From owner-svn-src-stable@freebsd.org Fri May 31 23:40:19 2019 Return-Path: Delivered-To: svn-src-stable@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id DA3DC15A45EE; Fri, 31 May 2019 23:40:18 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Received: from smtp.freebsd.org (smtp.freebsd.org [96.47.72.83]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 7C74389190; Fri, 31 May 2019 23:40:18 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Received: from John-Baldwins-MacBook-Pro-4.local (ralph.baldwin.cx [66.234.199.215]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) (Authenticated sender: jhb) by smtp.freebsd.org (Postfix) with ESMTPSA id A401D178A7; Fri, 31 May 2019 23:40:17 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Subject: Re: svn commit: r348482 - stable/11/sys/netipsec To: Warner Losh Cc: src-committers , svn-src-all , svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org References: <201905312026.x4VKQu3T051213@repo.freebsd.org> <15af7ff4-42c9-2020-4167-6e757317f38a@FreeBSD.org> From: John Baldwin Openpgp: preference=signencrypt Autocrypt: addr=jhb@FreeBSD.org; keydata= mQGiBETQ+XcRBADMFybiq69u+fJRy/0wzqTNS8jFfWaBTs5/OfcV7wWezVmf9sgwn8TW0Dk0 c9MBl0pz+H01dA2ZSGZ5fXlmFIsee1WEzqeJzpiwd/pejPgSzXB9ijbLHZ2/E0jhGBcVy5Yo /Tw5+U/+laeYKu2xb0XPvM0zMNls1ah5OnP9a6Ql6wCgupaoMySb7DXm2LHD1Z9jTsHcAQMD /1jzh2BoHriy/Q2s4KzzjVp/mQO5DSm2z14BvbQRcXU48oAosHA1u3Wrov6LfPY+0U1tG47X 1BGfnQH+rNAaH0livoSBQ0IPI/8WfIW7ub4qV6HYwWKVqkDkqwcpmGNDbz3gfaDht6nsie5Z pcuCcul4M9CW7Md6zzyvktjnbz61BADGDCopfZC4of0Z3Ka0u8Wik6UJOuqShBt1WcFS8ya1 oB4rc4tXfSHyMF63aPUBMxHR5DXeH+EO2edoSwViDMqWk1jTnYza51rbGY+pebLQOVOxAY7k do5Ordl3wklBPMVEPWoZ61SdbcjhHVwaC5zfiskcxj5wwXd2E9qYlBqRg7QeSm9obiBCYWxk d2luIDxqaGJARnJlZUJTRC5vcmc+iGAEExECACAFAkTQ+awCGwMGCwkIBwMCBBUCCAMEFgID AQIeAQIXgAAKCRBy3lIGd+N/BI6RAJ9S97fvbME+3hxzE3JUyUZ6vTewDACdE1stFuSfqMvM jomvZdYxIYyTUpC5Ag0ERND5ghAIAPwsO0B7BL+bz8sLlLoQktGxXwXQfS5cInvL17Dsgnr3 1AKa94j9EnXQyPEj7u0d+LmEe6CGEGDh1OcGFTMVrof2ZzkSy4+FkZwMKJpTiqeaShMh+Goj XlwIMDxyADYvBIg3eN5YdFKaPQpfgSqhT+7El7w+wSZZD8pPQuLAnie5iz9C8iKy4/cMSOrH YUK/tO+Nhw8Jjlw94Ik0T80iEhI2t+XBVjwdfjbq3HrJ0ehqdBwukyeJRYKmbn298KOFQVHO EVbHA4rF/37jzaMadK43FgJ0SAhPPF5l4l89z5oPu0b/+5e2inA3b8J3iGZxywjM+Csq1tqz hltEc7Q+E08AAwUIAL+15XH8bPbjNJdVyg2CMl10JNW2wWg2Q6qdljeaRqeR6zFus7EZTwtX sNzs5bP8y51PSUDJbeiy2RNCNKWFMndM22TZnk3GNG45nQd4OwYK0RZVrikalmJY5Q6m7Z16 4yrZgIXFdKj2t8F+x613/SJW1lIr9/bDp4U9tw0V1g3l2dFtD3p3ZrQ3hpoDtoK70ioIAjjH aIXIAcm3FGZFXy503DOA0KaTWwvOVdYCFLm3zWuSOmrX/GsEc7ovasOWwjPn878qVjbUKWwx Q4QkF4OhUV9zPtf9tDSAZ3x7QSwoKbCoRCZ/xbyTUPyQ1VvNy/mYrBcYlzHodsaqUDjHuW+I SQQYEQIACQUCRND5ggIbDAAKCRBy3lIGd+N/BCO8AJ9j1dWVQWxw/YdTbEyrRKOY8YZNwwCf afMAg8QvmOWnHx3wl8WslCaXaE8= Message-ID: <1d68c9d4-65f8-1f24-40d1-38813aa5de57@FreeBSD.org> Date: Fri, 31 May 2019 16:40:16 -0700 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: 7C74389190 X-Spamd-Bar: ------ Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-6.88 / 15.00]; NEURAL_HAM_MEDIUM(-1.00)[-1.000,0]; NEURAL_HAM_LONG(-1.00)[-1.000,0]; REPLY(-4.00)[]; NEURAL_HAM_SHORT(-0.88)[-0.876,0] X-BeenThere: svn-src-stable@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: SVN commit messages for all the -stable branches of the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 May 2019 23:40:19 -0000 On 5/31/19 3:47 PM, Warner Losh wrote: > On Fri, May 31, 2019 at 4:36 PM John Baldwin wrote: > >> On 5/31/19 1:26 PM, John Baldwin wrote: >>> Author: jhb >>> Date: Fri May 31 20:26:56 2019 >>> New Revision: 348482 >>> URL: https://svnweb.freebsd.org/changeset/base/348482 >>> >>> Log: >>> MFC 348205: >>> Add deprecation warnings for IPsec algorithms deprecated in RFC 8221. >>> >>> All of these algorithms are either explicitly marked MUST NOT, or they >>> are implicitly MUST NOTs by virtue of not being included in IETF's >>> list of protocols at all despite having assignments from IANA. >>> >>> Specifically, this adds warnings for the following ciphers: >>> - des-cbc >>> - blowfish-cbc >>> - cast128-cbc >>> - des-deriv >>> - des-32iv >>> - camellia-cbc >>> >>> Warnings for the following authentication algorithms are also added: >>> - hmac-md5 >>> - keyed-md5 >>> - keyed-sha1 >>> - hmac-ripemd160 >>> >>> Approved by: re (gjb) >> >> Sigh, so I just noticed while testing an MFC of another commit that adds >> deprecation warnings (GELI) that these warnings don't actually fire in 11 >> because gone_in(13, ...) only warns on 12.x and later: >> >> void >> _gone_in(int major, const char *msg) >> { >> >> gone_panic(major, P_OSREL_MAJOR(__FreeBSD_version), msg); >> if (P_OSREL_MAJOR(__FreeBSD_version) >= major) >> printf("Obsolete code will removed soon: %s\n", msg); >> else if (P_OSREL_MAJOR(__FreeBSD_version) + 1 == major) >> printf("Deprecated code (to be removed in FreeBSD %d): >> %s\n", >> major, msg); >> } >> >> I guess we could make the later test unconditional on stable/11 (and >> possibly >> make that change on HEAD and MFC it)? I think I understand why we did that >> originally (you could MFC warnings back to older branches without annoying >> users to keep code in sync), but I wonder if in practice we don't want the >> warnings always enabled? >> > > "It seemed like a good idea at the time" I think is why we did it, but it > turns out that it's not such a good idea. I agree: we should always warn in > older branches because latter-day releases of those branches will be > proximate to the removal time in major + 2. This is a perfect example of > this. Another datapoint in favor that I realized after my original e-mail is that gone_panic() doesn't have the + 1 check. If you set the associated sysctl to 2 (not the default) to panic for deprecated things, it will panic over something that it doesn't warn about by default. -- John Baldwin