Subject: Re: port bound SAs

From: Patrick McHardy <[email-masked]>
Date: Tue, 27 Jan 2009 18:29:04 +0100

Paul Moore wrote:
>>> I believe thats intentional, RFC2367 specifies to ignore port
> numbers except for larval states.
> 
> the ietf ipsec list thinks thats not the case. The consensus there is
> that the port owns the SA (and thats what Windows, and solaris actually
> do)

What does "think thats not the case" mean? Its clearly stated in
2.3.3. Address Extension:

...
    The
    zeroing of ports (e.g. sin_port and sin6_port) MUST be done for all
    messages except for originating SADB_ACQUIRE messages, which SHOULD
    fill them in with ports from the relevant TCP or UDP session which
    generates the ACQUIRE message.