cf104ead60
Copy from network:vpn/strongswan based on submit request 33800 from user mtomaschewski OBS-URL: https://build.opensuse.org/request/show/33800 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/strongswan?expand=0&rev=19
478 lines
25 KiB
Plaintext
478 lines
25 KiB
Plaintext
-------------------------------------------------------------------
|
|
Tue Mar 2 21:42:10 CET 2010 - mt@suse.de
|
|
|
|
- Updated to strongSwan 4.3.6 release, changes since 4.3.4 are:
|
|
* The IKEv2 daemon supports RFC 3779 IP address block constraints
|
|
carried as a critical X.509v3 extension in the peer certificate.
|
|
* The ipsec pool --add|del dns|nbns command manages DNS and NBNS
|
|
name server entries that are sent via the IKEv1 Mode Config or
|
|
IKEv2 Configuration Payload to remote clients.
|
|
* The Camellia cipher can be used as an IKEv1 encryption algorithm.
|
|
* The IKEv1 and IKEV2 daemons now check certificate path length
|
|
constraints.
|
|
* The new ipsec.conf conn option "inactivity" closes a CHILD_SA if
|
|
no traffic was sent or received within the given interval. To close
|
|
the complete IKE_SA if its only CHILD_SA was inactive, set the
|
|
global strongswan.conf option "charon.inactivity_close_ike" to yes.
|
|
* More detailed IKEv2 EAP payload information in debug output
|
|
* IKEv2 EAP-SIM and EAP-AKA share joint libsimaka library
|
|
* Added required userland changes for proper SHA256 and SHA384/512
|
|
in ESP that will be introduced with Linux 2.6.33.
|
|
The "sha256"/"sha2_256" keyword now configures the kernel with 128
|
|
bit truncation, not the non-standard 96 bit truncation used by
|
|
previous releases. To use the old 96 bit truncation scheme, the new
|
|
"sha256_96" proposal keyword has been introduced.
|
|
* Fixed IPComp in tunnel mode, stripping out the duplicated outer
|
|
header. This change makes IPcomp tunnel mode connections
|
|
incompatible with previous releases; disable compression on such
|
|
tunnels.
|
|
* Fixed BEET mode connections on recent kernels by installing SAs
|
|
with appropriate traffic selectors, based on a patch by Michael
|
|
Rossberg.
|
|
* Using extensions (such as BEET mode) and crypto algorithms (such
|
|
as twofish, serpent, sha256_96) allocated in the private use space
|
|
now require that we know its meaning, i.e. we are talking to
|
|
strongSwan. Use the new "charon.send_vendor_id" option in
|
|
strongswan.conf to let the remote peer know this is the case.
|
|
* Experimental support for draft-eronen-ipsec-ikev2-eap-auth, where
|
|
the responder omits public key authentication in favor of a mutual
|
|
authentication method. To enable EAP-only authentication, set
|
|
rightauth=eap on the responder to rely only on the MSK constructed
|
|
AUTH payload. This not-yet standardized extension requires the
|
|
strongSwan vendor ID introduced above.
|
|
* The IKEv1 daemon ignores the Juniper SRX notification type 40001,
|
|
thus allowing interoperability.
|
|
* The IKEv1 pluto daemon can now use SQL-based address pools to
|
|
deal out virtual IP addresses as a Mode Config server. The pool
|
|
capability has been migrated from charon's sql plugin to a new
|
|
attr-sql plugin which is loaded by libstrongswan and which can be
|
|
used by both daemons either with a SQLite or MySQL database and the
|
|
corresponding plugin.
|
|
* Plugin names have been streamlined: EAP plugins now have a dash
|
|
after eap (e.g. eap-sim), as it is used with the --enable-eap-sim
|
|
./configure option.
|
|
Plugin configuration sections in strongswan.conf now use the same
|
|
name as the plugin itself (i.e. with a dash). Make sure to update
|
|
"load" directives and the affected plugin sections in existing
|
|
strongswan.conf files.
|
|
* The private/public key parsing and encoding has been split up
|
|
into separate pkcs1, pgp, pem and dnskey plugins. The public key
|
|
implementation plugins gmp, gcrypt and openssl can all make use
|
|
of them.
