[lkml]   [1999]   [Aug]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: linux-ipsec: Re: IPSEC transport mode w/2.2.x kernels and large packets
    On Tue, 10 Aug 1999 wrote:
    > It means only one thing. That bulk of your code should not be called
    > from firewall chain. IPsec sits at socket layer.

    No, in a security gateway IPSEC sits at the firewall level -- sockets
    are not involved, because the traffic is coming from elsewhere, not
    from local users.

    (We do wish to support local users with FreeS/WAN, but our single most
    important application is in security gateways, because such a gateway can
    encrypt the traffic of an entire subnet without requiring changes to the
    software on every single computer in the subnet.)

    > As minimum, you have
    > to teach socket, that it should not fragment packet.

    Unfortunately, we have no choice in this area. We must handle whatever
    packets are being sent through the gateway. We do not even have the
    option of reducing the MTU, because that breaks too much (badly written,
    non-Linux) software.

    Henry Spencer

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:53    [W:0.018 / U:139.016 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site