lkml.org 
[lkml]   [1999]   [Aug]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: IPSEC transport mode w/2.2.x kernels and large packets
    Date
    From
    > > Set the MTU to 64K
    > > Set the MSS on the routers to the estimated path mtu
    >
    > You propose to rewrite the TCP MSS option on the routers while tunneling ?

    Typo - routes

    > of ICMP to avoid this potential attack? This would sound like overkill
    > to me, and there would be still enough other ways to generate retry packets
    > left (e.g. with TCP).

    Not really.

    > Also the tunnel start point has to be secured anyways, otherwise
    > all the encryption wouldn't make sense. Similar for the tunnel endpoint.
    >
    > Or do I miss something?

    The DF frames are coming from hosts that the tunnel passes through, not
    from inside the tunnel. That is the problem.

    Frames from the tunnel itself are protected and encrypted, but any icmp
    generated by the tunnel itself are unencrypted and unsigned so cannot be
    trusted

    Alan


    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.rutgers.edu
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:53    [W:3.740 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site