Index: sys/netinet/raw_ip.c
===================================================================
--- sys/netinet/raw_ip.c	(revision 356787)
+++ sys/netinet/raw_ip.c	(working copy)
@@ -844,6 +844,14 @@ rip_ctlinput(int cmd, struct sockaddr *sa, void *v
 
 		ifa_free(&ia->ia_ifa);
 		break;
+
+#if defined(IPSEC) || defined(IPSEC_SUPPORT)
+	case PRC_MSGSIZE:
+		if (IPSEC_ENABLED(ipv4)) {
+			IPSEC_CTLINPUT(ipv4, cmd, sa, vip);
+		}
+		break;
+#endif /* IPSEC */
 	}
 }
 
Index: sys/netipsec/ipsec.h
===================================================================
--- sys/netipsec/ipsec.h	(revision 356787)
+++ sys/netipsec/ipsec.h	(working copy)
@@ -348,6 +348,7 @@ int ipsec4_pcbctl(struct inpcb *, struct sockopt *
 int ipsec4_output(struct mbuf *, struct inpcb *);
 int ipsec4_capability(struct mbuf *, u_int);
 int ipsec4_common_input_cb(struct mbuf *, struct secasvar *, int, int);
+int ipsec4_ctlinput(int, struct sockaddr *, void *);
 int ipsec4_process_packet(struct mbuf *, struct secpolicy *, struct inpcb *);
 int ipsec_process_done(struct mbuf *, struct secpolicy *, struct secasvar *,
     u_int);
Index: sys/netipsec/ipsec6.h
===================================================================
--- sys/netipsec/ipsec6.h	(revision 356787)
+++ sys/netipsec/ipsec6.h	(working copy)
@@ -73,6 +73,7 @@ int ipsec6_pcbctl(struct inpcb *, struct sockopt *
 int ipsec6_output(struct mbuf *, struct inpcb *);
 int ipsec6_capability(struct mbuf *, u_int);
 int ipsec6_common_input_cb(struct mbuf *, struct secasvar *, int, int);
+int ipsec6_ctlinput(int, struct sockaddr *, void *);
 int ipsec6_process_packet(struct mbuf *, struct secpolicy *, struct inpcb *);
 
 int ip6_ipsec_filtertunnel(struct mbuf *);
Index: sys/netipsec/ipsec_input.c
===================================================================
--- sys/netipsec/ipsec_input.c	(revision 356787)
+++ sys/netipsec/ipsec_input.c	(working copy)
@@ -68,7 +68,9 @@ __FBSDID("$FreeBSD$");
 #include <netinet/in_systm.h>
 #include <netinet/ip.h>
 #include <netinet/ip_var.h>
+#include <netinet/ip_icmp.h>
 #include <netinet/in_var.h>
+#include <netinet/tcp_var.h>
 
 #include <netinet/ip6.h>
 #ifdef INET6
@@ -268,6 +270,51 @@ ipsec4_input(struct mbuf *m, int offset, int proto
 }
 
 /*
+ * IPSEC_CTLINPUT() method implementation for IPv4.
+ */
+int
+ipsec4_ctlinput(int code, struct sockaddr *sa, void *v)
+{
+	struct in_conninfo inc;
+	struct secasvar *sav;
+	struct icmp *icp;
+	struct ip *ip = v;
+	uint32_t mtu, spi;
+
+	if (code != PRC_MSGSIZE || ip == NULL)
+		return (EINVAL);
+	if (ip->ip_p != IPPROTO_ESP)
+		return (EPROTONOSUPPORT);
+	if (sa->sa_family != AF_INET ||
+	    sa->sa_len != sizeof(struct sockaddr_in))
+		return (EAFNOSUPPORT);
+
+	icp = __containerof(ip, struct icmp, icmp_ip);
+	mtu = ntohs(icp->icmp_nextmtu);
+	if (mtu < 576) /* TCP_MSS + sizeof(struct tcpiphdr) */
+		return (EINVAL);
+	/*
+	 * It is required by icmp_input() that packet has at least
+	 * ICMP_ADVLENMIN bytes. Thus we can get SPI.
+	 */
+	memcpy(&spi, (caddr_t)ip + (ip->ip_hl << 2), sizeof(spi));
+	sav = key_allocsa((union sockaddr_union *)sa, ip->ip_p, spi);
+	if (sav == NULL)
+		return (ENOENT);
+	/*
+	 * If SA uses transport mode, notify protocols that they
+	 * should use reduced MTU for given destination address.
+	 */
+	if (sav->sah->saidx.mode != IPSEC_MODE_TUNNEL) {
+		memset(&inc, 0, sizeof(inc));
+		inc.inc_faddr = satosin(sa)->sin_addr;
+		tcp_hc_updatemtu(&inc, mtu);
+	}
+	key_freesav(&sav);
+	return (0);
+}
+
+/*
  * IPsec input callback for INET protocols.
  * This routine is called as the transform callback.
  * Takes care of filtering and other sanity checks on
@@ -481,6 +528,16 @@ ipsec6_input(struct mbuf *m, int offset, int proto
 }
 
