Module Name:	src
Committed By:	jonathan
Date:		Sun Apr 25 22:25:05 UTC 2004

Modified Files:
	src/lib/libipsec: pfkey.c pfkey_dump.c policy_token.l
	src/sbin/setkey: parse.y setkey.8 token.l
	src/share/man/man4: tcp.4
	src/sys/net: pfkeyv2.h
	src/sys/netinet: files.netinet ip.h tcp.h tcp_input.c tcp_output.c
	    tcp_subr.c tcp_usrreq.c tcp_var.h
	src/sys/netipsec: files.netipsec ipsec.c ipsec.h key.c
Added Files:
	src/sys/netipsec: xform_tcp.c

Log Message:
Initial commit of a port of the FreeBSD implementation of RFC 2385
(MD5 signatures for TCP, as used with BGP).  Credit for original
FreeBSD code goes to Bruce M. Simpson, with FreeBSD sponsorship
credited to sentex.net.  Shortening of the setsockopt() name
attributed to Vincent Jardin.

This commit is a minimal, working version of the FreeBSD code, as
MFC'ed to FreeBSD-4. It has received minimal testing with a ttcp
modified to set the TCP-MD5 option; BMS's additions to tcpdump-current
(tcpdump -M) confirm that the MD5 signatures are correct.  Committed
as-is for further testing between a NetBSD BGP speaker (e.g., quagga)
and industry-standard BGP speakers (e.g., Cisco, Juniper).

NOTE: This version has two potential flaws. First, I do see any code
that verifies recieved TCP-MD5 signatures.  Second, the TCP-MD5
options are internally padded and assumed to be 32-bit aligned. A more
space-efficient scheme is to pack all TCP options densely (and
possibly unaligned) into the TCP header ; then do one final padding to
a 4-byte boundary.  Pre-existing comments note that accounting for
TCP-option space when we add SACK is yet to be done. For now, I'm
punting on that; we can solve it properly, in a way that will handle
SACK blocks, as a separate exercise.

In case a pullup to NetBSD-2 is requested, this adds sys/netipsec/xform_tcp.c
,and modifies:

sys/net/pfkeyv2.h,v 1.15
sys/netinet/files.netinet,v 1.5
sys/netinet/ip.h,v 1.25
sys/netinet/tcp.h,v 1.15
sys/netinet/tcp_input.c,v 1.200
sys/netinet/tcp_output.c,v 1.109
sys/netinet/tcp_subr.c,v 1.165
sys/netinet/tcp_usrreq.c,v 1.89
sys/netinet/tcp_var.h,v 1.109
sys/netipsec/files.netipsec,v 1.3
sys/netipsec/ipsec.c,v 1.11
sys/netipsec/ipsec.h,v 1.7
sys/netipsec/key.c,v 1.11
share/man/man4/tcp.4,v 1.16
lib/libipsec/pfkey.c,v 1.20
lib/libipsec/pfkey_dump.c,v 1.17
lib/libipsec/policy_token.l,v 1.8
sbin/setkey/parse.y,v 1.14
sbin/setkey/setkey.8,v 1.27
sbin/setkey/token.l,v 1.15

Note that the preceding two revisions to tcp.4 will be
required to cleanly apply this diff.


To generate a diff of this commit:
cvs rdiff -r1.20 -r1.21 src/lib/libipsec/pfkey.c
cvs rdiff -r1.17 -r1.18 src/lib/libipsec/pfkey_dump.c
cvs rdiff -r1.8 -r1.9 src/lib/libipsec/policy_token.l
cvs rdiff -r1.14 -r1.15 src/sbin/setkey/parse.y
cvs rdiff -r1.27 -r1.28 src/sbin/setkey/setkey.8
cvs rdiff -r1.15 -r1.16 src/sbin/setkey/token.l
cvs rdiff -r1.16 -r1.17 src/share/man/man4/tcp.4
cvs rdiff -r1.15 -r1.16 src/sys/net/pfkeyv2.h
cvs rdiff -r1.5 -r1.6 src/sys/netinet/files.netinet
cvs rdiff -r1.25 -r1.26 src/sys/netinet/ip.h
cvs rdiff -r1.15 -r1.16 src/sys/netinet/tcp.h
cvs rdiff -r1.200 -r1.201 src/sys/netinet/tcp_input.c
cvs rdiff -r1.109 -r1.110 src/sys/netinet/tcp_output.c \
    src/sys/netinet/tcp_var.h
cvs rdiff -r1.165 -r1.166 src/sys/netinet/tcp_subr.c
cvs rdiff -r1.89 -r1.90 src/sys/netinet/tcp_usrreq.c
cvs rdiff -r1.3 -r1.4 src/sys/netipsec/files.netipsec
cvs rdiff -r1.11 -r1.12 src/sys/netipsec/ipsec.c src/sys/netipsec/key.c
cvs rdiff -r1.7 -r1.8 src/sys/netipsec/ipsec.h
cvs rdiff -r0 -r1.1 src/sys/netipsec/xform_tcp.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.