On Tue, Mar 15, 2005 at 10:24:50AM -0800, David S. Miller wrote:

So, at that point, I guess the next task is to handle PMTU events of already
encrypted packets properly?  We still have that problem right?  When the
ICMP payload is encrypted we have to cache some information on IPSEC output
so that a proto+SPI key can find us the encrypted inner IP header info, which
we'll need in order to process (and/or forward) the ICMP PMTU information
correctly.

Yes, that's going to be the second part of the MTU work.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} [off-list ref]
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt