Messages in this thread | | | Date | Tue, 10 Aug 1999 12:29:50 -0400 (EDT) | From | Henry Spencer <> | Subject | Re: linux-ipsec: Re: IPSEC transport mode w/2.2.x kernels and large packets |
| |
On Tue, 10 Aug 1999 kuznet@ms2.inr.ac.ru wrote: > It means only one thing. That bulk of your code should not be called > from firewall chain. IPsec sits at socket layer.
No, in a security gateway IPSEC sits at the firewall level -- sockets are not involved, because the traffic is coming from elsewhere, not from local users.
(We do wish to support local users with FreeS/WAN, but our single most important application is in security gateways, because such a gateway can encrypt the traffic of an entire subnet without requiring changes to the software on every single computer in the subnet.)
> As minimum, you have > to teach socket, that it should not fragment packet.
Unfortunately, we have no choice in this area. We must handle whatever packets are being sent through the gateway. We do not even have the option of reducing the MTU, because that breaks too much (badly written, non-Linux) software.
Henry Spencer henry@spsystems.net (henry@zoo.toronto.edu)
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |