Hangbin Liu <liuhangbin@kylinos.cn>

nft cannot match RM_ADDR when it is the second MPTCP option,
so we rely on hard-coded offsets. A tcpdump capture of the RM_ADDR
message looks like:

  [TCP header: 20 bytes] [nop] [nop] [timestamp: 10 bytes] \
        [MPTCP DSS: 12 bytes] [MPTCP RM_ADDR: 4 bytes]

We verify: TCP Data Offset (TCP[12] × 8) equals 48 bytes (12 x 4),
DSS length (TCP[33] x 8) is 12 bytes, and RM_ADDR subtype (TCP[46] × 8)
is 4. This matches the old cBPF check, which calculated offsets starting
from the IP header:

(ip[32] & 0xf0) == 0xc0 && ip[53] == 0x0c && (ip[66] & 0xf0) == 0x40

Also add MPTCP kind (30) checks for the DSS (TCP[32] x 8) and RM_ADDR
(TCP[44] x 8) options.

Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
---
 tools/testing/selftests/net/mptcp/mptcp_join.sh | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
index b16e24418e73..194b80277ae2 100755
--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
@@ -4375,7 +4375,12 @@ endpoint_tests()
 		local nft=1
 		ip netns exec "${ns2}" nft insert rule ip filter OUTPUT \
 			ip saddr 10.0.1.2 meta l4proto tcp \
-			tcp option mptcp subtype remove-addr drop || nft=0
+			@th,96,4 == 12 \
+			@th,256,8 == 30 \
+			@th,264,8 == 12 \
+			@th,352,8 == 30 \
+			@th,368,4 == 4 \
+			drop || nft=0
 		local i
 		for i in $(seq 3); do
 			pm_nl_del_endpoint $ns2 1 10.0.1.2
@@ -4454,7 +4459,12 @@ endpoint_tests()
 		local nft=1
 		ip netns exec "${ns1}" nft insert rule ip filter OUTPUT \
 			ip saddr 10.0.1.1 meta l4proto tcp \
-			tcp option mptcp subtype remove-addr drop || nft=0
+			@th,96,4 == 12 \
+			@th,256,8 == 30 \
+			@th,264,8 == 12 \
+			@th,352,8 == 30 \
+			@th,368,4 == 4 \
+			drop || nft=0
 		pm_nl_del_endpoint $ns1 42 10.0.1.1
 		sleep 0.5
 		chk_subflow_nr "after delete ID 0" 2

---
base-commit: 9651c766735c19e7a6b90d731bab53ef7959def8
change-id: 20261008-mptcp_rm_addr-92ab7ff3d94d

Best regards,
-- 
Hangbin Liu <liuhangbin@kylinos.cn>

Re: [PATCH mptcp-next] selftests: mptcp: use offset to match RM_ADDR message

[MPTCP CI]

Hi Hangbin,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Perf: Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/37761573416

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/8bb8b9b41840
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1181526


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)

Re: [PATCH mptcp-next] selftests: mptcp: use offset to match RM_ADDR message

[Matthieu Baerts]

Hi Hangbin,

Thank you for the follow-up!

On 08/10/2026 12:06, Hangbin Liu wrote:
> From: Hangbin Liu <liuhangbin@kylinos.cn>
> 
> nft cannot match RM_ADDR when it is the second MPTCP option,

Do you mind adding a short explanation why or just a ref to:

 https://lore.kernel.org/a391d81c-0bce-41e6-886e-a558765c6891@kernel.org

Also, could you title this patch:

  Squash to "selftests: mptcp: convert iptables to nftables for
  mptcp_join.sh"

And mention what should be added to the original commit message, please?

> so we rely on hard-coded offsets. A tcpdump capture of the RM_ADDR
> message looks like:
> 
>   [TCP header: 20 bytes] [nop] [nop] [timestamp: 10 bytes] \
>         [MPTCP DSS: 12 bytes] [MPTCP RM_ADDR: 4 bytes]
> 
> We verify: TCP Data Offset (TCP[12] × 8) equals 48 bytes (12 x 4),
> DSS length (TCP[33] x 8) is 12 bytes, and RM_ADDR subtype (TCP[46] × 8)
> is 4. This matches the old cBPF check, which calculated offsets starting
> from the IP header:
> 
> (ip[32] & 0xf0) == 0xc0 && ip[53] == 0x0c && (ip[66] & 0xf0) == 0x40
> 
> Also add MPTCP kind (30) checks for the DSS (TCP[32] x 8) and RM_ADDR
> (TCP[44] x 8) options.

Good idea.

> 
> Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
> ---
>  tools/testing/selftests/net/mptcp/mptcp_join.sh | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
> 
> diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> index b16e24418e73..194b80277ae2 100755
> --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
> +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> @@ -4375,7 +4375,12 @@ endpoint_tests()
>  		local nft=1
>  		ip netns exec "${ns2}" nft insert rule ip filter OUTPUT \
>  			ip saddr 10.0.1.2 meta l4proto tcp \
> -			tcp option mptcp subtype remove-addr drop || nft=0
> +			@th,96,4 == 12 \
> +			@th,256,8 == 30 \
> +			@th,264,8 == 12 \
> +			@th,352,8 == 30 \
> +			@th,368,4 == 4 \
> +			drop || nft=0
>  		local i
>  		for i in $(seq 3); do
>  			pm_nl_del_endpoint $ns2 1 10.0.1.2
> @@ -4454,7 +4459,12 @@ endpoint_tests()
>  		local nft=1
>  		ip netns exec "${ns1}" nft insert rule ip filter OUTPUT \
>  			ip saddr 10.0.1.1 meta l4proto tcp \
> -			tcp option mptcp subtype remove-addr drop || nft=0
> +			@th,96,4 == 12 \
> +			@th,256,8 == 30 \
> +			@th,264,8 == 12 \
> +			@th,352,8 == 30 \
> +			@th,368,4 == 4 \

Do you mind just adding this sequence to a global variable (an array?),
similar to what was done before with the cBPF filter, with a short
comment, please?

