[IPSEC]: Add XFRM_STATE_NOPMTUDISC flag

This patch adds the flag XFRM_STATE_NOPMTUDISC for xfrm states.  It is
similar to the nopmtudisc on IPIP/GRE tunnels.  It only has an effect
on IPv4 tunnel mode states.  For these states, it will ensure that the
DF flag is always cleared.

This is primarily useful to work around ICMP blackholes.

In future this flag could also allow a larger MTU to be set within the
tunnel just like IPIP/GRE tunnels.  This could be useful for short haul
tunnels where temporary fragmentation outside the tunnel is desired over
smaller fragments inside the tunnel.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: James Morris <jmorris@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 4 insertions, 0 deletions

diff --git a/net/key/af_key.c b/net/key/af_key.c
index 652dd09ccd3a..4879743b945a 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -690,6 +690,8 @@ static struct sk_buff * pfkey_xfrm_state2msg(struct xfrm_state *x, int add_keys,
                 sa->sadb_sa_flags |= SADB_SAFLAGS_NOECN;
         if (x->props.flags & XFRM_STATE_DECAP_DSCP)
                 sa->sadb_sa_flags |= SADB_SAFLAGS_DECAP_DSCP;
+        if (x->props.flags & XFRM_STATE_NOPMTUDISC)
+                sa->sadb_sa_flags |= SADB_SAFLAGS_NOPMTUDISC;
 
         /* hard time */
         if (hsc & 2) {
@@ -974,6 +976,8 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr,
                 x->props.flags |= XFRM_STATE_NOECN;
         if (sa->sadb_sa_flags & SADB_SAFLAGS_DECAP_DSCP)
                 x->props.flags |= XFRM_STATE_DECAP_DSCP;
+        if (sa->sadb_sa_flags & SADB_SAFLAGS_NOPMTUDISC)
+                x->props.flags |= XFRM_STATE_NOPMTUDISC;
 
         lifetime = (struct sadb_lifetime*) ext_hdrs[SADB_EXT_LIFETIME_HARD-1];
         if (lifetime != NULL) {