1 files changed, 6 insertions, 0 deletions

diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index a75240f0d42b..afaebc766933 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -125,6 +125,12 @@ tcpmss_mangle_packet(struct sk_buff *skb,
 
         skb_put(skb, TCPOLEN_MSS);
 
+        /* RFC 879 states that the default MSS is 536 without specific
+         * knowledge that the destination host is prepared to accept larger.
+         * Since no MSS was provided, we MUST NOT set a value > 536.
+         */
+        newmss = min(newmss, (u16)536);
+
         opt = (u_int8_t *)tcph + sizeof(struct tcphdr);
         memmove(opt + TCPOLEN_MSS, opt, tcplen - sizeof(struct tcphdr));