Re: IPsec xfrm resolution

[Patrick McHardy <kaber@trash.net>]

Herbert Xu wrote:

>On Sat, Feb 19, 2005 at 07:47:11PM +0100, Patrick McHardy wrote:
>  
>
>>>That's a bug.  How can you forward packets properly if the tunnel mode
>>>SA is missing?
>>>      
>>>
>>Using normal routing. What meaning would "optional" have otherwise ?
>>If the encapsulation has to be done, the user shouldn't mark the SA
>>as optional in my opinion.
>>    
>>
>
>In that case you can't mark IPCOMP SAs as optional in this scenario
>which is the most common application of optional:
>
>IPCOMP(tunnel) -- ESP(transport)
>  
>
I've checked KAME, it also skips IPSEC_LEVEL_USE SAs if they aren't present.
IPCOMP in tunnel mode is a special case. It wants to express more than just
"optional". It means to say "use SA if present and some things wrt. size 
apply,
otherwise use a similar SA with proto=IPIP". One of both has to be used, and
this is what "optional" can't express. The current method is to use the IPIP
SA automatically created with the IPCOMP SA when the compressed size exceeds
the uncompressed size, but it doesn't handle a missing SA. This suggests we
need to special-case tunnel mode IPCOMP in xfrm_tmpl_resolve() and either
ignore "optional" for IPIP tunnel mode SAs or create them on demand.

Regards
Patrick