Re: IPsec xfrm resolution

[Patrick McHardy <kaber@xxxxxxxxx>]

Patrick McHardy wrote:

> I've checked KAME, it also skips IPSEC_LEVEL_USE SAs if they aren't 
> present.
> IPCOMP in tunnel mode is a special case. It wants to express more than 
> just
> "optional". It means to say "use SA if present and some things wrt. 
> size apply,
> otherwise use a similar SA with proto=IPIP". One of both has to be 
> used, and
> this is what "optional" can't express. The current method is to use 
> the IPIP
> SA automatically created with the IPCOMP SA when the compressed size 
> exceeds
> the uncompressed size, but it doesn't handle a missing SA. This 
> suggests we
> need to special-case tunnel mode IPCOMP in xfrm_tmpl_resolve() and either
> ignore "optional" for IPIP tunnel mode SAs or create them on demand.
How about this patch ? It ignores "optional" for missing tunnel mode 
SAs, symetric
to input.

Regards
Patrick

===== net/xfrm/xfrm_policy.c 1.66 vs edited =====
--- 1.66/net/xfrm/xfrm_policy.c 2005-02-16 00:16:04 +01:00
+++ edited/net/xfrm/xfrm_policy.c       2005-02-19 21:12:38 +01:00
@@ -656,7 +656,7 @@
                        xfrm_state_put(x);
                }
 
-               if (!tmpl->optional)
+               if (!tmpl->optional || tmpl->mode)
                        goto fail;
        }
        return nx;