Page MenuHomeVyOS Platform
Create Task
Maniphest T490

policy route path-MTU clamping
Closed, DuplicatePublicBUG
Actions

Description

This should work.

set policy route pppoe-out rule 1 protocol 'tcp'
set policy route pppoe-out rule 1 set tcp-mss 'pmtu'
set policy route pppoe-out rule 1 tcp flags 'SYN'

set interfaces ethernet eth0 policy route pppoe-out

But we get:

xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks

Most of the policy route stuff needs to be applied to the input side of an interface, but the mss clamping needs to be applied to the output side. I am not sure that is resolvable in the current config scheme, since the same policy route object can include both types.

/opt/vyatta/share/vyatta-cfg/templates/interfaces/ethernet/node.tag/policy/route/node.def calls /opt/vyatta/sbin/vyatta-firewall.pl with an 'in' argument.

The tcp mss clamping has nothing to do with routing, so should not be under the policy route tree.

Details

Difficulty level
Unknown (require assessment)
Version
1.2 current
Why the issue appeared?
Will be filled on close

Related Objects

Event Timeline

carl.byington created this task.Dec 5 2017, 1:43 AM
Tiberius added a subscriber: Tiberius.Dec 6 2017, 2:46 AM
Tiberius added a comment.Dec 6 2017, 2:59 AM

After some discussion surrounding similar issue in IRC recently, I believe FORWARD is the correct place for this, and 'set-mss' should be configurable in a rule which can specify one or both of input *and* output interface to allow proper expression of explicit MSS for inbound and outbound connections.

syncer triaged this task as Low priority.Dec 21 2017, 9:06 PM
pasik added a subscriber: pasik.Dec 26 2017, 10:41 PM
mustard added a subscriber: mustard.Feb 14 2018, 12:16 AM
syncer edited projects, added VyOS 1.2 Crux (VyOS 1.2.0-rc3); removed VyOS 1.1.x (1.1.9), VyOS 1.2 Crux.Oct 13 2018, 9:23 AM
syncer edited projects, added VyOS 1.2 Crux (VyOS 1.2.0-rc4); removed VyOS 1.2 Crux (VyOS 1.2.0-rc3).Oct 15 2018, 10:15 PM
dmbaturin closed this task as a duplicate of T124: Policy route pmtu option fail.Oct 21 2018, 5:39 PM
syncer moved this task from Needs Triage to Finished on the VyOS 1.2 Crux (VyOS 1.2.0-rc4) board.Oct 24 2018, 4:40 PM
syncer added a project: VyOS-1.2.0-GA.Jan 25 2019, 2:38 PM
Viacheslav mentioned this in T2868: Tcp-mss option in policy calls kernel-panic.Nov 26 2020, 6:11 PM