Component: ipsec

6.38.4 Stable 2017-Mar-08 (9 years ago)

• deducted policy SA src/dst address from src/dst address;
• do not require "sa-dst-address" if "action=none" or "action=discard";
• fixed SA address check in policy lookup;
• hide SA address for transport policies;
• keep policy in kernel even with bad proposal;
• kill ph2 on policy removal;
• updated/fixed Radius attributes;

6.38.1 Stable 2017-Jan-13 (9 years ago)

• added ability to kill particular remote-peer;
• fixed flush speed and SAs on startup;
• fixed peer port export;
• port is used only for initiators;

6.37.4 Long-term 2017-Jan-13 (9 years ago)

• fixed kernel failure on tile with sha256 when hardware encryption is not being used;

6.38 Stable 2016-Dec-30 (9 years ago)

• added ability to specify static IP address at "send-dns" option;
• added ph2 accounting for each policy "/ip ipsec policy ph2-count";
• allow to specify explicit split dns address;
• changed logging topic from error to debug when empty pfkey messages are received;
• do not auto-negotiate more SAs than needed;
• ensure generated policy refers to valid proposal;
• fixed camellia crypto algorithm module loading;
• fixed IPv6 remote prefix;
• fixed kernel failure on tile with sha256 when hardware encryption is not being used;
• fixed peer configuration my-id IPv4 address endianness;
• fixed ph2 auto-negotiation by checking policies in correct order;
• load ipv6 related modules only when ipv6 package is enabled;
• make generated policies always as unique;
• non passive peers will also establish SAs from policy without waiting for the first packet;
• optimized logging under ipsec topic;
• show active flag when policy has active SA;
• show SA "enc-key-size";
• split "mode-config" and "send-dns" arguments;

6.37.2 Stable 2016-Nov-08 (9 years ago)

• changed logging topic from error to debug for ph2 transform mismatch messages;

6.37 Stable 2016-Sep-23 (9 years ago)

• fixed crash with enabled fragmentation;
• fixed dynamic policy not deleted on disconnect for nat-t peers;
• fixed fragmentation use negotiation;
• fixed kernel crash when sha512 was used;

6.36.3 Stable 2016-Sep-05 (9 years ago)

• don't log authtype mismatch as critical;
• fixed xauth parameter printing in terminal;

6.36 Stable 2016-Jul-20 (10 years ago)

• add dead ph2 detection exception for windows msgid noncompliance with rfc;
• added dead ph2 reply detection;
• don't register temporary ph2 on dead list;
• fix initiator modecfg dynamic dns;
• fixed AH with SHA2;
• fixed checks before accessing ph1 nat options;
• fixed mode-config export;
• fixed route cache overflow when using ipsec with route cache disabled;
• fixed windows msgid check on x86 devices;
• show remote peer address in error messages when possible;
• store udp encapsulation type in proposal;

6.35.4 Stable 2016-Jun-09 (10 years ago)

• fixed mode-config export;
• fixed route cache overflow when using ipsec with route cache disabled;

6.34.5 Long-term 2016-May-27 (10 years ago)

• better flush on proposal change;
• fixed crash on policy update;

6.35 Stable 2016-Apr-14 (10 years ago)

• always re-key ph1 because it was possible that ph1 without DPD would expire;
• better flush on proposal change;
• fixed crash on policy update;
• fixed fast ph2 SA addition;
• fixed larval SA refresh for display;
• fixed multiple consecutive dynamic policy flush;

6.34.4 Stable 2016-Mar-24 (10 years ago)

• take into account ip protocol in kernel policy matcher;

6.34.2 Stable 2016-Feb-18 (10 years ago)

• fix console peer aes enc algorithm display;

6.32.4 Long-term 2016-Feb-09 (10 years ago)

• fixed kernel failure after underlying tunnel has been disabled/enabled;

6.34 Stable 2016-Jan-29 (10 years ago)

• allow my-id address specification in main mode;
• prioritize proposals;
• support multiple DH groups for phase 1;
• fix phase2 hmac-sha-256-128 truncation len from 96 to 128 This will break compatibility with all previous versions and any other currently compatible software using sha256 hmac for phase2;
• make sure that dynamic policy always has dynamic flag;
• fixed active SAs flushing;
• improved TCP performance on CCRs;

6.33 Stable 2015-Nov-06 (10 years ago)

• force flow cache validation once in 1h;
• fix set on multiple policies which could result in adding non existent dynamic policies to the list;
• fix transport mode ph2 ID ports when policy selects specific ip protocol on initiator;
• use local-address for phase 1 matching and initiation;
• fix replay window, was accidentally disabled since version 6.30;

6.32.2 Stable 2015-Sep-17 (10 years ago)

• fixed kernel failure when packets were not ordered on first call;
• fix sockaddr buf size on id generation for ipv6 address;

6.32 Stable 2015-Aug-31 (10 years ago)

• added compatibility option skip-peer-id-check;
• fix potential memory leak;
• use local-address for phase 1 matching and initiation;
• fix transport mode ph2 ID ports when policy selects specific ip protocol on initiator;

6.30.2 Long-term 2015-Jul-22 (11 years ago)

• fixed crash in when gcm encryption was used

6.30.1 Long-term 2015-Jul-14 (11 years ago)

• disallow changing dynamic peer;

6.30 Stable 2015-Jul-08 (11 years ago)

• fail ph2 negitioation when initiator proposed key length does not match proposal configuration;
• increase replay window to 128;

6.29 Stable 2015-May-27 (11 years ago)

• allow to specify custom IP address for my_id parameter;

6.27 Stable 2015-Feb-11 (11 years ago)

• fixed crash that happened in specific situation;

6.21 Stable 2014-Oct-30 (11 years ago)

• fix downgrade problem to v5;
• disallow template-policy-group=none in peer config and set it to 'default';

6.20 Stable 2014-Oct-01 (11 years ago)

• support fqdn as my id;
• allow binding modeconf address to username;