(usagi-users 03313) why it can't find SA

Hello, all

I have a question;
I set two SAD entries use the following command:

1)setkey -c <<EOF
add 3ffe:501:ffff:ff02:200:ff:fe00:a1a1 3ffe:501:ffff: ff00:200:ff:fe00:b0b0 
esp 0x1000 
-m tunnel 
-E des-cbc "TAHITEST";
dump;
EOF

2)setkey -c <<EOF
add 3ffe:501:ffff:ff02:200:ff:fe00:a1a1 3ffe:501:ffff: ff00:200:ff:fe00:b0b0 
ah 0x1000 
-m tunnel 
-A hmac-md5 "TAHITEST89ABCDEF";   
dump;
EOF

This two SAD entries are same with IPsrc, spi, but different protocol;
When we send a packet with ESP as its extention header through the tunnel,it can go through.
However,when we send a packet with AH as its extention header through the tunnel,it can't find matching SA.That is "xfrm_policy_ok" returns -1 (tmpl->optional = 0) and "__xfrm_policy_check" returns 0 and packet is rejected.

It is similar with the first condition. Why the second condition can't find matching SA? 


Thank you!

B.R. Lv Liangying