linux-ipsec: IPSEC vs. fragments

> > but when i enable "IP: Always defragment" kernel option,
> > almost everything works fine.
>
> Right. IPSEC is not able to deal with fragments. It is not allowed to
> deal with fragments per: the specifications.

I've always skimmed rather lightly over the fragmentation stuff in the specs -- it's a messy issue -- but spurred by this, I went back and had a look. Unless I've missed something, only transport mode is allowed to insist that it see only whole packets. Tunnel mode is supposed to handle them, barring some situations -- e.g., SPD specifications which require knowing the port number -- where it doesn't have enough information.

                                                          Henry Spencer
                                                       henry@spsystems.net
                                                     (henry@zoo.toronto.edu)