Use transport mode ESP SA if IPcomp is used, IPcomp already applies outer IP header

diff --git a/NEWS b/NEWS
index 54b8a514aae24d2a8c3c96566f7da09d41a367f1..8f71908b5d6b42919ec5aaba833282b3c54f4e03 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,7 +5,7 @@ strongswan-4.3.6
 
 - More detailed IKEv2 EAP payload information in debug output
 
-- IKEv2 EAP-SIM and EAP-AKA share joint libsimaka library 
+- IKEv2 EAP-SIM and EAP-AKA share joint libsimaka library
 
 - Added required userland changes for proper SHA256 and SHA384/512 in ESP that
   will be introduced with Linux 2.6.33. The "sha256"/"sha2_256" keyword now
@@ -13,6 +13,10 @@ strongswan-4.3.6
   bit truncation used by previous releases. To use the old 96 bit truncation
   scheme, the new "sha256_96" proposal keyword has been introduced.
 
+- Fixed IPComp in tunnel mode, stripping out the duplicated outer header. This
+  change makes IPcomp tunnel mode connections incompatible with previous
+  releases; disable compression on such tunnels.
+
 strongswan-4.3.5
 ----------------
 

diff --git a/src/charon/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/charon/plugins/kernel_netlink/kernel_netlink_ipsec.c
index cff5611d45cfc08fa9ffe12c85e4a876141b7848..d96d6fc6125ef5cbca021b578ae62d7e96c0a9d7 100644 (file)
--- a/src/charon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+++ b/src/charon/plugins/kernel_netlink/kernel_netlink_ipsec.c
@@ -946,6 +946,8 @@ static status_t add_sa(private_kernel_netlink_ipsec_t *this,
                           ENCR_UNDEFINED, chunk_empty, AUTH_UNDEFINED, chunk_empty,
                           mode, ipcomp, 0, FALSE, inbound);
                ipcomp = IPCOMP_NONE;
+               /* use transport mode ESP SA, IPComp uses tunnel mode */
+               mode = MODE_TRANSPORT;
        }
 
        memset(&request, 0, sizeof(request));
@@ -1663,6 +1665,15 @@ static status_t add_policy(private_kernel_netlink_ipsec_t *this,
                }
 
                tmpl++;
+
+               /* use transport mode for ESP if we have a tunnel mode IPcomp SA */
+               mode = MODE_TRANSPORT;
+       }
+       else
+       {
+               /* when using IPcomp, only the IPcomp SA uses tmp src/dst addresses */
+               host2xfrm(src, &tmpl->saddr);
+               host2xfrm(dst, &tmpl->id.daddr);
        }
 
        tmpl->reqid = reqid;
@@ -1671,9 +1682,6 @@ static status_t add_policy(private_kernel_netlink_ipsec_t *this,
        tmpl->mode = mode2kernel(mode);
        tmpl->family = src->get_family(src);
 
-       host2xfrm(src, &tmpl->saddr);
-       host2xfrm(dst, &tmpl->id.daddr);
-
        if (this->socket_xfrm->send_ack(this->socket_xfrm, hdr) != SUCCESS)
        {
                DBG1(DBG_KNL, "unable to add policy %R === %R %N", src_ts, dst_ts,