Re: [PATH] IPv6 IPsec support

[David S. Miller]

   From: Kazunori Miyazawa <[e-mail]>
   Date: Thu, 6 Mar 2003 09:32:19 +0900

   - Extension Header Processing on inbound:
     As a result of IPv6 IPsec support, Extension Header processing is devided
     into ipv6_parse_exthdrs and ipproto->handler. I think it is better to merge
     other Extension Header handling into ipproto->handler.
   
Ok.

   - Fragmentation support on outbound:
     We should change ipv6_build_xmit like ip_append_data style to support
     fragmentation with IPsec.
   
Please work together with Alexey on this.  There are known
major problems on ipv4 side, and it must be resolved before
ipv6 side may be done.

For example, right now a non-TCP packet can do the following.  If it
is just slightly smaller than MTU, and when encapsulated in ESP/AH it
becomes larger than MTU, we will not fragment it and too-large frame
will be sent to device.

In my last round of talks with Alexey I believe we were very close to
a possible solution to this problem.  The idea was to have a "local
dont-fragment" flag, and at the very last stage of IP output we check
this and either 1) clear DF and fragment or 2) drop packet and send
ICMP message back.

Alexey, what is the current state?

   - Removing duplicate codes, clean up and improveing performance.
   
   - Considering relation of IPv6 IPsec and Mobile IPv6. This is future stuff.
   
Ok.