- new iptables (xtables) bring problems to tc, when ipt is used.
rhbz#497344 still broken. tc_modules.patch brings correct paths to
xtables, but that doesn't fix whole issue.
- 497355 ip should allow creation of an IPsec SA with 'proto any' and
specified sport and dport as selectors