[lkml]   [1999]   [Aug]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: linux-ipsec: Re: IPSEC transport mode w/2.2.x kernels and large packets
On Tue, 10 Aug 1999 wrote:
> It means only one thing. That bulk of your code should not be called
> from firewall chain. IPsec sits at socket layer.

No, in a security gateway IPSEC sits at the firewall level -- sockets
are not involved, because the traffic is coming from elsewhere, not
from local users.

(We do wish to support local users with FreeS/WAN, but our single most
important application is in security gateways, because such a gateway can
encrypt the traffic of an entire subnet without requiring changes to the
software on every single computer in the subnet.)

> As minimum, you have
> to teach socket, that it should not fragment packet.

Unfortunately, we have no choice in this area. We must handle whatever
packets are being sent through the gateway. We do not even have the
option of reducing the MTU, because that breaks too much (badly written,
non-Linux) software.

Henry Spencer

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:53    [W:0.045 / U:3.096 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site