diff options
| author | ae <ae@FreeBSD.org> | 2017-04-11 07:40:43 +0000 |
|---|---|---|
| committer | ae <ae@FreeBSD.org> | 2017-04-11 07:40:43 +0000 |
| commit | 480aa18ad07ac35a17bf83e12d1ede8f5775913a (patch) | |
| tree | 6c371c27797c3ecf925551a25cf88c950aa907c1 /sbin/setkey/setkey.8 | |
| parent | 1eab74877989ecd28a10a723ac8ba41881c32a1a (diff) | |
| download | FreeBSD-src-480aa18ad07ac35a17bf83e12d1ede8f5775913a.zip FreeBSD-src-480aa18ad07ac35a17bf83e12d1ede8f5775913a.tar.gz | |
MFC r316490:
When we are doing SA lookup for TCP-MD5, check both source and
destination addresses. Previous code has used only destination address
for lookup. But for inbound packets the source address was used as SA
destination address. Thus only outbound SA were used for both directions.
Now we use addresses from a packet as is, thus SAs for both directions are
needed.
Reported by: Mike Tancsa
MFC r316507,316508:
In the example section show that TCP-MD5 connection needs SA for both
directions.
Use unique SPI.
Diffstat (limited to 'sbin/setkey/setkey.8')
| -rw-r--r-- | sbin/setkey/setkey.8 | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sbin/setkey/setkey.8 b/sbin/setkey/setkey.8 index afaa753..8ae02e6 100644 --- a/sbin/setkey/setkey.8 +++ b/sbin/setkey/setkey.8 @@ -29,7 +29,7 @@ .\" .\" $FreeBSD$ .\" -.Dd March 7, 2017 +.Dd April 5, 2017 .Dt SETKEY 8 .Os .\" @@ -696,6 +696,7 @@ spdadd 10.0.11.41/32[21] 10.0.11.33/32[any] any Use TCP MD5 between two numerically specified hosts: .Bd -literal -offset indent add 10.1.10.34 10.1.10.36 tcp 0x1000 -A tcp-md5 "TCP-MD5 BGP secret" ; +add 10.1.10.36 10.1.10.34 tcp 0x1001 -A tcp-md5 "TCP-MD5 BGP secret" ; .Ed .\" .Sh SEE ALSO |
