IPSec transport mode, mtu, fragmentation...

[Victor Sudakov]

Andrey V. Elsukov wrote:
> On 20.12.2019 19:22, Victor Sudakov wrote:
> >> What's the root of the problem? ESP packets cannot get fragmented or
> >> what? 
> > 
> > Wireshark has shown that the "Don't Fragment" flag is set on all ESP
> > (protocol 50) packets. Who does this, why, and how can I switch it off
> > globally?
> 
> Hi,
> 
> I think this DF flag is originally from TCP packet.

You are probably right. I did not think of this.

> ESP xform for transport mode just replaces protocol in IP header and
> adds some info to the end of a packet.

It is rather easy to verify your theory. If you are right, then
disabling net.inet.tcp.path_mtu_discovery globally should remove the DF
flags from the ESP packets too, right?

Of course, net.inet.tcp.path_mtu_discovery=0 is not a solution, it's just
a way to check the origin of the DF flag.

And if you are right, what does it mean to us? Did you see
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242744 already ?

My ultimate wish is to make transport mode work out of the box, without
any workarounds like additional host routes or firewall rules.

-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
2:5005/49 at fidonet http://vas.tomsk.ru/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 455 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-net/attachments/20191223/8d3e92a3/attachment.sig>