On Tue, Nov 30, 2010 at 03:49:13PM +0000, Martin Willi wrote:
>
> + if (skb->len >= tfcpadto) {
> + clen = ALIGN(skb->len + 2, blksize);
> + } else if (x->tfc.flags & XFRM_TFC_ESPV3 &&
> + x->props.mode == XFRM_MODE_TUNNEL) {
> + /* ESPv3 TFC padding, append bytes to payload */
> + tfclen = tfcpadto - skb->len;
> + clen = ALIGN(skb->len + 2 + tfclen, blksize);
> + } else {
> + /* ESPv2 TFC padding. If we exceed the 255 byte maximum, use
> + * random padding to hide payload length as good as possible. */
> + clen = ALIGN(skb->len + 2 + tfcpadto - skb->len, blksize);
> + if (clen - skb->len - 2 > 255) {
> + clen = ALIGN(skb->len + (u8)random32() + 2, blksize);
> + if (clen - skb->len - 2 > 255)
> + clen -= blksize;
> + }
What is the basis of this random length padding?
Also, what happens when padto exceeds the MTU? Doesn't this
effectively disable PMTU-discovery?
I know that your last patch allows the padto to be set by PMTU.
But why would we ever want to use a padto that isn't clamped by
PMTU?
Cheers,
--
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe linux-crypto" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
