Upgrade from 9.10.2 to 11 - ZFS feature flags?

[lukeren]

I've just upgraded my test system to FreeNAS-11-STABLE with no issues at all.
The UI is giving me a warning though, that there's new feature flags available and I can upgrade if I want.
I don't know if I want to do that though, I can't seem to find any information about what these new flags will do, besides prevent me from reverting to 9.10.2.

I'm probably not looking in the right place, but can someone enlighten me please? :)

 

[Ericloewe]

FreeBSD 11, used in FreeNAS 11, adds only two feature flags over those supported in 10.3, used in FreeNAS 9.10:

• The skein hash function
• The SHA512 hash function

When not actually used by any datasets, the pool can be imported on older versions with no sweat. You don't gain anything from adding these feature flags unless you're doing dedup, so it's easiest to uncheck the alert and not bother for now.

More info in the Resources Section: https://forums.freenas.org/index.php?resources/zfs-feature-flags-in-freenas.95/

 

[lukeren]

Thanks, I'll do that :)

 

[Stux]

So, just upgraded my test machine to 11-RC. As was pointed out in this thread from the 9.3 days, https://forums.freenas.org/index.php?threads/upgrading-a-zfs-pool.26641/

The search box doesn't work. Still doesn't.

I think that the manual should point out what the new features are, and why you might want them. I didn't see it anywhere.

So, the conclusion is, there's no point upgrading... right?

Big scary warning is scary, should it even be displayed, or should perhaps a message be displayed when you try to activate something that actually requires the pool to be upgraded to function?

If this message is going to be displayed to every single person who upgrades to FreeNAS 11, then perhaps it needs to be pointed out clearer what to do.

The manual section, just says its a "One way street" and doesn't actually provide any guidance.

 

[Stux]

Ix updated the "New Features in 11.0" docs in RC2 to actually mention the new feature flags, but here is some good info I found from the original commit which added these flags to ZFS.

https://reviews.csiden.org/r/223/

sha512

This feature enables the use of the SHA-512/256 truncated hash
algorithm (FIPS 180-4) for checksum and dedup. The native 64-bit
arithemtic of SHA-512 provides an approximate 50% performance boost
over SHA-256 on 64-bit hardware and is thus a good minimum-change
replacement candidate for systems where hash performance is
important, but these systems cannot for whatever reason utilize the
faster skein and edonr algorithms.

Booting off of pools utilizing SHA-512/256 is supported (provided
that the updated GRUB stage2 module is installed).

skein

This feature enables the use of the Skein hash algorithm for
checksum and dedup. Skein is a high-performance secure hash
algorithm that was a finalist in the NIST SHA-3 competition. It
provides a very high security margin and high performance on 64-bit
hardware (80% faster than SHA-256). This implementation also
utilizes the new salted checksumming functionality in ZFS, which
means that the checksum is pre-seeded with a secret 256-bit random
key (stored on the pool) before being fed the data block to be
checksummed. Thus the produced checksums are unique to a given
pool, preventing hash collision attacks on systems with dedup.

The same information can be found in

man zpool-features

 

[zeezoo]

One question - after updating flags with encrypted pool - is it necessary to re-encrypt the pool or it can be de-crypted with old keys?

 

[Ericloewe]

The disks are encrypted, not the pool. Whatever you do with the pool, it's encrypted as it was.