Re: [PATCH nft v2] doc: add MPTCP subtypes documentation to man page

[Matthieu Baerts <matttbe@kernel.org>]

Hi Fernando,

On 06/10/2026 22:48, Fernando Fernandez Mancera wrote:
> In addition, document the limitation when there are multiple MPTCP
> options.

Thank you for the v2, it looks good to me!

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

> diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt
> index ceccfdaa..53e92905 100644
> --- a/doc/payload-expression.txt
> +++ b/doc/payload-expression.txt

(...)

> @@ -833,6 +859,21 @@ filter input tcp option sack-perm exists counter
>  filter input tcp option maxseg size lt 536
>  --------------------
>  
> +.matching MPTCP suboptions
> +--------------------
> +filter input tcp option mptcp subtype mp-join drop
> +--------------------
> +
> +[NOTE]
> +====================
> +Netfilter currently evaluates only the first MPTCP option found in the TCP
> +header. If a packet contains multiple MPTCP options, a rule attempting to match
> +the second option will never match. Having multiple MPTCP options in the same
> +packet is valid, e.g the Linux MPTCP stack inserts 'remove-addr', 'mp-prio' and

(small nit: I would have added an extra '.' after 'e.g', but I don't
think a v3 is needed to fix that.)

> +'mp-fail' after an MPTCP 'dss' option; 'mp-tcprst' can also be inserted after
> +an 'mp-fastclose'.
> +====================
> +
>  .matching IPv6 exthdr
>  ---------------------
>  ip6 filter input frag more-fragments 1 counter

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.