Subject: Re: 'ip' command should allow creation of an IPsec SA with 'proto any' and specified sport and dport as selectors

From: "Jiri Klimes" <[email-masked]>
Date: Fri, 24 Apr 2009 15:15:18 +0200

______________________________________________________________
> Od: [email-masked]
> Komu: [email-masked]
> CC: [email-masked]
> Datum: 24.04.2009 13:49
> Předmět: Re: 'ip' command should allow creation of an IPsec SA with 'proto any' and specified sport and dport as selectors
>
>From: "Jiri Klimes" <[email-masked]>
>Date: Fri, 24 Apr 2009 13:11:34 +0200
>
>> please find a patch in the attachment.
>
>There is no attachment.
>

oops, sorry.
Forgot the most important.

--- a/ip/ipxfrm.c
+++ b/ip/ipxfrm.c
@@ -1156,6 +1156,7 @@ static int xfrm_selector_upspec_parse(struct xfrm_selector *sel,
                case IPPROTO_UDP:
                case IPPROTO_SCTP:
                case IPPROTO_DCCP:
+               case IPPROTO_IP:  /* to allow shared SA for different protocols */
                        break;
                default:
                        fprintf(stderr, "\"sport\" and \"dport\" are invalid with proto=%s\n", strxf_proto(sel->proto));