On Tue, Aug 08, 2023 at 01:09:12PM -0400, D. Hugh Redelmeier wrote:
| From: Eric Garver egarver@redhat.com
Thanks for the useful reply. I hope the project benefits from naive questions.
| It's a doc bug. tcp-mss-clamp is only valid inside of a `<rich>` | element.
Is <rule> the same as <rich>? firewalld.policy(5) doesn't mention <rich>.
It should be "<rule>". My bad. :)
This is accepted in my policy XML file
<?xml version="1.0" encoding="utf-8"?>
<policy priority="100" target="ACCEPT"> <ingress-zone name="FedoraServer"/> <egress-zone name="external"/> <rule> <tcp-mss-clamp value="1492"/> </rule> </policy>
This is not allowed by the syntax described in firewalld.policy(5).
That's a doc bug. It's valid.
I don't know that it is doing anything. It doesn't fix my particular problem.
I tried this to see if the clamping showed up in the netfilter configuration: nft list ruleset | grep -i mss It lists nothing. I'm not adept at nft, so this might not be the right test.
Perhaps these above zones are not actually active (have interfaces/sources).
Can you show --get-active-zones ?
firewalld.policy(5) gives the syntax for rich rules twice. It would be better to only have one description. This wold be less confusing and it would prevent divergence. I think that it should include clamping.
Perhaps rich rules should be described only in their own man page. This is assuming the rules are the same whether they are for a zone or a policy object. firewalld.richlang(5) would seem to be the right place but it doesn't talk about XML. It says to look at firewalld.zone(5) and doesn't mention firewalld.policy(5) (that seems like a bug).
firewalld.richlang(5) lists Tcp-Mss-Clamp but the syntax doesn't seem to have a place for it. I guess that it is syntactically like masquerade but that isn't what the page says.
Why is Tcp-Mss-Clamp capitalized this way in filrewalld.richlanguage(5)? The natural way to capitalize it would be TCP-MSS-clamp. But all lower case is probably more humane. I notice that ICMP is all-caps.
Sorry about all these. Please open a github issue for these doc bugs.