Re: [RFC mptcp-next v4 08/10] mptcp: enable TLS setsockopt

Geliang Tang
2025-12-12T08:29:27Z

On Fri, 2025-12-12 at 15:23 +0800, GangYan wrote:
> Hi, Geliang:
> > On Fri, Dec 12, 2025 at 10:27:18AM +0800, Geliang Tang wrote:
> > From: Geliang Tang <tanggeliang@kylinos.cn>
> >
> > This patch adds MPTCP TLS setsockopt support. It allows setting the
> > TCP_ULP
> > option to 'tls' exclusively, and enables configuration of the
> > TLS_TX and
> > TLS_RX options at the SOL_TLS level.
> >
> > This option cannot be set when the socket is in CLOSE or LISTEN
> > state.
> >
> > Co-developed-by: Gang Yan <yangang@kylinos.cn>
> > Signed-off-by: Gang Yan <yangang@kylinos.cn>
> > Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
> > ---
> >  net/mptcp/sockopt.c | 18 +++++++++++++++++-
> >  1 file changed, 17 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c
> > index f3db4f2e8f81..52ff75702404 100644
> > --- a/net/mptcp/sockopt.c
> > +++ b/net/mptcp/sockopt.c
> > @@ -12,6 +12,7 @@
> >  #include <net/protocol.h>
> >  #include <net/tcp.h>
> >  #include <net/mptcp.h>
> > +#include <net/tls.h>
> >  #include "protocol.h"
> >
> >  #define MIN_INFO_OPTLEN_SIZE 16
> > @@ -567,6 +568,7 @@ static bool mptcp_supported_sockopt(int level,
> > int optname)
> >   case TCP_FASTOPEN_CONNECT:
> >   case TCP_FASTOPEN_KEY:
> >   case TCP_FASTOPEN_NO_COOKIE:
> > + case TCP_ULP:
> >   return true;
> >   }
> >
> > @@ -576,6 +578,13 @@ static bool mptcp_supported_sockopt(int level,
> > int optname)
> >   * TCP_REPAIR_WINDOW are not supported, better
> > avoid this mess
> >   */
> >   }
> > + if (level == SOL_TLS) {
> > + switch (optname) {
> > + case TLS_TX:
> > + case TLS_RX:
> > + return true;
> > + }
> > + }
> >   return false;
> >  }
> >
> > @@ -819,11 +828,18 @@ static int mptcp_setsockopt_sol_tcp(struct
> > mptcp_sock *msk, int optname,
> >       sockptr_t optval, unsigned int
> > optlen)
> >  {
> >   struct sock *sk = (void *)msk;
> > + char ulp[4] = "";
> >   int ret, val;
> >
> >   switch (optname) {
> >   case TCP_ULP:
> > - return -EOPNOTSUPP;
> > + if (copy_from_user(ulp, optval.user, 4))
> > + return -EFAULT;
> > + if (strcmp(ulp, "tls\0"))
> > + return -EOPNOTSUPP;
> > + if ((1 << sk->sk_state) & (TCPF_CLOSE |
> > TCPF_LISTEN))
> > + return -EINVAL;
> Here should return -ENOTCONN

Yes, you're right. I'll update it in v5.

Thanks,
-Geliang

>
> I'm running the tls selftest(tools/testing/selftest/net/tls.c), and
> the
> '-EINVAL' will cause an error in 'non_established' test, it checks
> the
> errno should be 'ENOTCONN'.
>
> If we don't return here is also OK, because the
> 'tcp_setsockopt' can return too, but I think a state validation at
> the
> MPTCP layer is necessary, and 'ENOTCONN' is more accurate for
> 'TCPF_CLOSE | TCPF_LISTEN'.
>
> WDYT
>
> Thanks
> Gang
> > + return tcp_setsockopt(sk, SOL_TCP, optname,
> > optval, optlen);
> >   case TCP_CONGESTION:
> >   return mptcp_setsockopt_sol_tcp_congestion(msk,
> > optval, optlen);
> >   case TCP_DEFER_ACCEPT:
> > --
> > 2.51.0
> >
> >