Commit 2293c574 authored by Matthieu Baerts (NGI0)'s avatar Matthieu Baerts (NGI0) Committed by Jakub Kicinski
Browse files

mptcp: pm: nl: announce deny-join-id0 flag 

During the connection establishment, a peer can tell the other one that
it cannot establish new subflows to the initial IP address and port by
setting the 'C' flag [1]. Doing so makes sense when the sender is behind
a strict NAT, operating behind a legacy Layer 4 load balancer, or using
anycast IP address for example.

When this 'C' flag is set, the path-managers must then not try to
establish new subflows to the other peer's initial IP address and port.
The in-kernel PM has access to this info, but the userspace PM didn't.

The RFC8684 [1] is strict about that:

  (...) therefore the receiver MUST NOT try to open any additional
  subflows toward this address and port.

So it is important to tell the userspace about that as it is responsible
for the respect of this flag.

When a new connection is created and established, the Netlink events
now contain the existing but not currently used 'flags' attribute. When
MPTCP_PM_EV_FLAG_DENY_JOIN_ID0 is set, it means no other subflows
to the initial IP address and port -- info that are also part of the
event -- can be established.

Link: https://datatracker.ietf.org/doc/html/rfc8684#section-3.1-20.6

 [1]
Fixes: 702c2f64 ("mptcp: netlink: allow userspace-driven subflow establishment")
Reported-by: default avatarMarek Majkowski <marek@cloudflare.com>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/532


Reviewed-by: default avatarMat Martineau <martineau@kernel.org>
Signed-off-by: default avatarMatthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20250912-net-mptcp-pm-uspace-deny_join_id0-v1-2-40171884ade8@kernel.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 96939cec

Documentation/netlink/specs/mptcp_pm.yaml

+2 −2
Original line number Diff line number Diff line
@@ -28,13 +28,13 @@ definitions: 
          traffic-patterns it can take a long time until the

          MPTCP_EVENT_ESTABLISHED is sent.

          Attributes: token, family, saddr4 | saddr6, daddr4 | daddr6, sport,

          dport, server-side.

          dport, server-side, [flags].

      -

        name: established

        doc: >-

          A MPTCP connection is established (can start new subflows).

          Attributes: token, family, saddr4 | saddr6, daddr4 | daddr6, sport,

          dport, server-side.

          dport, server-side, [flags].

      -

        name: closed

        doc: >-

include/uapi/linux/mptcp.h

+2 −0
Original line number Diff line number Diff line
@@ -31,6 +31,8 @@ 
#define MPTCP_INFO_FLAG_FALLBACK		_BITUL(0)

#define MPTCP_INFO_FLAG_REMOTE_KEY_RECEIVED	_BITUL(1)



#define MPTCP_PM_EV_FLAG_DENY_JOIN_ID0		_BITUL(0)



#define MPTCP_PM_ADDR_FLAG_SIGNAL                      (1 << 0)

#define MPTCP_PM_ADDR_FLAG_SUBFLOW                     (1 << 1)

#define MPTCP_PM_ADDR_FLAG_BACKUP                      (1 << 2)

include/uapi/linux/mptcp_pm.h

+2 −2
Original line number Diff line number Diff line
@@ -16,10 +16,10 @@ 
 *   good time to allocate memory and send ADD_ADDR if needed. Depending on the

 *   traffic-patterns it can take a long time until the MPTCP_EVENT_ESTABLISHED

 *   is sent. Attributes: token, family, saddr4 | saddr6, daddr4 | daddr6,

 *   sport, dport, server-side.

 *   sport, dport, server-side, [flags].

 * @MPTCP_EVENT_ESTABLISHED: A MPTCP connection is established (can start new

 *   subflows). Attributes: token, family, saddr4 | saddr6, daddr4 | daddr6,

 *   sport, dport, server-side.

 *   sport, dport, server-side, [flags].

 * @MPTCP_EVENT_CLOSED: A MPTCP connection has stopped. Attribute: token.

 * @MPTCP_EVENT_ANNOUNCED: A new address has been announced by the peer.

 *   Attributes: token, rem_id, family, daddr4 | daddr6 [, dport].

net/mptcp/pm_netlink.c

+7 −0
Original line number Diff line number Diff line
@@ -408,6 +408,7 @@ static int mptcp_event_created(struct sk_buff *skb, 
			       const struct sock *ssk)

{

	int err = nla_put_u32(skb, MPTCP_ATTR_TOKEN, READ_ONCE(msk->token));

	u16 flags = 0;



	if (err)

		return err;
@@ -415,6 +416,12 @@ static int mptcp_event_created(struct sk_buff *skb, 
	if (nla_put_u8(skb, MPTCP_ATTR_SERVER_SIDE, READ_ONCE(msk->pm.server_side)))

		return -EMSGSIZE;



	if (READ_ONCE(msk->pm.remote_deny_join_id0))

		flags |= MPTCP_PM_EV_FLAG_DENY_JOIN_ID0;



	if (flags && nla_put_u16(skb, MPTCP_ATTR_FLAGS, flags))

		return -EMSGSIZE;



	return mptcp_event_add_subflow(skb, ssk);

}