[PATCH] don't allow netfilter --setmss to increase mss

[PATCH] don't allow netfilter --setmss to increase mss

[Benjamin LaHaise]

Hi folks,

When terminating DSL connections for an assortment of random customers, I've 
found it necessary to use iptables to clamp the MSS used for connections to 
work around the various ICMP blackholes in the greater net.  Unfortunately, 
the current behaviour in Linux is imperfect and actually make things worse, 
so I'm proposing the following: increasing the MSS in a packet can never be 
a good thing, so make --set-mss only lower the MSS in a packet.

Yes, I am aware of --clamp-mss-to-pmtu, but it doesn't work for outgoing 
connections from clients (ie web traffic), as it only looks at the PMTU on 
the destination route, not the source of the packet (the DSL interfaces in 
question have a 1442 byte MTU while the destination ethernet interface is 
1500 -- there are problematic hosts which use a 1300 byte MTU).  Reworking 
that is probably a good idea at some point, but it's more work than this is.

Thoughts?  Would it be better to add a new flag?

		-ben

Signed-off-by: Benjamin LaHaise <bcrl@kvack.org>
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index d40f7e4..411c482 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -88,8 +88,11 @@ tcpmss_mangle_packet(struct sk_buff **pskb,
 
 			oldmss = (opt[i+2] << 8) | opt[i+3];
 
-			if (info->mss == XT_TCPMSS_CLAMP_PMTU &&
-			    oldmss <= newmss)
+			/* Never increase MSS, even when setting it, as
+			 * doing so results in problems for hosts that rely
+			 * on MSS being set correctly.
+			 */
+			if (oldmss <= newmss)
 				return 0;
 
 			opt[i+2] = (newmss & 0xff00) >> 8;

Re: [PATCH] don't allow netfilter --setmss to increase mss

[Patrick McHardy]

Please send netfilter-related patches to netfilter-devel.

Benjamin LaHaise wrote:
> When terminating DSL connections for an assortment of random customers, I've 
> found it necessary to use iptables to clamp the MSS used for connections to 
> work around the various ICMP blackholes in the greater net.  Unfortunately, 
> the current behaviour in Linux is imperfect and actually make things worse, 
> so I'm proposing the following: increasing the MSS in a packet can never be 
> a good thing, so make --set-mss only lower the MSS in a packet.
> 
> Yes, I am aware of --clamp-mss-to-pmtu, but it doesn't work for outgoing 
> connections from clients (ie web traffic), as it only looks at the PMTU on 
> the destination route, not the source of the packet (the DSL interfaces in 
> question have a 1442 byte MTU while the destination ethernet interface is 
> 1500 -- there are problematic hosts which use a 1300 byte MTU).  Reworking 
> that is probably a good idea at some point, but it's more work than this is.

Yes, this has always annoyed me too as it doesn't really work for me
in a similar setup where traffic first goes through an IPsec tunnel,
then through a MSS mangling gateway and then over a DSL line. I'll
add a patch on top of yours to take the MSS in reverse direction
into account.

> Thoughts?  Would it be better to add a new flag?

No, this is obviously a good idea, I actually thought we'd already
prevent increasing it in all cases. I've applied your patch, thanks.

Re: [PATCH] don't allow netfilter --setmss to increase mss

[Patrick McHardy]

Patrick McHardy wrote:
> Benjamin LaHaise wrote:
>> Yes, I am aware of --clamp-mss-to-pmtu, but it doesn't work for 
>> outgoing connections from clients (ie web traffic), as it only looks 
>> at the PMTU on the destination route, not the source of the packet 
>> (the DSL interfaces in question have a 1442 byte MTU while the 
>> destination ethernet interface is 1500 -- there are problematic hosts 
>> which use a 1300 byte MTU).  Reworking that is probably a good idea at 
>> some point, but it's more work than this is.
> 
> Yes, this has always annoyed me too as it doesn't really work for me
> in a similar setup where traffic first goes through an IPsec tunnel,
> then through a MSS mangling gateway and then over a DSL line. I'll
> add a patch on top of yours to take the MSS in reverse direction
> into account.


This gets a bit too ugly because of rp-filters and actually might
not properly work in setups with routing by fwmark, so I'll leave
it as it is, its probably better to manually set the MSS in these
cases.