Re: [PATCH nft v2] doc: add MPTCP subtypes documentation to man page

[Fernando Fernandez Mancera <fmancera@suse.de>]

On 10/6/26 10:48 PM, Fernando Fernandez Mancera wrote:
> In addition, document the limitation when there are multiple MPTCP
> options.
> 
> Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
> ---
> v2: added valid MPTCP situations suggested by Matthieu
> ---

I have accidentally sent this to netdev mailing list too. Please ignore 
it, it only concerns netfilter-devel.

Sorry for the inconvenience.

>   doc/payload-expression.txt | 41 ++++++++++++++++++++++++++++++++++++++
>   1 file changed, 41 insertions(+)
> 
> diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt
> index ceccfdaa..53e92905 100644
> --- a/doc/payload-expression.txt
> +++ b/doc/payload-expression.txt
> @@ -805,6 +805,32 @@ TCP option matching also supports raw expression syntax to access arbitrary opti
>   [verse]
>   *tcp option* *@*'number'*,*'offset'*,*'length'
>   
> +.MPTCP subtypes
> +[options="header"]
> +|============================
> +|Keyword| Description
> +|mp-capable|
> +Multipath capable
> +|mp-join|
> +Join connection
> +|dss|
> +Data sequence signal
> +|add-addr|
> +Add address
> +|remove-addr|
> +Remove address
> +|mp-prio|
> +Change subflow priority
> +|mp-fail|
> +Fallback to single-path TCP
> +|mp-fastclose|
> +Fast close
> +|mp-tcprst|
> +Subflow reset
> +|============================
> +
> +Data types can be queried with 'nft describe tcp option mptcp subtype'.
> +
>   .IP Options
>   [options="header"]
>   |==================
> @@ -833,6 +859,21 @@ filter input tcp option sack-perm exists counter
>   filter input tcp option maxseg size lt 536
>   --------------------
>   
> +.matching MPTCP suboptions
> +--------------------
> +filter input tcp option mptcp subtype mp-join drop
> +--------------------
> +
> +[NOTE]
> +====================
> +Netfilter currently evaluates only the first MPTCP option found in the TCP
> +header. If a packet contains multiple MPTCP options, a rule attempting to match
> +the second option will never match. Having multiple MPTCP options in the same
> +packet is valid, e.g the Linux MPTCP stack inserts 'remove-addr', 'mp-prio' and
> +'mp-fail' after an MPTCP 'dss' option; 'mp-tcprst' can also be inserted after
> +an 'mp-fastclose'.
> +====================
> +
>   .matching IPv6 exthdr
>   ---------------------
>   ip6 filter input frag more-fragments 1 counter