__ __ __ __ _____ _ _ _____ _ _ _ | \/ | \ \ / / | __ \ (_) | | / ____| | | | | | \ / |_ __\ V / | |__) | __ ___ ____ _| |_ ___ | (___ | |__ ___| | | | |\/| | '__|> < | ___/ '__| \ \ / / _` | __/ _ \ \___ \| '_ \ / _ \ | | | | | | |_ / . \ | | | | | |\ V / (_| | || __/ ____) | | | | __/ | | |_| |_|_(_)_/ \_\ |_| |_| |_| \_/ \__,_|\__\___| |_____/|_| |_|\___V 2.1 if you need WebShell for Seo everyday contact me on Telegram Telegram Address : @jackleetFor_More_Tools:
<!DOCTYPE html>
<html lang="en" data-content_root="../">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>IPsec — The Linux Kernel documentation</title>
<link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=fa44fd50" />
<link rel="stylesheet" type="text/css" href="../_static/alabaster.css?v=3918102e" />
<script src="../_static/documentation_options.js?v=5929fcd5"></script>
<script src="../_static/doctools.js?v=9bcbadda"></script>
<script src="../_static/sphinx_highlight.js?v=dc90522c"></script>
<link rel="index" title="Index" href="../genindex.html" />
<link rel="search" title="Search" href="../search.html" />
<link rel="next" title="IP Sysctl" href="ip-sysctl.html" />
<link rel="prev" title="IP dynamic address hack-port v0.03" href="ip_dynaddr.html" />
<link rel="stylesheet" href="../_static/custom.css" type="text/css" />
</head><body>
<div class="document">
<div class="sphinxsidebar" role="navigation" aria-label="Main">
<div class="sphinxsidebarwrapper">
<p class="logo"><a href="../index.html">
<img class="logo" src="../_static/logo.svg" alt="Logo of The Linux Kernel"/>
</a></p>
<h1 class="logo"><a href="../index.html">The Linux Kernel</a></h1>
<p class="blurb">6.18.50</p>
<search id="searchbox" style="display: none" role="search">
<h3 id="searchlabel">Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="../search.html" method="get">
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
<input type="submit" value="Go" />
</form>
</div>
</search>
<script>document.getElementById('searchbox').style.display = "block"</script>
<p>
<h3 class="kernel-toc-contents">Contents</h3>
<input type="checkbox" class="kernel-toc-toggle" id = "kernel-toc-toggle" checked>
<label class="kernel-toc-title" for="kernel-toc-toggle"></label>
<div class="kerneltoc" id="kerneltoc">
<ul>
<li class="toctree-l1"><a class="reference internal" href="../process/development-process.html">Development process</a></li>
<li class="toctree-l1"><a class="reference internal" href="../process/submitting-patches.html">Submitting patches</a></li>
<li class="toctree-l1"><a class="reference internal" href="../process/code-of-conduct.html">Code of conduct</a></li>
<li class="toctree-l1"><a class="reference internal" href="../maintainer/index.html">Maintainer handbook</a></li>
<li class="toctree-l1"><a class="reference internal" href="../process/index.html">All development-process docs</a></li>
</ul>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="../core-api/index.html">Core API</a></li>
<li class="toctree-l1"><a class="reference internal" href="../driver-api/index.html">Driver APIs</a></li>
<li class="toctree-l1 current"><a class="reference internal" href="../subsystem-apis.html">Subsystems</a><ul class="current">
<li class="toctree-l2"><a class="reference internal" href="../subsystem-apis.html#core-subsystems">Core subsystems</a></li>
<li class="toctree-l2"><a class="reference internal" href="../subsystem-apis.html#human-interfaces">Human interfaces</a></li>
<li class="toctree-l2 current"><a class="reference internal" href="../subsystem-apis.html#networking-interfaces">Networking interfaces</a><ul class="current">
<li class="toctree-l3 current"><a class="reference internal" href="index.html">Networking</a></li>
<li class="toctree-l3"><a class="reference internal" href="../netlabel/index.html">NetLabel</a></li>
<li class="toctree-l3"><a class="reference internal" href="../infiniband/index.html">InfiniBand</a></li>
<li class="toctree-l3"><a class="reference internal" href="../isdn/index.html">ISDN</a></li>
<li class="toctree-l3"><a class="reference internal" href="../mhi/index.html">MHI</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="../subsystem-apis.html#storage-interfaces">Storage interfaces</a></li>
<li class="toctree-l2"><a class="reference internal" href="../subsystem-apis.html#other-subsystems">Other subsystems</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../locking/index.html">Locking</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../process/license-rules.html">Licensing rules</a></li>
