lkml.org 
[lkml]   [1999]   [Aug]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: linux-ipsec: Re: IPSEC transport mode w/2.2.x kernels and large packets
On Tue, 10 Aug 1999 kuznet@ms2.inr.ac.ru wrote:
> It means only one thing. That bulk of your code should not be called
> from firewall chain. IPsec sits at socket layer.

No, in a security gateway IPSEC sits at the firewall level -- sockets
are not involved, because the traffic is coming from elsewhere, not
from local users.

(We do wish to support local users with FreeS/WAN, but our single most
important application is in security gateways, because such a gateway can
encrypt the traffic of an entire subnet without requiring changes to the
software on every single computer in the subnet.)

> As minimum, you have
> to teach socket, that it should not fragment packet.

Unfortunately, we have no choice in this area. We must handle whatever
packets are being sent through the gateway. We do not even have the
option of reducing the MTU, because that breaks too much (badly written,
non-Linux) software.

Henry Spencer
henry@spsystems.net
(henry@zoo.toronto.edu)


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:53    [from the cache]
©2003-2014 Jasper Spaans. Advertise on this site