|
|
* The EAP-AKA plugin can use different backends for USIM/quintuplet
|
|
calculations, very similar to the EAP-SIM plugin. The existing 3GPP2
|
|
software implementation has been migrated to a separate plugin.
|
|
* The IKEv2 daemon charon gained basic PGP support. It can use
|
|
locally installed peer certificates and can issue signatures based
|
|
on RSA private keys.
|
|
* The new 'ipsec pki' tool provides a set of commands to maintain a
|
|
public key infrastructure. It currently supports operations to
|
|
create RSA and ECDSA private/public keys, calculate fingerprints and
|
|
issue or verify certificates.
|
|
* Charon uses a monotonic time source for statistics and job
|
|
queueing, behaving correctly if the system time changes (e.g. when
|
|
using NTP).
|
|
* In addition to time based rekeying, charon supports IPsec SA
|
|
lifetimes based on processed volume or number of packets.
|
|
They new ipsec.conf paramaters 'lifetime' (an alias to 'keylife'),
|
|
'lifebytes' and 'lifepackets' handle SA timeouts, while the
|
|
parameters 'margintime' (an alias to rekeymargin), 'marginbytes'
|
|
and 'marginpackets' trigger the rekeying before a SA expires.
|
|
The existing parameter 'rekeyfuzz' affects all margins.
|
|
* If no CA/Gateway certificate is specified in the NetworkManager
|
|
plugin, charon uses a set of trusted root certificates preinstalled
|
|
by distributions. The directory containing CA certificates can be
|
|
specified using the --with-nm-ca-dir=path configure option.
|
|
* Fixed the encoding of the Email relative distinguished name in
|
|
left|rightid statements.
|
|
* Fixed the broken parsing of PKCS#7 wrapped certificates by the
|
|
pluto daemon.
|
|
* Fixed smartcard-based authentication in the pluto daemon which
|
|
was broken by the ECDSA support introduced with the 4.3.2 release.
|
|
* A patch contributed by Heiko Hund fixes mixed IPv6 in IPv4 and
|
|
vice versa tunnels established with the IKEv1 pluto daemon.
|
|
* The pluto daemon now uses the libstrongswan x509 plugin for
|
|
certificates and CRls and the struct id type was replaced by
|
|
identification_t used by charon and the libstrongswan library.
|
|
- Removed obsolete load_secrets patches, refreshed modprobe patch.
|
|
- Corrected a time_t cast reported by rpmlint (timer.c:51)
|
|
- Disabled libtoolize call and the gcrypt plugin on SLE 10.
|
|
|
|
-------------------------------------------------------------------
|
|
Fri Sep 4 12:56:59 CEST 2009 - mt@suse.de
|
|
|
|
- Fixed open failure debug message in load_secrets
|
|
|
|
-------------------------------------------------------------------
|
|
Thu Sep 3 23:44:37 CEST 2009 - mt@suse.de
|
|
|
|
- Applied patch fixing locking in ipsec.secrets inclusion.
|
|
|
|
-------------------------------------------------------------------
|
|
Mon Aug 31 16:06:13 CEST 2009 - mt@suse.de
|
|
|
|
- Updated to strongSwan 4.3.4 release:
|
|
* IKEv2 charon daemon ported to FreeBSD and Mac OS X. Installation
|
|
details can be found on wiki.strongswan.org.
|
|
* ipsec statusall shows the number of bytes transmitted and received
|
|
over ESP connections configured by the IKEv2 charon daemon.
|
|
* The IKEv2 charon daemon supports include files in ipsec.secrets.
|
|
- Removed obsolete ipsec.secrets include patch (bnc#524799)
|
|
and patch to avoid libchecksum version.
|
|
|
|
-------------------------------------------------------------------
|
|
Fri Aug 7 11:44:30 CEST 2009 - mt@suse.de
|
|
|
|
- Applied patch implementing ipsec.secrets "include" directive
|
|
support in charon (http://wiki.strongswan.org/issues/show/82,
|
|
bnc#524799).
