See also https://libreswan.org/

v5.4 (unreleased)

* IKEv2:

- update multiple key exchanges using IKE_INTERMEDIATE to RFC 9370 [Daiki Ueno, Andrew]

- support ML_KEM_768 in IKE_SA_INIT and IKE_INTERMEDIATE exchanges [Andrew]

- treat broken IKE_AUTH Child SA response as INVALID_SYNTAX [mamtagambhir, Andrew, #2348]

* X.509:

- fix loop when crlcheckinterval=0+`ipsec fetchcrls` [Wofferl #2383]

* config:

- fix plutodebug=all,add-prefix [Andrew #2338]

- fix per-connection debug= option (experimental in v5.0) [Andrew]

- support lease subnets with syntax leftaddresspool=2025::/56/64 (experimental) [Andrew]

* building:

- on Linux, prefer system's xfrm.h [Andrew, Antony, Vukasink, #2431 #2396 #2501]

Note: old Linux distros may need USE_XFRM_HEADER_COPY=true

- fix RPM package file/directory ownership [Joseph Marreo Corchado, Tuomo, #2167]

- fix seccomp rules to work with Bash 5.3 [Maciej S. Szmigiero, #2371]

- remove HAVE_BROKEN_POPEN=true needed by Angstrom linux [Andrew, #2588]

Angstrom's last release was 2017 or 8 years ago

* testing:

- Alpine test domain upgraded to 3.22.2 [Andrew]

- Debian test domain upgraded to 12.12 [Andrew]

- Fedora test domain upgraded to f43 [Andrew]

- FreeBSD test domain upgraded to 14.3 [Andrew, Ueno #2341]

- OpenBSD test domain upgraded to 7.8 [Andrew]

v5.3 (July 3, 2025)

* PKIX (Public Key Infrastructure X.509)

- moved cURL and LDAP CRL download code out of pluto [Andrew]

- replaced CRL thread with libevent [Andrew]

- fixed `ipsec checkcrls` [Andrew]

- when configured, use cURL to download LDAP CRLs [Andrew]

- verify using NSS's IPsec profile aka certificateUsageIPsec [Andrew]

- only verify using certificateUsageSSL{Client,Server} when USE_NSS_TLS_SECURITY_PROFILE [Andrew]

* IKEv2:

- fix PEXPECT when deleting crossed IKE SA [Andrew, Ilya Maximets #2101, Ondrej Moris #2123]

* IKEv1:

- fix CISCO's split support (requires cisco-split=yes) [Andrew, Amirreza #2230 Erikas #633]

- share-lease=yes|no (default yes) to share XAUTH/ModeCfg lease IP on multiple connections [Paul]

* initsystem:

- remove unused _stackmanager [Tuomo #2080]

- on BSD, default to syslog(LOG_NOTICE) and not pluto.log [Andrew #2295 #2298]

* config:

- merge `addconn` (`ipsec.conf`) and `whack` connection option parsers [Andrew]

- change `whack` to use same connection defaults as `ipsec.conf` [Andrew]

- support `ipsec addconn --name connname left=1.2.3.4 right=5.6.7.8` (experimental) [Andrew #2138]

- drop undocumented `ipsec readwriteconf --rootdir` option [Andrew, #2152]

- obsoleted virtual_private= and plutostderrlog= keywords [Tuomo]

- warn when END-option= has no END [Andrew #663]

- nflog= made an alias to nflog-group= [Andrew]

- recognize ah=... as phase2=ah phase2alg=... [Andrew #712]

* ipsec pluto:

- make `ipsec.conf`'s `config setup` and pluto options consistent [Andrew]

- fix `--config file1 --config file2` [Andrew]

* ipsec connectionstatus:

- support `ipsec connectionstatus '"labeled"[1][2]'` [Andrew #1308]

* testing:

- eliminated all pyOpenSSL dependencies [Andrew]

- review PKIX test coverage [Andrew]

- upgrade Fedora test domain to f42

* building:

- build with curl 8.14.1 [Andrew, Vincent #2319]

v5.2 (Feb 26, 2025)

* IKEv2:

- add PPK in INTERMEDIATE exchange, draft-ietf-ipsecme-ikev2-qr-alt-04 [Vukasin]

- add initial support for RFC 5723 IKE_SESSION_RESUME [Nupur Agrawal, Andrew]

- fix crash in <<ipsec rereadsecrets>> [Andrew, Ilya Maximets #1894]

- fix bogus ERROR when deleting connection [Andrew, Ilya Maximets #1914]

* IPsec Interface:

- add support on FreeBSD, NetBSD and OpenBSD [Andrew]

- add ipsec-interface-managed=no for namespaces [Andrew]

* IKEv1:

- removed compile-time SOFTREMOTE_CLIENT_WORKAROUND [Andrew]

- fix INVALID_ID_INFORMATION response using corrupt IV [Andrew #1830]

- fix reconnect with addresspool after restart [Andrew #1790]

- fix padding of modecfg payloads [Andrew wmasilva #2023]

- update ikepad= to allow {yes,no,auto} [Andrew]

* Linux:

- packet offload counters supported in 6.7+ [Paul]

- Add IPTFS support (RFC 9347) [Paul / Antony / Andrew]

- 6.10+ need replay-window 0 on OUTBOUND SA [Paul]

- Do not set nopmtudisc on inbound SA [Paul]

- Set DSCP options only on the relevant direction SA [Paul]

* updown:

- Use half-routes for IPv6 to cover whole address space #1994 [Tuomo]

- Use sourceip= for all remote subnets when set [Tuomo]

* whack/addconn:

- fix "duplicated flag ctlsocket" regression in 5.0 #1840 [Andrew, Ilya Maximets #1840]

- orders of magnitude speedup of 'ipsec add' w/ protoports= [Ilya Maximets #1987]

* building:

- fix build with USE_LIBCURL=false [Hans de Graaff #1845, Andrew]

- fix build on OpenBSD 7.6 [Andrew]

- fix build with GCC 15 / C 23 [Daiki Ueno]

- fix init script on Alpine [Andrew #2042]

* testing:

- update OpenBSD: 7.6; NetBSD: 10.1; FreeBSD: 14.2; Alpine: 3.21 [Andrew]

- eliminate pyOpenSSL dependency when generating CRLs and PKCS12 files [Andrew #1990 #1996]

v5.1 (Oct 8, 2024)

* IKEv2:

- fix race when initiator-responder cross rekey requests [Andrew]

- don't ignore Delete IKE SA request while waiting for Delete IKE SA response [Andrew]

- log arrival of first IKE_AUTH request that triggers DH [Andrew]

- rate limit logging of packets with invalid payloads

* IKEv1:

- fix Quick mode installing 0.0.0.0/0 when no MSG_CONFIG exchange [Andrew, Tuomo]

- fix iOS Quick mode request needing to re-recover lease [Andrew, Tuomo]

- fix regression where deleting ISAKMP deleted IPsec [Andrew, Tuomo]

- add config options of ah=sha2{256,512} [Andrew]

- add DH29,DH31 to default proposals [Andrew]

- reject ESP AEAD combined with non-NULL integrity [Andrew]

* Crypto:

- update IKE to use NSS's FIPS compliant PK11_AEADOp() [Andrew, Robert Relyea]

- support ESP with CHACHA20POLY1305 on FreeBSD and OpenBSD [Andrew]

* IPsec Interface:

- fix check for an existing IPsec Interface address (Linux) [Wolfgang]

- add IPsec Interface address when connection establishes [Wolfgang]

- fix adding IPv6 address to IPsec interface [Wolfgang]

- delete Ipsec Interface address when connection unroutes [Wolfgang]

- fix setting metric on IPsec Interface [Wolfgang]

- add IPsec Interface device when connection orients [Andrew]

- support existing IPsec interface on FreeBSD and OpenBSD [Andrew]

- log addition of IPsec Interface or Address [Andrew]

- don't delete existing ipsec1 interface (Linux) [Andrew]

- handle repeated connection adds [Wolfgang]

* Linux:

- handle NLMSG_DONE at end of response for > 6.9.0 kernels [Andrew]

- fix hang because of unhandled NLMSG_DONE at end of response (6.9.0-rc1) [Andrew, Ilya, github/1675]

- fix hang when initiating an on-demand TCP connection [Daiki, github/1156]

* updown:

- restore 4.x behaviour of running "updown unroute|down" when initiate fails [Wolfgang, Andrew]

- add test demonstrating redundant tunnels [Wolfgang]

- add plutodebug=updown for debugging updown scripts [Andrew]

* config:

- verbosely ignore x-* style comments in ipsec.conf [Andrew, github/1725]

* whack:

- ignore older whack as could trigger core dump [Andrew, github/1709]

- add --narrowing {yes,no}, retain undocumented --allow-narrowing [Andrew]

* building:

- replace calloc(size,nr) with alloc_things(), fixing compile error [Daiki]

- remove USE_NSS_AVA_COPY and copy of nss source, remove license exception [Tuomo]

- fix syntax error in ckaid.c allowed by GCC [yuncang123]

v5.0 (Apr 24, 2024)

