Date: Fri, 17 Jan 2020 12:49:08 +0300 From: "Andrey V. Elsukov" <bu7cher@yandex.ru> To: Victor Sudakov <vas@sibptus.ru>, Eugene Grosbein <eugen@grosbein.net> Cc: freebsd-net@freebsd.org, Michael Tuexen <tuexen@freebsd.org> Subject: Re: IPSec transport mode, mtu, fragmentation... Message-ID: <7c153a5a-db38-2770-89c7-9f95f59d29de@yandex.ru> In-Reply-To: <20200117093645.GA51899@admin.sibptus.ru> References: <20191220152314.GA55278@admin.sibptus.ru> <4cc83b85-dd30-8c0d-330e-aa549ce98c98@yandex.ru> <f9b7357e-ced1-4ce5-40d5-8e3dcad42442@yandex.ru> <d263a709-63cf-7da5-1747-8a6791f6503f@grosbein.net> <20200116155305.GA465@admin.sibptus.ru> <55f7bafa-24c4-9810-0d21-f82cb332ee2d@grosbein.net> <20200116160745.GA1356@admin.sibptus.ru> <72355e03-1cf8-c58f-3aec-b0a21e631870@grosbein.net> <20200117093645.GA51899@admin.sibptus.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --61B2Pq2xS9VT5qbiTNl5r8Kb9IEdTujJx Content-Type: multipart/mixed; boundary="PRHbJGYtaUEHm3ZCLRWbC1yeLxWmDMTCk"; protected-headers="v1" From: "Andrey V. Elsukov" <bu7cher@yandex.ru> To: Victor Sudakov <vas@sibptus.ru>, Eugene Grosbein <eugen@grosbein.net> Cc: freebsd-net@freebsd.org, Michael Tuexen <tuexen@freebsd.org> Message-ID: <7c153a5a-db38-2770-89c7-9f95f59d29de@yandex.ru> Subject: Re: IPSec transport mode, mtu, fragmentation... References: <20191220152314.GA55278@admin.sibptus.ru> <4cc83b85-dd30-8c0d-330e-aa549ce98c98@yandex.ru> <f9b7357e-ced1-4ce5-40d5-8e3dcad42442@yandex.ru> <d263a709-63cf-7da5-1747-8a6791f6503f@grosbein.net> <20200116155305.GA465@admin.sibptus.ru> <55f7bafa-24c4-9810-0d21-f82cb332ee2d@grosbein.net> <20200116160745.GA1356@admin.sibptus.ru> <72355e03-1cf8-c58f-3aec-b0a21e631870@grosbein.net> <20200117093645.GA51899@admin.sibptus.ru> In-Reply-To: <20200117093645.GA51899@admin.sibptus.ru> --PRHbJGYtaUEHm3ZCLRWbC1yeLxWmDMTCk Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 17.01.2020 12:36, Victor Sudakov wrote: > Back to the point. I've figured out that both encrypted (in transport > mode) and unencrypted TCP segments have the same MSS=3D1460. Then I'm > completely at a loss how the encrypted packets avoid being fragmented. > TCP has no way to know in advance that encryption overhead will be > added. For IPsec endpoints (i.e. when you encrypt own sessions) TCP for each outgoing packet invokes IPSEC_HDRSIZE() method, that returns approximate size required for IPsec, and using this information it calculates MSS. I think this should work in this way. --=20 WBR, Andrey V. Elsukov --PRHbJGYtaUEHm3ZCLRWbC1yeLxWmDMTCk-- --61B2Pq2xS9VT5qbiTNl5r8Kb9IEdTujJx Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/ iQEzBAEBCAAdFiEE5lkeG0HaFRbwybwAAcXqBBDIoXoFAl4hgxQACgkQAcXqBBDI oXqv+ggAv07sU9tZpEWpZtjNLvUxRT0NJCVvQ8eiNK4DsnMdGWGyQ1iNt6XD+5Kf uTOHD+vCt+naH/q+YG1Kp1QrevdAjMro1N0zDLi5Tc5F1x7U+5s7WOzxVl/7dgPE v+RngWrthhNKALUVWbhHm7wdJT3lWxVtfIEBxo0aAwuUAUeWCyUgzUw7yk9mLN1e sjIxX7Fnofr00+/qjEN0Ik8m4VfQvMO8+JNvuuRIhvNkUrTySzmfSwtiOZKyjJUH v9MLaoXAg5AjwJfA6hJ6kkP2Og98DK/fK8ylCx26CCoywE3BLMaqzfdYMvIjsMPd Y7lBhDjjsIbuKAMB6r6/NBnAutdaIw== =wrnW -----END PGP SIGNATURE----- --61B2Pq2xS9VT5qbiTNl5r8Kb9IEdTujJx--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?7c153a5a-db38-2770-89c7-9f95f59d29de>