Package: iptables Version: 1.4.8-3 Severity: normal I was wondering which is better or correct .... Here are the result of my search.
Although the manpage uses -t mangle for TCPMSS, "Netfilter Extensions HOWTO" states: http://netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO-4.html#ss4.7 | Typical usage would be: | # iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu The same example is given in the linux kernel source net/netfilter/Kconfig, too. iptables v1.4.8 Changelog state: | Changes from 1.4.7: | ... | Jan Engelhardt (9): | ... | doc: remove claim that TCPMSS is limited to mangle | ... | Tim Small (1): | doc: update TCPMSS manpage with Linux 2.6.25 changes It seems quite complicated situation. I found: http://lists.netfilter.org/pipermail/netfilter-devel/2005-December/022632.html | > and realize that most uses of TCPMSS (which I fear are not that | > rare) probably occur within the filter table. | > You can expect a global change to be quite difficult, I guess... :-( | | Thanks, I didn't know this, I'm going to change this to refer to | the mangle table. This still leaves the option of a warning, but | want I really wanted to know was whether anyone cares. From a | consistency point of view it should be restricted, for the | functionality it doesn't matter. So "-t mangle" as seen in manpage seems to be more preferred way for consistency of code but "-t filter" is still supported. So this bug may be reassigned to kernel source upstream and "Netfilter Extensions HOWTO". Osamu -- System Information: Debian Release: squeeze/sid APT prefers testing APT policy: (500, 'testing') Architecture: amd64 (x86_64) Kernel: Linux 2.6.32-5-amd64 (SMP w/2 CPU cores) Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages iptables depends on: ii libc6 2.11.2-7 Embedded GNU C Library: Shared lib ii libnfnetlink0 1.0.0-1 Netfilter netlink library iptables recommends no packages. iptables suggests no packages. -- no debconf information -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
