• Herbert Xu's avatar
    [IPV6]: Fix IPsec datagram fragmentation · 28a89453
    Herbert Xu authored
    This is a long-standing bug in the IPsec IPv6 code that breaks
    when we emit a IPsec tunnel-mode datagram packet.  The problem
    is that the code the emits the packet assumes the IPv6 stack
    will fragment it later, but the IPv6 stack assumes that whoever
    is emitting the packet is going to pre-fragment the packet.
    
    In the long term we need to fix both sides, e.g., to get the
    datagram code to pre-fragment as well as to get the IPv6 stack
    to fragment locally generated tunnel-mode packet.
    
    For now this patch does the second part which should make it
    work for the IPsec host case.
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    28a89453
xfrm6_output.c 2.11 KB