That would be easier to understand here, and to avoid duplicated code.

> +			drop || nft=0
>  		pm_nl_del_endpoint $ns1 42 10.0.1.1
>  		sleep 0.5
>  		chk_subflow_nr "after delete ID 0" 2
> 
> ---
> base-commit: 9651c766735c19e7a6b90d731bab53ef7959def8
> change-id: 20261008-mptcp_rm_addr-92ab7ff3d94d
> 
> Best regards,

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH mptcp-next] selftests: mptcp: use offset to match RM_ADDR message

[hangbin.liu]

Hi Matthieu,

October 8, 2026 at 7:46 PM, "Matthieu Baerts" <matttbe@kernel.org> wrote:
> 
> Hi Hangbin,
> 
> Thank you for the follow-up!
> 
> On 08/10/2026 12:06, Hangbin Liu wrote:
> 
> > 
> > From: Hangbin Liu <liuhangbin@kylinos.cn>
> >  
> >  nft cannot match RM_ADDR when it is the second MPTCP option,
> > 
> Do you mind adding a short explanation why or just a ref to:
> 
>  https://lore.kernel.org/a391d81c-0bce-41e6-886e-a558765c6891@kernel.org

OK, I will.

> 
> Also, could you title this patch:
> 
>  Squash to "selftests: mptcp: convert iptables to nftables for
>  mptcp_join.sh"
> 
> And mention what should be added to the original commit message, please?

OK, no problem.

> 
> > 
> > so we rely on hard-coded offsets. A tcpdump capture of the RM_ADDR
> >  message looks like:
> >  
> >  [TCP header: 20 bytes] [nop] [nop] [timestamp: 10 bytes] \
> >  [MPTCP DSS: 12 bytes] [MPTCP RM_ADDR: 4 bytes]
> >  
> >  We verify: TCP Data Offset (TCP[12] × 8) equals 48 bytes (12 x 4),
> >  DSS length (TCP[33] x 8) is 12 bytes, and RM_ADDR subtype (TCP[46] × 8)
> >  is 4. This matches the old cBPF check, which calculated offsets starting
> >  from the IP header:
> >  
> >  (ip[32] & 0xf0) == 0xc0 && ip[53] == 0x0c && (ip[66] & 0xf0) == 0x40
> >  
> >  Also add MPTCP kind (30) checks for the DSS (TCP[32] x 8) and RM_ADDR
> >  (TCP[44] x 8) options.
> > 
> Good idea.
> 
> > 
> > Signed-off-by: Hangbin Liu <liuhangbin@kylinos.cn>
> >  ---
> >  tools/testing/selftests/net/mptcp/mptcp_join.sh | 14 ++++++++++++--
> >  1 file changed, 12 insertions(+), 2 deletions(-)
> >  
> >  diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> >  index b16e24418e73..194b80277ae2 100755
> >  --- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
> >  +++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
> >  @@ -4375,7 +4375,12 @@ endpoint_tests()
> >  local nft=1
> >  ip netns exec "${ns2}" nft insert rule ip filter OUTPUT \
> >  ip saddr 10.0.1.2 meta l4proto tcp \
> >  - tcp option mptcp subtype remove-addr drop || nft=0
> >  + @th,96,4 == 12 \
> >  + @th,256,8 == 30 \
> >  + @th,264,8 == 12 \
> >  + @th,352,8 == 30 \
> >  + @th,368,4 == 4 \
> >  + drop || nft=0
> >  local i
> >  for i in $(seq 3); do
> >  pm_nl_del_endpoint $ns2 1 10.0.1.2
> >  @@ -4454,7 +4459,12 @@ endpoint_tests()
> >  local nft=1
> >  ip netns exec "${ns1}" nft insert rule ip filter OUTPUT \
> >  ip saddr 10.0.1.1 meta l4proto tcp \
> >  - tcp option mptcp subtype remove-addr drop || nft=0
> >  + @th,96,4 == 12 \
> >  + @th,256,8 == 30 \
> >  + @th,264,8 == 12 \
> >  + @th,352,8 == 30 \
> >  + @th,368,4 == 4 \
> > 
> Do you mind just adding this sequence to a global variable (an array?),
> similar to what was done before with the cBPF filter, with a short
> comment, please?
> 
> That would be easier to understand here, and to avoid duplicated code.

Yes, I will.

BTW, For mptcp_sockopt.sh,

    # just to debug: check we have multiple subflows connection requests
    add rule $table filter OUTPUT \
        tcp flags & (fin | syn | rst | ack) == syn \
        meta mark $m accept

do you think if there is a need to add counter or remove this rule?

Thanks
Hangbin

Re: [PATCH mptcp-next] selftests: mptcp: use offset to match RM_ADDR message

[Matthieu Baerts]

On 08/10/2026 15:40, hangbin.liu@linux.dev wrote:

(...)

> BTW, For mptcp_sockopt.sh,
> 
>     # just to debug: check we have multiple subflows connection requests
>     add rule $table filter OUTPUT \
>         tcp flags & (fin | syn | rst | ack) == syn \
>         meta mark $m accept
> 
> do you think if there is a need to add counter or remove this rule?

Easier to remove it. It can be easily added when debugging.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.