cf0313df27- rename -hmac subpackage to -fips because it isn't providing the hmac files, it provides the configuration drop in to enforce fips mode.Jan Engelhardt2024-11-26 12:56:29 +0000
3e9069345bAccepting request 1181997 from network:vpn
Ana Guerrero
2024-06-21 14:02:56 +0000
233d1d3c87- Update description of ipsec package: no longer mention /etc/init.d, which is not there for a long time anymore. - Drop legacy rc* -> sbin/service symlink. This was compatibilty boilerplate to transparently move between SySV and systemd [jsc#PED-264].Jan Engelhardt2024-06-20 17:00:41 +0000
6f280319a6Accepting request 1160698 from network:vpn
Ana Guerrero
2024-03-26 18:24:36 +0000
adcc79ae6bAccepting request 573411 from network:vpn
Dominique Leuenberger
2018-02-07 17:41:10 +0000
4ee9977c46Accepting request 534431 from home:jengelh:branches:network:vpn
Dominique Leuenberger
2018-02-06 17:07:40 +0000
a848a3d65dAccepting request 521289 from network:vpn
Dominique Leuenberger
2017-09-07 20:15:13 +0000
062c69a06dAccepting request 521273 from home:ndas:branches:network:vpn
Nirmoy Das
2017-09-05 15:38:01 +0000
e17322a559Accepting request 521079 from home:ndas:branches:network:vpn
Nirmoy Das
2017-09-05 10:08:54 +0000
5ffb8e04a6Accepting request 521071 from home:ndas:branches:network:vpn
Nirmoy Das
2017-09-05 09:57:57 +0000
ce390f0920Accepting request 514549 from network:vpn
Dominique Leuenberger
2017-08-24 16:45:53 +0000
339326d8bcAccepting request 514548 from home:ndas:branches:network:vpn
Nirmoy Das
2017-08-04 11:47:37 +0000
8cfc35877aAccepting request 513652 from home:ndas:branches:network:vpn
Nirmoy Das
2017-08-01 07:21:05 +0000
253288c928Accepting request 442527 from network:vpn
Dominique Leuenberger
2016-11-29 11:50:28 +0000
d3507c65d4Accepting request 406438 from home:dkosovic:branches:network:vpnMarius Tomaschewski2016-11-29 08:32:29 +0000
f3a0b7cca7Accepting request 344762 from network:vpn
Dominique Leuenberger
2015-11-17 13:23:11 +0000
406171b31d- Applied upstream fix for a authentication bypass vulnerability in the eap-mschapv2 plugin (CVE-2015-8023,bsc#953817). [+ 0007-strongswan-4.4.0-5.3.3_eap_mschapv2_state.patch]Marius Tomaschewski2015-11-16 15:23:01 +0000
ba2bed6a95Accepting request 311158 from network:vpn
Dominique Leuenberger
2015-06-09 06:49:35 +0000
cfde0c0ea7- Applied upstream fix for a rogue servers vulnerability, that may enable rogue servers able to authenticate itself with certificate issued by any CA the client trusts, to gain user credentials from a client in certain IKEv2 setups (bsc#933591,CVE-2015-4171). [+ 0006-strongswan-5.1.0-5.3.1_enforce_remote_auth.patch] - Fix to apply unknown_payload patch if fips is disabled (<= 13.1) and renamed it to use number prefix corresponding with patch nr. [- strongswan-5.2.2-5.3.0_unknown_payload.patch, + 0005-strongswan-5.2.2-5.3.0_unknown_payload.patch]Marius Tomaschewski2015-06-08 13:41:42 +0000
a596ccdfc9Accepting request 309675 from network:vpn
Dominique Leuenberger
2015-06-02 08:12:05 +0000
288621ec30- Applied upstream fix for a DoS and potential remote code execution vulnerability through payload type (bsc#931272,CVE-2015-3991) [+ strongswan-5.2.2-5.3.0_unknown_payload.patch]Marius Tomaschewski2015-06-01 16:25:25 +0000
b401bc1d51- Applied a fix by Marcus Meissner for a loop check in ipsec pki causing a segfault on attempt to create certificates when fips is enabled (bsc#918474,https://wiki.strongswan.org/issues/881) [+ 0006-strongswan-pkifix.918474.patch]Marius Tomaschewski2015-03-09 09:02:18 +0000
d688e99dd5Accepting request 287701 from network:vpn
Dominique Leuenberger
2015-02-27 09:59:38 +0000
055879bc1c- Updated to strongSwan 5.2.2 providing the following changes: Changes in version 5.2.2: * Fixed a denial-of-service vulnerability triggered by an IKEv2 Key Exchange payload that contains the Diffie-Hellman group 1025. This identifier was used internally for DH groups with custom generator and prime. Because these arguments are missing when creating DH objects based on the KE payload an invalid pointer dereference occurred. This allowed an attacker to crash the IKE daemon with a single IKE_SA_INIT message containing such a KE payload. The vulnerability has been registered as CVE-2014-9221. * The left/rightid options in ipsec.conf, or any other identity in strongSwan, now accept prefixes to enforce an explicit type, such as email: or fqdn:. Note that no conversion is done for the remaining string, refer to ipsec.conf(5) for details. * The post-quantum Bimodal Lattice Signature Scheme (BLISS) can be used as an IKEv2 public key authentication method. The pki tool offers full support for the generation of BLISS key pairs and certificates. * Fixed mapping of integrity algorithms negotiated for AH via IKEv1. This could cause interoperability issues when connecting to older versions of charon. Changes in version 5.2.1: * The new charon-systemd IKE daemon implements an IKE daemon tailored for use with systemd. It avoids the dependency on ipsec starter and uses swanctl as configuration backend, building a simple and lightweight solution. It supports native systemd journal logging. * Support for IKEv2 fragmentation as per RFC 7383 has been added. Like IKEv1 fragmentation it can be enabled by setting fragmentation=yes in ipsec.conf. * Support of the TCG TNC IF-M Attribute Segmentation specification proposal. All attributes can be segmented. Additionally TCG/SWID Tag, TCG/SWID Tag ID and IETF/Installed Packages attributes can be processed incrementally on a per segment basis.Marius Tomaschewski2015-01-05 14:41:37 +0000
fadffa6d60- Disallow brainpool elliptic curve groups in fips mode (bnc#856322). [* strongswan_fipsfilter.patch]Marius Tomaschewski2015-01-05 13:04:19 +0000
Ana Guerrero
OBS User unknown
Jan Engelhardt
Mohd Saquib
Dominique Leuenberger
Madhu Mohan Nelemane
Nirmoy Das
Marius Tomaschewski