[PATCH] mptcp: add per-reason MIB counters for MPTCP_RST_EMPTCP resets

[PATCH] mptcp: add per-reason MIB counters for MPTCP_RST_EMPTCP resets

[Shardul Bankar]

MPTCP_RST_EMPTCP (reset reason 1) is used as a catch-all for seven
distinct error conditions across subflow setup, authentication, and
data path validation.  The existing MPRstTx/MPRstRx counters only
track aggregate reset volume, making it difficult to diagnose which
code path is triggering subflow resets in production.

Add per-reason MIB counters for each MPTCP_RST_EMPTCP use site:

  MPRstMD5SIG         - MD5SIG on listener, incompatible with MPTCP
  MPRstNoToken        - JOIN token lookup failed, no matching conn
  MPRstNoMPJ          - SYN/ACK missing MP_JOIN option
  MPRstHMAC           - HMAC validation failed during subflow join
  MPRstFatalFallback  - fatal fallback during child socket creation
  MPRstBadMap         - invalid data mapping on established subflow
  MPRstNotEstablished - JOIN on not-fully-established msk

These counters are incremented alongside the existing reset_reason
assignment and are visible via nstat as MPTcpExtMPRst*.  The
aggregate MPRstTx/MPRstRx counters remain unchanged.

Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/511
Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
---
 net/mptcp/mib.c      |  7 +++++++
 net/mptcp/mib.h      |  7 +++++++
 net/mptcp/protocol.c |  1 +
 net/mptcp/subflow.c  | 14 +++++++++++---
 4 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/net/mptcp/mib.c b/net/mptcp/mib.c
index f23fda0c55a7..ec42583c59cf 100644
--- a/net/mptcp/mib.c
+++ b/net/mptcp/mib.c
@@ -71,6 +71,13 @@ static const struct snmp_mib mptcp_snmp_list[] = {
 	SNMP_MIB_ITEM("MPFastcloseRx", MPTCP_MIB_MPFASTCLOSERX),
 	SNMP_MIB_ITEM("MPRstTx", MPTCP_MIB_MPRSTTX),
 	SNMP_MIB_ITEM("MPRstRx", MPTCP_MIB_MPRSTRX),
+	SNMP_MIB_ITEM("MPRstMD5SIG", MPTCP_MIB_MPRSTMD5SIG),
+	SNMP_MIB_ITEM("MPRstNoToken", MPTCP_MIB_MPRSTNOTOKEN),
+	SNMP_MIB_ITEM("MPRstNoMPJ", MPTCP_MIB_MPRSTNOMPJ),
+	SNMP_MIB_ITEM("MPRstHMAC", MPTCP_MIB_MPRSTHMAC),
+	SNMP_MIB_ITEM("MPRstFatalFallback", MPTCP_MIB_MPRSTFATALFALLBACK),
+	SNMP_MIB_ITEM("MPRstBadMap", MPTCP_MIB_MPRSTBADMAP),
+	SNMP_MIB_ITEM("MPRstNotEstablished", MPTCP_MIB_MPRSTNOTESTABLISHED),
 	SNMP_MIB_ITEM("SubflowStale", MPTCP_MIB_SUBFLOWSTALE),
 	SNMP_MIB_ITEM("SubflowRecover", MPTCP_MIB_SUBFLOWRECOVER),
 	SNMP_MIB_ITEM("SndWndShared", MPTCP_MIB_SNDWNDSHARED),
diff --git a/net/mptcp/mib.h b/net/mptcp/mib.h
index 812218b5ed2b..0ac109b52d35 100644
--- a/net/mptcp/mib.h
+++ b/net/mptcp/mib.h
@@ -70,6 +70,13 @@ enum linux_mptcp_mib_field {
 	MPTCP_MIB_MPFASTCLOSERX,	/* Received a MP_FASTCLOSE */
 	MPTCP_MIB_MPRSTTX,		/* Transmit a MP_RST */
 	MPTCP_MIB_MPRSTRX,		/* Received a MP_RST */
+	MPTCP_MIB_MPRSTMD5SIG,		/* MP_RST: MD5SIG enabled on listener */
+	MPTCP_MIB_MPRSTNOTOKEN,		/* MP_RST: JOIN token not found */
+	MPTCP_MIB_MPRSTNOMPJ,		/* MP_RST: missing MPJ in SYN/ACK */
+	MPTCP_MIB_MPRSTHMAC,		/* MP_RST: HMAC validation failed */
+	MPTCP_MIB_MPRSTFATALFALLBACK,	/* MP_RST: fatal fallback on child */
+	MPTCP_MIB_MPRSTBADMAP,		/* MP_RST: bad data mapping */
+	MPTCP_MIB_MPRSTNOTESTABLISHED,	/* MP_RST: JOIN on not-established msk */
 	MPTCP_MIB_SUBFLOWSTALE,		/* Subflows entered 'stale' status */
 	MPTCP_MIB_SUBFLOWRECOVER,	/* Subflows returned to active status after being stale */
 	MPTCP_MIB_SNDWNDSHARED,		/* Subflow snd wnd is overridden by msk's one */
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 17b9a8c13ebf..b06cbcf983f4 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -3836,6 +3836,7 @@ bool mptcp_finish_join(struct sock *ssk)
 
