Component: ipsec
296 changelog entries across 97 version(s)
Releases by channel (stacked)
- added "split-dns" parameter support for mode configuration;
- added "use-responder-dns" parameter support;
- allow specifying two peers for a single policy for failover;
- control CRL validation with global "use-crl" setting;
- do full certificate validation for identities with explicit certificate;
- fixed minor spelling mistake in logs;
- improved IPsec service stability when receiving bogus packets;
- place dynamically created IPsec policies by L2TP client at the begining of the table;
- improved system stability when handling fragmented packets;
- improved system stability when handling fragmented packets;
- improved system stability when processing decrypted packet on unregistered interface;
- improved system stability when processing decrypted packet on unregistered interface;
- added "error" topic for identity check failure logging messages;
- fixed DNS resolving when domain has only AAAA entries;
- fixed policy "sa-src-address" detection from "local-address" (introduced in v6.45);
- allow inline "passphrase" parameter when importing keys;
- fixed minor spelling mistakes in logs;
- allow inline "passphrase" parameter when importing keys;
- fixed "eap-radius" authentication method (introduced in v6.45);
- fixed minor spelling mistakes in logs;
- added "connection-mark" parameter for mode-config initiator;
- allow peer argument only for "encrypt" policies (introduced in v6.45);
- fixed peer configuration migration from versions older than v6.43 (introduced in v6.45);
- improved stability for peer initialization (introduced in v6.45);
- show warning for policies with "unknown" peer;
- renamed "remote-peers" to "active-peers";
- renamed "rsa-signature" authentication method to "digital-signature";
- replaced policy SA address parameters with peer setting;
- use tunnel name for dynamic IPsec peer name;
- added dynamic comment field for "active-peers" menu inherited from identity;
- added "ph2-total" counter to "active-peers" menu;
- added support for RADIUS accounting for "eap-radius" and "pre-shared-key-xauth" authentication methods;
- added traffic statistics to "active-peers" menu;
- disallow setting "src-address" and "dst-address" for transport mode policies;
- do not allow adding identity to a dynamic peer;
- fixed policies becoming invalid after changing priority;
- general improvements in policy handling;
- properly drop already established tunnel when address change detected;
- added account log message when user is successfully authenticated;
- added basic pre-shared-key strength checks;
- added new "remote-id" peer matcher;
- allow to specify single address instead of IP pool under "mode-config";
- fixed active connection killing when changing peer configuration;
- fixed all policies not getting installed after startup (introduced in v6.43.8);
- fixed stability issues after changing peer configuration (introduced in v6.43);
- hide empty prefixes on "peer" menu;
- improved invalid policy handling when a valid policy is uninstalled;
- made dynamic "src-nat" rule more specific;
- made peers autosort themselves based on reachability status;
- moved "profile" menu outside "peer" menu;
- properly detect AES-NI extension as hardware AEAD;
- removed limitation that allowed only single "auth-method" with the same "exchange-mode" as responder;
- require write policy for key generation;
- accept only valid path for "export-pub-key" parameter in "key" menu;
- accept only valid path for "export-pub-key" parameter in "key" menu;
- fixed hw-aead (H) flag presence under Installed SAs on startup;
- improved stability when uninstalling multiple SAs at once;
- properly handle peer profiles on downgrade;
- properly update warnings under peer menu;
- fixed hw-aead (H) flag presence under Installed SAs on startup;
- improved stability when uninstalling multiple SAs at once;
- properly update warnings under peer menu;
- allow multiple peers to the same address with different local-address (introduced in v6.43);
- improved invalid policy handling when a valid policy is uninstalled;
- improved stability when using IPsec with disabled route cache;
- added "responder" parameter for "mode-config" to allow multiple initiator configurations;
- added "src-address-list" parameter for "mode-config" that generates dynamic "src-nat" rule;
- added warning messages for incorrect peer configuration;
- do not allow removal of "proposal" and "mode-config" entries that are in use;
- fixed AES-192-CTR fallback to software AEAD on ARM devices with wireless and RB3011UiAS-RM;
- fixed AES-CTR and AES-GCM key size proposing as initiator;
- fixed "static-dns" value storing;
- improved invalid policy handling when a valid policy is uninstalled;
- improved reliability on generated policy addition when IKEv1 or IKEv2 used;
- improved stability when using IPsec with disabled route cache;
- install all DNS server addresses provided by "mode-config" server;
- separate phase1 proposal configuration from peer menu;
- use monotonic timer for SA lifetime check;
- fixed policies becoming invalid if added after a disabled policy;
- fixed "sa-src-address" deduction from "src-address" in tunnel mode;
- improved invalid policy handling when a valid policy is uninstalled;
- improved reliability on IPsec hardware encryption for RB1100Dx4;
- fixed policies becoming invalid if added after a disabled policy;
- improved reliability on IPsec hardware encryption for ARM devices except RB1100Dx4;