[lkml]   [1999]   [Aug]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: IPSEC transport mode w/2.2.x kernels and large packets
    > > Typo - routes
    > Hmm, shifting state to people who shouldn't need to know.

    Shifting policy to userspace and the daemons involved. Which is where it should
    be. The whole point of the mss option originally was to allow users to drop
    the MSS of a path for better performance.

    > The hosts don't know that they communicating with a tunnel. So they don't
    > know that they're supposed to ignore ICMP_FRAG_NEEDED. They don't. If the
    > IPSec host doesn't generate it, someone else will. To avoid it you have
    > to make sure that the network after the tunnel is secured.

    Correct. But think about transport mode

    > I don't see any advantage in breaking IP, just to avoid one possible DoS,
    > when there are lots of others anyways, which cannot be avoided.

    Its not breaking IP.

    To do IPSEC with DF does require a little kernel tweaking because the
    slack space for the crypto headers needs to be factored into the path mtu
    computation. That can wait until after the basic solution

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:53    [W:0.019 / U:13.256 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site