Version 4.3.5 » History » Version 1
Tobias Brunner, 02.11.2009 14:30
Changes for Version 4.3.5
| 1 | 1 | Tobias Brunner | h1. Version 4.3.5 |
|---|---|---|---|
| 2 | 1 | Tobias Brunner | |
| 3 | 1 | Tobias Brunner | * The IKEv1 pluto daemon can now use SQL-based address pools to deal out |
| 4 | 1 | Tobias Brunner | virtual IP addresses as a Mode Config server. The pool capability has been |
| 5 | 1 | Tobias Brunner | migrated from charon's sql plugin to a new attr-sql plugin which is loaded |
| 6 | 1 | Tobias Brunner | by libstrongswan and which can be used by both daemons either with a SQLite |
| 7 | 1 | Tobias Brunner | or MySQL database and the corresponding plugin. |
| 8 | 1 | Tobias Brunner | |
| 9 | 1 | Tobias Brunner | * In addition to time based rekeying, charon supports IPsec SA lifetimes based |
| 10 | 1 | Tobias Brunner | on processed volume or number of packets. They new ipsec.conf paramaters |
| 11 | 1 | Tobias Brunner | 'lifetime' (an alias to 'keylife'), 'lifebytes' and 'lifepackets' handle |
| 12 | 1 | Tobias Brunner | SA timeouts, while the parameters 'margintime' (an alias to rekeymargin), |
| 13 | 1 | Tobias Brunner | 'marginbytes' and 'marginpackets' trigger the rekeying before a SA expires. |
| 14 | 1 | Tobias Brunner | The existing parameter 'rekeyfuzz' affects all margins. |
| 15 | 1 | Tobias Brunner | |
| 16 | 1 | Tobias Brunner | * The new '[[IPsecPKI|ipsec pki]]' tool provides a set of commands to maintain a public |
| 17 | 1 | Tobias Brunner | key infrastructure. It currently supports operations to create RSA and ECDSA |
| 18 | 1 | Tobias Brunner | private/public keys, calculate fingerprints and issue or verify certificates. |
| 19 | 1 | Tobias Brunner | |
| 20 | 1 | Tobias Brunner | * The EAP-AKA plugin can use different backends for USIM/quintuplet |
| 21 | 1 | Tobias Brunner | calculations, very similar to the EAP-SIM plugin. The existing 3GPP2 software |
| 22 | 1 | Tobias Brunner | implementation has been migrated to a separate plugin. |
| 23 | 1 | Tobias Brunner | |
| 24 | 1 | Tobias Brunner | * The IKEv2 daemon charon gained basic PGP support. It can use locally installed |
| 25 | 1 | Tobias Brunner | peer certificates and can issue signatures based on RSA private keys. |
| 26 | 1 | Tobias Brunner | |
| 27 | 1 | Tobias Brunner | * If no CA/Gateway certificate is specified in the NetworkManager plugin, |
| 28 | 1 | Tobias Brunner | charon uses a set of trusted root certificates preinstalled by distributions. |
| 29 | 1 | Tobias Brunner | The directory containing CA certificates can be specified using the |
| 30 | 1 | Tobias Brunner | --with-nm-ca-dir=path configure option. |
| 31 | 1 | Tobias Brunner | |
| 32 | 1 | Tobias Brunner | h2. IKEv1 fixes |
| 33 | 1 | Tobias Brunner | |
| 34 | 1 | Tobias Brunner | * Fixed smartcard-based authentication in the pluto daemon which was broken by |
| 35 | 1 | Tobias Brunner | the ECDSA support introduced with the 4.3.2 release. |
| 36 | 1 | Tobias Brunner | |
| 37 | 1 | Tobias Brunner | * Fixed the broken parsing of PKCS#7 wrapped certificates by the pluto daemon. |
| 38 | 1 | Tobias Brunner | |
| 39 | 1 | Tobias Brunner | * A patch contributed by Heiko Hund fixes mixed IPv6 in IPv4 and vice versa |
| 40 | 1 | Tobias Brunner | tunnels established with the IKEv1 pluto daemon. |
| 41 | 1 | Tobias Brunner | |
| 42 | 1 | Tobias Brunner | * The pluto daemon now uses the libstrongswan x509 plugin for certificates and |
| 43 | 1 | Tobias Brunner | CRLs and the struct id type was replaced by identification_t used by charon |
| 44 | 1 | Tobias Brunner | and the libstrongswan library. |
| 45 | 1 | Tobias Brunner | |
| 46 | 1 | Tobias Brunner | h2. IKEv2 fixes |
| 47 | 1 | Tobias Brunner | |
| 48 | 1 | Tobias Brunner | * Fixed the encoding of the Email relative distinguished name in left|rightid |
| 49 | 1 | Tobias Brunner | statements. |
| 50 | 1 | Tobias Brunner | |
| 51 | 1 | Tobias Brunner | * Charon uses a monotonic time source for statistics and job queueing, behaving |
| 52 | 1 | Tobias Brunner | correctly if the system time changes (e.g. when using NTP). |
| 53 | 1 | Tobias Brunner | |
| 54 | 1 | Tobias Brunner | * Plugin names have been streamlined: EAP plugins now have a dash after eap |
| 55 | 1 | Tobias Brunner | (e.g. eap-sim), as it is used with the --enable-eap-sim ./configure option. |
| 56 | 1 | Tobias Brunner | Plugin configuration sections in strongswan.conf now use the same name as the |
| 57 | 1 | Tobias Brunner | plugin itself (i.e. with a dash). Make sure to update "load" directives and |
| 58 | 1 | Tobias Brunner | the affected plugin sections in existing strongswan.conf files. |
| 59 | 1 | Tobias Brunner | |
| 60 | 1 | Tobias Brunner | * The private/public key parsing and encoding has been split up into |
| 61 | 1 | Tobias Brunner | separate pkcs1, pgp, pem and dnskey plugins. The public key implementation |
| 62 | 1 | Tobias Brunner | plugins gmp, gcrypt and openssl can all make use of them. |