Re: xt_TCPMSS target dropping SYN packets with data: suggested mod

[Luca Pesce <pesce.luca@gmail.com>]

Hi,

Pascal Hambourg<pascal.mail@plouf.fr.eu.org> wrote:
> When the receiver has SYN cookies enabled, it replies to a SYN with a
> SYN-ACK as usual, but does not keep any state for it. Instead the state is
> stored in the ISN (used as a "cookie") of the SYN-ACK and will come back in
> the final ACK of the 3-way handshake. Not keeping state means that any data
> contained in the first SYN segment are discarded.

thanks for your explanation!
Ok, so if the receiver is using syn cookies, the data in the SYN would
be discarded,
and that is fine. But the current implementation of TCPMSS target is
dropping the
whole syn packet (if it is carrying any payload), so the receiver is
not receiving
the syn - in that case, the TCP connection could not be established.

Again, I know that this scenario is very rare and awkward, I wan only thinking
about relaxing that check in the TCPMSS target to let this SYN with data go
through and establish the TCP connection, without caring too much
about the payload.