* IKEv1:

- globally disabled by default (ikev1-policy=drop); see RFC9395 [Daniel]

- limit default cryptosuite [Andrew, Paul, Tuomo]

IKE={AES_CBC,3DES_CBC}-{HMAC_SHA2_256,HMAC_SHA2_512HMAC_SHA1}-{MODP2048,MODP1536,DH19,DH31}

ESP={AES_CBC,3DES_CBC}-{HMAC_SHA1_96,HMAC_SHA2_512_256,HMAC_SHA2_256_128}-{AES_GCM_16_128,AES_GCM_16_256}

AH=HMAC_SHA1_96+HMAC_SHA2_512_256+HMAC_SHA2_256_128

- remove support for Labeled IPsec [Andrew]

- properly ignore dpdaction= [Andrew]

- see also IKEv2 routing/revival changes

* IKEv2:

- warn that fragmentation=force is ignored [Andrew]

- avoid post-authentication crash on corrupt TS payload [Andrew]

- support addresspool=v4/mask,v6/mask [Andrew]

- support subnet=SELECTOR,... using a single Child SA [Andrew]

- when non-MOBIKE never update NATed endpoint [#1492/Wofferl/Andrew]

- fix revival of IKE_AUTH (first) Child SA [Andrew]

- properly ignore dpdaction=, keyingtries= [Andrew]

- when reviving, install trap then block [Andrew]

- for auto=keep only retry once [Andrew]

- when redirect fails, fall back to revival [Andrew]

* Linux:

- HW packet offload support [Raed Salem <raeds@nvidia.com>,Paul]

- XFRM interface IP management with ref-counting [Brady Johnson]

- fix IPcomp with XFRM interfaces [Wolfgang]

* BSD:

- fix esp=aes_gcm [github/1220, Igor V. Gubenko, Andrew]

* whack:

- review ipsec-whack.8 [Tuomo, Andrew, Paul]

- change defaults to match addconn [Andrew]

- add --{rekey,delete,down}-{ike,child} --name <conn> [Andrew]

- match whack and addconn option names [Andrew]

- drop NNN_ prefix from all output [Andrew]

* config (ipsec.conf, addconn):

- update ipsec.conf.5 [Tuomo, Andrew, Paul]

- log ipsec.conf errors and warnings in Pluto [Andrew]

- <<include {a,b,c}.conf>> no longer supported [Andrew]

- fix keyexchange={ikev1,ikev2}; deprecate ikev2= [Andrew]

- remove nic-offload=auto option, only accept packet,crypto,yes [Paul]

- warn when converting legacy ",," to "\," in {left,right}id= [Andrew]

- change also= to expand inline (more like C's #include) [Andrew]

- fix KEYWORD= sometimes causing Pluto to exit [Andrew]

- parse <<KEYWORD=>> as <<KEYWORD=''>>, i.e., empty [Andrew]

- warn when, within a conn, there are duplicate keys [Andrew]

- add encap-dscp= [Wolfgang]

- implement interface-ip= [Brady]

- implement subnet=SELECTOR,SELECTOR,... [Andrew]

- default ikev1-policy to drop [Daniel]

- add ppk-ids= [Vukasin]

- add experimental per-connection debug= [Andrew]

- drop obsolete forceencaps= [Andrew]

- add groundhog= [Andrew]

- reject non-numeric sourceip=<address> [Andrew]

- fix crash when dpdtimeout= missing [Andrew]

* building:

- remove dependency on libxz via libsystemd [Tuomo Andrew]

- use INSTALL_INITSYSTEM=false to prevent update of /etc/<initsystem> [Andrew]

- use INSTALL_CONFIGS=false prevents update of /etc/ipsec.d et.al. [Andrew]

- drop FINAL* make variables; see mk/config.mk for alternatives [Andrew]

- remove old copy of unbound headers [Andrew]

- use DESTDIR instead of FINAL* env vars [Andrew]

- fix "make git-rpm" [Paul/Tuomo]

- check return values of libcap-ng functions [Paul]

- don't call ischar(signed char) [Andrew]

* packaging:

- fix Debian systemd service install [Antonio Silva]

* testing:

- fix namespace tests for super long dir names [Paul]

- add Alpine, Debian, NetBSD and FreeBSD KVMs [Andrew]

- add Alpine, Debian, NetBSD, FreeBSD and OpenBSD to nightly builds [Andrew]

- add man pages to nightly build [Andrew]

* initsystem:

- use documented ipsec sub-commands [Tuomo]

- stop using _stackmanager [Tuomo]

* documentation:

- update to docbook xml 4.5 [Tuomo]

- re-org pages adding libreswan.5 [Andrew]

* ipsec utilities:

- ipsec auto sub-command: deprecate [Tuomo]

- ipsec auto --{cmd} connection -> ipsec {cmd} connection [Tuomo]

- ipsec look: script moved to contrib/; use ip xfrm et.al. [Andrew]

- ipsec portexcludes: script moved to contrib/ [Andrew]

- ipsec barf: script moved to contrib/ [Andrew]

- ipsec _secretsensor: script moved to contrib/ [Andrew]

- ipsec show: drop ipsec subcommand (old, incomplete) [Paul]

- ipsec verify: drop ipsec subcommand (old, incomplete) [Paul]

v4.15 (April 15, 2024)

* Security: Fixes http://libreswan.org/security/CVE-2024-3652

* Linux: remove dependency on libxz via libsystemd [Tuomo Andrew]

* IKEv1: set default proposals to ESP aes-sha1 and AH sha1 [Andrew]

* IKEv1: reject ESP proposal combining AEAD and non-empty INTEG [Andrew]

* IKEv1: reject exchange when connection has no proposals [Andrew]

* IKEv1: limit default cryptosuite [Andrew, Paul, Tuomo]

IKE={AES_CBC,3DES_CBC}-{HMAC_SHA2_256,HMAC_SHA2_512HMAC_SHA1}-{MODP2048,MODP1536,DH19,DH31}

ESP={AES_CBC,3DES_CBC}-{HMAC_SHA1_96,HMAC_SHA2_512_256,HMAC_SHA2_256_128}-{AES_GCM_16_128,AES_GCM_16_256}

AH=HMAC_SHA1_96+HMAC_SHA2_512_256+HMAC_SHA2_256_128

v4.14 (March 11, 2024)

* Fix compile error in 4.13 in gntoid() [Andrew]

* testing: fixup ikev2-tfc-03 for padded packets [Andrew/Paul]

v4.13 (March 11, 2024)

* Security: Fixes http://libreswan.org/security/CVE-2024-2357

* Linux: make libcap-ng failures non-fatal [Andrew]

* BSD: fix esp=aes_gcm [Andrew]

* NetBSD: fix compiler warning in lib/libswan/x509.c [Andrew]

* x509: unpack IPv6 general names based on length [Andrew]

* pluto: TFC padding was not set for AEAD algorithms [SaiKumarCholleti@github]

v4.12 (Aug 8, 2023)

* SECURITY IKEv2: Fixes https://libreswan.org/security/CVE-2023-38710

* SECURITY IKEv1: Fixes https://libreswan.org/security/CVE-2023-38711

* SECURITY IKEv1: Fixes https://libreswan.org/security/CVE-2023-38712

* pluto: Do not crash on ipcomp expiry msg [Andrew]

v4.11 (May 3, 2023)

* SECURITY IKEv1: Fixes https://libreswan.org/security/CVE-2023-30570

v4.10 (February 28, 2023)

* SECURITY IKEv2: Fixes https://libreswan.org/security/CVE-2023-23009

* IKEv1: only clean up a connection when it isn't deleted [Andrew]

v4.9 (October 13, 2022)

* IKEv1: fix crasher (introduced in 4.8) when USE_NSS_KDF=false or MD5 [Andrew]

* IKEv2: fix RFC 8229 IKE/ESP over IPv6 TCP [Andrew]

v4.8 (October 2, 2022)

* release: remove SHA1 bindings from LIBRESWAN OpenPGP key [dkg/Paul]

* pluto: ignore obsoleted unused interfaces= / --iface [Paul/Andrew]

* pluto: various internal crypto struct changes [Andrew]

* pluto: fix traffic counters for AH and IPCOMP [Andrew]

* pluto: improve logging of duplicate serial cert error [Andrew]

* pluto: support for maxbytes/maxpacket counters [Antony/Paul]

* pluto: handle HW tokens using strange CKAIDs; github/815 [Andrew]

* pluto: added --ipsec-max-bytes / --ipsec-max-packets support [Antony]

* libipsecconf: added ipsec-max-bytes= and ipsec-max-packets= options [Paul]

* IKEv2: emit one CERTREQ payload with all the hashes [Andrew]

* addconn/whack: add support for {left,right}pubkey= [Andrew]

* showhostkey: add support for ECDSA pubkeys [Andrew]

* Crypto: add KDF self tests [Daiki Ueno]

* IPv6: open IPv6 IKE port 4500; github/800 [Andrew]

* showhostkey: add --pem option to print PEM encoded public key [Andrew]

