Marius Tomaschewski
cf29eb7ccf
- The tnc-pdp plugin implements a RADIUS server interface allowing
a strongSwan TNC server to act as a Policy Decision Point.
- The eap-radius authentication backend enforces Session-Timeout
attributes using RFC4478 repeated authentication and acts upon
RADIUS Dynamic Authorization extensions, RFC 5176. Currently
supported are disconnect requests and CoA messages containing
a Session-Timeout.
- The eap-radius plugin can forward arbitrary RADIUS attributes
from and to clients using custom IKEv2 notify payloads. The new
radattr plugin reads attributes to include from files and prints
received attributes to the console.
- Added support for untruncated MD5 and SHA1 HMACs in ESP as used
in RFC 4595.
- The cmac plugin implements the AES-CMAC-96 and AES-CMAC-PRF-128
algorithms as defined in RFC 4494 and RFC 4615, respectively.
- The resolve plugin automatically installs nameservers via
resolvconf(8), if it is installed, instead of modifying
/etc/resolv.conf directly.
- The IKEv2 charon daemon supports now raw RSA public keys in RFC
3110 DNSKEY and PKCS#1 file format.
- The farp plugin sends ARP responses for any tunneled address,
not only virtual IPs.
- Charon resolves hosts again during additional keying tries.
- Fixed switching back to original address pair during MOBIKE.
- When resending IKE_SA_INIT with a COOKIE charon reuses the previous
DH value, as specified in RFC 5996.
This has an effect on the lifecycle of diffie_hellman_t, see
source:src/libcharon/sa/keymat.h#39 for details.
- COOKIEs are now kept enabled a bit longer to avoid certain race
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=44
10 lines
428 B
Plaintext
10 lines
428 B
Plaintext
### Known warnings:
|
|
# - traditional name
|
|
addFilter("strongswan.* incoherent-init-script-name ipsec")
|
|
# - readme only, triggers full ipsec + ikev1&ikev2 install
|
|
addFilter("strongswan.* no-binary")
|
|
# - link to init script, covered by service(8)
|
|
addFilter("strongswan.* no-manual-page-for-binary rcipsec")
|
|
# - no, restating tunnels on update may break the update
|
|
addFilter("strongswan.*restart_on_update-postun /etc/init.d/ipsec")
|