rework how tcp md5 signatures are configured.

previously ldpd only allowed tcp md5 to be configured against a
neighbor (by ldp router id), but other vendors supported configuring
tcp md5sig by prefix as well as neighbor. this reworks the config
so auth is maintained globally as a list of prefixes that you do
and do not want to do tcp md5sig auth with.

the config statements look more like what is in bgpd.conf now too.

an example of the new config for interoperating with my baby cisco
test network:

on ios:

	mpls ldp password required for MPLS
	mpls ldp password option 1 for MPLS key-chain LDPAUTH

	key chain LDPAUTH
	 key 1
	  key-string secret

	interface Loopback0
	 ip address 192.168.0.0 255.255.255.255
	end

	ip prefix-list MPLS seq 5 permit 192.168.0.0/24
	ip access-list standard MPLS

	mpls ldp router-id Loopback0 force

and in ldpd.conf:

	router-id 192.168.0.25
	tcp md5sig password secret 192.168.0.0/24
	address-family ipv4 { interface vmx1 }

this still supports specifying tcp md5sig on neighbors, but that
is syntactic sugar around adding entries to the list of auths.

ok (and lots of help from) claudio@

1 files changed, 6 insertions, 9 deletions

diff --git a/usr.sbin/ldpd/ldpe.h b/usr.sbin/ldpd/ldpe.h
index 569e8ffc8bc..a4ad7de0440 100644
--- a/usr.sbin/ldpd/ldpe.h
+++ b/usr.sbin/ldpd/ldpe.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ldpe.h,v 1.75 2017/03/04 00:21:48 renato Exp $ */
+/*	$OpenBSD: ldpe.h,v 1.76 2019/01/23 02:02:04 dlg Exp $ */
 
 /*
  * Copyright (c) 2013, 2016 Renato Westphal <renato@openbsd.org>
@@ -94,13 +94,10 @@ struct nbr {
 	uint16_t		 keepalive;
 	uint16_t		 max_pdu_len;
 
-	struct {
-		uint8_t			established;
-		uint32_t		spi_in;
-		uint32_t		spi_out;
-		enum auth_method	method;
-		char			md5key[TCP_MD5_KEY_LEN];
-	} auth;
+	uint32_t		 auth_spi_in;
+	uint32_t		 auth_spi_out;
+	int			 auth_established;
+
 	int			 flags;
 };
 #define F_NBR_GTSM_NEGOTIATED	 0x01
@@ -276,7 +273,7 @@ char	*pkt_ptr;	/* packet buffer */
 
 /* pfkey.c */
 int	pfkey_read(int, struct sadb_msg *);
-int	pfkey_establish(struct nbr *, struct nbr_params *);
+int	pfkey_establish(struct ldpd_conf *, struct nbr *);
 int	pfkey_remove(struct nbr *);
 int	pfkey_init(void);