Index | Thread | Search

From:
Ingo Schwarze <schwarze@usta.de>
Subject:
Re: bgpd: add tcp md5sig documentation for rtr
To:
Theo Buehler <tb@theobuehler.org>
Cc:
tech@openbsd.org
Date:
Wed, 26 Aug 2026 16:05:45 +0200

Download raw body.

Thread
Hello Theo,

Theo Buehler wrote on Wed, Aug 26, 2026 at 03:13:02PM +0200:
> On Wed, Aug 26, 2026 at 02:47:05PM +0200, Claudio Jeker wrote:

>> I missed to add the tcp md5sig bits for rtr to bgpd.conf.5
>> This is just a copy of the same bits in the neighbor section.
>> 
>> -- 
>> :wq Claudio
>> 
>> Index: bgpd.conf.5
>> ===================================================================
>> RCS file: /cvs/src/usr.sbin/bgpd/bgpd.conf.5,v
>> diff -u -p -r1.255 bgpd.conf.5
>> --- bgpd.conf.5	2 Jun 2026 08:40:02 -0000	1.255
>> +++ bgpd.conf.5	26 Aug 2026 12:26:35 -0000
>> @@ -617,6 +617,16 @@ If not specified, the default
>>  .Ic port
>>  is
>>  .Em 323 .
>> +.Pp
>> +.It Ic tcp md5sig password Ar secret
>> +.It Ic tcp md5sig key Ar secret
>> +Enable TCP MD5 signatures per RFC 2385.
>> +The shared secret can either be given as a password or hexadecimal key.
>> +.Bd -literal -offset indent
>> +tcp md5sig password mekmitasdigoat
>> +tcp md5sig key deadbeef
>> +.Ed

> Not sure why the spacing around the .Bd block is asymmetric

I has been like that since at least 4.4BSD.  The .Ed macro did an output
line break and reset indentation, but did not insert vertical spacing;
similarly for .El. Modern groff and mandoc also agree on this aspect.
In general, the logic tends to be that some blocks (paragraphs,
lists, lists items, displays without -compact etc.) insert vertical
spacing before themselves, but not after themselves.

If needed, you control the vertical spacing when you start something new.

> but I'd consider putting a .Pp here (and also in the other copy).

Indeed, .Pp often makes sense after a list or display, because what
follows often is a new paragraph and only rarely something closely
associated with the list or display.

Yours,
  Ingo

> You do that in most other such blocks.
> Either way ok

>> +After changing keys, a session needs to be reset to use the new keys.
>>  .El
>>  .El
>>  .Sh NETWORK AND FLOWSPEC ANNOUNCEMENTS