K 10
svn:author
V 2
ae
K 8
svn:date
V 27
2016-12-06T12:52:20.086549Z
K 7
svn:log
V 568
Due to the changes in SADB now each SA has unique SPI.
Previously TCP-MD5 SAs have one magic SPI = 0x1000. This was used by
some applications. E.g. bird uses SADB_ADD and SADB_DELETE PF_KEY
messages to configure security key used by TCP_MD5SIG socket option.
To support old applications and configs add the workaround.

When SADB_ADD, SADB_GET and SADB_DELETE messages are used for
IPPROTO_TCP, do lookup for needed SA using its secasindex, instead of
SPI. When several TCP-MD5 SAs added with one SPI value, use key_do_getnewspi
to allocate new SPI value in SADB_ADD.

END