 	/* mptcp socket already closing? */
 	if (!mptcp_is_fully_established(parent)) {
+		MPTCP_INC_STATS(sock_net(parent), MPTCP_MIB_MPRSTNOTESTABLISHED);
 		subflow->reset_reason = MPTCP_RST_EMPTCP;
 		return false;
 	}
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index e2cb9d23e4a0..71bffcda0138 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -160,6 +160,7 @@ static int subflow_check_req(struct request_sock *req,
 	 * TCP option space.
 	 */
 	if (rcu_access_pointer(tcp_sk(sk_listener)->md5sig_info)) {
+		MPTCP_INC_STATS(sock_net(sk_listener), MPTCP_MIB_MPRSTMD5SIG);
 		subflow_add_reset_reason(skb, MPTCP_RST_EMPTCP);
 		return -EINVAL;
 	}
@@ -227,6 +228,7 @@ static int subflow_check_req(struct request_sock *req,
 
 		/* Can't fall back to TCP in this case. */
 		if (!subflow_req->msk) {
+			MPTCP_INC_STATS(sock_net(sk_listener), MPTCP_MIB_MPRSTNOTOKEN);
 			subflow_add_reset_reason(skb, MPTCP_RST_EMPTCP);
 			return -EPERM;
 		}
@@ -568,6 +570,7 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb)
 		u8 hmac[SHA256_DIGEST_SIZE];
 
 		if (!(mp_opt.suboptions & OPTION_MPTCP_MPJ_SYNACK)) {
+			MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPRSTNOMPJ);
 			subflow->reset_reason = MPTCP_RST_EMPTCP;
 			goto do_reset;
 		}
@@ -582,6 +585,7 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb)
 
 		if (!subflow_thmac_valid(subflow)) {
 			MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_JOINACKMAC);
+			MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPRSTHMAC);
 			subflow->reset_reason = MPTCP_RST_EMPTCP;
 			goto do_reset;
 		}
@@ -870,6 +874,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
 		 */
 		if (!ctx || fallback) {
 			if (fallback_is_fatal) {
+				MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPRSTFATALFALLBACK);
 				subflow_add_reset_reason(skb, MPTCP_RST_EMPTCP);
 				goto dispose_child;
 			}
@@ -1421,9 +1426,12 @@ static bool subflow_check_data_avail(struct sock *ssk)
 			 * subflow_error_report() will introduce the appropriate barriers
 			 */
 			subflow->reset_transient = 0;
-			subflow->reset_reason = status == MAPPING_NODSS ?
-						MPTCP_RST_EMIDDLEBOX :
-						MPTCP_RST_EMPTCP;
+			if (status == MAPPING_NODSS) {
+				subflow->reset_reason = MPTCP_RST_EMIDDLEBOX;
+			} else {
+				MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_MPRSTBADMAP);
+				subflow->reset_reason = MPTCP_RST_EMPTCP;
+			}
 
 reset:
 			WRITE_ONCE(ssk->sk_err, EBADMSG);
-- 
2.34.1

Re: [PATCH] mptcp: add per-reason MIB counters for MPTCP_RST_EMPTCP resets

[Matthieu Baerts]

Hi Shardul,

On 21/04/2026 11:56, Shardul Bankar wrote:
> MPTCP_RST_EMPTCP (reset reason 1) is used as a catch-all for seven
> distinct error conditions across subflow setup, authentication, and
> data path validation.  The existing MPRstTx/MPRstRx counters only
> track aggregate reset volume, making it difficult to diagnose which
> code path is triggering subflow resets in production.
> 
> Add per-reason MIB counters for each MPTCP_RST_EMPTCP use site:
> 
>   MPRstMD5SIG         - MD5SIG on listener, incompatible with MPTCP
>   MPRstNoToken        - JOIN token lookup failed, no matching conn
>   MPRstNoMPJ          - SYN/ACK missing MP_JOIN option
>   MPRstHMAC           - HMAC validation failed during subflow join
>   MPRstFatalFallback  - fatal fallback during child socket creation
>   MPRstBadMap         - invalid data mapping on established subflow
>   MPRstNotEstablished - JOIN on not-fully-established msk
> 
> These counters are incremented alongside the existing reset_reason
> assignment and are visible via nstat as MPTcpExtMPRst*.  The
> aggregate MPRstTx/MPRstRx counters remain unchanged.
Thank you for this patch.

Even if the patch looks globally good, net-next is currently closed, and
only bug fixes are accepted, see:

https://docs.kernel.org/process/maintainer-netdev.html

pw-bot: defer

Instead, I suggest switching the discussions only on the MPTCP ML: I
will try to review this patch and only send a reply to you and the MPTCP
list, if that's OK.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

Re: [PATCH] mptcp: add per-reason MIB counters for MPTCP_RST_EMPTCP resets

[Shardul Bankar]

On Tue, 2026-04-21 at 12:14 +0200, Matthieu Baerts wrote:
> Hi Shardul,
> 
> 
> Even if the patch looks globally good, net-next is currently closed,
> and
> only bug fixes are accepted, see:
> 
> https://docs.kernel.org/process/maintainer-netdev.html
> 
> pw-bot: defer
> 
> Instead, I suggest switching the discussions only on the MPTCP ML: I
> will try to review this patch and only send a reply to you and the
> MPTCP
> list, if that's OK.
> 
> Cheers,
> Matt

Hi Matt,

Thanks for looking at this. Happy to continue on the MPTCP list.

Thanks,
Shardul