Subject: Re: [15/*] [INET] Fix IPsec calculation in ip_append_data/ip6_append_data

From: Mika Penttilä <[email-masked]>
Date: Mon, 21 Mar 2005 18:14:07 +0200

Herbert Xu wrote:

>Hi Dave:
>
>On Tue, Mar 15, 2005 at 08:19:04PM +1100, herbert wrote:
>  
>
>>This patch fixes the IPsec overhead handling in ip_append_data and
>>ip6_append_data.  As it is they assume that the IPsec overhead is
>>constant.  This is not true as with ESP the IPsec overhead will vary
>>as the MTU varies.
>>    
>>
>
>This patch is wrong.  This is the *one* place where we do need to
>use the path MTU.  The reason is that when the packet is fragmented
>we only pay for the IPsec overhead once over all and not once for
>each fragment.
>
>Please revert it for now.
>
>The trailer_len in ip_append_data is not quite right as the trailer's
>length depends on the length of the entire packet.  However, it should
>be harmless since ESP knows how to extend the packet when necessary.
>
>Thanks,
>  
>
Shouldn't ip_output also use the path variant, dst_mtu(skb->dst->path), 
it's surely after ipsec- processing?

--Mika