Re: [PATCH nft] doc: add MPTCP subtypes documentation to man page

[Matthieu Baerts <matttbe@kernel.org>]

Hi Fernando,

On 01/10/2026 10:58, Fernando Fernandez Mancera wrote:
> On 9/30/26 8:38 PM, Matthieu Baerts wrote:
>> On 29/09/2026 16:14, Fernando Fernandez Mancera wrote:
>>> diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt
>>> index ceccfdaa..f1de0956 100644
>>> --- a/doc/payload-expression.txt
>>> +++ b/doc/payload-expression.txt
>>
>> (...)
>>
>>> @@ -833,6 +859,18 @@ filter input tcp option sack-perm exists counter
>>>   filter input tcp option maxseg size lt 536
>>>   --------------------
>>>   +.matching MPTCP suboptions
>>> +--------------------
>>> +filter input tcp option mptcp subtype mp-join drop
>>> +--------------------
>>> +
>>> +[NOTE]
>>> +====================
>>> +Netfilter currently evaluates only the first MPTCP option found in
>>> the TCP
>>> +header. If a packet contains multiple MPTCP options, a rule
>>> attempting to match
>>> +the second option will never match.
>>
>> Would it be interesting to give an example? e.g. a rule attempting to
>> match 'remove-addr', 'mp-prio' and 'mp-fail' (and 'mp-tcprst' in some
>> cases) are not going to catch anything when the traffic is emitted by
>> the current Linux kernel stack.
> 
> could you provide a good one? Ideally the documentation should be as
> simple as possible. I thought about adding the rule you asked about
> initially.. but I realized that simply describing the issue was better
> IMHO.
What about something like this?

  Netfilter currently evaluates only the first MPTCP option found in the
  TCP header. If a packet contains multiple MPTCP options, a rule
  attempting to match the second option will never match. Having
  multiple MPTCP options in the same packet is valid, e.g. the Linux
  MPTCP stack inserts 'remove-addr', 'mp-prio' and 'mp-fail' after an
  MPTCP 'dss' option ; 'mp-tcprst' can also be inserted after an 'mp-
  fastclose'.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.