Added support for --clamp-mss-to-pmtu option.

diff --git a/extensions/libipt_TCPMSS.c b/extensions/libipt_TCPMSS.c
index db8757b7aa999cd584deac90b73d55038bb1db69..03ce1bdbc482e3450c0df0f7607bd5e030a4bd53 100644 (file)
--- a/extensions/libipt_TCPMSS.c
+++ b/extensions/libipt_TCPMSS.c
@@ -21,13 +21,15 @@ static void
 help(void)
 {
        printf(
-"TCPMSS target v%s options:\n"
-"  --set-mss value                   Value to set MSS option to\n",
+"TCPMSS target v%s mutually-exclusive options:\n"
+"  --set-mss value               explicitly set MSS option to specified value\n"
+"  --clamp-mss-to-pmtu           automatically clamp MSS value to (path_MTU - 40)\n",
 NETFILTER_VERSION);
 }
 
 static struct option opts[] = {
        { "set-mss", 1, 0, '1' },
+       { "clamp-mss-to-pmtu", 0, 0, '2' },
        { 0 }
 };
 
@@ -53,14 +55,22 @@ parse(int c, char **argv, int invert, unsigned int *flags,
        case '1':
                if (*flags)
                        exit_error(PARAMETER_PROBLEM,
-                                  "TCPMSS target: Can't specify --set-mss twice");
-               if ((mssval = string_to_number(optarg, 0, 65535)) == -1)
+                                  "TCPMSS target: Only one option may be specified");
+               if ((mssval = string_to_number(optarg, 0, 65535 - 40)) == -1)
                        exit_error(PARAMETER_PROBLEM, "Bad TCPMSS value `%s'", optarg);
                
                mssinfo->mss = mssval;
                *flags = 1;
                break;
 
+       case '2':
+               if (*flags)
+                       exit_error(PARAMETER_PROBLEM,
+                                  "TCPMSS target: Only one option may be specified");
+               mssinfo->mss = IPT_TCPMSS_CLAMP_PMTU;
+               *flags = 1;
+               break;
+
        default:
                return 0;
        }
@@ -73,7 +83,7 @@ final_check(unsigned int flags)
 {
        if (!flags)
                exit_error(PARAMETER_PROBLEM,
-                          "TCPMSS target: Parameter --set-mss is required");
+                          "TCPMSS target: At least one parameter is required");
 }
 
 /* Prints out the targinfo. */
@@ -84,7 +94,10 @@ print(const struct ipt_ip *ip,
 {
        const struct ipt_tcpmss_info *mssinfo =
                (const struct ipt_tcpmss_info *)target->data;
-       printf("TCPMSS set %u ", mssinfo->mss);
+       if(mssinfo->mss == IPT_TCPMSS_CLAMP_PMTU)
+               printf("TCPMSS clamp to PMTU ");
+       else
+               printf("TCPMSS set %u ", mssinfo->mss);
 }
 
 /* Saves the union ipt_targinfo in parsable form to stdout. */
@@ -94,7 +107,10 @@ save(const struct ipt_ip *ip, const struct ipt_entry_target *target)
        const struct ipt_tcpmss_info *mssinfo =
                (const struct ipt_tcpmss_info *)target->data;
 
-       printf("--set-mss %u ", mssinfo->mss);
+       if(mssinfo->mss == IPT_TCPMSS_CLAMP_PMTU)
+               printf("--clamp-mss-to-pmtu ");
+       else
+               printf("--set-mss %u ", mssinfo->mss);
 }
 
 struct iptables_target mss