#!/bin/sh
# === MSS clamp persistence (坑 #12 part 3) ===
# fw4 reload (triggered by any ifup) wipes the nft rule added by 20-vxlan hotplug.
# This iface hotplug re-adds the rule after every interface ifup event,
# but only if the rule is missing (idempotent).
# Idempotency: grep for the unique "set 1360" string before adding.
[ "$ACTION" = "ifup" ] || exit 0
sleep 2  # wait for fw4 reload to complete
nft list chain inet fw4 mangle_forward 2>/dev/null | grep -q 'set 1360' || \
    nft add rule inet fw4 mangle_forward 'iifname "br-lan" tcp flags syn tcp option maxseg size set 1360' 2>/dev/null
exit 0