[PATCH net 0/2] mptcp: blackhole only if 1st SYN retrans w/o MPC is accepted

[PATCH net 0/2] mptcp: blackhole only if 1st SYN retrans w/o MPC is accepted

[Matthieu Baerts (NGI0)]

Here are two small fixes for issues introduced in v6.12.

- Patch 1: reset the mpc_drop mark for other SYN retransmits, to only
  consider an MPTCP blackhole when the first SYN retransmitted without
  the MPTCP options is accepted, as initially intended.

- Patch 2: also mention in the doc that the blackhole_timeout sysctl
  knob is per-netns, like all the others.

Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
Notes:
- The Cc stable tag has only been added to the first patch, I don't
  think it is usually added on fixes related to the doc, right?
- A Fixes tag is present in both patches: I hope that's also OK for the
  one modifying the doc. It can be removed if preferred.

---
Matthieu Baerts (NGI0) (2):
      mptcp: blackhole only if 1st SYN retrans w/o MPC is accepted
      doc: mptcp: sysctl: blackhole_timeout is per-netns

 Documentation/networking/mptcp-sysctl.rst | 2 +-
 net/mptcp/ctrl.c                          | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)
---
base-commit: 9e6c4e6b605c1fa3e24f74ee0b641e95f090188a
change-id: 20250128-net-mptcp-blackhole-fix-363f098fe726

Best regards,
-- 
Matthieu Baerts (NGI0) <matttbe@kernel.org>

[PATCH net 1/2] mptcp: blackhole only if 1st SYN retrans w/o MPC is accepted

[Matthieu Baerts (NGI0)]

The Fixes commit mentioned this:

> An MPTCP firewall blackhole can be detected if the following SYN
> retransmission after a fallback to "plain" TCP is accepted.

But in fact, this blackhole was detected if any following SYN
retransmissions after a fallback to TCP was accepted.

That's because 'mptcp_subflow_early_fallback()' will set 'request_mptcp'
to 0, and 'mpc_drop' will never be reset to 0 after.

This is an issue, because some not so unusual situations might cause the
kernel to detect a false-positive blackhole, e.g. a client trying to
connect to a server while the network is not ready yet, causing a few
SYN retransmissions, before reaching the end server.

Fixes: 27069e7cb3d1 ("mptcp: disable active MPTCP in case of blackhole")
Cc: stable@vger.kernel.org
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
 net/mptcp/ctrl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c
index 3999e0ba2c35b50c36ce32277e0b8bfb24197946..2dd81e6c26bdb5220abed68e26d70d2dc3ab14fb 100644
--- a/net/mptcp/ctrl.c
+++ b/net/mptcp/ctrl.c
@@ -418,9 +418,9 @@ void mptcp_active_detect_blackhole(struct sock *ssk, bool expired)
 			MPTCP_INC_STATS(net, MPTCP_MIB_MPCAPABLEACTIVEDROP);
 			subflow->mpc_drop = 1;
 			mptcp_subflow_early_fallback(mptcp_sk(subflow->conn), subflow);
-		} else {
-			subflow->mpc_drop = 0;
 		}
+	} else if (ssk->sk_state == TCP_SYN_SENT) {
+		subflow->mpc_drop = 0;
 	}
 }
 

-- 
2.47.1

[PATCH net 2/2] doc: mptcp: sysctl: blackhole_timeout is per-netns

[Matthieu Baerts (NGI0)]

All other sysctl entries mention it, and it is a per-namespace sysctl.

So mention it as well.

Fixes: 27069e7cb3d1 ("mptcp: disable active MPTCP in case of blackhole")
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
 Documentation/networking/mptcp-sysctl.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Documentation/networking/mptcp-sysctl.rst b/Documentation/networking/mptcp-sysctl.rst
index dc45c02113537b98dff76a6ed431c0449b5217f8..03e1d3610333e29423b0f40591c9e914dc2d0366 100644
--- a/Documentation/networking/mptcp-sysctl.rst
+++ b/Documentation/networking/mptcp-sysctl.rst
@@ -41,7 +41,7 @@ blackhole_timeout - INTEGER (seconds)
 	MPTCP is re-enabled and will reset to the initial value when the
 	blackhole issue goes away.
 
-	0 to disable the blackhole detection.
+	0 to disable the blackhole detection. This is a per-namespace sysctl.
 
 	Default: 3600
 

-- 
2.47.1

Re: [PATCH net 0/2] mptcp: blackhole only if 1st SYN retrans w/o MPC is accepted

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Wed, 29 Jan 2025 13:24:31 +0100 you wrote:
> Here are two small fixes for issues introduced in v6.12.
> 
> - Patch 1: reset the mpc_drop mark for other SYN retransmits, to only
>   consider an MPTCP blackhole when the first SYN retransmitted without
>   the MPTCP options is accepted, as initially intended.
> 
> - Patch 2: also mention in the doc that the blackhole_timeout sysctl
>   knob is per-netns, like all the others.
> 
> [...]

Here is the summary with links:
  - [net,1/2] mptcp: blackhole only if 1st SYN retrans w/o MPC is accepted
    https://git.kernel.org/netdev/net/c/e598d8981fd3
  - [net,2/2] doc: mptcp: sysctl: blackhole_timeout is per-netns
    https://git.kernel.org/netdev/net/c/18da4b5d1232

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html