Re: Netfilter: match "tcp option" with the same type present multiple times

[Matthieu Baerts <matttbe@kernel.org>]

Hi Jan,

On 28/09/2026 23:54, Jan Engelhardt wrote:
> On Monday 2026-09-28 14:13, Matthieu Baerts wrote:
> 
>> The MPTCP selftests are switching from IPTables to NFTables, and
>> Clashiko reported that this part of a rule wouldn't match anything:
>>
>>  tcp option mptcp subtype remove-addr drop
>>
>> When an MPTCP REMOVE_ADDR suboption (type 0x30, len >=4, subtype 0x4) is
>> added to the TCP options, it is added after an MPTCP DSS option (type
>> 0x30, len >= 8, subtype 0x2). In other words, there will be two MPTCP
>> (type 30) options in the TCP options. It looks like Netfilter doesn't
>> handle that, because it stops processing other TCP options when the
>> expected type is found:
>>
>> net/netfilter/nft_exthdr.c:nft_exthdr_tcp_eval() {
>>    ...
>> 	for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
>> 		optl = optlen(opt, i);
>>
>> 		if (		priv->type != opt[i])
>> 			continue;
>> 		...
>> 		return;  // <== it will look at the first MPTCP option
>> 	}
> 
> Hm, neither RFC 793 nor 9293 seem to define a general processing rule
> or error-handling behavior for duplicate or repeated options within
> the header of a TCP segment.

From what I understood at the IETF, new TCP extensions can only be
assigned one "type". If multiple message types should be passed, the
subtype should be either extracted from the size, or by using another
TLV inside. (MPTCP is using the two techniques.)

(Old extensions like SACK and echo are exceptions, because they are old
ones.)

> MPTCP RFC 8684 seems to acknowledge that, with:
> 
> "it may not be possible to combine all desired options .. on a single
> packet"

The MPTCP RFC specifies this mainly because of the TCP options space
restriction (40 bytes). For example, the ADD_ADDR option can take up to
30 bytes (+2 for the alignment). If you add TCP Timestamp (10 + 2 for
the alignment) or SACK, you are over the limit.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.