Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 6 May 2020 23:23:22 +0000 (UTC)
From:      John Baldwin <jhb@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org
Subject:   svn commit: r360721 - in stable: 11/sys/netipsec 12/sys/netipsec
Message-ID:  <202005062323.046NNMkU078740@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: jhb
Date: Wed May  6 23:23:22 2020
New Revision: 360721
URL: https://svnweb.freebsd.org/changeset/base/360721

Log:
  MFC 360202,360206: Deprecate 3des support in IPsec for FreeBSD 13.
  
  360202:
  Deprecate 3des support in IPsec for FreeBSD 13.
  
  RFC 8221 does not outright ban 3des as the algorithms deprecated for
  13 in r348205, but it is listed as a SHOULD NOT and will likely be a
  MUST NOT by the time 13 ships.
  
  360206:
  Fix name of 3DES cipher in deprecation warning.
  
  Sponsored by:	Chelsio Communications

Modified:
  stable/11/sys/netipsec/xform_esp.c
Directory Properties:
  stable/11/   (props changed)

Changes in other areas also in this revision:
Modified:
  stable/12/sys/netipsec/xform_esp.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/11/sys/netipsec/xform_esp.c
==============================================================================
--- stable/11/sys/netipsec/xform_esp.c	Wed May  6 23:03:40 2020	(r360720)
+++ stable/11/sys/netipsec/xform_esp.c	Wed May  6 23:23:22 2020	(r360721)
@@ -94,7 +94,7 @@ SYSCTL_VNET_PCPUSTAT(_net_inet_esp, IPSECCTL_STATS, st
     struct espstat, espstat,
     "ESP statistics (struct espstat, netipsec/esp_var.h");
 
-static struct timeval deswarn, blfwarn, castwarn, camelliawarn;
+static struct timeval deswarn, blfwarn, castwarn, camelliawarn, tdeswarn;
 
 static int esp_input_cb(struct cryptop *op);
 static int esp_output_cb(struct cryptop *crp);
@@ -163,6 +163,10 @@ esp_init(struct secasvar *sav, struct xformsw *xsp)
 	case SADB_EALG_DESCBC:
 		if (ratecheck(&deswarn, &ipsec_warn_interval))
 			gone_in(13, "DES cipher for IPsec");
+		break;
+	case SADB_EALG_3DESCBC:
+		if (ratecheck(&tdeswarn, &ipsec_warn_interval))
+			gone_in(13, "3DES cipher for IPsec");
 		break;
 	case SADB_X_EALG_BLOWFISHCBC:
 		if (ratecheck(&blfwarn, &ipsec_warn_interval))



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202005062323.046NNMkU078740>