Don't reject OPAQUE ports while verifying traffic selector substructure

diff --git a/src/libcharon/encoding/payloads/traffic_selector_substructure.c b/src/libcharon/encoding/payloads/traffic_selector_substructure.c
index 15f791b95328a0c3eb52af95693c254f10c1c859..334823db974b64d8822dd4e3e1dbabd886453df0 100644 (file)
--- a/src/libcharon/encoding/payloads/traffic_selector_substructure.c
+++ b/src/libcharon/encoding/payloads/traffic_selector_substructure.c
@@ -114,7 +114,11 @@ METHOD(payload_t, verify, status_t,
 {
        if (this->start_port > this->end_port)
        {
-               return FAILED;
+               /* OPAQUE ports are the only exception */
+               if (this->start_port != 0xffff && this->end_port != 0)
+               {
+                       return FAILED;
+               }
        }
        switch (this->ts_type)
        {