Commit 11a3e5c4 authored by Pavel Šimerda's avatar Pavel Šimerda Committed by Stephen Hemminger

ip-xfrm: support 'proto any' with 'sport' and 'dport'

When creating an IPsec SA that sets 'proto any' (IPPROTO_IP) and
specifies 'sport' and 'dport' at the same time in selector, the
following error is issued:

"sport" and "dport" are invalid with proto=ip

However using IPPROTO_IP with ports is completely legal and necessary
when one wants to share the SA on both TCP and UDP. One of the
applications requiring sharing SAs is 3GPP IMS AKA authentication.

See also:

 * https://bugzilla.redhat.com/show_bug.cgi?id=497355Reported-by: default avatarJiří Klimeš <jklimes@redhat.com>
Signed-off-by: default avatarPavel Šimerda <psimerda@redhat.com>
parent 06ec9039
......@@ -1344,6 +1344,7 @@ static int xfrm_selector_upspec_parse(struct xfrm_selector *sel,
case IPPROTO_UDP:
case IPPROTO_SCTP:
case IPPROTO_DCCP:
case IPPROTO_IP: /* to allow shared SA for different protocols */
break;
default:
fprintf(stderr, "\"sport\" and \"dport\" are invalid with PROTO value \"%s\"\n", strxf_proto(sel->proto));
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment