Patrick McHardy wrote:
I've checked KAME, it also skips IPSEC_LEVEL_USE SAs if they aren't
present.
IPCOMP in tunnel mode is a special case. It wants to express more than
just
"optional". It means to say "use SA if present and some things wrt.
size apply,
otherwise use a similar SA with proto=IPIP". One of both has to be
used, and
this is what "optional" can't express. The current method is to use
the IPIP
SA automatically created with the IPCOMP SA when the compressed size
exceeds
the uncompressed size, but it doesn't handle a missing SA. This
suggests we
need to special-case tunnel mode IPCOMP in xfrm_tmpl_resolve() and either
ignore "optional" for IPIP tunnel mode SAs or create them on demand.
How about this patch ? It ignores "optional" for missing tunnel mode
SAs, symetric
to input.
Regards
Patrick
===== net/xfrm/xfrm_policy.c 1.66 vs edited =====
--- 1.66/net/xfrm/xfrm_policy.c 2005-02-16 00:16:04 +01:00
+++ edited/net/xfrm/xfrm_policy.c 2005-02-19 21:12:38 +01:00
@@ -656,7 +656,7 @@
xfrm_state_put(x);
}
- if (!tmpl->optional)
+ if (!tmpl->optional || tmpl->mode)
goto fail;
}
return nx;
|