• Herbert Xu's avatar
    ipv6: Fix IPsec pre-encap fragmentation check · 93efac3f
    Herbert Xu authored
    The IPv6 IPsec pre-encap path performs fragmentation for tunnel-mode
    packets.  That is, we perform fragmentation pre-encap rather than
    post-encap.
    
    A check was added later to ensure that proper MTU information is
    passed back for locally generated traffic.  Unfortunately this
    check was performed on all IPsec packets, including transport-mode
    packets.
    
    What's more, the check failed to take GSO into account.
    
    The end result is that transport-mode GSO packets get dropped at
    the check.
    
    This patch fixes it by moving the tunnel mode check forward as well
    as adding the GSO check.
    
    Fixes: dd767856 ("xfrm6: Don't call icmpv6_send on local error")
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
    93efac3f
xfrm6_output.c 3.91 KB