|
|
|
|
-------------------------------------------------------------------
|
|
Mon Jul 27 13:40:57 CEST 2009 - mt@suse.de
|
|
|
|
- Updated to strongSwan 4.3.3 release:
|
|
* The configuration option --enable-integrity-test plus the
|
|
strongswan.conf option libstrongswan.integrity_test = yes
|
|
activate integrity tests of the IKE daemons charon and pluto,
|
|
libstrongswan and all loaded plugins. Thus dynamic library
|
|
misconfigurations and non-malicious file manipulations can be
|
|
reliably detected.
|
|
* The new default setting libstrongswan.ecp_x_coordinate_only=yes
|
|
allows IKEv1 interoperability with MS Windows using the ECP DH
|
|
groups 19 and 20.
|
|
* The IKEv1 pluto daemon now supports the AES-CCM and AES-GCM ESP
|
|
authenticated encryption algorithms.
|
|
* The IKEv1 pluto daemon now supports V4 OpenPGP keys.
|
|
* The RDN parser vulnerability discovered by Orange Labs research
|
|
team was not completely fixed in version 4.3.2. Some more
|
|
modifications had to be applied to the asn1_length() function to
|
|
make it robust.
|
|
- Enabled --enable-integrity-test configure option (new feature).
|
|
- Removed patch to avoid plugin versions (accepted by upstream)
|
|
and added patch to avoid version for new libchecksum library.
|
|
- Added -Wno-pointer-sign -Wno-strict-aliasing CFLAGS in the spec.
|
|
|
|
-------------------------------------------------------------------
|
|
Wed Jun 10 11:04:44 CEST 2009 - mt@suse.de
|
|
|
|
- Updated to strongSwan 4.3.2 release, that fixes two asn1 parser
|
|
DoS vulnerabilities and provides several new features, e.g.:
|
|
* The new gcrypt plugin provides symmetric cipher, hasher, RNG,
|
|
Diffie-Hellman and RSA crypto primitives using the LGPL licensed
|
|
GNU gcrypt library.
|
|
* libstrongswan features an integrated crypto selftest framework
|
|
for registered algorithms. The test-vector plugin provides a first
|
|
set of test vectors and allows pluto and charon to rely on tested
|
|
crypto algorithms.
|
|
* pluto can now use all libstrongswan plugins with the exception
|
|
of x509 and xcbc. Thanks to the openssl plugin, the ECP Diffie-
|
|
Hellman groups 19, 20, 21, 25, and 26 as well as ECDSA-256,
|
|
ECDSA-384, and ECDSA-521 authentication can be used with IKEv1.
|
|
* Applying their fuzzing tool, the Orange Labs vulnerability
|
|
research team found another two DoS vulnerabilities, one in the
|
|
rather old ASN.1 parser of Relative Distinguished Names (RDNs)
|
|
and a second one in the conversion of ASN.1 UTCTIME and
|
|
GENERALIZEDTIME strings to a time_t value.
|
|
* The nm plugin now passes DNS/NBNS server information to
|
|
NetworkManager, allowing a gateway administrator to set DNS/NBNS
|
|
configuration on clients dynamically.
|
|
* The nm plugin also accepts CA certificates for gateway
|
|
authentication. If a CA certificate is configured, strongSwan uses
|
|
the entered gateway address as its idenitity, requiring the gateways
|
|
certificate to contain the same as subjectAltName.
|
|
This allows a gateway administrator to deploy the same
|
|
certificates to Windows 7 and NetworkManager clients.
|
|
* The command ipsec purgeike deletes IKEv2 SAs that don't have a
|
|
CHILD SA.
|
|
The command ipsec down <conn>{n} deletes CHILD SA instance n of
|
|
connection <conn> whereas ipsec down <conn>{*} deletes all CHILD
|
|
SA instances.
|
|
The command ipsec down <conn>[n] deletes IKE SA instance n of
|
|
connection <conn> plus dependent CHILD SAs whereas ipsec down
|
|
<conn>[*] deletes all IKE SA instances of connection <conn>.
|
|
* Fixed a regression introduced in 4.3.0 where EAP authentication
|
|
calculated the AUTH payload incorrectly. Further, the EAP-MSCHAPv2
|
|
MSK key derivation has been updated to be compatible with the
|
|
Windows 7 Release Candidate.
|
|
* Refactored installation of triggering policies. Routed policies
|
|
are handled outside of IKE_SAs to keep them installed in any case.
|
|
A tunnel gets established only once, even if initiation is delayed
|
|
due network outages.
|
|
* Improved the handling of multiple acquire signals triggered by
|
|
the kernel.
|
|
* Fixed two DoS vulnerabilities in the charon daemon that were
|
|
discovered by fuzzing techniques:
|
|
1) Sending a malformed IKE_SA_INIT request leaved an incomplete
|
|
state which caused a null pointer dereference if a subsequent
|
|
CREATE_CHILD_SA request was sent.
|
|
2) Sending an IKE_AUTH request with either a missing TSi or TSr
|
|
payload caused a null pointer derefence because the checks for
|
|
TSi and TSr were interchanged.
|
|
The IKEv2 fuzzer used was developped by the Orange Labs
|
|
vulnerability research team. The tool was initially written
|
|
by Gabriel Campana and is now maintained by Laurent Butti.
|
|
* Added support for AES counter mode in ESP in IKEv2 using the
|
|
proposal keywords aes128ctr, aes192ctr and aes256ctr.
|
|
* Further progress in refactoring pluto: Use of the curl and ldap
|
|
plugins for fetching crls and OCSP. Use of the random plugin to
|
|
get keying material from /dev/random or /dev/urandom. Use of the
|
|
openssl plugin as an alternative to the aes, des, sha1, sha2, and
|
|
md5 plugins. The blowfish, twofish, and serpent encryption plugins
|
|
are now optional and are not enabled by default.
|
|
- Enabled new gcrypt plugin
|
|
- Adopted spec file and modprobe to syslog patch
|
|
- Removed obsolete getline glibc collision patch
|
|
- Added patch to avoid library version for plugins (rpmlint).
|
|
- Replaced update-dns-server patch with a --with-resolv-conf.
|
|
- Removed restart_on_update from spec file (see bnc#450390).
|
|
|
|
-------------------------------------------------------------------
|
|
Mon Jun 8 00:21:13 CEST 2009 - ro@suse.de
|
|
|
|
- rename getline to my_getline to avoid collision with function
|
|
from glibc
|
|
|
|
-------------------------------------------------------------------
|
|
Tue Jun 2 09:56:16 CEST 2009 - mt@suse.de
|
|
|
|
- Applied fix for a Denial-of-Service vulnerability where receiving
|
|
a malformed IKE_SA_INIT request leaves an incomplete state which
|
|
causes a crash of the IKEv2 charon while dereferencing a NULL
|
|
pointer if a subsequent CREATE_CHILD_SA is received (bnc#507742).
|
|
- Applied fix for a Denial-of-Service vulnerability where receiving
|
|
a malformed IKE_AUTH request with either a missing TSi or TSr
|
|
traffic selector payload causes a crash of the IKEv2 charon while
|
|
dereferencing a NULL pointer because the NULL pointer checks of
|
|
TSi and TSr before destruction were erroneously swapped
|
|
(bnc#507742).
|
|
|
|
-------------------------------------------------------------------
|
|
Tue Mar 31 11:19:03 CEST 2009 - mt@suse.de
|
|
|
|
- Updated to strongSwan 4.2.14 release that fixes a grave DPD
|
|
denial of service vulnerability registered as CVE-2009-0790,
|
|
that had been slumbering in the code for many years:
|
|
* A vulnerability in the Dead Peer Detection (RFC 3706) code
|
|
was found by Gerd v. Egidy <gerd.von.egidy@intra2net.com> of
|
|
Intra2net AG affecting all Openswan and strongSwan releases.
|
|
A malicious (or expired ISAKMP) R_U_THERE or R_U_THERE_ACK
|
|
Dead Peer Detection packet can cause the pluto IKE daemon to
|
|
crash and restart. No authentication or encryption is required
|
|
to trigger this bug. One spoofed UDP packet can cause the pluto
|
|
IKE daemon to restart and be unresponsive for a few seconds
|
|
while restarting. This DPD null state vulnerability has been
|
|
officially registered as CVE-2009-0790 and is fixed by this
|
|
release.
