From owner-freebsd-security@freebsd.org Mon Jul 11 22:45:04 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 7ADADB92EF4 for ; Mon, 11 Jul 2016 22:45:04 +0000 (UTC) (envelope-from mailing-machine@vniz.net) Received: from mail-lf0-f43.google.com (mail-lf0-f43.google.com [209.85.215.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 0A98E13A6 for ; Mon, 11 Jul 2016 22:45:03 +0000 (UTC) (envelope-from mailing-machine@vniz.net) Received: by mail-lf0-f43.google.com with SMTP id q132so83755035lfe.3 for ; Mon, 11 Jul 2016 15:45:03 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:subject:to:references:cc:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=oPoEGqCrjGt3O2w62mwp01AlqNc7C1hBzT1GhIUkhZU=; b=TI/Y5LJraUCYG4gWAkmpUFxHrahDXTciQiaxgdx1ac1zGMdi7t6QZ9p8Wn5QBkdHOy vmd0has+UX7naqxn0WJUuR3naCofJhrYL4lj2hZp7XjYxy0A1T91WvCBOP742tybQ92s JzXSOAWayL2WNoYoSI5oopeUWDWv935T0UNeQm0Xj0uRcNp7YT4wToONWm9jgkus3jv/ ezwxdeDAB1AEJnGmFWvMMkcYLzXNNRWn61oXuzUqJcH+jjgui0pkHzrJsLhhy1KvEUHi OngaMpcJtwhmhsZb/99ua/8ZH20RUF67E/BHI+3MSeSCtxcbajxaLWJghrsGN8J2wzwN N+yw== X-Gm-Message-State: ALyK8tKPKU7K9fYK2o36rn8DSVbUpO4jO9ApDhHw/2gLog1xe87ys2yHREuTTRiwAMgChw== X-Received: by 10.46.1.67 with SMTP id 64mr4675933ljb.22.1468277096135; Mon, 11 Jul 2016 15:44:56 -0700 (PDT) Received: from [192.168.1.2] ([89.169.173.68]) by smtp.gmail.com with ESMTPSA id h62sm1664273lji.28.2016.07.11.15.44.55 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 11 Jul 2016 15:44:55 -0700 (PDT) Subject: Re: GOST in OPENSSL_BASE To: Slawa Olhovchenkov , Jung-uk Kim References: <20160710133019.GD20831@zxy.spb.ru> <20160711184122.GP46309@zxy.spb.ru> Cc: freebsd-security@freebsd.org, freebsd-current@freebsd.org From: Andrey Chernov Message-ID: <98f27660-47ff-d212-8c50-9e6e1cd52e0b@freebsd.org> Date: Tue, 12 Jul 2016 01:44:54 +0300 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <20160711184122.GP46309@zxy.spb.ru> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Jul 2016 22:45:04 -0000 On 11.07.2016 21:41, Slawa Olhovchenkov wrote: > On Mon, Jul 11, 2016 at 02:28:45PM -0400, Jung-uk Kim wrote: > >> On 07/10/16 10:10 AM, Andrey Chernov wrote: >>> On 10.07.2016 16:30, Slawa Olhovchenkov wrote: >>>> I am surprised lack of support GOST in openssl-base. >>>> Can be this enabled before 11.0 released? >>> >>> AFAIK openssl maintainers says something like they can't support this >>> code and it will become rotten shortly with new changes, so they drop it. >> >> [OpenSSL-maintainer-for-the-base hat on] >> >> GOST is supported on FreeBSD 10.x and 11.x. We will not drop it on >> these branches unless secteam explicitly ask us to do so. However, we >> *may* drop it from 12.0 *iff* we import OpenSSL 1.1.0 branch. >> >> [OpenSSL-maintainer-for-the-base hat off] >> >> Jung-uk Kim >> > > Thanks! > > May be need file PR for dns/bind910? > > # grep -3 BROK /poudriere/ports/default/dns/bind910/Makefile > .include > > .if ( ${PORT_OPTIONS:MGOST} || ${PORT_OPTIONS:MGOST_ASN1} ) && ${SSL_DEFAULT} == base > BROKEN= OpenSSL from the base system does not support GOST, add \ > DEFAULT_VERSIONS+=ssl=openssl to your /etc/make.conf and rebuild everything \ > that needs SSL. > .endif > I dislike idea to use GOST in the bind, it is unneeded there, DNSSEC don't use GOST, so I vote for removing GOST option from there.