176 lines
6.2 KiB
Plaintext
176 lines
6.2 KiB
Plaintext
Version history:
|
|
----------------
|
|
0.8.x CVS (no official release yet)
|
|
o A lot of code cleanup
|
|
o XXX TODO
|
|
|
|
0.8.2 - 27 February 2014
|
|
o Fix admin port establish-sa for tunnel mode SAs (Alexander Sbitnev)
|
|
o Fix source port selection regression from version 0.8.1
|
|
o Various logging improvements
|
|
o Additional compliance and build fixes
|
|
|
|
0.8.1 - 08 January 2013
|
|
o Improved X.509 subject name comparation (Götz Babin-Ebell)
|
|
o Relax DPD cookie check for Cisco IOS compatibility (Roman Antink)
|
|
o Allow simplified syntax for inherited remote blocks (Roman Antink)
|
|
o Never shring pfkey socket buffer (Marcelo Leitner)
|
|
o Privilege separation child process exit fix
|
|
o Multiple memory allocation and use-after-free fixes
|
|
|
|
0.8 - 18 March 2011
|
|
o Fix authentication method ambiguity with kerberos and xauth
|
|
o RFC2253 compliant escaping of asn1dn identifiers (Cyrus Rahman)
|
|
o Local address code rewrite to speed things up
|
|
o Improved MIPv6 support (Arnaud Ebalard)
|
|
o ISAKMP SA (phase1) rekeying
|
|
o Improved scheduler (faster algorithm, support monotonic clock)
|
|
o Handle RESPONDER-LIFETIME in quick mode
|
|
o Handle INITIAL-CONTACT in from main mode too
|
|
o Rewritten event handling framework for admin port
|
|
o Ability to initiate IPsec SA through admin port
|
|
o NAT-T Original Address handling (transport mode NAT-T support)
|
|
o Remove various obsolete configuration options
|
|
o A lot of other bug fixes, performance improvements and clean ups
|
|
|
|
0.7.1 - 23 July 2008
|
|
o Fixes a memory leak when invalid proposal received
|
|
o Some fixes in DPD
|
|
o do not set default gss id if xauth is used
|
|
o fixed hybrid enabled builds
|
|
o fixed compilation on FreeBSD8
|
|
o cleanup in network port value manipulation
|
|
o Gets ports from SADB_X_EXT_NAT_T_[SD]PORT if present in
|
|
purge_ipsec_spi()
|
|
o Generates a log if cert validation has been disabled by
|
|
configuration
|
|
o better handling for pfkey socket read errors
|
|
o Fixes in yacc / bison stuff
|
|
o new plog() macro (reduced CPU usage when logging is disabled)
|
|
o Try to work better with huge SPD/SAD
|
|
o Corrected modecfg option syntax
|
|
|
|
0.7 - 09 August 2007
|
|
o Xauth with pre-shared key PSK
|
|
o Xauth with certificates
|
|
o SHA2 support
|
|
o pkcs7 support
|
|
o system accounting (utmp)
|
|
o Darwin support
|
|
o configuration can be reloaded
|
|
o Support for UNIQUE generated policies
|
|
o Support for semi anonymous sainfos
|
|
o Support for ph1id to remoteid matching
|
|
o Plain RSA authentication
|
|
o Native LDAP support for Xauth and modecfg
|
|
o Group membership checks for Xauth and sainfo selection
|
|
o Camellia cipher support
|
|
o IKE Fragment force option
|
|
o Modecfg SplitNet attribute support
|
|
o Modecfg SplitDNS attribute support ( server side )
|
|
o Modecfg Default Domain attribute support
|
|
o Modecfg DNS/WINS server multiple attribute support
|
|
|
|
0.6 - 27 June 2005
|
|
o Generated policies are now correctly flushed
|
|
o NAT-T works with multiple peers behind the NAT (need kernel support)
|
|
o Xauth can use shadow passwords
|
|
o TCP-MD5 support
|
|
o PAM support for Xauth
|
|
o Privilege separation
|
|
o ESP fragmentation in tunnel mode can be tunned (NetBSD only)
|
|
o racoon admin interface is exported (header and library) to
|
|
help building control programs for racoon (think GUI)
|
|
o Fixed single DES support; single DES users MUST UPGRADE.
