MTU estimation…

[Daniel Lenski]

David,
You're certainly right with this, uh, skeptical comment on the
ESP_OVERHEAD estimation in gpst.c …

    /* XXX: Look at set_esp_algo() and tell me again what the biggest
supported IV is? */
    #define ESP_OVERHEAD (4 /* SPI */ + 4 /* sequence number */ + \
             20 /* biggest supported MAC (SHA1) */ + 16 /* biggest
supported IV (AES-128) */ + \
            1 /* pad length */ + 1 /* next header */ + \

I copied it from a similar calculation from openconnect-internal.h:
http://git.infradead.org/users/dwmw2/openconnect.git/blob/1f079924c1684da5958747e24a0e91a3ea12d702:/openconnect-internal.h#l336

    #define DTLS_OVERHEAD (1 /* packet + header */ + 13 /* DTLS header */ + \
             20 /* biggest supported MAC (SHA1) */ +  16 /* biggest
supported IV (AES-128) */ + \
             16 /* max padding */)

I believe that *both* of these should be updated to:

    32 /* biggest support IV (AES-256) */

In practice, I have never seen or heard of a GP VPN that uses anything
other than aes128+sha1, but both the clients and servers appear to
include support for aes256 (and md5… woof).

Dan