forked from pool/strongswan
Marius Tomaschewski
9dc0c277ab
* Implements RFC 5793 Posture Broker Protocol (BP)
* Re-implemented TNCCS 1.1 protocol
* Allows to store IKE and ESP proposals in an SQL database
* Allows to store CRL and OCSP cert points in an SQL database
* New 'include' statement in strongswan.conf allows recursions
* Modifications of strongswan.conf parser, cause syntax attr plugin
syntax changes.
* ipsec listalgs now appends the plugin registering an algo
* Adds support for Traffic Flow Confidentiality with Linux 2.6.38
* New af-alg plugin allows to use new primitives in 2.6.38 crypto api
and removes the need for additional userland implementations.
* IKEv2 daemon supports the INITIAL_CONTACT notify
* conftest conformance testing framework
* new constraints plugin provides advanced X.509 constraint checking
* left/rightauth ipsec.conf keywords accept minimum strengths
* basic support for delta CRLs
See the NEWS file or http://download.strongswan.org/CHANGES4.txt
for a detailed description of the changes.
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=25
|
||
|---|---|---|
| .gitattributes | ||
| .gitignore | ||
| README.SUSE | ||
| strongswan_modprobe_syslog.patch | ||
| strongswan-4.5.1-rpmlintrc | ||
| strongswan-4.5.1.tar.bz2 | ||
| strongswan-4.5.1.tar.bz2.sig | ||
| strongswan.changes | ||
| strongswan.init.in | ||
| strongswan.spec | ||
Dear Customer, please note, that the strongswan release 4.5 changes the keyexchange mode to IKEv2 as default -- from strongswan-4.5.0/NEWS: "[...] IMPORTANT: the default keyexchange mode 'ike' is changing with release 4.5 from 'ikev1' to 'ikev2', thus commemorating the five year anniversary of the IKEv2 RFC 4306 and its mature successor RFC 5996. The time has definitively come for IKEv1 to go into retirement and to cede its place to the much more robust, powerful and versatile IKEv2 protocol! [...]" This requires adoption of either the "conn %default" or all other IKEv1 "conn" sections in the /etc/ipsec.conf to use explicit: keyexchange=ikev1 The strongswan package does no provide any files any more, but triggers the installation of both, IKEv1 (pluto) and IKEv2 (charon) daemons and the traditional starter scripts inclusive of the /etc/init.d/ipsec init script and /etc/ipsec.conf file. There is a new strongswan-nm package with a NetworkManager plugin to control the charon IKEv2 daemon through D-Bus, designed to work using the NetworkManager-strongswan graphical user interface. It does not depend on the traditional starter scripts, but on the IKEv2 charon daemon and plugins only. Have a lot of fun...