From ff49bb5125d8291f0dc8b75264511504ad53a956 Mon Sep 17 00:00:00 2001
From: Matthias Radestock <matthias.radestock@gmail.com>
Date: Sat, 25 Apr 2015 12:36:05 +0100
Subject: [PATCH] document why we carry the DF flag in payload

---
 router/crypto.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/router/crypto.go b/router/crypto.go
index 621457a1..a3723a5d 100644
--- a/router/crypto.go
+++ b/router/crypto.go
@@ -191,6 +191,12 @@ func NewNaClEncryptor(prefix []byte, conn *LocalConnection, df bool) *NaClEncryp
 func (ne *NaClEncryptor) Bytes() []byte {
 	plaintext := ne.NonEncryptor.Bytes()
 	offsetFlags := ne.offset
+	// We carry the DF flag in the (unencrypted portion of the)
+	// payload, rather than just extracting it from the packet headers
+	// at the receiving end, since we do not trust routers not to mess
+	// with headers. As we have different decryptors for non-DF and
+	// DF, that would result in hard to track down packet drops due to
+	// crypto errors.
 	if ne.df {
 		offsetFlags |= (1 << 15)
 	}