netdev - Re: [PATCH] don't allow netfilter --setmss to increase mss

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 05 Dec 2007 09:37:14 +0100
From:	Patrick McHardy <kaber@...sh.net>
To:	Benjamin LaHaise <bcrl@...ck.org>
CC:	David Miller <davem@...emloft.net>, netdev@...r.kernel.org,
	Netfilter Development Mailinglist 
	<netfilter-devel@...r.kernel.org>
Subject: Re: [PATCH] don't allow netfilter --setmss to increase mss

Patrick McHardy wrote:
> Benjamin LaHaise wrote:
>> Yes, I am aware of --clamp-mss-to-pmtu, but it doesn't work for 
>> outgoing connections from clients (ie web traffic), as it only looks 
>> at the PMTU on the destination route, not the source of the packet 
>> (the DSL interfaces in question have a 1442 byte MTU while the 
>> destination ethernet interface is 1500 -- there are problematic hosts 
>> which use a 1300 byte MTU).  Reworking that is probably a good idea at 
>> some point, but it's more work than this is.
> 
> Yes, this has always annoyed me too as it doesn't really work for me
> in a similar setup where traffic first goes through an IPsec tunnel,
> then through a MSS mangling gateway and then over a DSL line. I'll
> add a patch on top of yours to take the MSS in reverse direction
> into account.


This gets a bit too ugly because of rp-filters and actually might
not properly work in setups with routing by fwmark, so I'll leave
it as it is, its probably better to manually set the MSS in these
cases.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html