svn commit: r311036 - projects/ipsec/share/man/man4

[Andrey V. Elsukov]

Author: ae
Date: Sun Jan  1 20:56:03 2017
New Revision: 311036
URL: https://svnweb.freebsd.org/changeset/base/311036

Log:
  Update tcp.4 to reflect changes in TCP_SIGNATURE implementation.

Modified:
  projects/ipsec/share/man/man4/tcp.4

Modified: projects/ipsec/share/man/man4/tcp.4
==============================================================================
--- projects/ipsec/share/man/man4/tcp.4	Sun Jan  1 20:19:06 2017	(r311035)
+++ projects/ipsec/share/man/man4/tcp.4	Sun Jan  1 20:56:03 2017	(r311036)
@@ -34,7 +34,7 @@
 .\"     From: @(#)tcp.4	8.1 (Berkeley) 6/5/93
 .\" $FreeBSD$
 .\"
-.Dd October 21, 2016
+.Dd January 1, 2017
 .Dt TCP 4
 .Os
 .Sh NAME
@@ -272,33 +272,29 @@ or the internal send buffer is filled.
 This option enables the use of MD5 digests (also known as TCP-MD5)
 on writes to the specified socket.
 Outgoing traffic is digested;
-digests on incoming traffic are verified if the
-.Va net.inet.tcp.signature_verify_input
-sysctl is nonzero.
-The current default behavior for the system is to respond to a system
-advertising this option with TCP-MD5; this may change.
+digests on incoming traffic are verified.
+When socket has enabled this option, all outgoing TCP segments
+must be signed with MD5 digests, and all inbound TCP segments
+also must be signed.
 .Pp
 One common use for this in a
 .Fx
 router deployment is to enable
 based routers to interwork with Cisco equipment at peering points.
 Support for this feature conforms to RFC 2385.
-Only IPv4
-.Pq Dv AF_INET
-sessions are supported.
 .Pp
 In order for this option to function correctly, it is necessary for the
 administrator to add a tcp-md5 key entry to the system's security
 associations database (SADB) using the
 .Xr setkey 8
 utility.
-This entry must have an SPI of 0x1000 and can therefore only be specified
-on a per-host basis at this time.
+This entry can only be specified on a per-host basis at this time.
 .Pp
-If an SADB entry cannot be found for the destination, the outgoing traffic
-will have an invalid digest option prepended, and the following error message
-will be visible on the system console:
-.Em "tcp_signature_compute: SADB lookup failed for %d.%d.%d.%d" .
+If an SADB entry cannot be found for the destination,
+the system will not send any outgoing segments and will drop any
+inbound segments.
+.Pp
+Each dropped segment will be taken into account in the TCP protocol statistics.
 .El
 .Pp
 The option level for the