Author: jhb
Date: Wed May 6 23:23:22 2020
New Revision: 360721
URL: https://svnweb.freebsd.org/changeset/base/360721
Log:
MFC 360202,360206: Deprecate 3des support in IPsec for FreeBSD 13.
360202:
Deprecate 3des support in IPsec for FreeBSD 13.
RFC 8221 does not outright ban 3des as the algorithms deprecated for
13 in r348205, but it is listed as a SHOULD NOT and will likely be a
MUST NOT by the time 13 ships.
360206:
Fix name of 3DES cipher in deprecation warning.
Sponsored by: Chelsio Communications
Modified:
stable/11/sys/netipsec/xform_esp.c
Directory Properties:
stable/11/ (props changed)
Changes in other areas also in this revision:
Modified:
stable/12/sys/netipsec/xform_esp.c
Directory Properties:
stable/12/ (props changed)
Modified: stable/11/sys/netipsec/xform_esp.c
==============================================================================
--- stable/11/sys/netipsec/xform_esp.c Wed May 6 23:03:40 2020
(r360720)
+++ stable/11/sys/netipsec/xform_esp.c Wed May 6 23:23:22 2020
(r360721)
@@ -94,7 +94,7 @@ SYSCTL_VNET_PCPUSTAT(_net_inet_esp, IPSECCTL_STATS, st
struct espstat, espstat,
"ESP statistics (struct espstat, netipsec/esp_var.h");
-static struct timeval deswarn, blfwarn, castwarn, camelliawarn;
+static struct timeval deswarn, blfwarn, castwarn, camelliawarn, tdeswarn;
static int esp_input_cb(struct cryptop *op);
static int esp_output_cb(struct cryptop *crp);
@@ -163,6 +163,10 @@ esp_init(struct secasvar *sav, struct xformsw *xsp)
case SADB_EALG_DESCBC:
if (ratecheck(&deswarn, &ipsec_warn_interval))
gone_in(13, "DES cipher for IPsec");
+ break;
+ case SADB_EALG_3DESCBC:
+ if (ratecheck(&tdeswarn, &ipsec_warn_interval))
+ gone_in(13, "3DES cipher for IPsec");
break;
case SADB_X_EALG_BLOWFISHCBC:
if (ratecheck(&blfwarn, &ipsec_warn_interval))
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
