Comment by reissbaker
11 hours ago
This is not rare. Every TCP connection in Go by default enables MPTCP [1]. Simply running a Go program that uses TCP without explicitly disabling this behavior will cause the running kernel to be vulnerable.
1: https://groups.google.com/g/golang-announce/c/PCoQcdxoScw
the default on all of my RHEL is to have it disabled, I believe it's the same on Debian based
sysctl -a | grep net.mptcp.enabled net.mptcp.enabled = 0
and golang apps would just gracefully downgrade to non mptcp in that case.
But any sane configuration would have the MPTCP port blocked behind a firewall (unless you were intentionally using MPTCP).
> MPTCP port blocked
MPTCP doesn’t use any specific ports. It’s an OSI layer higher than that. It’s part of the TCP protocol itself. So if your firewall routes TCP traffic of a specific port (eg HTTP) already then it’ll route MPTCP along with it too.
MPTCP is a protocol extension that requires cooperation by both peers and all middleboxes. So, if there is a Layer 7 firewall, or DPI/SPI, or TLS termination on the path, and it's not inclined to preserve the MPTCP options, then MPTCP will be disabled.