When playing a bit with IPv6 and XFRM I ran into a possible issue/edge case.
In my testing I used linux 4.14.95, I was planning on testing this with latest kernel and investigating this a bit more deeply but so far I've not yet been able to do so... Only reason why I'm already submitting this message is because there is a 'Linux IPsec workshop' next week. When path-mtu between the two ipsec gateways is 1280 (i.e. minimum IPv6 mtu) and when a client in the network attempts to send a larger message then it receives a ICMPv6 PKT_TOOBIG message. The problem: mtu field in the message is set to 1198... This is lower then the minimum IPv6 mtu and the client seems to ignore it. (What I think should happen in this particular case: do not send a PKT_TOOBIG to the client but instead transmit fragmented IPv6 ESP packets to accommodate the path-mtu)
