Patrick McHardy wrote:

I've checked KAME, it also skips IPSEC_LEVEL_USE SAs if they aren't 
present.
IPCOMP in tunnel mode is a special case. It wants to express more than 
just
"optional". It means to say "use SA if present and some things wrt. 
size apply,
otherwise use a similar SA with proto=IPIP". One of both has to be 
used, and
this is what "optional" can't express. The current method is to use 
the IPIP
SA automatically created with the IPCOMP SA when the compressed size 
exceeds
the uncompressed size, but it doesn't handle a missing SA. This 
suggests we
need to special-case tunnel mode IPCOMP in xfrm_tmpl_resolve() and either
ignore "optional" for IPIP tunnel mode SAs or create them on demand.

How about this patch ? It ignores "optional" for missing tunnel mode 
SAs, symetric
to input.

Regards
Patrick