[Bug 242744] IPSec in transport mode between FreeBSD hosts blackholes TCP traffic

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242744

--- Comment #6 from Eugene Grosbein <eugen at freebsd.org> ---
OTOH, RFC 2401 Appendix B https://tools.ietf.org/html/rfc2401#page-1-48 states
that packets generated by IPSec transport mode must be allowed to fragment over
the path and this is incompatible with current behaviour keeping DF=1 for TCP
and may be an error in our IPSEC stack. Adding ae@ to CC: list.

Andrey, what is your opinion on the problem? Should we clear DF bit
unconditionally for outgoing IPv4 IPSec transport mode packets?

-- 
You are receiving this mail because:
You are the assignee for the bug.