Enforcing asymmetric TCP MSS?

Thread View: bit.listserv.openbsd-pf

2 messages

[T] Back to Threads [V] Tree View [G] Group Articles

2 total messages Started by Eric Lee Tue, 10 May 2011 08:46

#81

Author: Eric Lee
Date: Tue, 10 May 2011 08:46

24 lines
1530 bytes

Hi,

I'm trying to use scrub max-mss rules to create asymmetric MSS's.

Is this supported?  So far, I haven't got it to work (hence my post here).
The machine is running OpenBSD 4.9 with 2 network cards.

I have been trying things like:
match out on $ext proto tcp scrub(max-mss 1000) flags S/SA
match in on $ext proto tcp scrub(max-mss 500) flags SA/SA

Scrubbing on the other interface doesn't seem to work either.
match out on $int proto tcp scrub(max-mss 500) flags SA/SA

client <--> pf gateway <--> internet

With a sniffer on the client link and the internet link,
-client sends large MSS on initial syn (> 1000)
-pf scrubs MSS to 1000 on initial syn

-pf receives large MSS on syn+ack (> 1000)
-pf scrubs MSS to 1000 in syn+ack reply to client

Thanks!

Re: Enforcing asymmetric TCP MSS?

#82

Author: Henning Brauer
Date: Tue, 10 May 2011 13:16

21 lines
1745 bytes

* Eric Lee <elee25@gmail.com> [2011-05-10 10:30]:
> I'm trying to use scrub max-mss rules to create asymmetric MSS's.
> 
> Is this supported?  So far, I haven't got it to work (hence my post here).
> The machine is running OpenBSD 4.9 with 2 network cards.
> 
> I have been trying things like:
> match out on $ext proto tcp scrub(max-mss 1000) flags S/SA
> match in on $ext proto tcp scrub(max-mss 500) flags SA/SA

that doesn't work because only one of those two rules ever matches a
given connection, from then on the state decides.

using two match rules on different interfaces should work i think. the
only other option is stateless, but that is stupid for many many reasons.

-- 
Henning Brauer, hb@bsws.de, henning@openbsd.org
BS Web Services, http://bsws.de
Full-Service ISP - Secure Hosting, Mail and DNS Services
Dedicated Servers, Rootservers, Application Hosting

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads