Messages in this thread | | | Subject | Re: IPSEC transport mode w/2.2.x kernels and large packets | Date | Sat, 7 Aug 1999 19:08:33 +0100 (BST) | From | Alan Cox <> |
| |
> > Right, IPSECed packets should arguably never have DF set. From the > > RFCs, IIRC, this is configurable. > > They should. Writing a protocol in the 90ies which does not support > path mtu discovery is a very bad idea. Fragmented packets mean that
They thought about this, but there are some very very inconvient problems with ripping every internet router out and enforcing mandatory IP-AH on all routers with key exchanges and webs of trust.
Sometimes mathematics forces bad over "not possible"
> If you want to support IPv6 you'll need that anyways. DF is the default > there and cannot be turned off.
IPv6 has a much higher minimum MTU, the issue basically doesnt arise as the attacks dont work.
> Just set the MTU of the device correct. Then it'll happen for you.
Pity everything else then breaks
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |