forked from pool/strongswan
244 lines
12 KiB
Plaintext
244 lines
12 KiB
Plaintext
-------------------------------------------------------------------
|
|
Tue Jun 2 09:56:16 CEST 2009 - mt@suse.de
|
|
|
|
- Applied fix for a Denial-of-Service vulnerability where receiving
|
|
a malformed IKE_SA_INIT request leaves an incomplete state which
|
|
causes a crash of the IKEv2 charon while dereferencing a NULL
|
|
pointer if a subsequent CREATE_CHILD_SA is received (bnc#507742).
|
|
- Applied fix for a Denial-of-Service vulnerability where receiving
|
|
a malformed IKE_AUTH request with either a missing TSi or TSr
|
|
traffic selector payload causes a crash of the IKEv2 charon while
|
|
dereferencing a NULL pointer because the NULL pointer checks of
|
|
TSi and TSr before destruction were erroneously swapped
|
|
(bnc#507742).
|
|
|
|
-------------------------------------------------------------------
|
|
Tue Mar 31 11:19:03 CEST 2009 - mt@suse.de
|
|
|
|
- Updated to strongSwan 4.2.14 release that fixes a grave DPD
|
|
denial of service vulnerability registered as CVE-2009-0790,
|
|
that had been slumbering in the code for many years:
|
|
* A vulnerability in the Dead Peer Detection (RFC 3706) code
|
|
was found by Gerd v. Egidy <gerd.von.egidy@intra2net.com> of
|
|
Intra2net AG affecting all Openswan and strongSwan releases.
|
|
A malicious (or expired ISAKMP) R_U_THERE or R_U_THERE_ACK
|
|
Dead Peer Detection packet can cause the pluto IKE daemon to
|
|
crash and restart. No authentication or encryption is required
|
|
to trigger this bug. One spoofed UDP packet can cause the pluto
|
|
IKE daemon to restart and be unresponsive for a few seconds
|
|
while restarting. This DPD null state vulnerability has been
|
|
officially registered as CVE-2009-0790 and is fixed by this
|
|
release.
|
|
* The new server-side EAP RADIUS plugin (--enable-eap-radius)
|
|
relays EAP messages to and from a RADIUS server. Succesfully
|
|
tested with with a freeradius server using EAP-MD5 and EAP-SIM.
|
|
* ASN.1 to time_t conversion caused a time wrap-around for dates
|
|
after Jan 18 03:14:07 UTC 2038 on 32-bit platforms.
|
|
As a workaround such dates are set to the maximum representable
|
|
time, i.e. Jan 19 03:14:07 UTC 2038.
|
|
* Distinguished Names containing wildcards (*) are not sent in the
|
|
IDr payload anymore.
|
|
|
|
-------------------------------------------------------------------
|
|
Mon Oct 20 09:27:06 CEST 2008 - mt@suse.de
|
|
|
|
- Updated to 4.2.8 release:
|
|
* IKEv2 charon daemon supports authentication based on raw public
|
|
keys stored in the SQL database backend. The ipsec listpubkeys
|
|
command lists the available raw public keys via the stroke
|
|
interface.
|
|
* Several MOBIKE improvements: Detect changes in NAT mappings in
|
|
DPD exchanges, handle events if kernel detects NAT mapping changes
|
|
in UDP-encapsulated ESP packets (requires kernel patch), reuse old
|
|
addesses in MOBIKE updates as long as possible and other fixes.
|
|
* Fixed a bug in addr_in_subnet() which caused insertion of wrong
|
|
source routes for destination subnets having netwmasks not being a
|
|
multiple of 8 bits. Thanks go to Wolfgang Steudel, TU Ilmenau for
|
|
reporting this bug.
|
|
|
|
-------------------------------------------------------------------
|
|
Tue Oct 14 16:29:59 CEST 2008 - mt@suse.de
|
|
|
|
- Applied fix for addr_in_subnet() extracted from strongswan-4.2.8
|
|
which caused insertion of wrong source routes for destination
|
|
subnets having netwmasks not being a multiple of 8 bits.
|
|
Thanks go to Wolfgang Steudel, TU Ilmenau for reporting this bug.
|
|
(bnc#435200)
|
|
|
|
-------------------------------------------------------------------
|
|
Fri Oct 10 08:08:35 CEST 2008 - mt@suse.de
|
|
|
|
- Applied fix for a Denial-of-Service vulnerability where an
|
|
IKE_SA_INIT message with a KE payload containing zeroes only can
|
|
cause a crash of the IKEv2 charon daemon due to a NULL pointer
|
|
returned by the mpz_export() function of the GNU Multi Precision
|
|
(GMP) library. Thanks go to Mu Dynamics Research Labs for making
|
|
us aware of this problem. (bnc#435194)
|
|
|
|
-------------------------------------------------------------------
|
|
Thu Aug 28 14:31:49 CEST 2008 - mt@suse.de
|
|
|
|
- Fixed to use --enable-curl instead of --enable-http as before
|
|
- Enabled the OpenSSL crypto plugin in the spec file.
|
|
|
|
-------------------------------------------------------------------
|
|
Thu Aug 28 09:48:14 CEST 2008 - mt@suse.de
|
|
|
|
- Updated to 4.2.6 release, fixing bugs and offering a lot of new
|
|
features comparing to the last version provided by this package.
|
|
Most important are:
|
|
* A NetworkManager plugin allows GUI-based configuration of
|
|
road-warrior clients in a simple way. It features X509 based
|
|
gateway authentication and EAP client authentication, tunnel
|
|
setup/teardown and storing passwords in the Gnome Keyring.
|
|
* A new EAP-GTC plugin implements draft-sheffer-ikev2-gtc-00.txt
|
|
and allows username/password authentication against any PAM
|
|
service on the gateway. The new EAP method interacts nicely with
|
|
the NetworkManager plugin and allows client authentication against
|
|
e.g. LDAP.
|
|
* Improved support for the EAP-Identity method. The new ipsec.conf
|
|
eap_identity parameter defines an additional identity to pass to
|
|
the server in EAP authentication.
|
|
* Fixed two multithreading deadlocks occurring when starting up
|
|
several hundred tunnels concurrently.
|
|
* Fixed the --enable-integrity-test configure option which
|
|
computes a SHA-1 checksum over the libstrongswan library.
|
|
* Consistent logging of IKE and CHILD SAs at the audit (AUD) level.
|
|
* Improved the performance of the SQL-based virtual IP address pool
|
|
by introducing an additional addresses table. The leases table
|
|
storing only history information has become optional and can be
|
|
disabled by setting charon.plugins.sql.lease_history = no in
|
|
strongswan.conf.
|
|
* The XFRM_STATE_AF_UNSPEC flag added to xfrm.h allows IPv4-over-IPv6
|
|
and IPv6-over-IPv4 tunnels with the 2.6.26 and later Linux kernels.
|
|
* management of different virtual IP pools for different network
|
|
interfaces have become possible.
|
|
* fixed a bug which prevented the assignment of more than 256
|
|
virtual IP addresses from a pool managed by an sql database.
|
|
* fixed a bug which did not delete own IPCOMP SAs in the kernel.
|
|
* The openssl plugin supports the elliptic curve Diffie-Hellman
|
|
groups 19, 20, 21, 25, and 26 and ECDSA authentication using
|
|
elliptic curve X.509 certificates.
|
|
* Fixed a bug in stroke which caused multiple charon threads to
|
|
close the file descriptors during packet transfers over the stroke
|
|
socket.
|
|
* ESP sequence numbers are now migrated in IPsec SA updates handled
|
|
by MOBIKE. Works only with Linux kernels >= 2.6.17.
|
|
* Fixed a number of minor bugs that where discovered during the 4th
|
|
IKEv2 interoperability workshop in San Antonio, TX.
|
|
* Plugins for libstrongswan and charon can optionally be loaded
|
|
according to a configuration in strongswan.conf. Most components
|
|
provide a "load = " option followed by a space separated list of
|
|
plugins to load. This allows e.g. the fallback from a hardware
|
|
crypto accelerator to to software-based crypto plugins.
|
|
* Charons SQL plugin has been extended by a virtual IP address pool.
|
|
Configurations with a rightsourceip=%poolname setting query a
|
|
SQLite or MySQL database for leases. The "ipsec pool" command helps
|
|
in administrating the pool database. See ipsec pool --help for the
|
|
available options
|
|
* The Authenticated Encryption Algorithms AES-CCM-8/12/16 and
|
|
AES-GCM-8/12/16 for ESP are now supported starting with the Linux
|
|
2.6.25 kernel. The syntax is e.g. esp=aes128ccm12 or esp=aes256gcm16.
|
|
- Added patch disabling direct modifications of resolv.conf; has to
|
|
be replaced by a netconfig call.
|
|
- Added patch adding a missed file name argument in printf call in the
|
|
scripts/thread_analysis.c file -- resulting binary is not installed.
|
|
- Removed obsolete patches crash_badcfg_reload and old-caps-version.
|
|
|
|
-------------------------------------------------------------------
|
|
Mon Jun 30 22:40:31 CEST 2008 - mt@suse.de
|
|
|
|
- Added fix that explicitly enables version 1 linux capabilities
|
|
on version 2 systems to aviod that the charon and pluto daemons
|
|
exit because of failed capset call (bnc#404989).
|
|
|
|
-------------------------------------------------------------------
|
|
Mon May 19 16:17:16 CEST 2008 - mt@suse.de
|
|
|
|
- Applied fix (strongswan_crash_badcfg_reload.dif) to avoid
|
|
a crash after reloading with bad config (bnc#392062).
|
|
|
|
-------------------------------------------------------------------
|
|
Wed Apr 23 14:28:41 CEST 2008 - mt@suse.de
|
|
|
|
- Updated to 4.2.1 release. A lot of code refactoring in the 4.2
|
|
release provides much more modularity and therefore much more
|
|
extensiblity and offers the following new features:
|
|
* libstrongswan has been modularized to attach crypto algorithms,
|
|
credential implementations (secret and private keys, certificates)
|
|
and http/ldap fetchers dynamically through plugins.
|
|
* A relational database API that uses pluggable database providers
|
|
was added to libstrongswan including plugins for MySQL and SQLite.
|
|
* The IKEv2 keying charon daemon has become more extensible. Generic
|
|
plugins can provide arbitrary interfaces to credential stores and
|
|
connection management interfaces. Also any EAP method can be added.
|
|
* The authentication and credential framework in charon has been
|
|
heavily refactored to support modular credential providers, proper
|
|
CERTREQ/CERT payload exchanges and extensible authorization rules.
|
|
* Support for "Hash and URL" encoded certificate payloads has been
|
|
implemented in the IKEv2 daemon charon.
|
|
* The IKEv2 daemon charon now supports the "uniqueids" option to
|
|
close multiple IKE_SAs with the same peer.
|
|
* The crypto factory in libstrongswan additionally supports random
|
|
number generators. Plugins may provide other sources of randomness.
|
|
* Extended the credential framework by a caching option to allow
|
|
plugins persistent caching of fetched credentials.
|
|
* The new trust chain verification introduced in 4.2.0 has been
|
|
parallelized. Threads fetching CRL or OCSP information no longer
|
|
block other threads.
|
|
* A new IKEv2 configuration attribute framework has been introduced
|
|
allowing plugins to provide virtual IP addresses, and in the future,
|
|
other configuration attribute services (e.g. DNS/WINS servers).
|
|
* The stroke plugin has been extended to provide virtual IP addresses
|
|
from a simple pool defined in ipsec.conf.
|
|
* Fixed compilation on uClibc and a couple of other minor bugs.
|
|
* The IKEv1 pluto daemon now supports the ESP encryption algorithm
|
|
CAMELLIA with key lengths of 128, 192, and 256 bits, as well as the
|
|
authentication algorithm AES_XCBC_MAC.
|
|
- Applied a small patch defining _GNU_SOURCE for struct in6_pktinfo
|
|
and adding inclusion of limits.h for PATH_MAX availability.
|
|
- Added rpmlintrc file and a libtoolize call to the spec file.
|
|
|
|
-------------------------------------------------------------------
|
|
Tue Feb 19 11:44:03 CET 2008 - mt@suse.de
|
|
|
|
- Updated to 4.1.11 maintenance release, providing following fixes:
|
|
* IKE rekeying in NAT situations did not inherit the NAT conditions
|
|
to the rekeyed IKE_SA so that the UDP encapsulation was lost with
|
|
the next CHILD_SA rekeying.
|
|
* Wrong type definition of the next_payload variable in id_payload.c
|
|
caused an INVALID_SYNTAX error on PowerPC platforms.
|
|
* Implemented IKEv2 EAP-SIM server and client test modules that use
|
|
triplets stored in a file. For details on the configuration see
|
|
the scenario 'ikev2/rw-eap-sim-rsa'.
|
|
- The 4.1.10 final version, declared upstream as "Fully tested support
|
|
of IPv6 IPsec tunnel connections", fixes ordering error in oscp cache,
|
|
IPv6 defaults of the nexthop parameter, adds support for new EAP
|
|
modules [disabled in this build] and obsoletes our strongswan_path
|
|
and strongswan_ipsec_script_msg patches.
|
|
- Removed a sed call from init script.
|
|
|
|
-------------------------------------------------------------------
|
|
Sat Dec 8 13:03:42 CET 2007 - mt@suse.de
|
|
|
|
- Updated to 4.1.9 final, including all our patches.
|
|
- Changed init script to use ipsec cmd using LSB codes now.
|
|
- Added strongswan_path.dif setting a PATH in scripts (updown).
|
|
- Added strongswan_ipsec_script_msg.dif for consistent look of
|
|
ipsec script messages.
|
|
- Added strongswan_modprobe_syslog.dif redirecting modprobe
|
|
output to syslog.
|
|
|
|
-------------------------------------------------------------------
|
|
Mon Nov 26 10:19:40 CET 2007 - mt@suse.de
|
|
|
|
- Renamed charon plugins to avoid rpm conflicts with existing
|
|
libraries (libstroke). Patch: strongswan-libconflicts.dif
|
|
- Added init script. Template file: strongswan.init.in
|
|
|
|
-------------------------------------------------------------------
|
|
Thu Nov 22 10:25:56 CET 2007 - mt@suse.de
|
|
|
|
- Initial, unfinished package
|
|
|