Re: [RFC mptcp-next v4 08/10] mptcp: enable TLS setsockopt

[GangYan <gang.yan@linux.dev>]

Hi, Geliang:
> On Fri, Dec 12, 2025 at 10:27:18AM +0800, Geliang Tang wrote:
> From: Geliang Tang <tanggeliang@kylinos.cn>
> 
> This patch adds MPTCP TLS setsockopt support. It allows setting the TCP_ULP
> option to 'tls' exclusively, and enables configuration of the TLS_TX and
> TLS_RX options at the SOL_TLS level.
> 
> This option cannot be set when the socket is in CLOSE or LISTEN state.
> 
> Co-developed-by: Gang Yan <yangang@kylinos.cn>
> Signed-off-by: Gang Yan <yangang@kylinos.cn>
> Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
> ---
>  net/mptcp/sockopt.c | 18 +++++++++++++++++-
>  1 file changed, 17 insertions(+), 1 deletion(-)
> 
> diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c
> index f3db4f2e8f81..52ff75702404 100644
> --- a/net/mptcp/sockopt.c
> +++ b/net/mptcp/sockopt.c
> @@ -12,6 +12,7 @@
>  #include <net/protocol.h>
>  #include <net/tcp.h>
>  #include <net/mptcp.h>
> +#include <net/tls.h>
>  #include "protocol.h"
>  
>  #define MIN_INFO_OPTLEN_SIZE		16
> @@ -567,6 +568,7 @@ static bool mptcp_supported_sockopt(int level, int optname)
>  		case TCP_FASTOPEN_CONNECT:
>  		case TCP_FASTOPEN_KEY:
>  		case TCP_FASTOPEN_NO_COOKIE:
> +		case TCP_ULP:
>  			return true;
>  		}
>  
> @@ -576,6 +578,13 @@ static bool mptcp_supported_sockopt(int level, int optname)
>  		 * TCP_REPAIR_WINDOW are not supported, better avoid this mess
>  		 */
>  	}
> +	if (level == SOL_TLS) {
> +		switch (optname) {
> +		case TLS_TX:
> +		case TLS_RX:
> +			return true;
> +		}
> +	}
>  	return false;
>  }
>  
> @@ -819,11 +828,18 @@ static int mptcp_setsockopt_sol_tcp(struct mptcp_sock *msk, int optname,
>  				    sockptr_t optval, unsigned int optlen)
>  {
>  	struct sock *sk = (void *)msk;
> +	char ulp[4] = "";
>  	int ret, val;
>  
>  	switch (optname) {
>  	case TCP_ULP:
> -		return -EOPNOTSUPP;
> +		if (copy_from_user(ulp, optval.user, 4))
> +			return -EFAULT;
> +		if (strcmp(ulp, "tls\0"))
> +			return -EOPNOTSUPP;
> +		if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))
> +			return -EINVAL;
Here should return -ENOTCONN

I'm running the tls selftest(tools/testing/selftest/net/tls.c), and the
'-EINVAL' will cause an error in 'non_established' test, it checks the
errno should be 'ENOTCONN'.

If we don't return here is also OK, because the
'tcp_setsockopt' can return too, but I think a state validation at the
MPTCP layer is necessary, and 'ENOTCONN' is more accurate for
'TCPF_CLOSE | TCPF_LISTEN'.

WDYT

Thanks
Gang
> +		return tcp_setsockopt(sk, SOL_TCP, optname, optval, optlen);
>  	case TCP_CONGESTION:
>  		return mptcp_setsockopt_sol_tcp_congestion(msk, optval, optlen);
>  	case TCP_DEFER_ACCEPT:
> -- 
> 2.51.0
> 
>