[Swan] [Swan-announce] Libreswan 3.10 released

[The Libreswan Project]

The Libreswan Project has released libreswan-3.10

This is a major bugfix release.

Libreswan 3.9 did not enforce "strict mode", resulting in the default
proposals of 3des/aes/sha1/md5 to always be allowed despite the
configuration with esp= and ike=. Although none of these algorithms is
weak or broken, we urge everyone to upgrade to ensure compliance with
their local policy. Another important bugfix is for protoport selectors
on passthrough connections when using NETKEY. KLIPS support now covers
Linux kernels up to 3.16 and improves on handling IP aliases.

Two new whack options were added:

ipsec whack --traficstatus shows all XAUTH users and the traffic used on
the existing IPsec SA's.

ipsec --deleteuser --name <username> allows for terminating an IPsec SA
based on XAUTH username.

The updown script has been extended with two environment variables:
- PLUTO_ADDTIME will show the time the IPsec SA was added to the kernel
   and can be used to uniquely identify an IPsec SA.
- PLUTO_SA_TYPE is set to "AH" or "ESP".

For better Cisco compatibility, if a maximum SA Lifetime sent exceeds
our own maximum of 1 day, the lifetime used is capped at 1 day, instead
of the connection being rejected. The option cisco-unity=yes now also
sends the UNITY vendorid when as responder (VPN server)

You can download libreswan via https at:

https://download.libreswan.org/libreswan-3.10.tar.gz
https://download.libreswan.org/libreswan-3.10.tar.gz.asc

or via ftp at:

ftp://download.libreswan.org/libreswan-3.10.tar.gz
ftp://download.libreswan.org/libreswan-3.10.tar.gz.asc

The full changelog is available at:
https://download.libreswan.org/CHANGES

Please report bugs either via one of the mailinglists or at our bug tracker:

https://lists.libreswan.org/
https://bugs.libreswan.org/

Binary packages for Fedora, RHEL and Ubuntu can be found at
https://download.libreswan.org/binaries/

See also https://libreswan.org/

v3.10 (September 1, 2014)
* XAUTH: New option: ipsec whack --traficstatus [Antony]
* XAUTH: New option: ipsec --deleteuser --name xauth-username [Antony]
* XAUTH: Do not strip "-" from XAUTH usernames [Paul]
* _updown.netkey: New environment variable PLUTO_ADDTIME for IPsec SA's [Paul]
* _updown.netkey: Don't skip routing if mtu= option is used [Tuomo]
* NETKEY: protoport= installed broken swapped src/dst passthrough SA's [Antony]
* NETKEY: fix names for RIPEMD160 and AES_CTR [Paul]
* KLIPS: support 3.16+ kernels with update __ip_select_ident() [Thomas Geulig]
* _stackmanager: KLIPS support for alias devices [Marc-Christian Petersen]
* pluto: Simplfy/tidy alg_info [Hugh]
* pluto: Simplify find_host_connection() and terminate_connection() [Hugh]
* pluto: Fix a leaking socket in whack [Hugh]
* pluto: Combine same_dn() and match_dn() to avoid deduplicate logic [Hugh]
* pluto: Add strneq(); get rid of most remaining strncmp calls [Hugh]
* pluto: Get rid of or document strcat, strncat, strcpy, etc [Hugh]
* pluto: malloc/calloc/realloc/free tidying, including a few bug fixes [Hugh]
* pluto: Fix memory allocation/free errors (especially in ike_frag) [Hugh/Paul]
          (triggered as of 3.9 when --leak-detective was used)
* pluto: Various warning fixes from LLVM/Coverity [Hugh]
* pluto: Don't listen before all connections are loaded [Paul]
          (this sub-optimal behaviour was introduced in 3.1)
* cryptohelpers: cleanup and improved error logging [Hugh]
* IKEv2: esp=/phase2alg= should be strict (bug introduced in 3.9) [Paul]
* IKEv2: Don't abort all proposals when encountering unknown PRF [Hugh]
* IKEv2: ikev2_parse_*_sa_body: stop matching after first success [Hugh]
* IKEv2: Reject responder SA with multiple proposals [Hugh]
* IKEv2: Enforce proposal numbering rules [Hugh]
* IKEv2: first initiating XCHG of Original Responder is not a retransmit [Paul]
* IKEv2: Don't respond to reply messages when parent SA was not found [Paul]
* IKEv2: clarify O_responder/O_initiator and Request/Reply code [Paul]
* IKEv2: Check received msgid is larger then previous before storing [Paul]
* IKEv1: parse_ipsec_sa_body() did not allow newer AH transforms [Paul]
* IKEv1: Add sha2 and aes_cbc support for ESP algo [Paul]
* IKEv1: cap IKE lifetimes > 1d to 1d, instead of rejecting SA [Paul]
* IKEv1: cisco-unity=yes now also sends VID when acting as VPN server
* whack: Don't change exit status for RC_INFORMATIONAL* [Mike Gilbert]
* rsasigkey: a logic error limited the randomness of the key size [Paul]
* ipsec: create NSS DB on startup when missing [Paul]
* ipsec: Added "ipsec --checknss" that creates-when-missing NSS DB [Paul]
* verify: Make verify python3 compatbile [Slavek Kabrda]
* readwriteconf: Fix writing kt_invertbool's (like aggrmode=) [Paul]
* testing: Obsoleted dotest.sh with dotest.py, speed increase [Antony]
* testing: Added more test cases and general cleanup [Antony/Paul]
* compiling: Fix ADNS without USE_DNSSEC compile [Tuomo]
_______________________________________________
Swan-announce mailing list
Swan-announce at lists.libreswan.org
https://lists.libreswan.org/mailman/listinfo/swan-announce