Page MenuHomeVyOS Platform

MTU adjust-mss currently only modifying TCP SYN MSS in single direction
In progress, LowPublic

Description

set interfaces ethernet <interface> ip adjust-mss <mss | clamp-mss-to-pmtu> adds a nft rule which modifies the TCP SYN MSS value in postrouting when going OUT via the <interface>, but it doesn't modify the the TCP SYN MSS value passing through FROM <interface>.

Here is what adjust-mss sets:
nft add rule raw VYOS_TCP_MSS 'oifname "<IFNAME>" tcp flags & (syn|rst) == syn tcp option maxseg size set rt mtu'
or
nft add rule raw VYOS_TCP_MSS 'oifname "<IFNAME>" tcp flags & (syn|rst) == syn tcp option maxseg size 1461-65535 tcp option maxseg size set 1460'

There should also be an additional rule for forward, something like eg:

chain mangle_forward { 
  type filter hook forward priority mangle; policy accept;
  iifname "<IFNAME>" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu
}

Per the nftables documentation:
Note: The TCP maximum segment size is announced through TCP options in the original syn and the reply syn+ack packets. TCP maximum segment size is not negotiated, the RFC specifies that it is possible to have different TCP maximum segment size in each direction of the flow. Therefore, make sure you mangle both the TCP options of the original syn and the reply syn+ack packets. - https://wiki.nftables.org/wiki-nftables/index.php/Mangling_packet_headers

If useful I can include a diagram of when the forward mss adjustment is required.

Details

Version
-
Is it a breaking change?
Behavior change
Issue type
Bug (incorrect behavior)

Event Timeline

Firefishy created this object in space S1 VyOS Public.

Applies both to IPv4 and IPv6 per applicable vyos adjust-mss options.

I am happy to produce a pull request which adds the missing forward chain.

PR: https://github.com/vyos/vyos-1x/pull/4950 , although to be honest I am not perfectly happy with the implementation, there is likely a better way to implement it.

Viacheslav changed the task status from Open to In progress.Thu, Jan 22, 10:36 AM
Viacheslav assigned this task to Firefishy.

Based on feedback from the PR, I will do further investigation, come up with a proper test case and comparison with how others (eg: OpenWRT) implement MSS adjustment.