forked from pool/strongswan
Marius Tomaschewski
576d175479
* Our private libraries (e.g. libstrongswan) are not installed directly in
prefix/lib anymore. Instead a subdirectory is used (prefix/lib/ipsec/ by
default). The plugins directory is also moved from libexec/ipsec/ to that
directory.
* The dynamic IMC/IMV libraries were moved from the plugins directory to
a new imcvs directory in the prefix/lib/ipsec/ subdirectory.
* Job priorities were introduced to prevent thread starvation caused by too
many threads handling blocking operations (such as CRL fetching).
* Two new strongswan.conf options allow to fine-tune performance on IKEv2
gateways by dropping IKE_SA_INIT requests on high load.
* IKEv2 charon daemon supports PASS and DROP shunt policies
preventing traffic to go through IPsec connections. Installation of the
shunt policies either via the XFRM netfilter or PFKEYv2 IPsec kernel
interfaces.
* The history of policies installed in the kernel is now tracked so that e.g.
trap policies are correctly updated when reauthenticated SAs are terminated.
* IMC/IMV Scanner pair implementing the RFC 5792 PA-TNC (IF-M) protocol.
Using "netstat -l" the IMC scans open listening ports on the TNC client
and sends a port list to the IMV which based on a port policy decides if
the client is admitted to the network.
* IMC/IMV Test pair implementing the RFC 5792 PA-TNC (IF-M) protocol.
* The IKEv2 close action does not use the same value as the ipsec.conf dpdaction
setting, but the value defined by its own closeaction keyword. The action
is triggered if the remote peer closes a CHILD_SA unexpectedly.
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=28
|
||
|---|---|---|
| _service | ||
| _service:download_url:strongswan-4.5.3.tar.bz2 | ||
| _service:download_url:strongswan-4.5.3.tar.bz2.sig | ||
| .gitattributes | ||
| .gitignore | ||
| README.SUSE | ||
| strongswan_modprobe_syslog.patch | ||
| strongswan-4.5.3-rpmlintrc | ||
| strongswan.changes | ||
| strongswan.init.in | ||
| strongswan.spec | ||
Dear Customer, please note, that the strongswan release 4.5 changes the keyexchange mode to IKEv2 as default -- from strongswan-4.5.0/NEWS: "[...] IMPORTANT: the default keyexchange mode 'ike' is changing with release 4.5 from 'ikev1' to 'ikev2', thus commemorating the five year anniversary of the IKEv2 RFC 4306 and its mature successor RFC 5996. The time has definitively come for IKEv1 to go into retirement and to cede its place to the much more robust, powerful and versatile IKEv2 protocol! [...]" This requires adoption of either the "conn %default" or all other IKEv1 "conn" sections in the /etc/ipsec.conf to use explicit: keyexchange=ikev1 The strongswan package does no provide any files any more, but triggers the installation of both, IKEv1 (pluto) and IKEv2 (charon) daemons and the traditional starter scripts inclusive of the /etc/init.d/ipsec init script and /etc/ipsec.conf file. There is a new strongswan-nm package with a NetworkManager plugin to control the charon IKEv2 daemon through D-Bus, designed to work using the NetworkManager-strongswan graphical user interface. It does not depend on the traditional starter scripts, but on the IKEv2 charon daemon and plugins only. Have a lot of fun...