1 files changed, 19 insertions, 7 deletions

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 13b29360d102..b5c205b57669 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -253,7 +253,8 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
                  *    as per draft-ietf-ipsec-udp-encaps-06,
                  *    section 3.1.2
                  */
-                if (x->props.mode == XFRM_MODE_TRANSPORT)
+                if (x->props.mode == XFRM_MODE_TRANSPORT ||
+                    x->props.mode == XFRM_MODE_BEET)
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
         }
 
@@ -271,17 +272,28 @@ static u32 esp4_get_max_size(struct xfrm_state *x, int mtu)
 {
         struct esp_data *esp = x->data;
         u32 blksize = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4);
-
-        if (x->props.mode == XFRM_MODE_TUNNEL) {
-                mtu = ALIGN(mtu + 2, blksize);
-        } else {
-                /* The worst case. */
+        int enclen = 0;
+
+        switch (x->props.mode) {
+        case XFRM_MODE_TUNNEL:
+                mtu = ALIGN(mtu +2, blksize);
+                break;
+        default:
+        case XFRM_MODE_TRANSPORT:
+                /* The worst case */
                 mtu = ALIGN(mtu + 2, 4) + blksize - 4;
+                break;
+        case XFRM_MODE_BEET:
+                /* The worst case. */
+                enclen = IPV4_BEET_PHMAXLEN;
+                mtu = ALIGN(mtu + enclen + 2, blksize);
+                break;
         }
+
         if (esp->conf.padlen)
                 mtu = ALIGN(mtu, esp->conf.padlen);
 
-        return mtu + x->props.header_len + esp->auth.icv_trunc_len;
+        return mtu + x->props.header_len + esp->auth.icv_trunc_len - enclen;
 }
 
 static void esp4_err(struct sk_buff *skb, u32 info)