diff options
| -rw-r--r-- | sys/netipsec/xform_ipcomp.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/sys/netipsec/xform_ipcomp.c b/sys/netipsec/xform_ipcomp.c index 4049154..93a157e 100644 --- a/sys/netipsec/xform_ipcomp.c +++ b/sys/netipsec/xform_ipcomp.c @@ -343,6 +343,17 @@ ipcomp_output( ipcompx = sav->tdb_compalgxform; IPSEC_ASSERT(ipcompx != NULL, ("null compression xform")); + /* + * Do not touch the packet in case our payload to compress + * is lower than the minimal threshold of the compression + * alogrithm. We will just send out the data uncompressed. + * See RFC 3173, 2.2. Non-Expansion Policy. + */ + if (m->m_pkthdr.len <= ipcompx->minlen) { + /* XXX-BZ V_ipcompstat.threshold++; */ + return ipsec_process_done(m, isr); + } + ralen = m->m_pkthdr.len - skip; /* Raw payload length before comp. */ hlen = IPCOMP_HLENGTH; |
