Re: [15/*] [INET] Fix IPsec calculation in ip_append_data/ip6_append_data

[Mika Penttilä <mika.penttila@xxxxxxxxxxx>]

Herbert Xu wrote:

> Hi Dave:
>
> On Tue, Mar 15, 2005 at 08:19:04PM +1100, herbert wrote:
>  
>
> > This patch fixes the IPsec overhead handling in ip_append_data and
> > ip6_append_data.  As it is they assume that the IPsec overhead is
> > constant.  This is not true as with ESP the IPsec overhead will vary
> > as the MTU varies.
> >    
>
> This patch is wrong.  This is the *one* place where we do need to
> use the path MTU.  The reason is that when the packet is fragmented
> we only pay for the IPsec overhead once over all and not once for
> each fragment.
>
> Please revert it for now.
>
> The trailer_len in ip_append_data is not quite right as the trailer's
> length depends on the length of the entire packet.  However, it should
> be harmless since ESP knows how to extend the packet when necessary.
>
> Thanks,
>  
Shouldn't ip_output also use the path variant, dst_mtu(skb->dst->path), 
it's surely after ipsec- processing?

--Mika