Re: [PATCH nft v2] doc: add MPTCP subtypes documentation to man page
flat view
From: Fernando Fernandez Mancera <hidden>
Date: 2026-10-06 21:21:27
Also in:
netfilter-devel
On 10/6/26 10:48 PM, Fernando Fernandez Mancera wrote:
In addition, document the limitation when there are multiple MPTCP options. Signed-off-by: Fernando Fernandez Mancera <redacted> --- v2: added valid MPTCP situations suggested by Matthieu ---
I have accidentally sent this to netdev mailing list too. Please ignore it, it only concerns netfilter-devel. Sorry for the inconvenience.
quoted hunk ↗ jump to hunk
doc/payload-expression.txt | 41 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+)diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt index ceccfdaa..53e92905 100644 --- a/doc/payload-expression.txt +++ b/doc/payload-expression.txt@@ -805,6 +805,32 @@ TCP option matching also supports raw expression syntax to access arbitrary opti [verse] *tcp option* *@*'number'*,*'offset'*,*'length' +.MPTCP subtypes +[options="header"] +|============================ +|Keyword| Description +|mp-capable| +Multipath capable +|mp-join| +Join connection +|dss| +Data sequence signal +|add-addr| +Add address +|remove-addr| +Remove address +|mp-prio| +Change subflow priority +|mp-fail| +Fallback to single-path TCP +|mp-fastclose| +Fast close +|mp-tcprst| +Subflow reset +|============================ + +Data types can be queried with 'nft describe tcp option mptcp subtype'. + .IP Options [options="header"] |==================@@ -833,6 +859,21 @@ filter input tcp option sack-perm exists counter filter input tcp option maxseg size lt 536 -------------------- +.matching MPTCP suboptions +-------------------- +filter input tcp option mptcp subtype mp-join drop +-------------------- + +[NOTE] +==================== +Netfilter currently evaluates only the first MPTCP option found in the TCP +header. If a packet contains multiple MPTCP options, a rule attempting to match +the second option will never match. Having multiple MPTCP options in the same +packet is valid, e.g the Linux MPTCP stack inserts 'remove-addr', 'mp-prio' and +'mp-fail' after an MPTCP 'dss' option; 'mp-tcprst' can also be inserted after +an 'mp-fastclose'. +==================== + .matching IPv6 exthdr --------------------- ip6 filter input frag more-fragments 1 counter