svn commit: r360202 - head/sys/netipsec

[John Baldwin]

Author: jhb
Date: Wed Apr 22 19:44:33 2020
New Revision: 360202
URL: https://svnweb.freebsd.org/changeset/base/360202

Log:
  Deprecate 3des support in IPsec for FreeBSD 13.
  
  RFC 8221 does not outright ban 3des as the algorithms deprecated for
  13 in r348205, but it is listed as a SHOULD NOT and will likely be a
  MUST NOT by the time 13 ships.
  
  Discussed with:	bjk
  MFC after:	1 week
  Sponsored by:	Chelsio Communications
  Differential Revision:	https://reviews.freebsd.org/D24341

Modified:
  head/sys/netipsec/xform_esp.c

Modified: head/sys/netipsec/xform_esp.c
==============================================================================
--- head/sys/netipsec/xform_esp.c	Wed Apr 22 18:39:45 2020	(r360201)
+++ head/sys/netipsec/xform_esp.c	Wed Apr 22 19:44:33 2020	(r360202)
@@ -94,7 +94,7 @@ SYSCTL_VNET_PCPUSTAT(_net_inet_esp, IPSECCTL_STATS, st
     struct espstat, espstat,
     "ESP statistics (struct espstat, netipsec/esp_var.h");
 
-static struct timeval deswarn, blfwarn, castwarn, camelliawarn;
+static struct timeval deswarn, blfwarn, castwarn, camelliawarn, tdeswarn;
 
 static int esp_input_cb(struct cryptop *op);
 static int esp_output_cb(struct cryptop *crp);
@@ -162,6 +162,10 @@ esp_init(struct secasvar *sav, struct xformsw *xsp)
 	switch (sav->alg_enc) {
 	case SADB_EALG_DESCBC:
 		if (ratecheck(&deswarn, &ipsec_warn_interval))
+			gone_in(13, "DES cipher for IPsec");
+		break;
+	case SADB_EALG_3DESCBC:
+		if (ratecheck(&tdeswarn, &ipsec_warn_interval))
 			gone_in(13, "DES cipher for IPsec");
 		break;
 	case SADB_X_EALG_BLOWFISHCBC: