Re: [PATCH nft] doc: add MPTCP subtypes documentation to man page

[Matthieu Baerts <matttbe@kernel.org>]

Hi Fernando,

On 29/09/2026 16:14, Fernando Fernandez Mancera wrote:
> In addition, document the limitation when there are multiple MPTCP
> options.

Thank you for this patch!

> diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt
> index ceccfdaa..f1de0956 100644
> --- a/doc/payload-expression.txt
> +++ b/doc/payload-expression.txt

(...)

> @@ -833,6 +859,18 @@ filter input tcp option sack-perm exists counter
>  filter input tcp option maxseg size lt 536
>  --------------------
>  
> +.matching MPTCP suboptions
> +--------------------
> +filter input tcp option mptcp subtype mp-join drop
> +--------------------
> +
> +[NOTE]
> +====================
> +Netfilter currently evaluates only the first MPTCP option found in the TCP
> +header. If a packet contains multiple MPTCP options, a rule attempting to match
> +the second option will never match.

Would it be interesting to give an example? e.g. a rule attempting to
match 'remove-addr', 'mp-prio' and 'mp-fail' (and 'mp-tcprst' in some
cases) are not going to catch anything when the traffic is emitted by
the current Linux kernel stack.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.