[PATCH nft v2] doc: add MPTCP subtypes documentation to man page

[Fernando Fernandez Mancera <fmancera@suse.de>]

In addition, document the limitation when there are multiple MPTCP
options.

Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
---
v2: added valid MPTCP situations suggested by Matthieu
---
 doc/payload-expression.txt | 41 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt
index ceccfdaa..53e92905 100644
--- a/doc/payload-expression.txt
+++ b/doc/payload-expression.txt
@@ -805,6 +805,32 @@ TCP option matching also supports raw expression syntax to access arbitrary opti
 [verse]
 *tcp option* *@*'number'*,*'offset'*,*'length'
 
+.MPTCP subtypes
+[options="header"]
+|============================
+|Keyword| Description
+|mp-capable|
+Multipath capable
+|mp-join|
+Join connection
+|dss|
+Data sequence signal
+|add-addr|
+Add address
+|remove-addr|
+Remove address
+|mp-prio|
+Change subflow priority
+|mp-fail|
+Fallback to single-path TCP
+|mp-fastclose|
+Fast close
+|mp-tcprst|
+Subflow reset
+|============================
+
+Data types can be queried with 'nft describe tcp option mptcp subtype'.
+
 .IP Options
 [options="header"]
 |==================
@@ -833,6 +859,21 @@ filter input tcp option sack-perm exists counter
 filter input tcp option maxseg size lt 536
 --------------------
 
+.matching MPTCP suboptions
+--------------------
+filter input tcp option mptcp subtype mp-join drop
+--------------------
+
+[NOTE]
+====================
+Netfilter currently evaluates only the first MPTCP option found in the TCP
+header. If a packet contains multiple MPTCP options, a rule attempting to match
+the second option will never match. Having multiple MPTCP options in the same
+packet is valid, e.g the Linux MPTCP stack inserts 'remove-addr', 'mp-prio' and
+'mp-fail' after an MPTCP 'dss' option; 'mp-tcprst' can also be inserted after
+an 'mp-fastclose'.
+====================
+
 .matching IPv6 exthdr
 ---------------------
 ip6 filter input frag more-fragments 1 counter
-- 
2.55.0