<li class="toctree-l1"><a class="reference internal" href="../doc-guide/index.html">Writing documentation</a></li>
<li class="toctree-l1"><a class="reference internal" href="../dev-tools/index.html">Development tools</a></li>
<li class="toctree-l1"><a class="reference internal" href="../dev-tools/testing-overview.html">Testing guide</a></li>
<li class="toctree-l1"><a class="reference internal" href="../kernel-hacking/index.html">Hacking guide</a></li>
<li class="toctree-l1"><a class="reference internal" href="../trace/index.html">Tracing</a></li>
<li class="toctree-l1"><a class="reference internal" href="../fault-injection/index.html">Fault injection</a></li>
<li class="toctree-l1"><a class="reference internal" href="../livepatch/index.html">Livepatching</a></li>
<li class="toctree-l1"><a class="reference internal" href="../rust/index.html">Rust</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../admin-guide/index.html">Administration</a></li>
<li class="toctree-l1"><a class="reference internal" href="../kbuild/index.html">Build system</a></li>
<li class="toctree-l1"><a class="reference internal" href="../admin-guide/reporting-issues.html">Reporting issues</a></li>
<li class="toctree-l1"><a class="reference internal" href="../tools/index.html">Userspace tools</a></li>
<li class="toctree-l1"><a class="reference internal" href="../userspace-api/index.html">Userspace API</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../firmware-guide/index.html">Firmware</a></li>
<li class="toctree-l1"><a class="reference internal" href="../devicetree/index.html">Firmware and Devicetree</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../arch/index.html">CPU architectures</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../staging/index.html">Unsorted documentation</a></li>
</ul>
<ul>
<li class="toctree-l1"><a class="reference internal" href="../translations/index.html">Translations</a></li>
</ul>
</div>
<script type="text/javascript"> <!--
var sbar = document.getElementsByClassName("sphinxsidebar")[0];
let currents = document.getElementsByClassName("current")
if (currents.length) {
sbar.scrollTop = currents[currents.length - 1].offsetTop;
}
--> </script>
<div role="note" aria-label="source link">
<h3>This Page</h3>
<ul class="this-page-menu">
<li><a href="../_sources/networking/ipsec.rst.txt"
rel="nofollow">Show Source</a></li>
</ul>
</div>
</div>
</div>
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<section id="ipsec">
<h1>IPsec<a class="headerlink" href="#ipsec" title="Link to this heading">¶</a></h1>
<p>Here documents known IPsec corner cases which need to be keep in mind when
deploy various IPsec configuration in real world production environment.</p>
<ol class="arabic simple">
<li><dl class="simple">
<dt>IPcomp:</dt><dd><p>Small IP packet won’t get compressed at sender, and failed on
policy check on receiver.</p>
</dd>
</dl>
</li>
</ol>
<p>Quote from RFC3173:</p>
<div class="highlight-none notranslate"><div class="highlight"><pre><span></span>2.2. Non-Expansion Policy
If the total size of a compressed payload and the IPComp header, as
defined in section 3, is not smaller than the size of the original
payload, the IP datagram MUST be sent in the original non-compressed
form. To clarify: If an IP datagram is sent non-compressed, no
IPComp header is added to the datagram. This policy ensures saving
the decompression processing cycles and avoiding incurring IP
datagram fragmentation when the expanded datagram is larger than the
MTU.
Small IP datagrams are likely to expand as a result of compression.
Therefore, a numeric threshold should be applied before compression,
where IP datagrams of size smaller than the threshold are sent in the
original form without attempting compression. The numeric threshold
is implementation dependent.
</pre></div>
</div>
<p>Current IPComp implementation is indeed by the book, while as in practice
when sending non-compressed packet to the peer (whether or not packet len
is smaller than the threshold or the compressed len is larger than original
packet len), the packet is dropped when checking the policy as this packet
matches the selector but not coming from any XFRM layer, i.e., with no
security path. Such naked packet will not eventually make it to upper layer.
