Re: Netfilter: match "tcp option" with the same type present multiple times

[Matthieu Baerts <matttbe@kernel.org>]

Hi Fernando,

On 28/09/2026 23:17, Fernando Fernandez Mancera wrote:
> On 9/28/26 10:54 PM, Fernando Fernandez Mancera wrote:
>> On 9/28/26 2:13 PM, Matthieu Baerts wrote:
>>> Hello Netfilter devs,
>>>
>>> First, thank you for maintaining Netfilter in the kernel and the
>>> userspace tools.
>>>
>>> The MPTCP selftests are switching from IPTables to NFTables, and
>>> Clashiko reported that this part of a rule wouldn't match anything:
>>>
>>>    tcp option mptcp subtype remove-addr drop
>>>
>>> When an MPTCP REMOVE_ADDR suboption (type 0x30, len >=4, subtype 0x4) is
>>> added to the TCP options, it is added after an MPTCP DSS option (type
>>> 0x30, len >= 8, subtype 0x2). In other words, there will be two MPTCP
>>> (type 30) options in the TCP options. It looks like Netfilter doesn't
>>> handle that, because it stops processing other TCP options when the
>>> expected type is found:
>>>
>>> net/netfilter/nft_exthdr.c:nft_exthdr_tcp_eval() {
>>>      ...
>>>     for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) {
>>>         optl = optlen(opt, i);
>>>
>>>         if (priv->type != opt[i])
>>>             continue;
>>>         ...
>>>         return;  // <== it will look at the first MPTCP option
>>>     }
>>>      ...
>>> }
>>>
>>> It looks like it shouldn't stop if the wrong subtype is found, but the
>>> subtype is not compared there if I'm not mistaken. Should there be a fix
>>> to support this case?
>>>
>>> For more details about the Clashiko report:
>>>
>>> https://lore.kernel.org/179058242453.3145.1450534124183352369@kernel.org
>>>
>>>
>>> BTW, I'm probably missing something, but adding the following doesn't
>>> seem to have any effect on my side:
>>>
>>>    nft add table ip filter
>>>    nft add chain ip filter OUTPUT \
>>>      { type filter hook output priority filter; policy accept; }
>>>    nft insert rule ip filter OUTPUT tcp option mptcp exists counter drop
>>>
>>> Same with "mptcp subtype mp-capable", other subtypes or other types like
>>> "timestamp". But if I use ...
>>>
>>>    nft insert rule ip filter OUTPUT meta l4proto tcp counter drop
>>>
>>> ... then the drop is effective. Any idea what I'm missing here? :)
>>>
>>>
>>> (Also, it looks like the MPTCP suboptions are not documented in the nft
>>> man page :) )
>>>
>>
>> Tomorrow there should be a patch in netfilter-devel adding it, we
>> definitively should put more work into documentation.
>>
> 
> While at it, I will also document the existing limitation that was
> discussed above too.

Great, thank you for looking at all this :)

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.