|
|
|
|
0.5 - 10 April 2005
|
|
o Rewritten buildsystem. Now completely autoconfed, automaked,
|
|
libtoolized.
|
|
o IPsec-tools now compiles on NetBSD and FreeBSD again.
|
|
o Support for server-side hybrid authentication, with full
|
|
RADIUS supoort. This is interoperable with the Cisco VPN client.
|
|
o Support for client-side hybrid authentication (Tested only with
|
|
a racoon server)
|
|
o ISAKMP mode config support
|
|
o IKE fragmentation support
|
|
o Fixed FWD policy support.
|
|
o Fixed IPv6 compilation.
|
|
o Readline is optional, fixed setkey when compiled without readline.
|
|
o Configurable Root-CA certificate.
|
|
o Dead Peer Detection (DPD) support.
|
|
|
|
0.4rc1 - 09 August 2004
|
|
o Merged support for PlainRSA keys from the 'plainrsa' branch.
|
|
o Inheritance of 'remote{}' sections.
|
|
o Support for SPD policy priorities in setkey.
|
|
o Ciphers are now used through the 'EVP' interface which allows
|
|
using hardware crypto accelerators.
|
|
o Setkey has new option -n (no action).
|
|
o All source files now have 3-clause BSD license.
|
|
|
|
0.3 - 14 April 2004
|
|
o Fixed setkey to handle multiline commands again.
|
|
o Added command 'exit' to setkey.
|
|
o Fixed racoon to only Warn if no CRL was found.
|
|
o Improved testsuite.
|
|
|
|
0.3rc5 - 05 April 2004
|
|
o Security bugfix WRT handling X.509 signatures.
|
|
o Stability fix WRT unknown PF_KEY messages.
|
|
o Fixed NAT-T with more proposals (e.g. more crypto algos).
|
|
o Setkey parses lines one by one => doesn't exit on errors.
|
|
o Setkey supports readline => more user friendly.
|
|
|
|
0.3rc4 - 25 March 2004
|
|
o Fixed adding "null" encryption via 'setkey'.
|
|
o Fixed segfault when using AES in Phase1 with OpenSSL>=0.9.7
|
|
o Fixed NAT-T in aggressive mode.
|
|
o Fixed testsuite and added testsuite run into make check.
|
|
|
|
0.3rc3 - 19 March 2004
|
|
o Fixed compilation error with --enble-yydebug
|
|
o Better diagnostic when proposals don't match.
|
|
o Changed/added options to setkey.
|
|
|
|
0.3rc2 - 11 March 2004
|
|
o Added documentation for NAT-T
|
|
o Better NAT-T diagnostic.
|
|
o Test and workaround for missing va_copy()
|
|
|
|
0.3rc1 - 04 March 2004
|
|
o Support for NAT Traversal (NAT-T)
|
|
|
|
0.2.4 - 29 January 2004
|
|
o Sync with KAME as of 2004-01-07
|
|
o Fixed unauthorized deletion of SA in racoon (again).
|
|
|
|
0.2.3 - 15 January 2004
|
|
o Support for SA lifetime specified in bytes
|
|
(see setkey -bs/-bh options)
|
|
o Enhance support for OpenSSL 0.9.7
|
|
o Let racoon be more verbose
|
|
o Fixed some simple bugs (see ChangeLog for details)
|
|
o Fixed unauthorized deletion of SA in racoon
|
|
o Fixed problems on AMD64
|
|
o Ignore multicast addresses for IKE
|
|
|
|
0.2.2 - 13 March 2003
|
|
o Fix racoon to build on some systems that require linking against -lfl
|
|
o add an RPM spec to the distribution
|
|
|
|
0.2.1 - 07 March 2003
|
|
o Fix some more gcc-3.2.2 compiler warnings
|
|
o Fix racoon to actually configure with ssl in a non-standard location
|
|
o Fix racoon to not complain if krb5-config is not installed
|
|
|
|
0.2 - 06 March 2003
|
|
o Glibc-2.3 support
|
|
o OpenSSL-0.9.7 support
|
|
o Fixed duplicate-macro problems
|
|
o Fix racoon lex/yacc support
|
|
o Install psk.txt mode 600, racoon.conf mode 644
|
|
o Fix racoon to look in the correct directory for config files
|
|
|
|
0.1 - 03 March 2003
|
|
o Initial release of IPsec-Tools
|