From mboxrd@z Thu Jan 1 00:00:00 1970 From: Patrick McHardy Subject: Re: port bound SAs Date: Tue, 27 Jan 2009 18:12:17 +0100 Message-ID: <497F4071.2040302@trash.net> References: <20090126.222035.100955508.davem@davemloft.net> <497EE171.1030907@trash.net> <497F3DD0.5010502@trash.net> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: 7bit Cc: David Miller , netdev@vger.kernel.org To: Paul Moore Return-path: Received: from stinky.trash.net ([213.144.137.162]:42408 "EHLO stinky.trash.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757281AbZA0RMT (ORCPT ); Tue, 27 Jan 2009 12:12:19 -0500 In-Reply-To: Sender: netdev-owner@vger.kernel.org List-ID: Paul Moore wrote: > i did exactly that (in the original message) and it makes this test case > work but as I point out > > a) it should not be necessary > b) i get more SAs than I need > c) i can no longer say that a SA is optional (this is an error in the > pfkey/xfrm/racoon interface to combine two orthogonal concepts) > d) I am not convinced that I have resolved all cases. Needs more testing IIRC I tested port selectors in SA a few years ago using "ip xfrm" and they worked fine. The xfrm interface doesn't ignore them (copy_from_user_state()), I think the pfkey interface also doesn't. Please try configuring them manually using "ip xfrm state", I'm pretty sure the bug is actually in racoon.