Hi,
I found the tool "ip xfrm" is not able to add "cipher_null" because there is 
no possibility to set key with zero length.

I solved it by this change:

-       if (slen > 2 && strncmp(key, "0x", 2) == 0) {
+       if (slen >= 2 && strncmp(key, "0x", 2) == 0) {

By this change you can specify key as "0x" which will pass for key existence 
and set key len to 0.

this patch is against version iproute2-3.14.0

Second patch enable use proto ip. Because it is supported by kernel.

Have a nice day :)

Regards
Jarek