diff options
| author | Christian Poessinger <christian@poessinger.com> | 2022-12-17 08:27:39 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-12-17 08:27:39 +0100 |
| commit | a5068f5a7292320f34c7fae42daca79b71aef6ed (patch) | |
| tree | 58d8eaba99e21db9df5a735b8376eb5049f816cf /src/conf_mode | |
| parent | 89100cee64d41591b602d6f61980f21c278e6851 (diff) | |
| parent | 7709663c61f988cc60444fa932164f4931dfa7e3 (diff) | |
| download | vyos-1x-a5068f5a7292320f34c7fae42daca79b71aef6ed.tar.gz vyos-1x-a5068f5a7292320f34c7fae42daca79b71aef6ed.zip | |
Merge pull request #1557 from initramfs/equuleus-fix-tcp-mss
firewall: T4709: fix firewall MSS clamping issues
Diffstat (limited to 'src/conf_mode')
| -rwxr-xr-x | src/conf_mode/firewall_options.py | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/src/conf_mode/firewall_options.py b/src/conf_mode/firewall_options.py index 67bf5d0e2..b7f4aa82c 100755 --- a/src/conf_mode/firewall_options.py +++ b/src/conf_mode/firewall_options.py @@ -115,9 +115,12 @@ def apply(tcp): continue # adjust TCP MSS per interface - if mss: + if mss == 'clamp-mss-to-pmtu': call('iptables --table mangle --append {} --out-interface {} --protocol tcp ' - '--tcp-flags SYN,RST SYN --jump TCPMSS --set-mss {} >&/dev/null'.format(target, intf, mss)) + '--tcp-flags SYN,RST SYN --jump TCPMSS --clamp-mss-to-pmtu >&/dev/null'.format(target, intf)) + elif mss: + call('iptables --table mangle --append {} --out-interface {} --protocol tcp ' + '--tcp-flags SYN,RST SYN --jump TCPMSS --set-mss {} >&/dev/null'.format(target, intf, mss)) # Setup new ip6tables rules if tcp['new_chain6']: @@ -133,9 +136,12 @@ def apply(tcp): continue # adjust TCP MSS per interface - if mss: + if mss == 'clamp-mss-to-pmtu': + call('ip6tables --table mangle --append {} --out-interface {} --protocol tcp ' + '--tcp-flags SYN,RST SYN --jump TCPMSS --clamp-mss-to-pmtu >&/dev/null'.format(target, intf)) + elif mss: call('ip6tables --table mangle --append {} --out-interface {} --protocol tcp ' - '--tcp-flags SYN,RST SYN --jump TCPMSS --set-mss {} >&/dev/null'.format(target, intf, mss)) + '--tcp-flags SYN,RST SYN --jump TCPMSS --set-mss {} >&/dev/null'.format(target, intf, mss)) return None |