Hi Dave:
This patch makes ipt_TCPMSS use the correct MTU value for clamping.
This is a bit tricky actually since TCPMSS can be used in FORWARD,
LOCAL_OUT as well as POST_ROUTING.
In the first two cases we haven't performed IPsec yet so dst_mtu
obviously does the right thing. As it is, POST_ROUTING is performed
after xfrm_output so MSS clamping is useless there.
With Patrick's IPsec netfilter stuff, there will be a POST_ROUTING
processing before IPsec processing, in which case dst_mtu also returns
exactly what we want.
Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
BTW Patrick, how is the IPsec netfilter stuff going?
Cheers,
--
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
xfrm-22
Description: Text document
|