Commit:     170080645dac61816455afad807ffeb326ce79e8
Parent:     d6a2ba07c31b0497fc82a8c175400ea8747da2ef
Author:     Benjamin LaHaise <[EMAIL PROTECTED]>
AuthorDate: Mon Dec 17 22:27:36 2007 -0800
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Mon Jan 28 14:58:50 2008 -0800

    [NETFILTER]: xt_TCPMSS: don't allow netfilter --setmss to increase mss
    When terminating DSL connections for an assortment of random customers, I've
    found it necessary to use iptables to clamp the MSS used for connections to
    work around the various ICMP blackholes in the greater net.  Unfortunately,
    the current behaviour in Linux is imperfect and actually make things worse,
    so I'm proposing the following: increasing the MSS in a packet can never be
    a good thing, so make --set-mss only lower the MSS in a packet.
    Yes, I am aware of --clamp-mss-to-pmtu, but it doesn't work for outgoing
    connections from clients (ie web traffic), as it only looks at the PMTU on
    the destination route, not the source of the packet (the DSL interfaces in
    question have a 1442 byte MTU while the destination ethernet interface is
    1500 -- there are problematic hosts which use a 1300 byte MTU).  Reworking
    that is probably a good idea at some point, but it's more work than this is.
    Signed-off-by: Benjamin LaHaise <[EMAIL PROTECTED]>
    Signed-off-by: Patrick McHardy <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
 net/netfilter/xt_TCPMSS.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index e4ee4bc..a1bc77f 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -88,8 +88,11 @@ tcpmss_mangle_packet(struct sk_buff *skb,
                        oldmss = (opt[i+2] << 8) | opt[i+3];
-                       if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
-                           oldmss <= newmss)
+                       /* Never increase MSS, even when setting it, as
+                        * doing so results in problems for hosts that rely
+                        * on MSS being set correctly.
+                        */
+                       if (oldmss <= newmss)
                                return 0;
                        opt[i+2] = (newmss & 0xff00) >> 8;
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to