Subject: [RFC] mark MD5 as broken in older (stable) kernels

From: Stephen Hemminger <[email-masked]>
Date: Wed, 9 Jul 2008 09:58:51 -0700

The following should probably be sent to stable kernel tree to disable
MD5 in older kernels. It will avoid problems for all those vendor
kernels.

--- a/net/ipv4/Kconfig	2008-07-09 09:52:50.000000000 -0700
+++ b/net/ipv4/Kconfig	2008-07-09 09:54:27.000000000 -0700
@@ -622,7 +622,7 @@ config DEFAULT_TCP_CONG
 
 config TCP_MD5SIG
 	bool "TCP: MD5 Signature Option support (RFC2385) (EXPERIMENTAL)"
-	depends on EXPERIMENTAL
+	depends on EXPERIMENTAL && BROKEN
 	select CRYPTO
 	select CRYPTO_MD5
 	---help---
@@ -631,6 +631,8 @@ config TCP_MD5SIG
 	  on the Internet.
 
 	  If unsure, say N.
+	  The current version is broken for case of TCP SACK and devices that
+          use TSO or Scatter/Gather.
 
 source "net/ipv4/ipvs/Kconfig"