Am Donnerstag, 6. Dezember 2007 14:55 schrieb David Miller:
> You keep ignoring the fact that, as Herbert and I discussed, not
> blocking for IPSEC resolution will make some connect() cases fail that
> would otherwise not fail.
>
> There are two sides to this issue, and we need to consider them
> both.
as far as I've understood Herbert's patch, at least TCP connect can be fixed
so that non blocking connect() will neither fail nor block, but just use the
first or second retransmission of the SYN packet to complete the handshake
after IPSEC is up. As this will fix the common breakage case, just do so and
keep UDP sendmsg() etc for later.
You are looking at this issue too much from the kernel side. Admitted, this is
a corner case, but therefore nobody cares if connection completion takes two
SYNs and three seconds instead of one SYN and may be two seconds. But
application developers and users will validly complain if their applications
block unexpectedly for hours just because some random provider has a network
outage and IPSEC cannot come up.
Stefan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
