lkml.org 
[lkml]   [1999]   [Aug]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: linux-ipsec: Re: IPSEC transport mode w/2.2.x kernels and large packets
Date
Hello!

> bulk of our code should be called from a firewall chain. This does
> not help us now.

It means only one thing. That bulk of your code should not be called
from firewall chain. IPsec sits at socket layer. As minimum, you have
to teach socket, that it should not fragment packet.

Essentially, it means that ip_build_xmit is bypassed as whole
and policy decisions are made before you started to create buffer.
If you will transform packet, ip_build_xmit is uselless overhead,
it is so complicated because it is optimized for direct read, combined
with checksumming.


> skb->dev. The difference is they do not increase the packet size in
> the process, which we do.

Nobody prohibited you to reallocate it at any convenient moment.
Especially, after you decided to use virtual devices.


> The only ones I can use as a reference are KAME and OpenBSD. The
> former should be interesting. Both use mbufs!

Also both they use a bit different formatting conventions, KR C
and names sort of "ourfinisacked". Insert underscores, and you will
see no differences more. 8)

Alexey

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:53    [W:0.111 / U:0.104 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site