FreeBSD 6.1 IPsec Path MTU Discovery

[Tom Judge]

Johann Hugo wrote:
> On Tuesday 07 November 2006 19:39, Tom Judge wrote:
> 
> I'm seeing the same problem on my gif tunnel.
> 
> For an interim work around you can reduce the MTU size between Box1 and Box2 
> e.g "route change Box2 -mtu 1200". After it's starts working you can change it 
> back to 1500 en it keeps on working. 
>  
> Don't ask me why it works, I'm still trying to figure out what the problem is.
> 
> Johann

I have a patch for the problem,  it is related to a broken peice of code 
that is supposed to calculate the mtu using the size of the ip header 
and the size of the ipsec header.  However when the ipsec security 
policy is fetched some required sections are null and the code block 
completely fails.  The following patch fixes the problem for me as it 
allows the code to fall through to the standard mtu calculation using 
either the destination interface mtu or by calculating the next smallest 
rfc defined mtu.

It would be interesting to see if this patch works for you, I have 
submitted it on the open pr but have not had a response yet.


Tom J

PR: http://www.freebsd.org/cgi/query-pr.cgi?pr=kern/91412

Patch:

Index: sys/netinet/ip_input.c
===================================================================
--- sys/netinet/ip_input.c      (revision 24)
+++ sys/netinet/ip_input.c      (working copy)
@@ -1990,8 +1990,8 @@
  #else /* FAST_IPSEC */
                                 KEY_FREESP(&sp);
  #endif
-                               ipstat.ips_cantfrag++;
-                               break;
+//                             ipstat.ips_cantfrag++;
+//                             break;
                         }
                 }
  #endif /*IPSEC || FAST_IPSEC*/