package/network/config/firewall/patches/0001-zones-apply-tcp-mss-clamping-also-on-ingress-path.patch

   1 From 4a7df7d8c4e40fd2ce0d9f125755249dee17a8bd Mon Sep 17 00:00:00 2001
   2 From: Yousong Zhou <yszhou4tech@gmail.com>
   3 Date: Fri, 24 Jul 2020 12:52:59 +0800
   4 Subject: [PATCH] zones: apply tcp mss clamping also on ingress path
   5
   6 Fixes FS#3231
   7
   8 Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
   9 Acked-by: Jo-Philipp Wich <jo@mein.io>
  10 (cherry picked from commit e9b90dfac2225927c035f6a76277b850c282dc9a)
  11 ---
  12  zones.c | 8 ++++++++
  13  1 file changed, 8 insertions(+)
  14
  15 diff --git a/zones.c b/zones.c
  16 index 01fb706..3d54a76 100644
  17 --- a/zones.c
  18 +++ b/zones.c
  19 @@ -552,6 +552,14 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
  20                         fw3_ipt_rule_target(r, "TCPMSS");
  21                         fw3_ipt_rule_addarg(r, false, "--clamp-mss-to-pmtu", NULL);
  22                         fw3_ipt_rule_replace(r, "FORWARD");
  23 +
  24 +                       r = fw3_ipt_rule_create(handle, &tcp, dev, NULL, sub, NULL);
  25 +                       fw3_ipt_rule_addarg(r, false, "--tcp-flags", "SYN,RST");
  26 +                       fw3_ipt_rule_addarg(r, false, "SYN", NULL);
  27 +                       fw3_ipt_rule_comment(r, "Zone %s MTU fixing", zone->name);
  28 +                       fw3_ipt_rule_target(r, "TCPMSS");
  29 +                       fw3_ipt_rule_addarg(r, false, "--clamp-mss-to-pmtu", NULL);
  30 +                       fw3_ipt_rule_replace(r, "FORWARD");
  31                 }
  32         }
  33         else if (handle->table == FW3_TABLE_RAW)