Component: ipsec
296 changelog entries across 97 version(s)
Releases by channel (stacked)
- fixed AES-CTR and AES-GCM support on RB1200;
- improved single tunnel hardware acceleration performance on MMIPS devices;
- properly detect interface for "mode-config" client IP address assignment;
- fixed incorrect esp proposal key size usage;
- properly update IPsec secret for IPIP/EoIP/GRE dynamic peer;
- properly update IPsec secret for IPIP/EoIP/GRE dynamic peer;
- added DH groups 19, 20 and 21 support for phase1 and phase2;
- allow to specify "remote-peer" address as DNS name;
- fixed incorrect esp proposal key size usage;
- fixed policy enable/disable;
- improved hardware accelerated IPSec performance on 750Gr3;
- improved reliability on certificate usage;
- renamed "firewall" argument to "notrack-chain" in peer configuration;
- skip invalid policies for phase2;
- fixed lost value for "remote-certificate" parameter after disable/enable;
- do not deduct "dst-address" from "sa-dst-address" for "/0" policies;
- kill PH1 on "mode-config" address failure;
- do not deduct policy src/dst address for tunnel policies;
- fixed generated policy priority;
- fixed peer "my-id" address reset;
- fixed generated policy priority;
- fixed peer "my-id" address reset;
- renamed "remote-dynamic-address" to "dynamic-address";
- added "last-seen" parameter to active connection list;
- allow mixing aead algorithms in proposal;
- better responder flag calculator for console;
- disallow AH+ESP combined policies ;
- do not loose "use-ipsec=yes" parameter after downgrade;
- enable aes-ni on i386 and x64 for cbc, ctr and gcm modes;
- fixed "/ip ipsec policy group export verbose";
- fixed "mode-cfg" verbose export;
- fixed SA authentication flag;
- renamed "hw-authenc" flag to "hw-aead";
- show hardware accelerated authenticated SAs;
- updated tilera classifier for UDP encapsulated ESP;
- deducted policy SA src/dst address from src/dst address;
- do not require "sa-dst-address" if "action=none" or "action=discard";
- fixed SA address check in policy lookup;
- hide SA address for transport policies;
- keep policy in kernel even with bad proposal;
- kill ph2 on policy removal;
- updated/fixed Radius attributes;
- added ability to kill particular remote-peer;
- fixed flush speed and SAs on startup;
- fixed peer port export;
- port is used only for initiators;
- fixed kernel failure on tile with sha256 when hardware encryption is not being used;
- added ability to specify static IP address at "send-dns" option;
- added ph2 accounting for each policy "/ip ipsec policy ph2-count";
- allow to specify explicit split dns address;
- changed logging topic from error to debug when empty pfkey messages are received;
- do not auto-negotiate more SAs than needed;
- ensure generated policy refers to valid proposal;
- fixed camellia crypto algorithm module loading;
- fixed IPv6 remote prefix;
- fixed kernel failure on tile with sha256 when hardware encryption is not being used;
- fixed peer configuration my-id IPv4 address endianness;
- fixed ph2 auto-negotiation by checking policies in correct order;
- load ipv6 related modules only when ipv6 package is enabled;
- make generated policies always as unique;
- non passive peers will also establish SAs from policy without waiting for the first packet;
- optimized logging under ipsec topic;
- show active flag when policy has active SA;
- show SA "enc-key-size";
- split "mode-config" and "send-dns" arguments;
- changed logging topic from error to debug for ph2 transform mismatch messages;
- fixed crash with enabled fragmentation;
- fixed dynamic policy not deleted on disconnect for nat-t peers;
- fixed fragmentation use negotiation;
- fixed kernel crash when sha512 was used;
- don't log authtype mismatch as critical;
- fixed xauth parameter printing in terminal;
- add dead ph2 detection exception for windows msgid noncompliance with rfc;
- added dead ph2 reply detection;
- don't register temporary ph2 on dead list;
- fix initiator modecfg dynamic dns;
- fixed AH with SHA2;
- fixed checks before accessing ph1 nat options;
- fixed mode-config export;
- fixed route cache overflow when using ipsec with route cache disabled;
- fixed windows msgid check on x86 devices;
- show remote peer address in error messages when possible;
- store udp encapsulation type in proposal;
- fixed mode-config export;
- fixed route cache overflow when using ipsec with route cache disabled;
- better flush on proposal change;
- fixed crash on policy update;
- always re-key ph1 because it was possible that ph1 without DPD would expire;
- better flush on proposal change;
- fixed crash on policy update;
- fixed fast ph2 SA addition;
- fixed larval SA refresh for display;
- fixed multiple consecutive dynamic policy flush;
- take into account ip protocol in kernel policy matcher;
- fix console peer aes enc algorithm display;
- fixed kernel failure after underlying tunnel has been disabled/enabled;
- allow my-id address specification in main mode;
- prioritize proposals;
- support multiple DH groups for phase 1;
- fix phase2 hmac-sha-256-128 truncation len from 96 to 128 This will break compatibility with all previous versions and any other currently compatible software using sha256 hmac for phase2;
- make sure that dynamic policy always has dynamic flag;
- fixed active SAs flushing;
- improved TCP performance on CCRs;