* unbound: _unbound-hook converted from python to shell [Andrew]

* BSD: delete old BSDKAME code replaced by PFKEYV2 code [Andrew]

* BSD: fix replay window byte vs bit math [Andrew]

* BSD: fix code finding interfaces; github/728 [Andrew]

* FreeBSD: support large replay window; github/756 [Andrew]

* FreeBSD: support ESN; github/721 [Andrew]

* linux: update copy of xfrm.h header [Paul]

* packaging: update fedora spec file [Paul/Tuomo]

* building: on BSD, always use GCC; freebsd/264288 llvm/55963 [Andrew]

* building: enable LTO when USE_LTO=true; github/836 github/834 [Andrew]

* building: dropped default build and packaging support for:

Fedora 22, 28, 29, 30

Debian stretch

Ubuntu cosmic, xenial

RHEL6 was removed in v4.5

Add SUSE, Arch, Mint

v4.7 (May 24, 2022)

* IKEv2: EAPTLS support [Timo Teräs / Andrew]

* IKEv2: EAPONLY support [Andrew]

* IKEv2: fix interop when IPCOMP+transport-mode [Andrew]

* IKEv2: fix race between new IKE SA and liveness [Andrew]

* IKEv2: fix interop with Android 12 + certificates [Andrew]

* IKEv1: reject IKEv2 only authby=secret+rsasig [Andrew]

* kernel: fix double delete of kernel policy when tearing down SA [Andrew]

* kernel: fix deleting policy when an XFRMi FD ID; github/618 [Andrew]

* kernel: general cleanups [Andrew]

* _stackmanager / pluto: support Ubuntu 18.04 LTS kernels [Paul]

* FreeBSD: libreswan builds out-of-the-box [Andrew]

* BSD: Add IPv6 support (tested on NetBSD)

* building: fix build on fedora rawhide [Paul]

* internals: initiate IKEv2 CREATE_CHILD_SA exchange using IKE SA [Andrew]

* internals: _updown.bsdkame renamed to _updown.bsd

v4.6 (January 11, 2022)

* SECURITY: Fixes CVE-2022-23094 https://libreswan.org/security/CVE-2022-23094

* IKEv2: aggressively check incoming fragments [Andrew]

* IKEv2: when rekeying and PFS, only propose/allow original crypt-suite [Andrew]

* IKEv2: when PFS, don't repeatedly log all proposals [Andrew]

* IKEv2: Labeled IPsec improvements [Andrew]

* IKEv1: support for ISAKMP_N_CISCO_LOAD_BALANCE removed [Andrew]

* pluto: Revamp the host connection lookup mechanism [Andrew]

* pluto: Change default replay-window from 32 to 128 [Paul]

* pluto: Change default esn= to "either" and prefer "yes" [Paul]

* pluto: Disable esn when replay-window=0 [Paul]

* pluto: Drop obsolete debug options such as crypto-low [Andrew]

* seccomp: Updated syscall allow-list [Paul]

* packaging: replace old SUSE packaging with pointer to downstream [Andrew]

* NetBSD: Don't use ESN - not supported by kernel [Andrew]

* letsencrypt: Fix bashisms in letsencrypt script [dkg]

* libipsecconf: allow leftauth=ecdsa|rsa (match authby= values) [Paul]

* testing: significantly improved testing [Andrew, Paul]

v4.5 (August 20, 2021)

* IKEv1: multiple subnets could lead to crossed wires, failures [Paul/Andrew]

* IKEv2: don't tear down IKE SA on TS_UNACCEPTABLE [Paul]

* IKEv2: unpend/delete Child SA when rejected by IKE_AUTH response [Andrew]

* IKEv2: mobike: resolve_defaultroute_one() updates [Andrew]

* IKEv2: mobike: prevent sending duplicate mobike response [Andrew]

* IKEv2: Support for Childless IKE SA [Andrew]

* IKEv2: redirect: make peer redirecting in IKE_AUTH childless [Vukasin]

* IKEv2: Labeled IPsec --up causes Childless IKE SA [Andrew/Paul]

* IKEv2: Labeled IPsec conns share SPD policies (as IKEv1) [Andrew/Paul/Kavinda]

* IKEv2: Performance; eliminate more O(#CONNECTIONS) code [Andrew]

* IKEv2: Immediately delete replaced Child from new (IC) IKE SA [Andrew/Paul]

* pluto: mismatched subnets= could take down all conns [Paul]

* pluto: Don't delete existing IKE SA of connection instance [Paul]

* pluto: fail better on parse errors in subnet= clause [Paul]

* libswan: use getaddrinfo(3) instead of gethostbyname2(3) [Hugh]

* libipsecconf: fail to load conn if no right= or left= set [Paul]

* libipsecconf: change default of initial-contact= to yes [Paul]

* X509: directly append new CRL requests to the fetch queue [Andrew]

* whack: implement --impair trigger:<global-event> [Andrew]

* ipsec.service: remove reload which did not work as expected [Tuomo]

* portexcludes: update to use python3 [Kim]

* building: fix NetBSD build [Andrew]

* building: fix arm / aarch64 build [kekePower@github]

* building: Remove support for RHEL6 USE_OLD_SELINUX [Paul]

* packaging: handle properly rpm sysctl config [Tuomo]

* packaging: rhel7: fix python2 shebang [Tuomo]

v4.4 (April 22, 2021)

* IKEv2: Fixes for TCP encap in Transport Mode and host-to-host [Paul/Sabrina]

* IKEv2: Fixes to Labeled IPsec policies [Kavinda Wewegama/Paul]

* IKEv2: Add redirect statistics to whack --globalstatus [Clive Zagno]

* IKEv2: Connections would not always switch when needed [Andrew/Paul]

* pluto: Fix for host-to-host connections use non-standard IKE ports [Paul]

* pluto: Use peer ID (IKEv2 IDr, IKEv1 Aggr) to select best initial conn [Paul]

* pluto: Disable interface-ip= as the feature is not yet implemented [Paul]

* pluto: Fix PLUTO_PEER_CLIENT* in updown for NAT + Transport Mode [Paul]

* pluto: Remove never updated PLUTO_VERSION for updown scripts [Paul]

* pluto: Actually set PLUTO_CONNECTION_TYPE= to transport or tunnel [Paul]

* pluto: Allow non-templated wildcard ID connections to match [Paul]

* pluto: Reduce and merge various logging messages [Andrew]

* libipsecconf: Do not allow vhost/vnet in IKEv2 connections [Paul]

* XFRM: Restarting pluto when using ipsec-interface= could fail [Paul]

* contrib/munin: Update plugin to use python3 and update doc header [Tuomo]

* testing: Enable OpenBSD interop tests [Paul/Ravi]

* testing: Make tests more reliable on KVM [Andrew]

v4.3 (February 21, 2021)

* pluto: Restore range checking on Labeled IPsec [Paul/Andrew]

* pluto: Higher state serialno does not imply newest state [Paul]

* pluto: Cleanup ip_address vs ip_endpoint (protoport dropping) [Andrew]

* pluto: Revival of code could accidentally fallback to IKEv1 [Andrew]

* newhostkey: Add support for generating ECDSA keys [Daiki Ueno]

* libipsecconf: Ignore empty option at end of config (rhbz#1685653) [Andrew]

* whack: Add --global-redirect and --global-redirect-to options [Pietro Monteiro]

v4.2 (February 2, 2021)

* IKEv2: Support for IKEv2 Labeled IPsec [Hugh, Sahana, Paul, Kavinda Wewegama]

* IKEv2: MOBIKE could cause assertion failure due to eroute ownership [Paul]

* IKEv2: MOBIKE and NAT port update code interfered with each other [Andrew]

* IKEv1: Re-enable questionable Microsoft proposals to fix L2TP/IPsec [Paul]

* IKEv1: Do not load IKEv1 conns when IKEv1 support not compiled in [Paul]

* IKEv1: Fix XAUTH: re-transmit when sending CFG request [Andrew]

* pluto: New config setup option ikev1-policy=<accept|drop|reject> [Paul]

* pluto: Change default ikelifetime from 1h to 8h [Paul]

* pluto: Add ignore-peer-dns=yes|no and whack --ignore-peer-dns [Paul]

* pluto: Startup could take long time closing fd's (github#373) [Andrew]

* pluto: IKEv2 connection could accidentally retry as IKEv1 [Andrew]

* pluto: change default IKE SA lifetime from 1h to 8h [Paul]

Resolves: github#362, github#405, hwdsl2/setup-ipsec-vpn#912

* pluto: Revived conns can try to quickly re-use existing NAT mapping.

Can be used with new auto=keep [Paul, Andrew]

* pluto: Don't complain about DNS names starting with number [Paul]

* pluto: Re-implement Labeled IPsec for IKEv1 [Paul, Sahana]

* pluto: Support for --shutdown --leave-state [Paul]

* whack: add very raw --processstatus [Andrew]

* whack: no longer require --ipv6 when specifying raw IPv6 host addresses

* libswan: Re-introduce xauthusername/remote_peer_type for NM-libreswan [Paul]

* initsystem: fix docker/podman startup with sysvinit [Paul]

* initsystem: ensure non-testing namespaces work with systemd [Paul]

* initsystem: systemd support for ipsec whack --shutdown --leave-state [Paul]

* pluto: prefer IPv4 over IPv6 when performing DNS lookups [Andrew]

* building: Support for compiling without IKEv1 via USE_IKEv1=false [Paul]

* building: Various clang compiler related fixes [Timm Baeder]

* building: fix NetBSD arm64 build [Andrew]

* testing: many updates [Andrew, Paul]

v4.1 (October 18, 2020)

* IKEv2: Fix Notify protocol ID interop with Cisco introduced in 4.0 [Antony]

* addconn: Fix resolving with %defaultroute plus peer with A + AAAA [Antony]

* building: minor cleanups [Andrew/Tuomo]

v4.0 (October 14, 2020)

* KLIPS: Support for KLIPS completely removed [Paul]

* pluto: Removed support for deprecated algos: serpent, twofish, cast [Paul]

* IKEv2: EXPERIMENTAL: Support for RFC 8229 IKE/ESP over TCP [Andrew/Mayank Totale]

New per-conn keywords: listen-tcp=yes|no, tcponly=yes|no, tcp-remoteport=

Requires: Linux kernel >= 5.8

* IKEv2: Support for leftikeport= / rightikeport= [Andrew/Paul]

* IKEv2: EXPERIMENTAL: Support for INTERMEDIATE Exchange [Yulia Kuzovkova/GSoC]

New keyword: intermediate=yes

* FIPS: Remove DH 23/24 from FIPS allowed list as per SP 800 56A Rev 3 [Paul]

* pluto: Support for rereading configured certificates from NSS [Myungjin Lee]

* pluto: plutodebug= keywords are now: base,cpu-usage,crypt,tmi,private [Andrew]

* pluto: find_pluto_xfrmi_interface() would only check first interface [Paul]

* pluto: ddos cookies-threshold and max-halfopen output was swapped [John Mah]

* pluto: Fix leased IP address leak [Andrew/Paul]

* pluto: Fix displaying PLUTO_BYTES_ counters [Paul]

* pluto: Replace/remove deprecated libselinux functions [Eduardo Barretto]

* pluto: Update selinux calls for Labeled IPsec support [Richard Haines]

* pluto: Memory leak fixes [Hugh]

* pluto: Remove unused per peer logging [Andrew]

* pluto: Cleanup logging code for minimal logging support [Andrew]

* pluto: Cleanup netlink / XFRM code [Hugh]

* pluto: xfrmi used mark-out for XFRMA_SET_MARK [Antony/Wolfgang]

* pluto: Support for ipsec0 interface to help migrate from KLIPS to XFRM [Paul]

* pluto: Fix logging some IKE messages to proper IKE SA state [Andrew]

* pluto: Remove global ikeport/nat-ikeport, add listen-udp/listen-tcp [Paul]

* pluto: Connections now have serial numbers which are logged [Paul/Andrew]

* pluto: No longer require :RSA sections in ipsec.secrets [Andrew]

* pluto: pluto chooses wrong raw RSA key (github#352) [Andrew]

* seccomp: Update syscall allowlist for pluto and addconn [Paul]

* whack: Support for ipsec whack --rereadcerts [Paul]

* whack: Rename --ikev1-allow and --ikev2-allow to --ikev1 and --ikev2 [Paul]

* whack: Clear inherited defaults for IKEv2 from IKEv1 connections [Paul]

* show: Fixup for python3 version of ipaddress module [Paul]

* IKEv2: Fix Windows 10 rekey being rejected [Antony/Paul]

* IKEv2: Remove duplicaes from proposals using "+" [Andrew]

* IKEv2: CERTREQ payload was not sent for authby=ecdsa [Paul]

* IKEv2: Decode notify payloads into the message digest [Andrew]

* IKEv2: Don't use NAT-T port when no NAT DETECTION payloads received [Andrew]

* IKEv2: Add load-balance support (multiple targets) to redirect [Vukasin]

* IKEv2: Only sent REDIRECTs to established IKE SA's (not IPsec SAs) [Paul]

* IKEv2: Fix AUTH failure if ID payload reserved fields != 0 [Paul/Andrew/Hugh]

* IKEv2: A delete(IKE SA) request should not trigger a delete request [Andrew]

* IKEv2: Ignore, not abort when receiving unknown type transforms [Andrew]

* IKEv2: Don't switch NAT port on receiving non-NAT notify payloads [Andrew]

* IKEv1: Prevent crashing in Quick Mode on unused NAT payload [Daniel Wendler]

* libipsecconf: Fix config handling of policy-label [bauen1]

* libipsecconf: Promote ah= / esp= as desired keywords over phase2alg= [Paul]

* libipsecconf: Remove most obsoleted option names with undersscore(_) [Paul]

* rsasigkey/newhostkey: Remove obsoleted --output option [Paul]

* building: Add NetBSD support [Andrew]

* building: Remove support for SINGLE_CONF_DIR, EMIT_ISAKMP_SPI, [Paul]

USE_KEYRR and TEST_INDECENT_PROPOSAL

* building: Merge userland.mk into config.mk to simplify makefiles [Tuomo]

* building: Deprecate INC_ variables [Tuomo]

* building: Remove all support for SERPENT, TWOFISH, CAST and RIPEMD [Paul]

* building: Remove -DALLOW_MICROSOFT_BAD_PROPOSAL [Tuomo]

* building: The define USE_NSS_PRF was renamed to USE_NSS_KDF [Tuomo]

* building: Rename master branch to main branch [Paul]

* building: Fix finding ipsec command in non-standard bin dirs [Tuomo]

* building: Introduce USE_OLD_SELINUX to support libselinux < 2.1.9 [Paul]

* building: NETKEY options changed to XFRM options [Paul]

* building: NSS database (*.db) are now expected in /var/lib/ipsec/nss [Tuomo]

ipsec checknss called in initsystem will migrate files

Use FINALNSSDIR=/etc/ipsec.d to use the pre-4.0 location

* packaging: Debian: remove runtime dependency on systemd [Stephen Kitt]

* packaging: Fedora: add missing build dependency for certutil [Stephen Kitt]

* packaging: Debian switched to using /usr/libexec/ [dkg]

* testing: Support Fedora32, Ubuntu, improved namespaces support [Paul/Others]

* testing: Work around kernel ICMP Acquire bug [Paul]

* testing: Added interop testing with OpenBSD iked [Ravi Teja]

* documentation: friendler ipsec cmd output [Paul]

v3.32 (May 11, 2020)

* SECURITY: Fixes CVE-2020-1763 https://libreswan.org/security/CVE-2020-1763

* IKEv2: Support non-narrowed child rekey for narrowing (regression in 3.31)

* FIPS: ECDSA keys were mistakenly rejected as "too weak" [Paul]

* FIPS: Minimum RSA key size is 2048, not 3072 [Paul]

* FIPS: Use NSS to check FIPS mode instead of manually checking fips=1 [Paul]

* IKEv2: Do not use fragments if not appropriate (regression from v3.30) [Paul]

* IKEv1: Add NSS KDF support for the Quick Mode KDF [Andrew/Paul]

* libipsecconf: support old-style ",," to mean "\," in specifying id [Paul]

* libipsecconf: left/rightinterface-ip= are not kt_obsolete [Paul]

* whack: Add missing ecdsa/sha2 and compat rsa policy options to whack [Paul]

* Fix left=%iface syntax due to string length miscalculation [Antony]

* X509: don't try to match up ID on SAN when ID type is ID_DER_ASN1_DN [Paul]

* packaging: debian fixes [Tuomo]

* building: USE_NSS_KDF=true now uses NSS for all KDF functions

Using this option, libreswan no longer needs FIPS certification

v3.31 (March 3, 2020)

* IKEv2: Opportunistic conns specifying keyingtries=0 are changed to 1 [Paul]

* IKEv2: Fix ikev2 rekey failures due to bad Traffic Selector proposa [Antony]

* IKEv2: Verify (not ignore) expected TSi/TSr payloads for IPsec rekeys [Paul]

* IKEv1: Support for XFRMi interfaces [Paul]

* X509: When IDr payload is type ID_DER_ASN1_DN, don't check for SAN [Paul]

* pluto: Disable log_to_audit if kernel does not support audit [Paul]

* pluto: Increase max IKEv2 fragments to 32 to support Windows [John Mah]

* addconn: Do not assert on ipsec-interface=no [Paul]

* nat_traversal: Fix not to send nat-t keepalives when there is no nat [Tuomo]

* KLIPS: Fix _updown.klips (regression introduced in 3.30) [Wolfgang]

v3.30 (February 13, 2020)

* WARNING: This is the last release that supports the KLIPS stack,

use the new ipsec-interface= virtual interfaces instead.