|
|
* The new server-side EAP RADIUS plugin (--enable-eap-radius)
|
|
relays EAP messages to and from a RADIUS server. Succesfully
|
|
tested with with a freeradius server using EAP-MD5 and EAP-SIM.
|
|
* ASN.1 to time_t conversion caused a time wrap-around for dates
|
|
after Jan 18 03:14:07 UTC 2038 on 32-bit platforms.
|
|
As a workaround such dates are set to the maximum representable
|
|
time, i.e. Jan 19 03:14:07 UTC 2038.
|
|
* Distinguished Names containing wildcards (*) are not sent in the
|
|
IDr payload anymore.
|
|
|
|
-------------------------------------------------------------------
|
|
Mon Oct 20 09:27:06 CEST 2008 - mt@suse.de
|
|
|
|
- Updated to 4.2.8 release:
|
|
* IKEv2 charon daemon supports authentication based on raw public
|
|
keys stored in the SQL database backend. The ipsec listpubkeys
|
|
command lists the available raw public keys via the stroke
|
|
interface.
|
|
* Several MOBIKE improvements: Detect changes in NAT mappings in
|
|
DPD exchanges, handle events if kernel detects NAT mapping changes
|
|
in UDP-encapsulated ESP packets (requires kernel patch), reuse old
|
|
addesses in MOBIKE updates as long as possible and other fixes.
|
|
* Fixed a bug in addr_in_subnet() which caused insertion of wrong
|
|
source routes for destination subnets having netwmasks not being a
|
|
multiple of 8 bits. Thanks go to Wolfgang Steudel, TU Ilmenau for
|
|
reporting this bug.
|
|
|
|
-------------------------------------------------------------------
|
|
Tue Oct 14 16:29:59 CEST 2008 - mt@suse.de
|
|
|
|
- Applied fix for addr_in_subnet() extracted from strongswan-4.2.8
|
|
which caused insertion of wrong source routes for destination
|
|
subnets having netwmasks not being a multiple of 8 bits.
|
|
Thanks go to Wolfgang Steudel, TU Ilmenau for reporting this bug.
|
|
(bnc#435200)
|
|
|
|
-------------------------------------------------------------------
|
|
Fri Oct 10 08:08:35 CEST 2008 - mt@suse.de
|
|
|
|
- Applied fix for a Denial-of-Service vulnerability where an
|
|
IKE_SA_INIT message with a KE payload containing zeroes only can
|
|
cause a crash of the IKEv2 charon daemon due to a NULL pointer
|
|
returned by the mpz_export() function of the GNU Multi Precision
|
|
(GMP) library. Thanks go to Mu Dynamics Research Labs for making
|
|
us aware of this problem. (bnc#435194)
|
|
|
|
-------------------------------------------------------------------
|
|
Thu Aug 28 14:31:49 CEST 2008 - mt@suse.de
|
|
|
|
- Fixed to use --enable-curl instead of --enable-http as before
|
|
- Enabled the OpenSSL crypto plugin in the spec file.
|
|
|
|
-------------------------------------------------------------------
|
|
Thu Aug 28 09:48:14 CEST 2008 - mt@suse.de
|
|
|
|
- Updated to 4.2.6 release, fixing bugs and offering a lot of new
|
|
features comparing to the last version provided by this package.
|
|
Most important are:
|
|
* A NetworkManager plugin allows GUI-based configuration of
|
|
road-warrior clients in a simple way. It features X509 based
|
|
gateway authentication and EAP client authentication, tunnel
|
|
setup/teardown and storing passwords in the Gnome Keyring.
|
|
* A new EAP-GTC plugin implements draft-sheffer-ikev2-gtc-00.txt
|
|
and allows username/password authentication against any PAM
|
|
service on the gateway. The new EAP method interacts nicely with
|
|
the NetworkManager plugin and allows client authentication against
|
|
e.g. LDAP.
|
|
* Improved support for the EAP-Identity method. The new ipsec.conf
|
|
eap_identity parameter defines an additional identity to pass to
|
|
the server in EAP authentication.
|
|
* Fixed two multithreading deadlocks occurring when starting up
|
|
several hundred tunnels concurrently.
|
|
* Fixed the --enable-integrity-test configure option which
|
|
computes a SHA-1 checksum over the libstrongswan library.
|
|
* Consistent logging of IKE and CHILD SAs at the audit (AUD) level.
|
|
* Improved the performance of the SQL-based virtual IP address pool
|
|
by introducing an additional addresses table. The leases table
|
|
storing only history information has become optional and can be
|
|
disabled by setting charon.plugins.sql.lease_history = no in
|
|
strongswan.conf.
|
|
* The XFRM_STATE_AF_UNSPEC flag added to xfrm.h allows IPv4-over-IPv6
|
|
and IPv6-over-IPv4 tunnels with the 2.6.26 and later Linux kernels.
|
|
* management of different virtual IP pools for different network
|
|
interfaces have become possible.
|
|
* fixed a bug which prevented the assignment of more than 256
|
|
virtual IP addresses from a pool managed by an sql database.
|
|
* fixed a bug which did not delete own IPCOMP SAs in the kernel.
|
|
* The openssl plugin supports the elliptic curve Diffie-Hellman
|
|
groups 19, 20, 21, 25, and 26 and ECDSA authentication using
|
|
elliptic curve X.509 certificates.
|
|
* Fixed a bug in stroke which caused multiple charon threads to
|
|
close the file descriptors during packet transfers over the stroke
|
|
socket.
|
|
* ESP sequence numbers are now migrated in IPsec SA updates handled
|
|
by MOBIKE. Works only with Linux kernels >= 2.6.17.
|
|
* Fixed a number of minor bugs that where discovered during the 4th
|
|
IKEv2 interoperability workshop in San Antonio, TX.
|
|
* Plugins for libstrongswan and charon can optionally be loaded
|
|
according to a configuration in strongswan.conf. Most components
|
|
provide a "load = " option followed by a space separated list of
|
|
plugins to load. This allows e.g. the fallback from a hardware
|
|
crypto accelerator to to software-based crypto plugins.
|
|
* Charons SQL plugin has been extended by a virtual IP address pool.
|
|
Configurations with a rightsourceip=%poolname setting query a
|
|
SQLite or MySQL database for leases. The "ipsec pool" command helps
|
|
in administrating the pool database. See ipsec pool --help for the
|
|
available options
|
|
* The Authenticated Encryption Algorithms AES-CCM-8/12/16 and
|
|
AES-GCM-8/12/16 for ESP are now supported starting with the Linux
|
|
2.6.25 kernel. The syntax is e.g. esp=aes128ccm12 or esp=aes256gcm16.
|
|
- Added patch disabling direct modifications of resolv.conf; has to
|
|
be replaced by a netconfig call.
|
|
- Added patch adding a missed file name argument in printf call in the
|
|
scripts/thread_analysis.c file -- resulting binary is not installed.
|
|
- Removed obsolete patches crash_badcfg_reload and old-caps-version.
|
|
|
|
-------------------------------------------------------------------
|
|
Mon Jun 30 22:40:31 CEST 2008 - mt@suse.de
|
|
|
|
- Added fix that explicitly enables version 1 linux capabilities
|
|
on version 2 systems to aviod that the charon and pluto daemons
|
|
exit because of failed capset call (bnc#404989).
|
|
|
|
-------------------------------------------------------------------
|
|
Mon May 19 16:17:16 CEST 2008 - mt@suse.de
|
|
|
|
- Applied fix (strongswan_crash_badcfg_reload.dif) to avoid
|
|
a crash after reloading with bad config (bnc#392062).
|
|
|
|
-------------------------------------------------------------------
|
|
Wed Apr 23 14:28:41 CEST 2008 - mt@suse.de
|
|
|
|
- Updated to 4.2.1 release. A lot of code refactoring in the 4.2
|
|
release provides much more modularity and therefore much more
|
|
extensiblity and offers the following new features:
|
|
* libstrongswan has been modularized to attach crypto algorithms,
|
|
credential implementations (secret and private keys, certificates)
|
|
and http/ldap fetchers dynamically through plugins.
|
|
* A relational database API that uses pluggable database providers
|
|
was added to libstrongswan including plugins for MySQL and SQLite.
|
|
* The IKEv2 keying charon daemon has become more extensible. Generic
|
|
plugins can provide arbitrary interfaces to credential stores and
|
|
connection management interfaces. Also any EAP method can be added.
|
|
* The authentication and credential framework in charon has been
|
|
heavily refactored to support modular credential providers, proper
|
|
CERTREQ/CERT payload exchanges and extensible authorization rules.
|
|
* Support for "Hash and URL" encoded certificate payloads has been
|
|
implemented in the IKEv2 daemon charon.
|
|
* The IKEv2 daemon charon now supports the "uniqueids" option to
|
|
close multiple IKE_SAs with the same peer.
|
|
* The crypto factory in libstrongswan additionally supports random
|
|
number generators. Plugins may provide other sources of randomness.
|
|
* Extended the credential framework by a caching option to allow
|
|
plugins persistent caching of fetched credentials.
|
|
* The new trust chain verification introduced in 4.2.0 has been
|
|
parallelized. Threads fetching CRL or OCSP information no longer
|
|
block other threads.
|
|
* A new IKEv2 configuration attribute framework has been introduced
|
|
allowing plugins to provide virtual IP addresses, and in the future,
|
|
other configuration attribute services (e.g. DNS/WINS servers).
|
|
* The stroke plugin has been extended to provide virtual IP addresses
|
|
from a simple pool defined in ipsec.conf.
|
|
* Fixed compilation on uClibc and a couple of other minor bugs.
|
|
* The IKEv1 pluto daemon now supports the ESP encryption algorithm
|
|
CAMELLIA with key lengths of 128, 192, and 256 bits, as well as the
|
|
authentication algorithm AES_XCBC_MAC.
|
|
- Applied a small patch defining _GNU_SOURCE for struct in6_pktinfo
|
|
and adding inclusion of limits.h for PATH_MAX availability.
|
|
- Added rpmlintrc file and a libtoolize call to the spec file.
|
|
|
|
-------------------------------------------------------------------
|
|
Tue Feb 19 11:44:03 CET 2008 - mt@suse.de
|
|
|
|
- Updated to 4.1.11 maintenance release, providing following fixes:
|
|
* IKE rekeying in NAT situations did not inherit the NAT conditions
|
|
to the rekeyed IKE_SA so that the UDP encapsulation was lost with
|
|
the next CHILD_SA rekeying.
|
|
* Wrong type definition of the next_payload variable in id_payload.c
|
|
caused an INVALID_SYNTAX error on PowerPC platforms.
|
|
* Implemented IKEv2 EAP-SIM server and client test modules that use
|
|
triplets stored in a file. For details on the configuration see
|
|
the scenario 'ikev2/rw-eap-sim-rsa'.
|
|
- The 4.1.10 final version, declared upstream as "Fully tested support
|
|
of IPv6 IPsec tunnel connections", fixes ordering error in oscp cache,
|
|
IPv6 defaults of the nexthop parameter, adds support for new EAP
|
|
modules [disabled in this build] and obsoletes our strongswan_path
|
|
and strongswan_ipsec_script_msg patches.
|
|
- Removed a sed call from init script.
|
|
|
|
-------------------------------------------------------------------
|
|
Sat Dec 8 13:03:42 CET 2007 - mt@suse.de
|
|
|
|
- Updated to 4.1.9 final, including all our patches.
|
|
- Changed init script to use ipsec cmd using LSB codes now.
|
|
- Added strongswan_path.dif setting a PATH in scripts (updown).
|
|
- Added strongswan_ipsec_script_msg.dif for consistent look of
|
|
ipsec script messages.
|
|
- Added strongswan_modprobe_syslog.dif redirecting modprobe
|
|
output to syslog.
|
|
|
|
-------------------------------------------------------------------
|
|
Mon Nov 26 10:19:40 CET 2007 - mt@suse.de
|
|
|
|
- Renamed charon plugins to avoid rpm conflicts with existing
|
|
libraries (libstroke). Patch: strongswan-libconflicts.dif
|
|
- Added init script. Template file: strongswan.init.in
|
|
|
|
-------------------------------------------------------------------
|
|
Thu Nov 22 10:25:56 CET 2007 - mt@suse.de
|
|
|
|
- Initial, unfinished package
|
|
|