[IPSec]A problem with xfrm_check_output()

From: Zhao, Forrest (forrest.zhao@intel.com)
Date: Fri Jul 25 2003 - 02:17:33 EST


Hi, Alexey

After reading the code, I found a problem with function
xfrm_check_output()

As you have pointed out in the last mail, if we check against
precaluclated
dst->pmtu before doing transformation, it will result in underestimation
of mtu
for esp due to alignment paddings and for IPCOMP it will be totally
unfair.

The function xfrm_check_output() has the same problem, because it's
invoked
before doing transformation.

I think it's appropriate to invoke xfrm_check_output() after the
transformation.
Only after doing the transformation can we know the actual esp alignment
padding
and the actual IPCOMP packet size.

What's your advice?

Thanks,
Forrest

-
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html



This archive was generated by hypermail 2b29 : Thu Jul 31 2003 - 22:00:01 EST