Re: Netfilter: match "tcp option" with the same type present multiple times

[Florian Westphal <fw@strlen.de>]

Matthieu Baerts <matttbe@kernel.org> wrote:
> Hello Netfilter devs,
> 
> First, thank you for maintaining Netfilter in the kernel and the
> userspace tools.
> 
> The MPTCP selftests are switching from IPTables to NFTables, and
> Clashiko reported that this part of a rule wouldn't match anything:
> 
>   tcp option mptcp subtype remove-addr drop
> 
> When an MPTCP REMOVE_ADDR suboption (type 0x30, len >=4, subtype 0x4) is
> added to the TCP options, it is added after an MPTCP DSS option (type
> 0x30, len >= 8, subtype 0x2). In other words, there will be two MPTCP
> (type 30) options in the TCP options. It looks like Netfilter doesn't
> handle that, because it stops processing other TCP options when the
> expected type is found:

Yes, this won't work. 'tcp option X' extracts the
option X.

I don't see how this could be fixed within the limitations of the
architecture.  Just use bpf.

> It looks like it shouldn't stop if the wrong subtype is found, but the
> subtype is not compared there if I'm not mistaken. Should there be a fix
> to support this case?

I don't know how, unless one would extend the kernel to make it aware of
mptcp, which also requires userspace to pass the suboption type to look
for in addition to 'mptcp option'.

> BTW, I'm probably missing something, but adding the following doesn't
> seem to have any effect on my side:
> 
>   nft add table ip filter
>   nft add chain ip filter OUTPUT \
>     { type filter hook output priority filter; policy accept; }
>   nft insert rule ip filter OUTPUT tcp option mptcp exists counter drop
> 
> Same with "mptcp subtype mp-capable", other subtypes or other types like
> "timestamp". But if I use ...
> 
>   nft insert rule ip filter OUTPUT meta l4proto tcp counter drop
> 
> ... then the drop is effective. Any idea what I'm missing here? :)

No idea.
cd git/netfilter.org/nftables/tests/shell; ./run-tests.sh -k testcases/packetpath/tcp_options

passes here.
Even tried adding 'tcp option timestamp exists...' to the test, also
passes.

nft --debug=netlink list ruleset displays the rule like this:

inet t c 15 14
  [ exthdr load tcpopt 1b @ 8 + 0 present => reg 1 ]
  [ cmp eq reg 1 0x01 ]
  [ objref type 1 name tsc ]

Linux 7.3.0-rc3+
nftables v1.1.6 (Commodore Bullmoose #7)