Re: [PATCH mptcp-net 2/7] mptcp: pm: userspace: respect deny_join_id0 attr

[Mat Martineau <martineau@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 2232 bytes --]

On Fri, 29 Aug 2025, Christoph Paasch wrote:

> On Fri, Aug 29, 2025 at 1:33 PM Matthieu Baerts (NGI0)
> <matttbe@kernel.org> wrote:
>>
>> During the connection establishment, a peer can tell the other that it
>> cannot establish new subflows to the initial IP address and port by
>> setting the 'C' flag [1]. The RFC8684 is strict about that:
>>
>>   (...) therefore the receiver MUST NOT try to open any additional
>>   subflows toward this address and port.
>>
>> It is then important not to let the userspace PM establishing such
>> subflows, and return an error (ECONNREFUSED) if it tries to do so.
>>
>> Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment")
>> Link: https://datatracker.ietf.org/doc/html/rfc8684\#section-3.1-20.6 [1]
>> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
>> ---
>>  net/mptcp/pm_userspace.c | 6 ++++++
>>  1 file changed, 6 insertions(+)
>>
>> diff --git a/net/mptcp/pm_userspace.c b/net/mptcp/pm_userspace.c
>> index 1911fe1799fa38a53381247a830a9a0daf1c4492..9968dc9a8b45112114953f66848ea22c971136d6 100644
>> --- a/net/mptcp/pm_userspace.c
>> +++ b/net/mptcp/pm_userspace.c
>> @@ -391,6 +391,12 @@ int mptcp_pm_nl_subflow_create_doit(struct sk_buff *skb, struct genl_info *info)
>>         if (err < 0)
>>                 goto create_err;
>>
>> +       if (READ_ONCE(msk->pm.remote_deny_join_id0) && addr_r.id == 0) {
>
> If userspace wants to, it could still work around that by still using
> the initial subflow's IP-address and just use a non-zero address-ID.
>
> Is that really a concern ? Sure, the IETF-draft says "MUST NOT", and
> so, shouldn't we leave it up to the userspace PM to make that decision
> ?
>

I concur with Christoph on this one, I think the PM (userspace or kernel) 
is responsible for this aspect of the protocol so it doesn't need to be 
double-checked here.

- Mat

>
>> +               GENL_SET_ERR_MSG(info, "deny join id0");
>> +               err = -ECONNREFUSED;
>> +               goto create_err;
>> +       }
>> +
>>         if (!mptcp_pm_addr_families_match(sk, &entry.addr, &addr_r)) {
>>                 GENL_SET_ERR_MSG(info, "families mismatch");
>>                 err = -EINVAL;
>>
>> --
>> 2.50.1
>>
>>
>
>