lkml.org 
[lkml]   [1999]   [Aug]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: IPSEC transport mode w/2.2.x kernels and large packets
Date
From
> > Right, IPSECed packets should arguably never have DF set.  From the
> > RFCs, IIRC, this is configurable.
>
> They should. Writing a protocol in the 90ies which does not support
> path mtu discovery is a very bad idea. Fragmented packets mean that

They thought about this, but there are some very very inconvient problems
with ripping every internet router out and enforcing mandatory IP-AH on
all routers with key exchanges and webs of trust.

Sometimes mathematics forces bad over "not possible"

> If you want to support IPv6 you'll need that anyways. DF is the default
> there and cannot be turned off.

IPv6 has a much higher minimum MTU, the issue basically doesnt arise as the
attacks dont work.

> Just set the MTU of the device correct. Then it'll happen for you.

Pity everything else then breaks


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:53    [W:1.784 / U:0.064 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site