Re: [PATCH mptcp-next RFC 2/3] mptcp: reject MP_JOIN earlier

Hello,

On 14/08/2026 20:31, Matthieu Baerts (NGI0) wrote:
> When a SYN + MP_JOIN is received, it is good to check directly if the
> MP_JOIN is allowed, then checking that later at the establishment of the
> new subflow.
> 
> This avoids situations where the 3WHS is done, then the joined subflow
> is rejected.
> 
> This changes the behaviour, and the new behaviour is tracked with the
> MPJoinDisallow MIB counter.
> 
> TODO: adapt the selftests to be able to run on older kernels: if the new
> counter is not available, increment syn_ack and syn_rej instead.

(...)

> @@ -217,17 +228,19 @@ static int subflow_check_req(struct request_sock *req,
>  			SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_TOKENFALLBACKINIT);
>  
>  	} else if (opt_mp_join && listener->request_mptcp) {
> +		u8 reason;
> +
>  		subflow_req->ssn_offset = TCP_SKB_CB(skb)->seq;
>  		subflow_req->mp_join = 1;
>  		subflow_req->backup = mp_opt.backup;
>  		subflow_req->remote_id = mp_opt.join_id;
>  		subflow_req->token = mp_opt.token;
>  		subflow_req->remote_nonce = mp_opt.nonce;
> -		subflow_req->msk = subflow_token_join_request(req);
> +		subflow_req->msk = subflow_token_join_request(req, &reason);
>  
>  		/* Can't fall back to TCP in this case. */
>  		if (!subflow_req->msk) {
> -			subflow_add_reset_reason(skb, MPTCP_RST_EMPTCP);
> +			subflow_add_reset_reason(skb, reason);
>  			return -EPERM;
>  		}

Note: the call to mptcp_can_accept_new_subflow() here below, when
handling req->syncookies, is no longer needed as it is now done earlier
for all cases, in subflow_token_join_request().

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.