Subject: Re: port bound SAs

From: Patrick McHardy <[email-masked]>
Date: Tue, 27 Jan 2009 18:12:17 +0100

Paul Moore wrote:
> i did exactly that (in the original message) and it makes this test case
> work but as I point out
> 
> a) it should not be necessary 
> b) i get more SAs than I need
> c) i can no longer say that a SA is optional (this is an error in the
> pfkey/xfrm/racoon interface to combine two orthogonal concepts)
> d) I am not convinced that I have resolved all cases. Needs more testing

IIRC I tested port selectors in SA a few years ago using "ip xfrm"
and they worked fine. The xfrm interface doesn't ignore them 
(copy_from_user_state()), I think the pfkey interface also doesn't.

Please try configuring them manually using "ip xfrm state",
I'm pretty sure the bug is actually in racoon.