[PATCH nft v2] doc: add MPTCP subtypes documentation to man page

[PATCH nft v2] doc: add MPTCP subtypes documentation to man page

[Fernando Fernandez Mancera]

In addition, document the limitation when there are multiple MPTCP
options.

Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
---
v2: added valid MPTCP situations suggested by Matthieu
---
 doc/payload-expression.txt | 41 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt
index ceccfdaa..53e92905 100644
--- a/doc/payload-expression.txt
+++ b/doc/payload-expression.txt
@@ -805,6 +805,32 @@ TCP option matching also supports raw expression syntax to access arbitrary opti
 [verse]
 *tcp option* *@*'number'*,*'offset'*,*'length'
 
+.MPTCP subtypes
+[options="header"]
+|============================
+|Keyword| Description
+|mp-capable|
+Multipath capable
+|mp-join|
+Join connection
+|dss|
+Data sequence signal
+|add-addr|
+Add address
+|remove-addr|
+Remove address
+|mp-prio|
+Change subflow priority
+|mp-fail|
+Fallback to single-path TCP
+|mp-fastclose|
+Fast close
+|mp-tcprst|
+Subflow reset
+|============================
+
+Data types can be queried with 'nft describe tcp option mptcp subtype'.
+
 .IP Options
 [options="header"]
 |==================
@@ -833,6 +859,21 @@ filter input tcp option sack-perm exists counter
 filter input tcp option maxseg size lt 536
 --------------------
 
+.matching MPTCP suboptions
+--------------------
+filter input tcp option mptcp subtype mp-join drop
+--------------------
+
+[NOTE]
+====================
+Netfilter currently evaluates only the first MPTCP option found in the TCP
+header. If a packet contains multiple MPTCP options, a rule attempting to match
+the second option will never match. Having multiple MPTCP options in the same
+packet is valid, e.g the Linux MPTCP stack inserts 'remove-addr', 'mp-prio' and
+'mp-fail' after an MPTCP 'dss' option; 'mp-tcprst' can also be inserted after
+an 'mp-fastclose'.
+====================
+
 .matching IPv6 exthdr
 ---------------------
 ip6 filter input frag more-fragments 1 counter
-- 
2.55.0

Re: [PATCH nft v2] doc: add MPTCP subtypes documentation to man page

[Fernando Fernandez Mancera]

On 10/6/26 10:48 PM, Fernando Fernandez Mancera wrote:
> In addition, document the limitation when there are multiple MPTCP
> options.
> 
> Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
> ---
> v2: added valid MPTCP situations suggested by Matthieu
> ---

I have accidentally sent this to netdev mailing list too. Please ignore 
it, it only concerns netfilter-devel.

Sorry for the inconvenience.

>   doc/payload-expression.txt | 41 ++++++++++++++++++++++++++++++++++++++
>   1 file changed, 41 insertions(+)
> 
> diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt
> index ceccfdaa..53e92905 100644
> --- a/doc/payload-expression.txt
> +++ b/doc/payload-expression.txt
> @@ -805,6 +805,32 @@ TCP option matching also supports raw expression syntax to access arbitrary opti
>   [verse]
>   *tcp option* *@*'number'*,*'offset'*,*'length'
>   
> +.MPTCP subtypes
> +[options="header"]
> +|============================
> +|Keyword| Description
> +|mp-capable|
> +Multipath capable
> +|mp-join|
> +Join connection
> +|dss|
> +Data sequence signal
> +|add-addr|
> +Add address
> +|remove-addr|
> +Remove address
> +|mp-prio|
> +Change subflow priority
> +|mp-fail|
> +Fallback to single-path TCP
> +|mp-fastclose|
> +Fast close
> +|mp-tcprst|
> +Subflow reset
> +|============================
> +
> +Data types can be queried with 'nft describe tcp option mptcp subtype'.
> +
>   .IP Options
>   [options="header"]
>   |==================
> @@ -833,6 +859,21 @@ filter input tcp option sack-perm exists counter
>   filter input tcp option maxseg size lt 536
>   --------------------
>   
> +.matching MPTCP suboptions
> +--------------------
> +filter input tcp option mptcp subtype mp-join drop
> +--------------------
> +
> +[NOTE]
> +====================
> +Netfilter currently evaluates only the first MPTCP option found in the TCP
> +header. If a packet contains multiple MPTCP options, a rule attempting to match
> +the second option will never match. Having multiple MPTCP options in the same
> +packet is valid, e.g the Linux MPTCP stack inserts 'remove-addr', 'mp-prio' and
> +'mp-fail' after an MPTCP 'dss' option; 'mp-tcprst' can also be inserted after
> +an 'mp-fastclose'.
> +====================
> +
>   .matching IPv6 exthdr
>   ---------------------
>   ip6 filter input frag more-fragments 1 counter

Re: [PATCH nft v2] doc: add MPTCP subtypes documentation to man page

[Matthieu Baerts]

Hi Fernando,

On 06/10/2026 22:48, Fernando Fernandez Mancera wrote:
> In addition, document the limitation when there are multiple MPTCP
> options.

Thank you for the v2, it looks good to me!

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

> diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt
> index ceccfdaa..53e92905 100644
> --- a/doc/payload-expression.txt
> +++ b/doc/payload-expression.txt

(...)

> @@ -833,6 +859,21 @@ filter input tcp option sack-perm exists counter
>  filter input tcp option maxseg size lt 536
>  --------------------
>  
> +.matching MPTCP suboptions
> +--------------------
> +filter input tcp option mptcp subtype mp-join drop
> +--------------------
> +
> +[NOTE]
> +====================
> +Netfilter currently evaluates only the first MPTCP option found in the TCP
> +header. If a packet contains multiple MPTCP options, a rule attempting to match
> +the second option will never match. Having multiple MPTCP options in the same
> +packet is valid, e.g the Linux MPTCP stack inserts 'remove-addr', 'mp-prio' and

(small nit: I would have added an extra '.' after 'e.g', but I don't
think a v3 is needed to fix that.)

> +'mp-fail' after an MPTCP 'dss' option; 'mp-tcprst' can also be inserted after
> +an 'mp-fastclose'.
> +====================
> +
>  .matching IPv6 exthdr
>  ---------------------
>  ip6 filter input frag more-fragments 1 counter

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.