Re: [PATCH mptcp-next 0/2] mptcp: MIB counter for invalid option

Hi Gang,

On 12/08/2026 12:05, Gang Yan wrote:
> From: Gang Yan <[email protected]>
> 
> This series is designed for [1].
> 
> Patch 1 passes the 'net' to options parser, I used to use
> dev_net(skb->dev) for MIB counters, but the AI reported it is not
> suitable for this. This patch has no functional change.
> 
> Patch 2 adds the InvalidOptionRx counter, and increments it when
> receive the invalid options.
> 
> The packetdill testcase is submitted, and can be reviewed in [2].
> 
> [1] https://github.com/multipath-tcp/mptcp_net-next/issues/628
Thank you for the patches. Please next time add a comment on the GitHub
ticket: I already have the patches ready, but I had to wait (for
administration purposes) before sending them:

============

commit 8173df5a467cac6ed421bb832ac3ee675b490fa6 (b4/mptcp-mib-inval-opt)
Author: Matthieu Baerts (NGI0) <[email protected]>
Date:   Fri Jul 31 14:10:38 2026 +0200

    mptcp: options: reset parsing in case of invalidity

    When an invalid option is detected -- any unexpected suboptions
    combinations or use of invalid sizes -- the current behaviour is to
    ignore the currently parsed option.

    Receiving such invalid options is suspicious: either this is coming from
    a buggy host, or an attacker. In this case, it seems safer to drop any
    previously parsed MPTCP option from such packet.

    Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>

commit be5492962195d2988a9c508bc8ce4d3f55ac1da7
Author: Matthieu Baerts (NGI0) <[email protected]>
Date:   Wed Jul 29 20:01:45 2026 +0200

    mptcp: options: track invalid ones

    Any unexpected suboptions combinations or use of invalid sizes are
    suspicious: either it is coming from a buggy host, or an attacker.

    Better to track that with a new MIB counter.

    Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>

commit 684c6244b5b76d30aaf30d62597247485b89cdb3
Author: Matthieu Baerts (NGI0) <[email protected]>
Date:   Mon Aug 3 20:24:02 2026 +0200

    mptcp: options: use a dedicated bit for csum reqd

    Instead of mixing that with suboptions: that's the only non-suboptions
    that is present in the 'suboptions' field.

    This even cause a workaround with OPTIONS_MPTCP_DSS to exclude this
    non-suboptions when checking which other ones are set.

    Move it to a dedicated free bit, and adapt the corresponding code.

    This is clearer like that.

    Signed-off-by: Matthieu Baerts (NGI0) <[email protected]>

=========

In your version, I see that you increment the counter even when the
suboption is not invalid, e.g. the version or the hmac is not supported.
I don't think we should do that.

If that's OK for you, I can add a co-dev by on my patches.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.