forked from pool/strongswan
Jan Engelhardt
509c30e68d
- Update to version 5.8.2: * Fix CVE-2018-17540, CVE-2018-16151 and CVE-2018-16152. * boo#1109845 and boo#1107874. - Please check included NEWS file for info on what other changes that have been done in versions 5.8.2, 5.8.1 5.8.0, 5.7.2, 5.7.1 and 5.7.0. - Rebase strongswan_ipsec_service.patch. - Disable patches that need rebase or dropping: * strongswan_modprobe_syslog.patch * 0006-fix-compilation-error-by-adding-stdint.h.patch - Add conditional pkgconfig(libsystemd) BuildRequires: New dependency. OBS-URL: https://build.opensuse.org/request/show/761676 OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=114 |
||
|---|---|---|
| .gitattributes | ||
| .gitignore | ||
| 0005-ikev1-Don-t-retransmit-Aggressive-Mode-response.patch | ||
| 0006-fix-compilation-error-by-adding-stdint.h.patch | ||
| fips-enforce.conf | ||
| fipscheck.sh.in | ||
| README.SUSE | ||
| strongswan_fipscheck.patch | ||
| strongswan_fipsfilter.patch | ||
| strongswan_ipsec_service.patch | ||
| strongswan_modprobe_syslog.patch | ||
| strongswan-5.8.2.tar.bz2 | ||
| strongswan-5.8.2.tar.bz2.sig | ||
| strongswan-rpmlintrc | ||
| strongswan.changes | ||
| strongswan.init.in | ||
| strongswan.keyring | ||
| strongswan.spec | ||
Dear Customer, please note, that the strongswan release 4.5 changes the keyexchange mode to IKEv2 as default -- from strongswan-4.5.0/NEWS: "[...] IMPORTANT: the default keyexchange mode 'ike' is changing with release 4.5 from 'ikev1' to 'ikev2', thus commemorating the five year anniversary of the IKEv2 RFC 4306 and its mature successor RFC 5996. The time has definitively come for IKEv1 to go into retirement and to cede its place to the much more robust, powerful and versatile IKEv2 protocol! [...]" This requires adoption of either the "conn %default" or all other IKEv1 "conn" sections in the /etc/ipsec.conf to use explicit: keyexchange=ikev1 The charon daemon in strongswan 5.x versions supports IKEv1 and IKEv2, thus a separate pluto IKEv1 daemon is not needed / not shipped any more. The strongswan package does not provide any files except of this README, but triggers the installation of the charon daemon and the "traditional" strongswan-ipsec package providing the "ipsec" script and service. The ipsec.service is an alias link to the "strongswan.service" systemd service unit and created by "systemctl enable strongswan.service". There is a new strongswan-nm package with a NetworkManager specific charon-nm binary controlling the charon daemon through D-Bus and designed to work using the NetworkManager-strongswan graphical user interface. It does not depend on the traditional starter scripts, but on the IKEv2 charon daemon and plugins only. The stongswan-hmac package provides the fips hmac hash files, a _fipscheck script and a /etc/strongswan.d/charon/zzz_fips-enforce.conf config file, which disables all non-openssl algorithm implementations. When fips operation mode is enabled in the kernel using the fips=1 boot parameter, the strongswan fips checks are executed in front of any start action of the "ipsec" script provided by the "strongswan-ipsec" package and a verification problem causes a failure as required by fips-140-2. Further, it is not required to enable the fips_mode in the openssl plugin (/etc/strongswan.d/charon/openssl.conf); the kernel entablement enables it automatically as needed. The "ipsec _fipscheck" command allows to execute the fips checks manually without a check if fips is enabled (/proc/sys/crypto/fips_enabled is 1), e.g. for testing purposes. Have a lot of fun...