kernel-netlink: install selectors on SA for transport/BEET mode without proto/port

If a transport/BEET SA has different selectors for different proto/ports,
installing just the proto/port of the first SA would break any additional
selector.

diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
index 47e725c1c9e2d68c0c42b9ea07f89bfe1a5faab7..2f8cb6b3e27f306c47548fae69c0930263fffd54 100644 (file)
--- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
+++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
@@ -1224,6 +1224,12 @@ METHOD(kernel_ipsec_t, add_sa, status_t,
                        if(src_ts && dst_ts)
                        {
                                sa->sel = ts2selector(src_ts, dst_ts);
+                               /* don't install proto/port on SA. This would break
+                                * potential secondary SAs for the same address using a
+                                * different prot/port. */
+                               sa->sel.proto = 0;
+                               sa->sel.dport = sa->sel.dport_mask = 0;
+                               sa->sel.sport = sa->sel.sport_mask = 0;
                        }
                        break;
                default: