Re: [PATCH 1/4] TCPMSS: dont drop packets

[Patrick McHardy <kaber@trash.net>]

philipc@snapgear.com wrote:
> MSS clamping should be best effort, since we are doing the clamping
> to avoid dropped packets.  If we can't clamp, then forward it anyway
> and hope PMTU discovery works.
> 
> The test case that caused problems was syn packet containing data.

That seems to be an invalid testcase.

> Related questions:
> This patch changes the behaviour when setting the MSS too, is this
> acceptable?
> 
> Should skb_make_writable() and skb_checksum_help() cause dropped packets
> if they fail?
> 
> Which mangle targets should drop packets if they fail?
> MARK should, since the mark may be used in filter rules.
> What about DSCP, ECN, TOS, TTL?

I don't think its a good idea to change this long standing behaviour.
The next incarnation of iptables will support user-supplied verdicts
for non-terminal targets, but until then it seems reasonable to say
"user said do x, can't do it, so drop".

It should be noted that most of these conditions can't be true anyway,
I have a half-finished patch to remove most of them.