From: Herbert Xu <[EMAIL PROTECTED]> Date: Wed, 5 Dec 2007 18:39:27 +1100
> On Tue, Dec 04, 2007 at 11:34:32PM -0800, David Miller wrote: > > > > TCP has some built-in assumptions about characteristics of > > interent links and what constitutes a timeout which is "too long" > > and should thus result in a full connection failure. > > > > IPSEC changes this because of IPSEC route resolution via > > ISAKMP. > > > > With this in mind I can definitely see people preferring > > the "block until IPSEC resolves" behavior, especially for > > something like, say, periodic remote backups and stuff like > > that where you really want the thing to just sit and wait > > for the connect() to succeed instead of failing. > > Hmm, but connect(2) should succeed in that case thanks to the > blackhole route, no? The subsequent SYNs will then be dropped > until the IPsec SAs are in place. If it hits sysctl_tcp_syn_retries SYN attempts, the connect will hard fail. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