The result is much more wired to the user when ping peer with different
payload length.</p>
<p>One workaround is try to set “level use” for each policy if user observed
above scenario. The consequence of doing so is small packet(uncompressed)
will skip policy checking on receiver side.</p>
</section>
</div>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="footer">
©The kernel development community.
|
Powered by <a href="https://www.sphinx-doc.org/">Sphinx 8.1.3</a>
& <a href="https://alabaster.readthedocs.io">Alabaster 0.7.16</a>
|
<a href="../_sources/networking/ipsec.rst.txt"
rel="nofollow">Page source</a>
</div>
</body>
</html>| Name | Type | Size | Permission | Actions |
|---|---|---|---|---|
| caif | Folder | 0755 |
|
|
| device_drivers | Folder | 0755 |
|
|
| devlink | Folder | 0755 |
|
|
| diagnostic | Folder | 0755 |
|
|
| dsa | Folder | 0755 |
|
|
| mac80211_hwsim | Folder | 0755 |
|
|
| net_cachelines | Folder | 0755 |
|
|
| pse-pd | Folder | 0755 |
|
|
| 6lowpan.html | File | 9.97 KB | 0644 |
|
| 6pack.html | File | 18.06 KB | 0644 |
|
| af_xdp.html | File | 71.08 KB | 0644 |
|
| alias.html | File | 9.71 KB | 0644 |
|
| arcnet-hardware.html | File | 153.3 KB | 0644 |
|
| arcnet.html | File | 37.48 KB | 0644 |
|
| atm.html | File | 8.24 KB | 0644 |
|
| ax25.html | File | 8.75 KB | 0644 |
|
| bareudp.html | File | 10.56 KB | 0644 |
|
| batman-adv.html | File | 16.81 KB | 0644 |
|
| bonding.html | File | 140.89 KB | 0644 |
|
| bridge.html | File | 53.36 KB | 0644 |
|
| can.html | File | 120.11 KB | 0644 |
|
| can_ucan_protocol.html | File | 25.27 KB | 0644 |
|
| cdc_mbim.html | File | 25.28 KB | 0644 |
|
| checksum-offloads.html | File | 16.15 KB | 0644 |
|
| dctcp.html | File | 10.32 KB | 0644 |
|
| devmem.html | File | 24.33 KB | 0644 |
|
| dns_resolver.html | File | 15.11 KB | 0644 |
|
| driver.html | File | 20.41 KB | 0644 |
|
| eql.html | File | 31.48 KB | 0644 |
|
| ethtool-netlink.html | File | 274 KB | 0644 |
|
| failover.html | File | 8.43 KB | 0644 |
|
| fib_trie.html | File | 16.04 KB | 0644 |
|
| filter.html | File | 42.43 KB | 0644 |
|
| gen_stats.html | File | 14.2 KB | 0644 |
|
| generic-hdlc.html | File | 14.67 KB | 0644 |
|
| generic_netlink.html | File | 8.11 KB | 0644 |
|
| gtp.html | File | 20.55 KB | 0644 |
|
| ieee802154.html | File | 25.03 KB | 0644 |
|
| ila.html | File | 21.79 KB | 0644 |
|
| index.html | File | 108.18 KB | 0644 |
|
| ioam6-sysctl.html | File | 8.48 KB | 0644 |
|
| iou-zcrx.html | File | 16.63 KB | 0644 |
|
| ip-sysctl.html | File | 154.81 KB | 0644 |
|
| ip_dynaddr.html | File | 9.97 KB | 0644 |
|
| ipsec.html | File | 9.71 KB | 0644 |
|
| ipv6.html | File | 9.87 KB | 0644 |
|
| ipvlan.html | File | 16.87 KB | 0644 |
|
| ipvs-sysctl.html | File | 20.73 KB | 0644 |
|
| iso15765-2.html | File | 39.91 KB | 0644 |
|
| j1939.html | File | 99.33 KB | 0644 |
|
| kapi.html | File | 1.78 MB | 0644 |
|
| kcm.html | File | 21.67 KB | 0644 |
|
| l2tp.html | File | 47.74 KB | 0644 |
|
| lapb-module.html | File | 22.56 KB | 0644 |
|
| mac80211-injection.html | File | 12.37 KB | 0644 |
|
| mctp.html | File | 35.16 KB | 0644 |
|
| mpls-sysctl.html | File | 9.64 KB | 0644 |
|
| mptcp-sysctl.html | File | 13.33 KB | 0644 |
|
| mptcp.html | File | 19.74 KB | 0644 |
|
