Re: IPsec xfrm resolution

[Patrick McHardy <kaber@trash.net>]

[-- Attachment #1: Type: text/plain, Size: 859 bytes --]

Patrick McHardy wrote:

> I've checked KAME, it also skips IPSEC_LEVEL_USE SAs if they aren't 
> present.
> IPCOMP in tunnel mode is a special case. It wants to express more than 
> just
> "optional". It means to say "use SA if present and some things wrt. 
> size apply,
> otherwise use a similar SA with proto=IPIP". One of both has to be 
> used, and
> this is what "optional" can't express. The current method is to use 
> the IPIP
> SA automatically created with the IPCOMP SA when the compressed size 
> exceeds
> the uncompressed size, but it doesn't handle a missing SA. This 
> suggests we
> need to special-case tunnel mode IPCOMP in xfrm_tmpl_resolve() and either
> ignore "optional" for IPIP tunnel mode SAs or create them on demand.

How about this patch ? It ignores "optional" for missing tunnel mode 
SAs, symetric
to input.

Regards
Patrick


[-- Attachment #2: x1 --]
[-- Type: text/plain, Size: 314 bytes --]

===== net/xfrm/xfrm_policy.c 1.66 vs edited =====
--- 1.66/net/xfrm/xfrm_policy.c	2005-02-16 00:16:04 +01:00
+++ edited/net/xfrm/xfrm_policy.c	2005-02-19 21:12:38 +01:00
@@ -656,7 +656,7 @@
 			xfrm_state_put(x);
 		}
 
-		if (!tmpl->optional)
+		if (!tmpl->optional || tmpl->mode)
 			goto fail;
 	}
 	return nx;