Re: [IPSec]A problem with xfrm_check_output()

From: Herbert Xu (
Date: Fri Jul 25 2003 - 04:54:35 EST

Zhao, Forrest <> wrote:
> As you have pointed out in the last mail, if we check against
> precaluclated
> dst->pmtu before doing transformation, it will result in underestimation
> of mtu
> for esp due to alignment paddings and for IPCOMP it will be totally
> unfair.

I disagree with the part about IPCOMP SAs. We should always calculate
the MTUs for IPCOMP based on the worst-case scenario, that is, as if
the packet is not compressible.

This might seem unfair to the packet that has just arrived, but sooner
or later we're going to get an uncompressible packet forcing the MTU

Debian GNU/Linux 3.0 is out! ( )
Email:  Herbert Xu ~{PmV>HI~} <>
Home Page:
PGP Key:
To unsubscribe from this list: send the line "unsubscribe linux-net" in
the body of a message to
More majordomo info at

This archive was generated by hypermail 2b29 : Thu Jul 31 2003 - 22:00:01 EST