Marius Tomaschewski
1caa59fb4f
- A new default configuration file layout is introduced. The new
default strongswan.conf file mainly includes config snippets from
the strongswan.d and strongswan.d/charon directories (the latter
containing snippets for all plugins). The snippets, with commented
defaults, are automatically generated and installed, if they don't
exist yet. Also installed in $prefix/share/strongswan/templates so
existing files can be compared to the current defaults.
- As an alternative to the non-extensible charon.load setting, the
plugins to load in charon (and optionally other applications) can
now be determined via the charon.plugins.<name>.load setting for
each plugin (enabled in the new default strongswan.conf file via the
charon.load_modular option). The load setting optionally takes a
numeric priority value that allows reordering the plugins (otherwise
the default plugin order is preserved).
- All strongswan.conf settings that were formerly defined in library
specific "global" sections are now application specific (e.g.
settings for plugins in libstrongswan.plugins can now be set only
for charon in charon.plugins). The old options are still supported,
which now allows to define defaults for all applications in the
libstrongswan section.
- The ntru libstrongswan plugin supports NTRUEncrypt as a post-quantum
computer IKE key exchange mechanism. The implementation is based on
the ntru-crypto library from the NTRUOpenSourceProject.
The supported security strengths are ntru112, ntru128, ntru192, and
ntru256. Since the private DH group IDs 1030..1033 have been
assigned, the strongSwan Vendor ID must be sent in order to use NTRU
(charon.send_vendor_id = yes).
- Defined a TPMRA remote attestation workitem and added support for it
to the Attestation IMV.
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=64
10 lines
428 B
Plaintext
10 lines
428 B
Plaintext
### Known warnings:
|
|
# - traditional name
|
|
addFilter("strongswan.* incoherent-init-script-name ipsec")
|
|
# - readme only, triggers full ipsec + ikev1&ikev2 install
|
|
addFilter("strongswan.* no-binary")
|
|
# - link to init script, covered by service(8)
|
|
addFilter("strongswan.* no-manual-page-for-binary rcipsec")
|
|
# - no, restating tunnels on update may break the update
|
|
addFilter("strongswan.*restart_on_update-postun /etc/init.d/ipsec")
|