* XFRM: Fix detection on kernels without xfrm_stat (debian et all) [Paul]

* XFRM: XFRMi interface support using ipsec-interface= and iface-ip= [Antony]

* IKEv2: Message ID handling: remove a O(#STATES) lookup [Andrew]

* IKEv2: OE previous half-open state overwrites IPsec policy [Paul/Stepan]

* IKEv2: On initiator, do not retransmit on IKE_AUTH processing failure [Paul]

* IKEv2: Prevent leak in ikev2_send_certreq() on sending error [Paul]

* IKEv2: Remove SHA1 from default proposal list [Paul]

* IKEv2: On PPK failure with insist, return AUTHENTICATION_FAILED [Vukasin]

* IKEv2: Do not try to delete (replaced) bare shunts [Paul]

* IKEv2: Delete pending outgoing bare shunts if incoming IPsec happened [Paul]

* IKEv2: Allow CP payload in CREATE_CHILD_SA (RFC 7296 Appendix C.4) [Paul]

* IKEv2: calculate_sa_prio() now allows OE shunt to override priority [Paul]

* IKEv2: calculate_sa_prio() support for /32 template vs instance [Hugh/Paul]

* IKEv2: IPv6 support for addresspool= option [Antony]

* IKEv2: Updated support for MOBIKE triggered events [Antony]

* IKEv2: Support reconnecting authnull clients [Paul]

* IKEv2: New whack commands --rekey-ike and --rekey-ipsec [Antony]

* IKEv2: Prefer RFC 7427 Digital Signatures for default authby=rsasig [Sahana]

* IKEv2: Refuse SHA1 for RFC 7427 Digital Signatures as per RFC 8247 [Sahana]

* IKEv2: Use IKEv2 fragment size values (not IKEv1) [Andrew]

* IKEv2: On initiator, do not retransmit on IKE_AUTH processing failure [Paul]

* IKEv1: Re-implement CVE-2019-10155 fix to prevent future occurrences [Andrew]

* IKEv1: do not assert on bad virtual private entry [Paul]

* pluto: Simplify plutodebug= options to: base, cpu-usage, crypt, private and tmi

(maps old values to new ones for compatibility) [Andrew]

* pluto: non-default ipsec.conf did not load auto=add connections [Paul]

* pluto: fix %defaultroute for link-local and non-link-local gateway [Antony]

* pluto: Improve whackfd handling (prevent console hangs/omissions) [Andrew]

* pluto: Support to disable SAN checks (require-id-on-certificate=no) [Paul]

* pluto: Audit log IKE SA and IPsec SA failures for Common Criteria (CC) [Paul]

* pluto: Disable support for DH2/modp1024 at compile time [Paul]

* pluto: Add audit-log=yes|no (default yes) [Paul]

* pluto: DDNS event should not cause connection initialization [Paul]

* pluto: Various O(STATE) optimializations [Andrew]

* pluto: Fixup reporting of esp-hw-offload capabilities in kernel/nic [Paul]

* pluto: Add chacha20_poly1305 and curve25519 to default proposals [Paul]

* pluto: Updated SECCOMP syscall whitelist [Paul]

* pluto: With non-default config file, connections loading was skipped [Paul]

* pluto: Fix Opportunistic Encryption with Transport Mode policies [Paul]

* pluto: Fix various memory leaks in IKE and X.509 code [Andrew]

* pluto: netlink: increase the additional bufferspace to 32KiB [Antony]

* pluto: pluto --selftest no longer logs to stderr with timestamps [Paul]

* pluto: fix for redirect-to type when it is FQDN [John Mah]

* pluto: addresspool: give new lease to different (xauth)usernames [Paul]

* pluto: addresspool: reduce complexity from O(#LEASES) to O(1) [Andrew]

* whack: Remove obsoleted --whackrecord and --whackstoprecord options [Andrew]

* whack: Added whack --ddns to trigger DNS refresh event manually [Paul]

* X509: Offload most code to helpers for significant performance boost [Andrew]

* X509: Simplify code, cut redundant calculations, speed improvements [Andrew]

* X509: SAN checks should confirm IKE peer ID on responder too [Paul]

* letsencrypt: new command "ipsec letsencrypt" [Rishabh]

* _updown.netkey: PLUTO_VIRT_INTERFACE replaces PLUTO_INTERFACE [Antony]

* _updown.netkey: add IPv6 routing support [Tuomo]

* _updown.netkey: don't remove old resolv.conf, just update it [Tuomo]

* _updown.netkey: fix for iproute2 >= 5.1 which no longer ignores /mask [Paul]

* libswan: Don't leak ECDSA pubkey on form_ckaid_ecdsa() failure [Paul]

* libswan: Close netlink socket on send error in netlink_query() [Paul]

* libipsecconf: don't throw error for not finding a wildcarded include [Paul]

* verify: improve support for python2 and python3 [Anand Bibhuti/Paul]

* KLIPS: Support for kernels >= 4.20 with SYNC_SKCIPHER_REQUEST_ON_STACK [Paul]

* KLIPS: Userland tools compile fixes [Hugh/Paul]

* building: No longer build with DH2(modp1024) support (see RFC 8247) [Paul]

* building: Add config for PYTHON_BINARY, default being /usr/bin/python3 [Tuomo]

* building: Add new USE_NSS_PRF, to use KDF from NSS [Robert Relyea/Andrew]

* building: Add USE_PRF_AES_XCBC, replaces USE_XCBC [Paul]

* building: Fixes for NetBSD build [Andrew]

* building: Fixes for gcc10 [Paul]

* packaging: fedora30 requires gcc to be listed as BuildRequires: [Paul]

* packaging: Add Debian stretch specific configs and more cleanup [Antony]

* packaging: make deb jessie and xenial config detection [Antony]

* packaging: update python she-bang handling [Tuomo]

* testing: Added a new namespaces based testrun method [Antony]

* testing: setup: namespace based ipsec stop needs ip xfrm flush state [Paul]

* testing: setup: namespace based ipsec skips initsystem [Paul]

v3.29 (June 10, 2019)

* SECURITY: Fixes CVE-2019-10155 https://libreswan.org/security/CVE-2019-10155

* programs: Change to /proc/sys/net/core/xfrm_acq_expires to detect XFRM [Paul]

* barf: Fix shell script parse error and small cleanup [Tuomo/Hugh]

* packaging: fedora30 requires gcc to be listed as BuildRequires: [Paul]

* packaging: rhel6 doesn't need USE_AVA_COPY=true or WERROR_CFLAGS= [Tuomo]

* packaging/rhel6: remove -lrt, not needed any more [Tuomo]

* systemd: change Restart default to on-failure [Tuomo]

* building: Makefiles: Use RT_LDFLAGS for glibc < 2.17 support [Tuomo]

* building: userland-cflags.mk: add RT_LDFLAGS= for older glibc [Tuomo]

v3.28 (May 20, 2019)

* SECURITY: Fixes CVE-2019-12312 https://libreswan.org/security/CVE-2019-12312

* KLIPS: Disable KLIPS userland support per default [Paul]

WARNING: Support for KLIPS will be removed in 2019

* MAST: Removed support for MAST variant of KLIPS stack [Paul]

* IKE: Change default connection from IKEv1 to IKEv2 [Paul]

* IKEv2: Don't try to encrypt notify response without SKEYSEED [Andrew/Paul/Hugh]

* IKEv2: ikev2= keyword changed to only accept "yes" or "no" [Paul]

* IKEv2: Support for REDIRECT (RFC 5685) [Vukasin Karadzic/GSoC]

(new keywords redirect-to, accept-redirect, global-redirect=

global-redirect-to and new ipsec whack --redirect command

* IKEv2: Initialize daily secret used for DCOOKIES [Paul/Andrew]

* IKEv2: Extend narrowing code to support protoports [Andrew/Paul]

* IKEv2: Fix bug that prevented AH from rekeying [Andrew]

* IKEv2: IKE SA rekey could lead to losing track of Child SA [Andrew/Antony]

* IKEv2: A spurious DH calculation was performed and discarded [Andrew]

* IKEv2: Support for IPCOMP (compress=yes) [Paul]

* IKEv2: Initialize NAT keepalives check on IKE SA establishment [Paul]

* IKEv2: Only sent NAT keepalives for IKE states (suppresses IPsec dups) [Paul]

* IKEv2: Timeout in receiving IKE_AUTH reply would abort connection [Paul]

* IKEv2: Add ECP384, ECP521 and CURVE25519 to default IKEv2 proposal [Paul]

* IKEv2: Remove SHA1 from default IKEv2 proposal [Paul]

* IKEv2: Delete on auto=start conn would not restart (introduced in 3.23) [Paul]

* IKEv2: Compact proposals to prevent fragmentation of IKE_INIT [Andrew]

* IKEv2: Fix opportunistic group policy on /32 groupinstances on delete [Paul]

* IKEv2: Fix opportunistic /32 on non-defaultroute interface [Paul]

* IKEv2: Do not send two requests for IKEv2_INTERNAL_IP4_ADDRESS [Paul]

* IKEv2: Show payload structure of received packet in RFC notation [Andrew]

* IKEv2: Release whack when peer ID is wrong [Paul]

