Re: [PATCH] don't allow netfilter --setmss to increase mss

[Patrick McHardy <kaber@trash.net>]

Please send netfilter-related patches to netfilter-devel.

Benjamin LaHaise wrote:
> When terminating DSL connections for an assortment of random customers, I've 
> found it necessary to use iptables to clamp the MSS used for connections to 
> work around the various ICMP blackholes in the greater net.  Unfortunately, 
> the current behaviour in Linux is imperfect and actually make things worse, 
> so I'm proposing the following: increasing the MSS in a packet can never be 
> a good thing, so make --set-mss only lower the MSS in a packet.
> 
> Yes, I am aware of --clamp-mss-to-pmtu, but it doesn't work for outgoing 
> connections from clients (ie web traffic), as it only looks at the PMTU on 
> the destination route, not the source of the packet (the DSL interfaces in 
> question have a 1442 byte MTU while the destination ethernet interface is 
> 1500 -- there are problematic hosts which use a 1300 byte MTU).  Reworking 
> that is probably a good idea at some point, but it's more work than this is.

Yes, this has always annoyed me too as it doesn't really work for me
in a similar setup where traffic first goes through an IPsec tunnel,
then through a MSS mangling gateway and then over a DSL line. I'll
add a patch on top of yours to take the MSS in reverse direction
into account.

> Thoughts?  Would it be better to add a new flag?

No, this is obviously a good idea, I actually thought we'd already
prevent increasing it in all cases. I've applied your patch, thanks.