[NETFILTER]: xt_TCPMSS: don't allow netfilter --setmss to increase mss
When terminating DSL connections for an assortment of random customers, I've found it necessary to use iptables to clamp the MSS used for connections to work around the various ICMP blackholes in the greater net. Unfortunately, the current behaviour in Linux is imperfect and actually make things worse, so I'm proposing the following: increasing the MSS in a packet can never be a good thing, so make --set-mss only lower the MSS in a packet. Yes, I am aware of --clamp-mss-to-pmtu, but it doesn't work for outgoing connections from clients (ie web traffic), as it only looks at the PMTU on the destination route, not the source of the packet (the DSL interfaces in question have a 1442 byte MTU while the destination ethernet interface is 1500 -- there are problematic hosts which use a 1300 byte MTU). Reworking that is probably a good idea at some point, but it's more work than this is. Signed-off-by: Benjamin LaHaise <bcrl@kvack.org> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
d6a2ba07c3
commit
170080645d
|
@ -88,8 +88,11 @@ tcpmss_mangle_packet(struct sk_buff *skb,
|
||||||
|
|
||||||
oldmss = (opt[i+2] << 8) | opt[i+3];
|
oldmss = (opt[i+2] << 8) | opt[i+3];
|
||||||
|
|
||||||
if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
|
/* Never increase MSS, even when setting it, as
|
||||||
oldmss <= newmss)
|
* doing so results in problems for hosts that rely
|
||||||
|
* on MSS being set correctly.
|
||||||
|
*/
|
||||||
|
if (oldmss <= newmss)
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
opt[i+2] = (newmss & 0xff00) >> 8;
|
opt[i+2] = (newmss & 0xff00) >> 8;
|
||||||
|
|
Loading…
Reference in a new issue