From: Florian Westphal <fw@strlen.de>
To: Matthieu Baerts <matttbe@kernel.org>
Cc: Netfilter Devel <netfilter-devel@vger.kernel.org>,
Netfilter Coreteam <coreteam@netfilter.org>
Subject: Re: Netfilter: match "tcp option" with the same type present multiple times
Date: Mon, 28 Sep 2026 23:08:35 +0200 [thread overview]
Message-ID: <arrXOOODs-EeMnNC@strlen.de> (raw)
In-Reply-To: <cc29ad91-bb10-4b82-813b-2acea5dab3a7@kernel.org>
Matthieu Baerts <matttbe@kernel.org> wrote:
> Yes, or with a raw payload expression with NFTables.
If you expect identical layout every time, yes, that works too.
> Should there be a note somewhere in the doc about this limitation?
> Because it looks like it will never be possible to match such subtype.
Yes, not without extra code on the kernel side.
> There are other MPTCP suboptions that can be used with DSS, e.g. MP_PRIO
> and MP_FAIL. But also MP_RST that can be used with FAST_CLOSE.
Right. I did not consider that this stops at first mptcp option
encountered.
> > passes here.
> > Even tried adding 'tcp option timestamp exists...' to the test, also
> > passes.
>
> Arf, my bad, I still had debugging code, sorry... :/
Phew :-)
next prev parent reply other threads:[~2026-09-28 21:08 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-28 12:13 Netfilter: match "tcp option" with the same type present multiple times Matthieu Baerts
2026-09-28 13:13 ` Florian Westphal
2026-09-28 20:26 ` Matthieu Baerts
2026-09-28 21:08 ` Florian Westphal [this message]
2026-09-28 20:56 ` Fernando Fernandez Mancera
2026-09-28 21:22 ` Florian Westphal
2026-09-28 21:23 ` Fernando Fernandez Mancera
2026-09-28 20:54 ` Fernando Fernandez Mancera
2026-09-28 21:17 ` Fernando Fernandez Mancera
2026-09-28 21:22 ` Matthieu Baerts
2026-09-28 21:52 ` Pablo Neira Ayuso
2026-09-29 9:21 ` Matthieu Baerts
2026-09-29 10:00 ` Pablo Neira Ayuso
2026-09-29 10:40 ` Matthieu Baerts
2026-09-29 12:03 ` Pablo Neira Ayuso
2026-09-30 18:33 ` Matthieu Baerts
2026-10-06 23:29 ` Pablo Neira Ayuso
2026-10-07 8:01 ` Fernando Fernandez Mancera
2026-10-07 10:47 ` Pablo Neira Ayuso
2026-10-07 8:17 ` Matthieu Baerts
2026-09-28 21:54 ` Jan Engelhardt
2026-09-29 9:34 ` Matthieu Baerts
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=arrXOOODs-EeMnNC@strlen.de \
--to=fw@strlen.de \
--cc=coreteam@netfilter.org \
--cc=matttbe@kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.