On Tue, Nov 30, 2010 at 03:49:13PM +0000, Martin Willi wrote:
>
> +     if (skb->len >= tfcpadto) {
> +             clen = ALIGN(skb->len + 2, blksize);
> +     } else if (x->tfc.flags & XFRM_TFC_ESPV3 &&
> +                x->props.mode == XFRM_MODE_TUNNEL) {
> +             /* ESPv3 TFC padding, append bytes to payload */
> +             tfclen = tfcpadto - skb->len;
> +             clen = ALIGN(skb->len + 2 + tfclen, blksize);
> +     } else {
> +             /* ESPv2 TFC padding. If we exceed the 255 byte maximum, use
> +              * random padding to hide payload length as good as possible. */
> +             clen = ALIGN(skb->len + 2 + tfcpadto - skb->len, blksize);
> +             if (clen - skb->len - 2 > 255) {
> +                     clen = ALIGN(skb->len + (u8)random32() + 2, blksize);
> +                     if (clen - skb->len - 2 > 255)
> +                             clen -= blksize;
> +             }

What is the basis of this random length padding?

Also, what happens when padto exceeds the MTU? Doesn't this
effectively disable PMTU-discovery?

I know that your last patch allows the padto to be set by PMTU.
But why would we ever want to use a padto that isn't clamped by
PMTU?

Cheers,
-- 
Email: Herbert Xu <herb...@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe linux-crypto" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to