* IKEv2: Hardened PPK code and fixed memory leaks [Hugh]

* IKEv2: Use less resources under DDoS attack to send/process COOKIES [Andrew]

* IKEv2: Delete partial Child SA states that can never establish [Paul]

* IKEv2: Remove SHA1 from default proposals [Paul]

* IKEv2: Add ECP groups and Curve25519 to default proposal [Paul]

* IKEv2: Fix AH rekeying (handle not having encrypter [Paul]

* IKEv2: NAT-T keepalives did not start if only IKEv2 conns were in use [Paul]

* IKEv2: Drop IKE_SA_INIT requests with non-zero SPIr [Andrew]

* IKEv2: On rekey, sometimes a CHILD SA was lost (wrong hash slot) [Andrew]

* IKEv1: Don't leave a dangling pointer after IKE SA delete [Paul/Hugh]

* IKEv1: Only sent NAT keepalives for IPsec states (suppresses 1 dup) [Paul]

* IKEv1: Do not activate DPD when peer does not support it [Paul]

* IKEv1: Reject key sizes <= 0 properly instead of crashing [Paul]

* IKEv1: Fix Aggressive Mode interop with Volans Technology [wuwei29]

* IKEv1: Remove bogus "duplicate Delete" check causing Windows 1m outage [Paul]

* IKEv1: If whack socket not there for passwd input, return STF_FATAL [Paul]

* IKEv1: Remove Win98 workaround ignoring IPsec SA deletes in first 60s [Paul]

* X509: Do not keep received CERTs beyond the connection lifetime [Andrew]

* X509: Support for NSS IPsec profiles mbz#1252891 [Kai Engbert/Paul]

* X509: Don't fail validation on critical flag in Key Usage payloads [Paul]

* X509: Fix ocsp-method=get|post to actually skip get when asked) [Stepan Broz]

* X509: Fix various leaks [Hugh, Andrew]

* X509: Cache contents read from NSS database for performance [Andrew]

* pluto: Re-initialize (w backoff) conns that should remain "up" [Paul/Hugh]

* pluto: Use any sent IKE message to reset the DPD/liveness counter [Paul]

* pluto: Add timing information to packet processing [Andrew]

* pluto: Significant performance improvements for conns and certs [Andrew]

* pluto: Simplify state lookups and SPI passing [Andrew]

* pluto: Speed up state lookups by only looking at proper hash chain [Andrew]

* pluto: metric= value should accept values > 255 [Tuomo]

* pluto: New "cpu-usage" plutodebug option displaying timing info [Andrew/Paul]

* pluto: Refuse to load connections with TFC and AH or Transport Mode [Paul]

* pluto: Fix memory leak in CERTREQ sending [Hugh]

* pluto: Revive (with back-off) auto=start conns that receive Delete/Notify [Paul]

* pluto: Show all activated impairments in ipsec status [Andrew]

* pluto: Do not load a connection if its certificate has a problem [Andrew]

* pluto: Handle case when external use deletes certificate from NSS [Andrew]

* pluto: Fix resource leaks [Andrew/Hugh]

* pluto: Improve and extend pluto statistics [Paul]

* pluto: Deleting a connection should bring it down first to run _updown [Paul]

* pluto: Revive auto=start conns that receive Delete/Notify [Paul/Hugh/Andrew]

* pluto: Refuse to load connections with unsupported type=transport [Paul]

* pluto: Refuse to load connections with TFC and AH or Transport Mode [Paul]

* addconn: Fix crash on startup with dnssec-enable=no [Stepan Broz]

* libswan: Only use valid ephemeral ports for libunbound context [Stepan Broz]

* libswan: Do not process DNSSEC root key or trust anchors when disabled [Paul]

* libipsecconf: conn %default content could get overwritten rhbz#1704085 [Hugh]

* libipsecconf: Allow IKEv2 style ike/esp proposals using '+' symbol [Andrew]

(example: ike=aes_gcm+chacha20_poly1305,aes-sha2+sha1)

* libipsecconf: Updated defaults for filling in proposal elements [Andrew]

(drop sha1, sha2_512 before sha2_256 for esp, lots of new DH groups)

* libipsecconf: Be more tolerant of duplicate proposals and 'none' DH [Andrew]

* confreadwrite: Fix double host printing, line and bad ikev2=UNKNOWN [Paul]

* ipsec: Add "ipsec traffic" as shorthand for "ipsec trafficstatus" [Paul]

* ipsec: Add "ipsec brief" as shorthand for "ipsec briefcstatus" [Paul]

* _stackmanager: Do not attempt to load PF_KEY (af_key.ko) module [Paul]

* whack: Fix option name to and documentation of ms-dh-downgrade [Tuomo]

* whack: Two new impairments: del-with-notify and bad-ikev2-xchg [Andrew/Paul]

* whack: Fix non operational connection flags / arguments [Daniel Kautz]

* whack: Add new --briefstatus which skips showing all states [Paul]

* auto: Fix replace operation for when changing from subnet= to subnets= [wuwei29]

* verify: Removed broken IP forwarding check [Paul]

* FIPS: X.509 minimum public key size check was rejecting valid keys [Paul]

* FIPS: Disallow AES-XCBC from PRF/INTEG, Allow AES-GMAC [Paul]

* FIPS: Fixup FIPS_IKE_SA_LIFETIME_MAXIMUM to 24h as per NIST SP 800-77 [Paul]

* FIPS: Force IKE maximum lifetime of 24h (default is 1h) [Paul/Vukasin]

* XFRM: Use netlink for last remaining obsolete PF_KEY API API calls [Antony]

* XFRM: Clean up and add logging to IPsec SA for nic-offload= [Hugh/Paul]

* XFRM: Set default XFRM_LIFETIME_DEFAULT to 30 (was 300) [Paul]

* libswan: Fix leaks in badly formed secrets/ppk_id [Vukasin Karadzic]

* libswan: Don't crash on mangled PSK or PPK secrets [Vukasin Karadzic]

* initsystems/systemd: Install tmpfiles config when installing unitfile [Tuomo]

* barf: No longer look for netstat, ifconfig and mii-tool [Paul]

* building: Sort all wildcarded object files for build reproducibility [dkg]

* building: Update NSS includes to not use obsoleted header files [Paul/Andrew]

* building: USE_NSS_AVA_COPY ?= false, only needed with NSS < 3.30 [Tuomo]

* building: USE_UNBOUND_EVENT_H_COPY ?= false, enable only for [Tuomo]

unbound <= 1.7.3 without unbound-event.h

* building: Fix UNBOUND_VERSION testing so result compiles on Fedora 29 [Hugh]

* building: USE_NSS_IPSEC_PROFILE ?= true, Requires nss >= 3.41 [Tuomo]

* building: Support for unbound > 1.8.0 [Antony]

* building: Update XFRM headers [Antony]

* building: Add 'make install-rpm-dep' and 'make install-deb-dep' [Antony]

* testing: Lots of new and improved test cases [lots of people]

* packaging: Add a spec file for RHEL8/CentOS8 [Paul]

* packaging: debian: explicitly set ARCH for reproducibility [dkg]

* packaging: debian updates [Antony/Paul]

v3.27 (October 7, 2018)

* XFRM: SA marks must be included for delete operation [Tijs Van Buggenhout]

* pluto: Resolve a crasher in ECDSA freeing code [Hugh/Sahana]

* pluto: Resolve a hang when recursively loading same config file [Hugh]

* pluto: Refuse to load conns with different subnet address families [Paul]

* IKEv2: Fix regression on ID_NULL causing a new conn instance [Paul]

* IKEv1: Drop duplicates when not a reply [Andrew]

* IKEv1: Don't respond with errors to invalid encrypted packets [Andrew]

* IKEv1: Don't print empty informational warning on delete payload [Paul]

* IKEv1: Don't add spurious ESP-NULL proposal to AH proposals [Andrew]

* whack: Release whack socket on IKE_AUTH errors [Andrew]

* libswan: fix buffer size to getnameinfo() call in resolve_ppp_peer() [Hugh]

* libipsecconf: Don't accidentally clear modecfgdomains= entries [Andrew]

* building: Fixup NSS includes and links (fixes Debian builds) [Andrew/Paul]

* documentation: Update (L)GPL license links and http -> https links [dkg]

* Bugtracker bugs fixed:

#177 left=%defaultroute not working when "src" in the default route [Kim]

#80 VTI interface vanishes when peer goes down and up [yu-shiba]

v3.26 (September 16, 2018)

* IKEv2: Support for RSA-PSS (RFC 7427) via authby=rsa-sha2 [Sahana Prasad]

* IKEv2: Support for ECDSA (RFC 7427) via authby=ecdsa-sha2 [Sahana Prasad]

* IKEv2: Use DER handling code of NSS instead of our custom code [Andrew]

* IKEv2: Fix core dump when impaired and proposing esp=null-none [Andrew]

* IKEv2: Fix traffic selector lookup for asymmetric conns [Andrew/Paul]

* IKEv2: Add IKE and ESP support for chacha20poly1305 (RFC 7634) [Andrew]