 /*
+ * IPSEC_CTLINPUT() method implementation for IPv6.
+ */
+int
+ipsec6_ctlinput(int code, struct sockaddr *sa, void *v)
+{
+	/* TBD: */
+	return (0);
+}
+
+/*
  * IPsec input callback, called by the transform callback. Takes care of
  * filtering and other sanity checks on the processed packet.
  */
Index: sys/netipsec/ipsec_mod.c
===================================================================
--- sys/netipsec/ipsec_mod.c	(revision 356787)
+++ sys/netipsec/ipsec_mod.c	(working copy)
@@ -63,6 +63,7 @@ static const struct ipsec_methods ipv4_methods = {
 	.pcbctl = ipsec4_pcbctl,
 	.capability = ipsec4_capability,
 	.check_policy = ipsec4_in_reject,
+	.ctlinput = ipsec4_ctlinput,
 	.hdrsize = ipsec_hdrsiz_inpcb,
 	.udp_input = udp_ipsec_input,
 	.udp_pcbctl = udp_ipsec_pcbctl,
@@ -84,6 +85,7 @@ static const struct ipsec_methods ipv6_methods = {
 	.pcbctl = ipsec6_pcbctl,
 	.capability = ipsec6_capability,
 	.check_policy = ipsec6_in_reject,
+	.ctlinput = ipsec6_ctlinput,
 	.hdrsize = ipsec_hdrsiz_inpcb,
 };
 #ifndef KLD_MODULE
Index: sys/netipsec/ipsec_support.h
===================================================================
--- sys/netipsec/ipsec_support.h	(revision 356787)
+++ sys/netipsec/ipsec_support.h	(working copy)
@@ -134,6 +134,8 @@ extern const struct ipsec_support * const ipv6_ips
     (*(proto ## _ipsec_support)->methods->capability)(m, __VA_ARGS__)
 #define	IPSEC_HDRSIZE(proto, inp)		\
     (*(proto ## _ipsec_support)->methods->hdrsize)(inp)
+#define	IPSEC_CTLINPUT(proto, code, sa, v)	\
+    (*(proto ## _ipsec_support)->methods->ctlinput)(code, sa, v)
 
 #define	UDPENCAP_INPUT(m, ...)			\
     (*ipv4_ipsec_support->methods->udp_input)(m, __VA_ARGS__)
@@ -162,6 +164,8 @@ int ipsec_kmod_pcbctl(struct ipsec_support * const
     struct sockopt *);
 int ipsec_kmod_capability(struct ipsec_support * const, struct mbuf *, u_int);
 size_t ipsec_kmod_hdrsize(struct ipsec_support * const, struct inpcb *);
+int ipsec_kmod_ctlinput(struct ipsec_support * const, int,
+    struct sockaddr *, void *);
 int ipsec_kmod_udp_input(struct ipsec_support * const, struct mbuf *, int, int);
 int ipsec_kmod_udp_pcbctl(struct ipsec_support * const, struct inpcb *,
     struct sockopt *);
@@ -185,6 +189,8 @@ int ipsec_kmod_udp_pcbctl(struct ipsec_support * c
     ipsec_kmod_capability(proto ## _ipsec_support, __VA_ARGS__)
 #define	IPSEC_HDRSIZE(proto, ...)	\
     ipsec_kmod_hdrsize(proto ## _ipsec_support, __VA_ARGS__)
+#define	IPSEC_CTLINPUT(proto, ...)	\
+    ipsec_kmod_ctlinput(proto ## _ipsec_support, __VA_ARGS__)
 #endif /* IPSEC_SUPPORT */
 #endif /* _KERNEL */
 #endif /* _NETIPSEC_IPSEC_SUPPORT_H_ */
Index: sys/netipsec/subr_ipsec.c
===================================================================
--- sys/netipsec/subr_ipsec.c	(revision 356787)
+++ sys/netipsec/subr_ipsec.c	(working copy)
@@ -361,6 +361,11 @@ IPSEC_KMOD_METHOD(int, ipsec_kmod_check_policy, sc
 	struct inpcb *inp), METHOD_ARGS(m, inp)
 )
 
+IPSEC_KMOD_METHOD(int, ipsec_kmod_ctlinput, sc,
+    ctlinput, METHOD_DECL(struct ipsec_support * const sc, int code,
+        struct sockaddr *sa, void *v), METHOD_ARGS(code, sa, v)
+)
+
 IPSEC_KMOD_METHOD(int, ipsec_kmod_forward, sc,
     forward, METHOD_DECL(struct ipsec_support * const sc, struct mbuf *m),
     (m)