@@ -1206,6 +1206,14 @@ typedef struct odp_ipsec_status_t {
* restored. The amount and content of packet data before the IP header is
* undefined.
*
+ * Additional TFC padding might be present after packet contents unless IKEv2
+ * ESP_TFC_PADDING_NOT_SUPPORTED notification was used. The resulting ODP
+ * packet will extend beyond the end of the IP packet it contains or the
+ * resulting IP packet will extend beyond the end of the IP payload protocol
+ * (for tunnel or transport cases respectively). An ODP application can detect
+ * and remove such padding by inspecting the length fields of the relevant
+ * protocol headers in the result packet.
+ *
* Each successfully transformed packet has a valid value for these metadata
* regardless of the inner packet parse configuration
* (odp_ipsec_inbound_config_t):
@@ -1271,6 +1279,12 @@ int odp_ipsec_in(const odp_packet_t pkt_in[], int num_in,
* with IPSEC, etc headers constructed according to the standards. The amount
* and content of packet data before the IP header is undefined.
*
+ * Additional TFC padding might be present after packet payload (see RFC 4303
+ * section 2.7 for the list of requirements) unless
+ * ESP_TFC_PADDING_NOT_SUPPORTED notification was used. Such padding should be
+ * filled by application before submitting packet to ODP. Such padding will be
+ * included into encrypted packet. Receiver side will skip this padding.
+ *
* Each successfully transformed packet has a valid value for these metadata:
* - L3 offset: Offset to the first byte of the (outmost) IP header
*