* IKEv2: Fix leaks in ikev2_calculate_rsa_hash [Hugh]

* IKEv2: Simplify proposal generating [Hugh]

* IKEv1: Fix handling XAUTH empty passwords [Andrew]

* IKEv1: Various code cleanup, next payload handling [Hugh]

* IKEv1: fix optional key-length regression (in v3.25) with ESP prop [Andrew]

* IKEv1: Don't delete replaced IKE SA, it confuses third party clients [Paul]

* pluto: Relax strictness of DH in ESP/AH proposals [Andrew]

* pluto: Fix for two roadwarriors using ID_IPv4 behind same NAT [Paul]

* pluto: Do not hand out old lease address for authby=secret conns [Paul]

* pluto: new --selftest option that exits pluto after startup tests [Paul]

* pluto: Updated known Vendor ID table [Paul]

* XFRM: Don't call init_pfkey() on boot so Linux upstream can kill it [Andrew]

*_unbound-hook: Fixup adding IPv4 pubkey, unbound now quotes arg as 1 [Paul]

* building: Fix listed patches for debian build [Paul]

* building: enable DH31 (curve25519) per default [Paul]

* building: disable DH23,DH24 per default [Paul]

* testing: prepare to migrate from f22 to f28 [Andrew, Antony, Paul]

* Bugtracker bugs fixed:

#166 IPsec/XAuth reusing lease for multiple clients behind same NAT [Paul]

v3.25 (June 27, 2018)

* IKEv2: MOBIKE Initiator support (RFC 4555) [Antony]

* IKEv2: Support for IKE SA rekeying RFC7296 1.3.2, initiator [Antony]

* IKEv2: Support for IPsec SA rekeying RFC7296 1.3.3, initiator [Antony]

* IKEv2: Support for IKE SA reauth=yes|no RFC7296 2.8.3 [Antony]

* IKEv2: Temporarily disable Liveness/DPD when MOBIKE kick in [Antony]

* IKEv2: No longer allow contradicting esp= and pfs= options [Andrew]

* IKEv2: PPK support for authby=rsasig [Vukasin Karadzic]

* IKEv2: Support for CURVE25519 (RFC 8031) [Andrew]

* IKEv2: IANA INTERNAL_DNSSEC_TA allocation added [Paul]

* IKEv2: Add PPK support to authby=rsasig [Vukasin]

* IKEv2: Don't calculate NO_PPK_AUTH when the POLICY is INSIST [Vukasin]

* IKEv2: fix PPK when responder is ppk=no but has a valid PPKID [Paul/Vukasin]

* IKEv2: Support for protoport based Opportunistic IPsec [Paul]

* IKEv2: Support multiple authby values (eg authby=rsasig,null) [Paul]

* IKEv2: Support for AUTHNULL fallback via private use Notify [Vukasin]

* IKEv2: Fix v3.23 regression causing liveness check to always fail [Tuomo]

* IKEv2: Support for Microsoft rekey bug: ms-dh-downgrade=yes|no [Andrew/Paul]

* IKEv2: Allow switching between OE instances with different protoports [Paul]

* IKEv2: process INITIAL_CONTACT and delete old states from a connection [Paul]

* IKEv2: Only retransmit fragments on receiving first fragment [Andrew]

* IKEv2: When sending fragments, also update st_msgid_lastreplied [Paul]

* IKEv2: Encrypt IKE_AUTH reply when authentication failed [Andrew]

* IKEv2: Fix handling of corrupt encrypted packets [Andrew]

* IKEv2: Do not call ISAKMP_SA_established() during CREATE_CHILD_SA [Paul]

* IKEv2: When receiving Initial Contact, delete old IPsec SA's [Paul]

* IKEv2: Harden IP triggered OE with new dns-match-id=yes|no [AntonyPaul]

* IKEv2: Add PRF/INTEG support for AES_XCBC / AES_CMAC [Andrew]

* IKEv2: permit DH=none (as in esp=aes;none,aes;dh22) [Andrew]

* IKEv1: Prevent crashes with IKEv1 mistakenly allowing narrowing=yes [Paul]

* IKEv1: DPD was not getting scheduled (bug introduced in 3.23) [Paul]

* IKEv1: modecfg_send_set() must not ignore failure of modecfg_resp() [Hugh]

* X509: Extend support for wildcard certs matching remote peer ID [Paul/Hugh]

* X509: Support PKCS7 for Microsoft interop with intermediate certs [Andrew]

* X509: Handle CRL fetching in separate thread [Andrew]

* pluto: Obsoleted connaddrfamily= (fixes 6in4 and 4in6) [Paul]

* pluto: New hostaddrfamily= and clientaddrfamily= (only needed w DNS) [Paul]

* pluto: Cleanup of state/md passing code [Andrew]

* pluto: Allow switching back from wrong instance to template conn [Paul]

* pluto: disentangle IKEv1 and IKEv2 packet sending code [Andrew]

* pluto: Allow rightsubnets= without leftsubnet(s)= [Paul]

* pluto: don't share IP leases for authby=secret (in case of group ID) [Paul]

* pluto: Parser bug prevented 4in6 config [mhuntxu at github, Daniel M. Weeks]

* pluto: Find and delete old connection/states with same ID [Paul/Hugh]

* pluto: traffic log (and updown) line had in/out bytes swapped [Paul/Tuomo]

* pluto: Fix memory/fd leaks found by Coverity and in cert code [Hugh/Andrew]

* pluto: Improve SPD longest prefix to priority calculation [Andrew/Paul/Hugh]

* addconn: Fix auto=route and auto=start processing [Paul]

* whack/auto: Ensure all status and list commands return no error code [Paul]

* KLIPS: Replace deprecated blkcipher with skcipher crypto API [Tijs Van Buggenhout]

* FIPS: Support new NIST ACVP protocol with cavp tool cmdline args [Andrew]

* FIPS: Don't attempt HMAC integrity test on rsasigkey (rhbz#1544143) [Paul]

* FIPS: Don't allow RSA keys < 3072 [Matt/Paul]

* FIPS: Enable our PRF aes_xcbc wrapper on NSS hash code in FIPS mode [Andrew]

* FIPS: Raise minimum RSA key length allowed to 3072 [Paul]

* CAVP: Add -<acvp-key> <acvp-value> and -json(output) options to CAVP [Andrew]

* portexcludes: new command ipsec portexcludes (see portexcludes.conf) [Paul]

* _updown.netkey: fix deleting routes when half routes are used [Tuomo]

* _updown.netkey: don't delete VTI interfaces until we can refcount [Tuomo]

* _updown.netkey: fix unroute: "need at least a destination address" [Tuomo]

* _updown.netkey: don't do proxyarp for direct host-host tunnels [Tuomo]

* _updown.netkey: force routing if we don't have route to remote network [Tuomo]

* _unbound-hook: Pass all IPSECKEY's to pluto, not just the first [Paul]

* contrib/python-swan: module to check if traffic get be encrypted [Kim]

* contrib/c-swan: example code to check if traffic get be encrypted [Kim]

* building: added USE_GLIBC_KERN_FLIP_HEADERS (default off) [Paul]

* building: when ElectricFence enabled, add extra system calls to seccomp [Andrew]

* ipsec: add checknss option --settrusts to reset CA trusts in nss db [Tuomo]

* _updown.netkey: force routing when necessary for IPsec to work [Tuomo]

* _updown.netkey: do not proxyarp for host-host tunnels [Tuomo]

* look: sort XFRM output by priority [Andrew]

* Bugtracker bugs fixed:

#311: segfault in crl fetching git master f5b17dc [Andrew, Tuomo]

#314: IPv6 default route is deleted by mistake

#318: vti interface gets down on previous initiator if roles switch [Tuomo]

#320: nsspassword file location is half implemented

#328: Addcon crash on duplicit "left" or "leftid" keys in conn config [Stepan Broz]

v3.24 (June 26, 2018)

* This release was never published

v3.23 (January 25, 2018)

* IKEv2: MOBIKE Responder support (RFC 4555) [Antony/Paul]

* IKEv2: Add support for modecfgdns= and modecfgdomains= like for IKEv1 [Paul]

* IKEv2: EXPERIMENTAL: Support for Postquantim Preshared Keys [Vukasin Karadzic]

based on draft-ietf-ipsecme-qr-ikev2-01 (using private use numbers)

new option: ppk=yes|no|insist (default no)

* pluto: Fix DEFAULT_RUNDIR to be set so it is really configurable [Tuomo]

* pluto: Add support IDr payload (You Tarzan, me Jane) [Paul]

* pluto: pass state to send_crypto_helper_request() [Andrew]

* pluto: Internal time/scheduling changes, micro-seconds logging [Andrew]

* pluto: make counts of states consistently "unsigned" [Hugh]

* pluto/lib: Remove obsoleted/unused %myid support [Paul]

* pluto: add --impair replay-forward,replay-backward [Andrew]

* pluto: add --impair dup-incoming-packets [Andrew]

* pluto: Rework nic offload detection code [Aviv Heller]

