Component: ipsec

6.34.4 Stable 2016-Mar-24 (10 years ago)

• take into account ip protocol in kernel policy matcher;

6.34.2 Stable 2016-Feb-18 (10 years ago)

• fix console peer aes enc algorithm display;

6.32.4 Long-term 2016-Feb-09 (10 years ago)

• fixed kernel failure after underlying tunnel has been disabled/enabled;

6.34 Stable 2016-Jan-29 (10 years ago)

• allow my-id address specification in main mode;
• prioritize proposals;
• support multiple DH groups for phase 1;
• fix phase2 hmac-sha-256-128 truncation len from 96 to 128 This will break compatibility with all previous versions and any other currently compatible software using sha256 hmac for phase2;
• make sure that dynamic policy always has dynamic flag;
• fixed active SAs flushing;
• improved TCP performance on CCRs;

6.33 Stable 2015-Nov-06 (10 years ago)

• force flow cache validation once in 1h;
• fix set on multiple policies which could result in adding non existent dynamic policies to the list;
• fix transport mode ph2 ID ports when policy selects specific ip protocol on initiator;
• use local-address for phase 1 matching and initiation;
• fix replay window, was accidentally disabled since version 6.30;

6.32.2 Stable 2015-Sep-17 (11 years ago)

• fixed kernel failure when packets were not ordered on first call;
• fix sockaddr buf size on id generation for ipv6 address;

6.32 Stable 2015-Aug-31 (11 years ago)

• added compatibility option skip-peer-id-check;
• fix potential memory leak;
• use local-address for phase 1 matching and initiation;
• fix transport mode ph2 ID ports when policy selects specific ip protocol on initiator;

6.30.2 Long-term 2015-Jul-22 (11 years ago)

• fixed crash in when gcm encryption was used

6.30.1 Long-term 2015-Jul-14 (11 years ago)

• disallow changing dynamic peer;

6.30 Stable 2015-Jul-08 (11 years ago)

• fail ph2 negitioation when initiator proposed key length does not match proposal configuration;
• increase replay window to 128;

6.29 Stable 2015-May-27 (11 years ago)

• allow to specify custom IP address for my_id parameter;

6.27 Stable 2015-Feb-11 (11 years ago)

• fixed crash that happened in specific situation;

6.21 Stable 2014-Oct-30 (12 years ago)

• fix downgrade problem to v5;
• disallow template-policy-group=none in peer config and set it to 'default';

6.20 Stable 2014-Oct-01 (12 years ago)

• support fqdn as my id;
• allow binding modeconf address to username;

6.19 Stable 2014-Aug-26 (12 years ago)

• when peer config is changed kill only relevant SAs;

6.18 Stable 2014-Aug-01 (12 years ago)

• fix addition of default policy template;

6.16 Stable 2014-Jul-17 (12 years ago)

• fix AH proposal and problem when sometimes policy was not generated;
• allow multiple encryption algorithms per peer;

6.12 Stable 2014-Apr-14 (12 years ago)

• support IPv4 over IPv6 and vice versa;

6.11 Stable 2014-Mar-20 (12 years ago)

• fix aes-cbc hardware acceleration on CCR with key sizes 192 and 256;

6.8 — 2014-Jan-29 (12 years ago)

• enable hardware acceleration for aes-cbc + md5|sha1|sha256 aead on CCR;

6.7 Stable 2013-Nov-29 (12 years ago)

• added aes-gcm icv16 encryption mode;
• added aes-ctr encryption mode;
• added sha256 and sha512 support;
• proposal defaults changed to aes-128 and sha1 for both phase1 and phase2;
• fix policy bypass on IPv6 gre, ipip, eoip tunnels when policy uses protocol filter;

6.5 Stable 2013-Oct-16 (13 years ago)

• fix peer mathing with non byte aligned masks;

6.2 Stable 2013-Aug-02 (13 years ago)

• fixed peer address matching;
• fix phase1 autonegotiation on little endian platforms;

6.1 Stable 2013-Jun-12 (13 years ago)

• for peers with full IP address specified system will autostart ISAKMP SA negotiation;

6.0 Stable 2013-May-17 (13 years ago)

• added /peer passive option which will prevent starting ISAKMP negotiation and signifies xauth responder/initiator side;
• added pre-shared-key-xauth and rsa-signature-hybrid authentication methods;