From ed3209681d966705c557dcf7588baec74ec2918b Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Sat, 3 Oct 2026 20:50:13 +1000
Subject: [PATCH] Load MSS option via tcpopt exthdr op in clamp rule

---
 internal/nftables/compiler.go      |  4 ++--
 internal/nftables/compiler_test.go | 23 ++++++++++++++++++-----
 2 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/internal/nftables/compiler.go b/internal/nftables/compiler.go
index 45e6549..018b72f 100644
--- a/internal/nftables/compiler.go
+++ b/internal/nftables/compiler.go
@@ -790,7 +790,7 @@ func (c *Compiler) compileMSSClamp(state *FirewallState) {
 					Type:         2,
 					Offset:       2,
 					Len:          2,
-					Op:           0,
+					Op:           expr.ExthdrOpTcpopt,
 				},
 				&expr.Cmp{Op: expr.CmpOpGt, Register: 1, Data: mssBytes},
 				&expr.Immediate{Register: 1, Data: mssBytes},
@@ -799,7 +799,7 @@ func (c *Compiler) compileMSSClamp(state *FirewallState) {
 					Type:           2,
 					Offset:         2,
 					Len:            2,
-					Op:             1,
+					Op:             expr.ExthdrOpTcpopt,
 				},
 			)
 			state.Rules["forward"] = append(state.Rules["forward"], ManagedRule{
diff --git a/internal/nftables/compiler_test.go b/internal/nftables/compiler_test.go
index 84fa751..9204028 100644
--- a/internal/nftables/compiler_test.go
+++ b/internal/nftables/compiler_test.go
@@ -1,6 +1,7 @@
 package nftables
 
 import (
+	"reflect"
 	"testing"
 
 	"github.com/google/nftables/expr"
@@ -1197,14 +1198,26 @@ func TestCompile_MSSClamp(t *testing.T) {
 		t.Fatalf("Compile() error: %v", err)
 	}
 
-	found := false
-	for _, r := range state.Rules["forward"] {
+	var rule *ManagedRule
+	for i, r := range state.Rules["forward"] {
 		if r.Tag == "mss:eth1" {
-			found = true
+			rule = &state.Rules["forward"][i]
 		}
 	}
-	if !found {
-		t.Error("MSS clamp rule not found in forward chain")
+	if rule == nil {
+		t.Fatal("MSS clamp rule not found in forward chain")
+	}
+
+	mss := []byte{0x05, 0x78}
+	want := []expr.Any{
+		&expr.Exthdr{DestRegister: 1, Type: 2, Offset: 2, Len: 2, Op: expr.ExthdrOpTcpopt},
+		&expr.Cmp{Op: expr.CmpOpGt, Register: 1, Data: mss},
+		&expr.Immediate{Register: 1, Data: mss},
+		&expr.Exthdr{SourceRegister: 1, Type: 2, Offset: 2, Len: 2, Op: expr.ExthdrOpTcpopt},
+	}
+	got := rule.Exprs[len(rule.Exprs)-len(want):]
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("MSS clamp exprs = %#v, want %#v", got, want)
 	}
 }