Minor IPSec bug + solution

[Martin Bouzek <martin.bouzek@radas-atc.cz>]

Hi,

I was setting up an VPN via IPSec in kernel 2.6.x on IPv4 and found the
following bug. It is not possible to set up an IPComp/ESP tunnel with
IPComp set as mandatory. The following setup works fine for me:

spdadd 192.168.1.0/24 192.168.2.0/24 any -P out ipsec
           ipcomp/tunnel/192.168.1.100-192.168.2.212/use
           esp/tunnel/192.168.1.100-82.99.145.1/require;

(IPs are little bit confusing, because computers are behing NAT and the
pair SP is not shown, because it is not important)

But the following one is not working:

spdadd 192.168.1.0/24 192.168.2.0/24 any -P out ipsec
           ipcomp/tunnel/192.168.1.100-192.168.2.212/require
           esp/tunnel/192.168.1.100-82.99.145.1/require;



Of course it is possible to use the first setup, but I found that
problem was in "require" for IPComp only after quite a while of
debugging. :-) 

The later setup is not working, because all IP-IP packets are droped by 
__xfrm_policy_check function, because of error in xfrm_state_ok
function. For tunnels it returns 

tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, family);

but it should return 

tmpl->optional || !xfrm_state_addr_cmp(tmpl, x, family);

The packet should pass policy check if either the policy is optional OR
the source address match. The code says that check pass if policy is
optional AND the address match, which is obviously wrong. IMHO it is the
reason, why I have to set this "use" for IPComp tunnel.

So the problem is in file "net/xfrm/xfrm_policy.c" in function
"xfrm_state_ok" - on line 868 in 2.6.8.1 kernel. It seems to me to
trivial change to create a patch.


I am not sure where I shall send this mail. As I said, it is a minnor
bug, and it is possible to set up things working even with it.
Nevertheless it would be nice to have it fixed. Can somebody help me,
where I shall send it?

Thanks.
- Martin Bouzek
- martin.bouzek@radas-atc.cz