| From: Eric Garver egarver@redhat.com
Thanks for the useful reply. I hope the project benefits from naive questions.
| It's a doc bug. tcp-mss-clamp is only valid inside of a `<rich>` | element.
Is <rule> the same as <rich>? firewalld.policy(5) doesn't mention <rich>.
This is accepted in my policy XML file
<?xml version="1.0" encoding="utf-8"?> <policy priority="100" target="ACCEPT"> <ingress-zone name="FedoraServer"/> <egress-zone name="external"/> <rule> <tcp-mss-clamp value="1492"/> </rule> </policy>
This is not allowed by the syntax described in firewalld.policy(5).
I don't know that it is doing anything. It doesn't fix my particular problem.
I tried this to see if the clamping showed up in the netfilter configuration: nft list ruleset | grep -i mss It lists nothing. I'm not adept at nft, so this might not be the right test.
firewalld.policy(5) gives the syntax for rich rules twice. It would be better to only have one description. This wold be less confusing and it would prevent divergence. I think that it should include clamping.
Perhaps rich rules should be described only in their own man page. This is assuming the rules are the same whether they are for a zone or a policy object. firewalld.richlang(5) would seem to be the right place but it doesn't talk about XML. It says to look at firewalld.zone(5) and doesn't mention firewalld.policy(5) (that seems like a bug).
firewalld.richlang(5) lists Tcp-Mss-Clamp but the syntax doesn't seem to have a place for it. I guess that it is syntactically like masquerade but that isn't what the page says.
Why is Tcp-Mss-Clamp capitalized this way in filrewalld.richlanguage(5)? The natural way to capitalize it would be TCP-MSS-clamp. But all lower case is probably more humane. I notice that ICMP is all-caps.