From 7709663c61f988cc60444fa932164f4931dfa7e3 Mon Sep 17 00:00:00 2001
From: initramfs <initramfs@initramfs.io>
Date: Mon, 26 Sep 2022 11:01:02 +0800
Subject: firewall: T4709: adjust TCP MSS clamping ranges and options

This commit fixes MSS clamping ranges as well as reintroduces the
clamp-mss-to-pmtu option value to clamp to PMTU instead.
---
 interface-definitions/firewall-options.xml.in | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

(limited to 'interface-definitions/firewall-options.xml.in')

diff --git a/interface-definitions/firewall-options.xml.in b/interface-definitions/firewall-options.xml.in
index 8d9225a9a..1bcee2011 100644
--- a/interface-definitions/firewall-options.xml.in
+++ b/interface-definitions/firewall-options.xml.in
@@ -20,24 +20,40 @@
               <leafNode name="adjust-mss">
                 <properties>
                   <help>Adjust MSS for IPv4 transit packets</help>
+                  <completionHelp>
+                      <list>clamp-mss-to-pmtu</list>
+                  </completionHelp>
                   <valueHelp>
-                    <format>500-1460</format>
+                      <format>clamp-mss-to-pmtu</format>
+                      <description>Automatically sets the MSS to the proper value</description>
+                 </valueHelp>
+                  <valueHelp>
+                    <format>536-65535</format>
                     <description>TCP Maximum segment size in bytes</description>
                   </valueHelp>
                   <constraint>
-                    <validator name="numeric" argument="--range 500-1460"/>
+                    <validator name="numeric" argument="--range 536-65535"/>
+                    <regex>(clamp-mss-to-pmtu)</regex>
                   </constraint>
                 </properties>
               </leafNode>
               <leafNode name="adjust-mss6">
                 <properties>
                   <help>Adjust MSS for IPv6 transit packets</help>
+                  <completionHelp>
+                      <list>clamp-mss-to-pmtu</list>
+                  </completionHelp>
+                  <valueHelp>
+                      <format>clamp-mss-to-pmtu</format>
+                      <description>Automatically sets the MSS to the proper value</description>
+                  </valueHelp>
                   <valueHelp>
-                    <format>1280-1492</format>
+                    <format>1220-65535</format>
                     <description>TCP Maximum segment size in bytes</description>
                   </valueHelp>
                   <constraint>
-                    <validator name="numeric" argument="--range 1280-1492"/>
+                    <validator name="numeric" argument="--range 1220-65535"/>
+                    <regex>(clamp-mss-to-pmtu)</regex>
                   </constraint>
                 </properties>
               </leafNode>
-- 
cgit v1.2.3