[Bug 242744] IPSec in transport mode between FreeBSD hosts blackholes TCP traffic

bugzilla-noreply at freebsd.org bugzilla-noreply at freebsd.org
Sat Dec 21 08:51:56 UTC 2019


--- Comment #6 from Eugene Grosbein <eugen at freebsd.org> ---
OTOH, RFC 2401 Appendix B https://tools.ietf.org/html/rfc2401#page-1-48 states
that packets generated by IPSec transport mode must be allowed to fragment over
the path and this is incompatible with current behaviour keeping DF=1 for TCP
and may be an error in our IPSEC stack. Adding ae@ to CC: list.

Andrey, what is your opinion on the problem? Should we clear DF bit
unconditionally for outgoing IPv4 IPSec transport mode packets?

You are receiving this mail because:
You are the assignee for the bug.

More information about the freebsd-net mailing list