Re: 'ip' command should allow creation of an IPsec SA with 'proto any' and specified sport and dport as selectors

["Jiri Klimes" <klimes@centrum.cz>]

[-- Attachment #1: Type: text/plain, Size: 495 bytes --]

______________________________________________________________
> Od: davem@davemloft.net
> Komu: klimes@centrum.cz
> CC: netdev@vger.kernel.org
> Datum: 24.04.2009 13:49
> Předmět: Re: 'ip' command should allow creation of an IPsec SA with 'proto any' and specified sport and dport as selectors
>
>From: "Jiri Klimes" <klimes@centrum.cz>
>Date: Fri, 24 Apr 2009 13:11:34 +0200
>
>> please find a patch in the attachment.
>
>There is no attachment.
>

oops, sorry.
Forgot the most important.



[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: ip_sa.patch --]
[-- Type: text/x-patch; name="ip_sa.patch", Size: 487 bytes --]

--- a/ip/ipxfrm.c
+++ b/ip/ipxfrm.c
@@ -1156,6 +1156,7 @@ static int xfrm_selector_upspec_parse(struct xfrm_selector *sel,
                case IPPROTO_UDP:
                case IPPROTO_SCTP:
                case IPPROTO_DCCP:
+               case IPPROTO_IP:  /* to allow shared SA for different protocols */
                        break;
                default:
                        fprintf(stderr, "\"sport\" and \"dport\" are invalid with proto=%s\n", strxf_proto(sel->proto));