Re: [RFC mptcp-next v4 08/10] mptcp: enable TLS setsockopt

GangYan
2025-12-12T07:24:12Z

Hi, Geliang:
> On Fri, Dec 12, 2025 at 10:27:18AM +0800, Geliang Tang wrote:
> From: Geliang Tang <tanggeliang@kylinos.cn>
>
> This patch adds MPTCP TLS setsockopt support. It allows setting the TCP_ULP
> option to 'tls' exclusively, and enables configuration of the TLS_TX and
> TLS_RX options at the SOL_TLS level.
>
> This option cannot be set when the socket is in CLOSE or LISTEN state.
>
> Co-developed-by: Gang Yan <yangang@kylinos.cn>
> Signed-off-by: Gang Yan <yangang@kylinos.cn>
> Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
> ---
> net/mptcp/sockopt.c | 18 +++++++++++++++++-
> 1 file changed, 17 insertions(+), 1 deletion(-)
>
> diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c
> index f3db4f2e8f81..52ff75702404 100644
> --- a/net/mptcp/sockopt.c
> +++ b/net/mptcp/sockopt.c
> @@ -12,6 +12,7 @@
> #include <net/protocol.h>
> #include <net/tcp.h>
> #include <net/mptcp.h>
> +#include <net/tls.h>
> #include "protocol.h"
>
> #define MIN_INFO_OPTLEN_SIZE 16
> @@ -567,6 +568,7 @@ static bool mptcp_supported_sockopt(int level, int optname)
> case TCP_FASTOPEN_CONNECT:
> case TCP_FASTOPEN_KEY:
> case TCP_FASTOPEN_NO_COOKIE:
> + case TCP_ULP:
> return true;
> }
>
> @@ -576,6 +578,13 @@ static bool mptcp_supported_sockopt(int level, int optname)
> * TCP_REPAIR_WINDOW are not supported, better avoid this mess
> */
> }
> + if (level == SOL_TLS) {
> + switch (optname) {
> + case TLS_TX:
> + case TLS_RX:
> + return true;
> + }
> + }
> return false;
> }
>
> @@ -819,11 +828,18 @@ static int mptcp_setsockopt_sol_tcp(struct mptcp_sock *msk, int optname,
> sockptr_t optval, unsigned int optlen)
> {
> struct sock *sk = (void *)msk;
> + char ulp[4] = "";
> int ret, val;
>
> switch (optname) {
> case TCP_ULP:
> - return -EOPNOTSUPP;
> + if (copy_from_user(ulp, optval.user, 4))
> + return -EFAULT;
> + if (strcmp(ulp, "tls\0"))
> + return -EOPNOTSUPP;
> + if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))
> + return -EINVAL;
Here should return -ENOTCONN

I'm running the tls selftest(tools/testing/selftest/net/tls.c), and the
'-EINVAL' will cause an error in 'non_established' test, it checks the
errno should be 'ENOTCONN'.

If we don't return here is also OK, because the
'tcp_setsockopt' can return too, but I think a state validation at the
MPTCP layer is necessary, and 'ENOTCONN' is more accurate for
'TCPF_CLOSE | TCPF_LISTEN'.

WDYT

Thanks
Gang
> + return tcp_setsockopt(sk, SOL_TCP, optname, optval, optlen);
> case TCP_CONGESTION:
> return mptcp_setsockopt_sol_tcp_congestion(msk, optval, optlen);
> case TCP_DEFER_ACCEPT:
> --
> 2.51.0
>
>