#!/bin/sh
# === MSS clamp persistence (坑 #12 part 3 + 坑 #6 2026-07-25 加固) ===
# fw4 reload (triggered by any ifup) wipes the nft rule added by 20-vxlan hotplug.
# br_netfilter 晚加载会把 bridge-nf-call-* sysctl 重置回 0 (sysctl.d 开机时键不存在被静默跳过)。
# This iface hotplug re-asserts both after every interface ifup event (idempotent).
[ "$ACTION" = "ifup" ] || exit 0
sleep 2  # wait for fw4 reload to complete
sysctl -w net.bridge.bridge-nf-call-iptables=1 >/dev/null 2>&1
sysctl -w net.bridge.bridge-nf-call-ip6tables=1 >/dev/null 2>&1
sysctl -w net.bridge.bridge-nf-call-arptables=1 >/dev/null 2>&1
nft list chain inet fw4 mangle_forward 2>/dev/null | grep -q 'set 1360' ||     nft add rule inet fw4 mangle_forward 'iifname "br-lan" tcp flags syn tcp option maxseg size set 1360' 2>/dev/null
exit 0