Re: IPsec and Path MTU

[Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>]

Hello!

> The problem is that each bundle can have only one PMTU.  But
> there can be an arbitrary number of paths over each bundle.

Seems, I still do not understand what you mean.

Returning to the beginning:

> 			But this is wrong because it assigns
> a single MTU to all hosts behind an IPsec gateway, even though their
> paths may well diverge beyond the gateway.

Diverge where exactly? On path where packets are transformed? PMTU discovery
cannot do something clever for this case: we receive only small piece
of transformed datagram, in the best case with SPI in it, so we
can only update pmtu not even on bundle, but on even wider aggregate,
on SA itself. This part is missing now, by the way, it is to be done
inside error handlers in transformations.

>From another hand, if it is an ICMP from beyond another end of tunnel,
it is problem of original senders to handle them. Gateways even do not
see such ICMPs, which are destined not for them.

Alexey