From owner-freebsd-current@freebsd.org Mon Jul 11 22:45:04 2016 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 7A3FCB92EF3 for ; Mon, 11 Jul 2016 22:45:04 +0000 (UTC) (envelope-from mailing-machine@vniz.net) Received: from mail-lf0-f53.google.com (mail-lf0-f53.google.com [209.85.215.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 0A90B13A4 for ; Mon, 11 Jul 2016 22:45:03 +0000 (UTC) (envelope-from mailing-machine@vniz.net) Received: by mail-lf0-f53.google.com with SMTP id b199so1728762lfe.0 for ; Mon, 11 Jul 2016 15:45:03 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=oPoEGqCrjGt3O2w62mwp01AlqNc7C1hBzT1GhIUkhZU=; b=hjNRVf6gd0y/RHXLmbPTAorwFDWEIIECuWe1UHtvMdQL0EsdoDTCcm+2cDtB8H+rzR 27yO8UPloq5TQsLjI4V1zfUJF9an2u0pzxnf7quXr2yMXem+WirN4v6Gfpi3g2GSZ6ci qhhrOWwjt2n/exuZpkQEwkHEXGbpjVK54rabbxL464eIhPkq2SFely4rds+AbDOlpp2d AmxvpBiwni1hGuL7jEF0hPbgEM07/47ElF4NoZ/1HTwLFun6B4R9VhSpTGfHPUC/V1pR Ha5n+LEOEQ+ist2BrI3iZP4v2E/ZE60p7EhGfWOcMJCxa9nhA1smQ0OCdf30286tbqsp W6ow== X-Gm-Message-State: ALyK8tIolIvuoBzFNyRdvSQRfCIwaJ2109JEKrZkvOSdEW5LWABrm6dgGfJCbdz22DJ/ig== X-Received: by 10.46.1.67 with SMTP id 64mr4675933ljb.22.1468277096135; Mon, 11 Jul 2016 15:44:56 -0700 (PDT) Received: from [192.168.1.2] ([89.169.173.68]) by smtp.gmail.com with ESMTPSA id h62sm1664273lji.28.2016.07.11.15.44.55 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 11 Jul 2016 15:44:55 -0700 (PDT) Subject: Re: GOST in OPENSSL_BASE To: Slawa Olhovchenkov , Jung-uk Kim References: <20160710133019.GD20831@zxy.spb.ru> <20160711184122.GP46309@zxy.spb.ru> Cc: freebsd-security@freebsd.org, freebsd-current@freebsd.org From: Andrey Chernov Message-ID: <98f27660-47ff-d212-8c50-9e6e1cd52e0b@freebsd.org> Date: Tue, 12 Jul 2016 01:44:54 +0300 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <20160711184122.GP46309@zxy.spb.ru> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Jul 2016 22:45:04 -0000 On 11.07.2016 21:41, Slawa Olhovchenkov wrote: > On Mon, Jul 11, 2016 at 02:28:45PM -0400, Jung-uk Kim wrote: > >> On 07/10/16 10:10 AM, Andrey Chernov wrote: >>> On 10.07.2016 16:30, Slawa Olhovchenkov wrote: >>>> I am surprised lack of support GOST in openssl-base. >>>> Can be this enabled before 11.0 released? >>> >>> AFAIK openssl maintainers says something like they can't support this >>> code and it will become rotten shortly with new changes, so they drop it. >> >> [OpenSSL-maintainer-for-the-base hat on] >> >> GOST is supported on FreeBSD 10.x and 11.x. We will not drop it on >> these branches unless secteam explicitly ask us to do so. However, we >> *may* drop it from 12.0 *iff* we import OpenSSL 1.1.0 branch. >> >> [OpenSSL-maintainer-for-the-base hat off] >> >> Jung-uk Kim >> > > Thanks! > > May be need file PR for dns/bind910? > > # grep -3 BROK /poudriere/ports/default/dns/bind910/Makefile > .include > > .if ( ${PORT_OPTIONS:MGOST} || ${PORT_OPTIONS:MGOST_ASN1} ) && ${SSL_DEFAULT} == base > BROKEN= OpenSSL from the base system does not support GOST, add \ > DEFAULT_VERSIONS+=ssl=openssl to your /etc/make.conf and rebuild everything \ > that needs SSL. > .endif > I dislike idea to use GOST in the bind, it is unneeded there, DNSSEC don't use GOST, so I vote for removing GOST option from there.