Version 4.4.1 » History » Version 1
Tobias Brunner, 03.08.2010 10:14
News for 4.4.1
| 1 | 1 | Tobias Brunner | h1. Version 4.4.1 |
|---|---|---|---|
| 2 | 1 | Tobias Brunner | |
| 3 | 1 | Tobias Brunner | * Support of XFRM marks in IPsec SAs and IPsec policies introduced with the Linux 2.6.34 kernel. |
| 4 | 1 | Tobias Brunner | For details see the example scenarios {{tc(ikev2/nat-two-rw-mark)}}, {{tc(ikev2/rw-mark-in-out)}}, |
| 5 | 1 | Tobias Brunner | {{tc(ikev2/net2net-psk-dscp)}} and {{tc(ikev2/net2net-same-nets)}}. |
| 6 | 1 | Tobias Brunner | |
| 7 | 1 | Tobias Brunner | * The PLUTO_MARK_IN and PLUTO_ESP_ENC environment variables can be used |
| 8 | 1 | Tobias Brunner | in a user-specific updown script to set marks on inbound ESP or |
| 9 | 1 | Tobias Brunner | ESP_IN_UDP packets. |
| 10 | 1 | Tobias Brunner | |
| 11 | 1 | Tobias Brunner | * The openssl plugin now supports X.509 certificate and CRL functions. The use of the Online |
| 12 | 1 | Tobias Brunner | Certificate Status Protocol (OCSP) still requires the x509 plugin, though. |
| 13 | 1 | Tobias Brunner | X.509 attribute certificate handling rely on the x509 plugin as well. |
| 14 | 1 | Tobias Brunner | |
| 15 | 1 | Tobias Brunner | * OCSP/CRL checking in IKEv2 has been moved to the revocation plugin, enabled |
| 16 | 1 | Tobias Brunner | by default. Plase update manual load directives in strongswan.conf. |
| 17 | 1 | Tobias Brunner | |
| 18 | 1 | Tobias Brunner | * RFC3779 ipAddrBlock constraint checking has been moved to the addrblock |
| 19 | 1 | Tobias Brunner | plugin, disabled by default. Enable it and update manual load directives |
| 20 | 1 | Tobias Brunner | in strongswan.conf, if required. |
| 21 | 1 | Tobias Brunner | |
| 22 | 1 | Tobias Brunner | * Issue a warning if explicit load lists are used. Since the number of pluto |
| 23 | 1 | Tobias Brunner | and charon plugins are increasing steadily with each release and explicit load |
| 24 | 1 | Tobias Brunner | lists might become obsoleted, a warning is now issued by ipsec starter if explicit |
| 25 | 1 | Tobias Brunner | load lists are found in strongswan.conf since we don't recommend their use for |
| 26 | 1 | Tobias Brunner | inexperienced users. [[PluginLoad|Experts read on here.]] |
| 27 | 1 | Tobias Brunner | |
| 28 | 1 | Tobias Brunner | |
| 29 | 1 | Tobias Brunner | * The pki utility supports CRL generation using the --signcrl command. |
| 30 | 1 | Tobias Brunner | |
| 31 | 1 | Tobias Brunner | * The ipsec pki --self, --issue and --req commands now support output in |
| 32 | 1 | Tobias Brunner | PEM format using the --outform pem option. |
| 33 | 1 | Tobias Brunner | |
| 34 | 1 | Tobias Brunner | * The major refactoring of the IKEv1 Mode Config functionality now allows |
| 35 | 1 | Tobias Brunner | the transport and handling of arbitrary Mode Config attributes. |
| 36 | 1 | Tobias Brunner | |
| 37 | 1 | Tobias Brunner | * The [[EapRadius|RADIUS proxy plugin eap-radius]] now supports multiple servers. Configured |
| 38 | 1 | Tobias Brunner | servers are chosen randomly, with the option to prefer a specific server. |
| 39 | 1 | Tobias Brunner | Non-responding servers are degraded by the selection process. |
| 40 | 1 | Tobias Brunner | |
| 41 | 1 | Tobias Brunner | * The ipsec pool tool manages arbitrary configuration attributes stored |
| 42 | 1 | Tobias Brunner | in an SQL database. ipsec pool --help gives the details. |
| 43 | 1 | Tobias Brunner | |
| 44 | 1 | Tobias Brunner | * The new eap-simaka-sql plugin acts as a backend for EAP-SIM and EAP-AKA, |
| 45 | 1 | Tobias Brunner | reading triplets/quintuplets from an SQL database. |
| 46 | 1 | Tobias Brunner | |
| 47 | 1 | Tobias Brunner | * The [[HighAvailability|High Availability]] plugin now supports a HA enabled in-memory address |
| 48 | 1 | Tobias Brunner | pool and Node reintegration without IKE_SA rekeying. The latter allows |
| 49 | 1 | Tobias Brunner | clients without IKE_SA rekeying support to keep connected during |
| 50 | 1 | Tobias Brunner | reintegration. Additionally, many other issues have been fixed in the ha |
| 51 | 1 | Tobias Brunner | plugin. |
| 52 | 1 | Tobias Brunner | |
| 53 | 1 | Tobias Brunner | * Fixed a potential remote code execution vulnerability resulting from |
| 54 | 1 | Tobias Brunner | the misuse of snprintf(). The vulnerability was introduced with the |
| 55 | 1 | Tobias Brunner | strongswan-4.3.3 release and is exploitable by unauthenticated users. |
| 56 | 1 | Tobias Brunner | Patches for all releases starting with 4.3.3 are "available":http://download.strongswan.org/patches/08_snprintf_patch/. |