| msg_zerocopy.html | File | 19.72 KB | 0644 |
|
| multi-pf-netdev.html | File | 17.48 KB | 0644 |
|
| multiqueue.html | File | 13.21 KB | 0644 |
|
| napi.html | File | 43.36 KB | 0644 |
|
| net_dim.html | File | 76.45 KB | 0644 |
|
| net_failover.html | File | 16.3 KB | 0644 |
|
| netconsole.html | File | 31.44 KB | 0644 |
|
| netdev-features.html | File | 17.75 KB | 0644 |
|
| netdevices.html | File | 43.33 KB | 0644 |
|
| netfilter-sysctl.html | File | 8.43 KB | 0644 |
|
| netif-msg.html | File | 12.93 KB | 0644 |
|
| netmem.html | File | 14.84 KB | 0644 |
|
| nexthop-group-resilient.html | File | 24.56 KB | 0644 |
|
| nf_conntrack-sysctl.html | File | 15.77 KB | 0644 |
|
| nf_flowtable.html | File | 21.24 KB | 0644 |
|
| nfc.html | File | 13.73 KB | 0644 |
|
| oa-tc6-framework.html | File | 39.07 KB | 0644 |
|
| openvswitch.html | File | 21.15 KB | 0644 |
|
| operstates.html | File | 18.28 KB | 0644 |
|
| packet_mmap.html | File | 55.34 KB | 0644 |
|
| page_pool.html | File | 59.25 KB | 0644 |
|
| phonet.html | File | 16.92 KB | 0644 |
|
| phy-link-topology.html | File | 15.77 KB | 0644 |
|
| phy.html | File | 40.5 KB | 0644 |
|
| pktgen.html | File | 24.97 KB | 0644 |
|
| plip.html | File | 18.56 KB | 0644 |
|
| ppp_generic.html | File | 37.23 KB | 0644 |
|
| proc_net_tcp.html | File | 11.13 KB | 0644 |
|
| psp.html | File | 18.66 KB | 0644 |
|
| radiotap-headers.html | File | 14.73 KB | 0644 |
|
| rds.html | File | 29.39 KB | 0644 |
|
| regulatory.html | File | 18.44 KB | 0644 |
|
| representors.html | File | 25.79 KB | 0644 |
|
| rxrpc.html | File | 130.88 KB | 0644 |
|
| scaling.html | File | 40.25 KB | 0644 |
|
| sctp.html | File | 9.73 KB | 0644 |
|
| secid.html | File | 8.42 KB | 0644 |
|
| seg6-sysctl.html | File | 9.53 KB | 0644 |
|
| segmentation-offloads.html | File | 17.81 KB | 0644 |
|
| sfp-phylink.html | File | 41.09 KB | 0644 |
|
| skbuff.html | File | 29.22 KB | 0644 |
|
| smc-sysctl.html | File | 10.42 KB | 0644 |
|
| snmp_counter.html | File | 91.51 KB | 0644 |
|
| sriov.html | File | 9.46 KB | 0644 |
|
| statistics.html | File | 31.78 KB | 0644 |
|
| strparser.html | File | 19.15 KB | 0644 |
|
| switchdev.html | File | 39.55 KB | 0644 |
|
| sysfs-tagging.html | File | 10.95 KB | 0644 |
|
| tc-actions-env-rules.html | File | 8.87 KB | 0644 |
|
| tc-queue-filters.html | File | 9.33 KB | 0644 |
|
| tcp-thin.html | File | 10.33 KB | 0644 |
|
| tcp_ao.html | File | 35.85 KB | 0644 |
|
| team.html | File | 7.93 KB | 0644 |
|
| timestamping.html | File | 59.83 KB | 0644 |
|
| tipc.html | File | 384.61 KB | 0644 |
|
| tls-handshake.html | File | 21.18 KB | 0644 |
|
| tls-offload.html | File | 42.72 KB | 0644 |
|
| tls.html | File | 39.38 KB | 0644 |
|
| tproxy.html | File | 13.18 KB | 0644 |
|
| tuntap.html | File | 19 KB | 0644 |
|
| udplite.html | File | 23.04 KB | 0644 |
|
| vrf.html | File | 28.46 KB | 0644 |
|
| vxlan.html | File | 11.95 KB | 0644 |
|
| x25-iface.html | File | 10.9 KB | 0644 |
|
| x25.html | File | 10.07 KB | 0644 |
|
| xdp-rx-metadata.html | File | 27.46 KB | 0644 |
|
| xfrm_device.html | File | 19.14 KB | 0644 |
|
| xfrm_proc.html | File | 11.37 KB | 0644 |
|
| xfrm_sync.html | File | 15.85 KB | 0644 |
|
| xfrm_sysctl.html | File | 8.07 KB | 0644 |
|
| xsk-tx-metadata.html | File | 18.64 KB | 0644 |
|