From 11a3e5c4b31530840d6ea4339ce4078d5922b5d6 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Pavel=20=C5=A0imerda?= Date: Mon, 13 Apr 2015 16:00:57 +0200 Subject: [PATCH] ip-xfrm: support 'proto any' with 'sport' and 'dport' MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit When creating an IPsec SA that sets 'proto any' (IPPROTO_IP) and specifies 'sport' and 'dport' at the same time in selector, the following error is issued: "sport" and "dport" are invalid with proto=ip However using IPPROTO_IP with ports is completely legal and necessary when one wants to share the SA on both TCP and UDP. One of the applications requiring sharing SAs is 3GPP IMS AKA authentication. See also: * https://bugzilla.redhat.com/show_bug.cgi?id=497355 Reported-by: Jiří Klimeš Signed-off-by: Pavel Šimerda --- ip/ipxfrm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/ip/ipxfrm.c b/ip/ipxfrm.c index 9aaf58d5b..9c2642890 100644 --- a/ip/ipxfrm.c +++ b/ip/ipxfrm.c @@ -1344,6 +1344,7 @@ static int xfrm_selector_upspec_parse(struct xfrm_selector *sel, case IPPROTO_UDP: case IPPROTO_SCTP: case IPPROTO_DCCP: + case IPPROTO_IP: /* to allow shared SA for different protocols */ break; default: fprintf(stderr, "\"sport\" and \"dport\" are invalid with PROTO value \"%s\"\n", strxf_proto(sel->proto)); -- 2.47.2