Subject: [Ipsec] Reassembly for ipsec

From: "M.Chenna kesava Reddy" <[email-masked]>
Date: Wed, 03 Nov 2004 20:06:58 +0530

Hi,
Can any one clarify me regarding reassmbly for ipsec.
Say in SG which is supporting tunnel mode, will  receive fragmented 
packets from host behind that SG, and we need to apply ipsec in tunnel 
mode in the outbound  processing of this  fragmented packet. here can we 
apply ipsec on to fragments.
Say we applied ipsec encapsulation on to this fragment, its size is 
increased by IP + ESP, say size is exceeded MTU of the interface, do I 
need to fragment it before sending it to interface.
Say SG received packet from internet and it is fragment of tunneled 
packet, do I need to reassemble the packet before applying ipsec inbound 
processing.
In the case of routers(SG), we should not do any reassembly I think, is 
this  a performance hit.
Does all the openSSL cryptography algorithms needs contiguous buffer 
means  it  won't  handle mbufs in links, then we need to write all this 
mbuf's(fragments) in to one big buffer before sending it to cryptography. 

thx
mcreddy

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Wed, 3 Nov 2004 12:09:24 -0500

At 8:06 PM +0530 11/3/04, M.Chenna kesava Reddy wrote:
>packets from host behind that SG, and we need to apply ipsec in 
>tunnel mode in the outbound  processing of this  fragmented packet. 
>here can we apply ipsec on to fragments.
>increased by IP + ESP, say size is exceeded MTU of the interface, do 
>I need to fragment it before sending it to interface.

you must fragment the packet before transmitting it, since, in your 
example, the protected packet now exceeds the PMTU. the simplest case 
is to fragment after IPsec processing, although fragmenting prior to 
processing is also now allowed.

>packet, do I need to reassemble the packet before applying ipsec 
>inbound processing.
>In the case of routers(SG), we should not do any reassembly I think, 
>is this  a performance hit.

you need to reassemble IF the fragmentation occurred after IPsec 
processing, otherwise you will not be able to perform processing on 
non-initial fragments.

Steve

---

From: Stephen Kent <[email-masked]>
Date: Wed, 3 Nov 2004 12:09:24 -0500

Steve