* pluto: Retry send on -EAGAIN in check_msg_errqueue() (up to 32x) [Paul/Hugh]

* pluto: Pull latest kernel traffic counters before logging/deleting SA [Paul]

* pluto: STF_INLINE, STF_TOOMUCHCRYPTO no longer needed in helpers [Andrew]

* pluto: Replace socket queues with a simple queue and mutex+cont [Andrew]

* pluto: Do not send DPD/liveness probes for replaced inactive IPsec SAs [Paul]

* pluto: crypto processing cleanup [Andrew]

* XFRM: XFRM_MIGRATE support, used for MOBIKE [Antony]

* XFRM: Listen to NETLINK_ROUTE messages from kernel for MOBIKE [Antony]

* XFRM: Fix unique marks accidentally setting -1 instead of random [Paul]

* XFRM: Only install IPv6 holes when system has configured IPv6 [Antony]

* XFRM: Add support for decap-dscp=yes|no (default no) [Paul]

* XFRM: Add support for nopmtudisc=yes|no (default no) [Paul]

* KLIPS: Support kernels 4.14+ with renamed dev->priv_destructor [Paul]

* KLIPS: updown fixes for IPv6 default route and metric/mtu settings [Wolfgang]

* SECCOMP: Update syscall whitelist for use of libunbound [Paul]

* IKEv1: better handle ESP with no integrity vs unknown integrity [Andrew]

* IKEv1: Fix packet retransmit code wrf timeouts vs duplucates [Andrew]

* IKEv1: Prevent duplicate responder states on retransmision [Andrew]

* IKEv1: Don't linger R1 states for 1h but use configured timeouts [Paul]

* IKEv2: nat_traversal_change_port_lookup() code moved [Antony]

* IKEv2: Macros could misinterpret some IKE/IPsec states [Paul/Antony]

* IKEv2: Updated Group transforms to comply with RFC 8247 [Paul]

* PAM: Don't cancel pam threads (unsupported!) but drop results instead [Andrew]

* _updown: Fix resolv.conf handling (github #130) [Tuomo]

* _updown: Fix POINTPOINT interfaces not to use nexthop [Tuomo]

* _updown.netkey: Add source ip to dev lo by default [Tuomo]

* Makefiles: Fix INC_MANDIR to be share/man and add FINALMANDIR [Tuomo]

* packaging: Move debian/ to packaging ('make deb' still works) [Antony]

* contrib: Added ipsec-dyndns to demonstrante how push an IPSECKEY [Paul]

* Bugtracker bugs fixed:

#313: changesource in updown_klips doesn't respect PLUTO_METRIC [Wolfgang]

#314: IPv6 default route is deleted by mistake [Wolfgang]

v3.22 (October 22, 2017)

* IKEv2: EXPERIMENTAL: unbound DNS server ipsecmod support [Opportunistic IPsec]

* IKEv2: Initial support for RFC 7427 Digital Signature [Sahana Prasad/GSoC]

* IKEv2: Do not include INTEG=NONE in AEAD IKE proposals [Andrew]

* IKEv2: Accept both ESP=AEAD+NONE and ESP=AEAD in proposals [Andrew]

(See also: https://www.rfc-editor.org/errata/eid5109)

* IKEV2: Fix interop with old pluto that rejected esp=aead+none [Andrew]

* IKEv2: Add support for GMAC via esp=null_auth_aes_gcm [Andrew]

* IKEv2: Fragmentation code cleanup and memory leak fixes [Andrew]

* IKEv1: Fix XAUTH retransmits and packet storage [Antony]

* IKEv1: Perform custom state change for XAUTH without ModeCFG [Paul]

* IKEv1: Add support for nat-ikev1-method=none [Paul]

* IKEv1: XAUTH password length wasn't consistent at 128 [Stepan Broz]

* pluto: Natively install ICMPv6 neighbour discovery holes [Mayank Totale/GSoC]

* pluto: Fixup XAUTH/PAM thread cancellation handling [Andrew/Antony]

* pluto: Change default rundir from /var/run/pluto to /run/pluto [Paul]

* pluto: Various ike_alg parsing updates [Andrew]

* pluto: Various cleanups in addresspool and XAUTH code [Hugh]

* pluto: Fix missing ntohl() on the SPI numbers in ipsec status [Paul]

* pluto: Various memory leak fixes [Antony,Paul,Hugh]

* pluto: Make ioctl(SIOCGIFFLAGS) failure for labeled devices non-fatal [Paul]

* pluto: Give IKE traffic preference via SO_PRIO [Paul]

* pluto: New setup options: ike-socket-errqueue= , ike-socket-bufsiza=e [Paul]

* pluto: Improve whack --listevents with libevent [Antony]

* pluto: Fixup NIC offload support [Antony, Hugh]

* pluto: Track and try the number of EAGAIN errors on IKE socket [Hugh/Paul]

* pluto: Prevent spurious initiating states on responder-only conn [Antony]

* pluto: don't call sanitize_string() in fmt_log() as it is expensive [Paul]

* pluto: No longer need to specify null for AEAD, can use esp=aes_gcm [Andrew]

* pluto: Increase default nhelpers for 1 CPU (2) and 2 CPUs (4) [Paul]

* pluto: New option logip= (default yes) to disable log of incoming IPs [Paul]

* pluto: signal handling cleanup [Andrew/Hugh]

* pluto: Don't try to retransmit unsent packet [Paul/Hugh]

* pluto: state hashing improvements [Andrew]

* pluto: Fix erranious connecting switching (bug in v3.21) [Paul]

* pluto: when deleting parent, don't deschedule DH for wrong child [Andrew]

* pluto: dpdaction=restart fixup when using %any [Antony]

* pluto: Don't die on labeled interfaces without SIOCGIFFLAGS support [Paul]

* addconn: left=%defaultroute would fail if >500 host routes [Kim]

* showhostkey/rsasigkey: Fixup mismatch of public key display [Andrew]

* FIPS: Some selftests did not run properly under FIPS mode [Andrew]

* KLIPS: Removed old premade patches, use make targets instead [paul]

* updown Don't remove source ip if it's still used (rhbz#1492501) [Tuomo]

* updown: Allow disabling via leftupdown="" or leftupdown="%disabled" [Paul]

* updown: SPI numbers were missing ntohl() conversion [Paul]

* various: phase out --ctlbase for --ctlsocket and --rundir [Paul]

* libipsecconf: reject unavailable kernel algorithms in parser [Andrew]

* libswan/pluto: throw a clearer error for broken libunbound [Paul]

* libswan/pluto: Cleanup logging and tighten logging lock [Andrew]

* libswan/pluto: Greatly optimize logging code [Andrew]

* libswan/pluto: Some logging algorithm renames for more consistency [Andrew]

* building: remove -fexceptions; breaks pthread_cleanup_push [Andrew]

* packaging: Update debian/ and move to packaging/debian [Antony]

* packaging: Update fedora/rhel spec files [Tuomo]

* testing: --impair-foo changed to --impair foo [Andrew]

* testing: Some new impair options for testing [Andrew,Sahana,Paul]

* testing: Allow null encryption with null auth for testing [Andrew]

* Bugtracker bugs fixed:

#294: Bug in public key reported by rsasigkey [Tijs Van Buggenhout/Andrew]

#299: Fix overlapping addresspool and static lease from passwd file [Antony]

#300: Fix bug in v3.21 that rejected hardcodes certs without a CA [Paul]

#302: IKEv1-only and IKEv2-only must not share IKE SA [Paul]

#303: xauth password length limited to 64 bytes [Stepan Broz]

v3.21 (August 9, 2017)

* FIPS: Don't crash on too weak PSK's in FIPS mode, warn for non-FIPS [Andrew]

* FIPS: rsasigkey: Use modulus F4, not 3 (FIPS 186-4, section B.3.1) [Paul]

* pluto: Support for "idXXX" esp/ike transform IDs removed [Andrew,Paul]

* pluto: Do not return whack error when termining an alias connection [Paul]

* pluto: Remove IKE policy bits on passthrough conns [Paul]

* pluto: Minor memory leak fixes [Paul]

* pluto: Fix memory leak due to addresspool reference count error [Antony]

* pluto: Re-add support for ipsec whack --listevents [Antony]

* pluto: Cleanup listed events on shutdown to please leak-detective [Antony]

* pluto: Perform stricter SubjectAltName checks on configured ID's [Paul]

* pluto: Handle *subnets in --route and --unroute via whack [Mika/Tuomo]

* pluto: Unify IKEv1 XAUTH and IKEv2 PAM threading code [Andrew]

* pluto: Use pthread_cancel() (not SIGINT, conflicts with debuggers) [Andrew]

* pluto: Fix memory corruption with XAUTH/PAM threads [Andrew/Hugh]

* pluto: Fix resource leak processing XAUTH password authentication [Andrew]

* pluto: Fix warnings generated by gcc 7.1 [Lubomir Rintel]

* pluto: NIC offload support nic-offload=auto|yes|no (eg mellanox) [Ilan Tayari]

* pluto: Use common function in ikev1 / ikev2 for dpd/liveness actions [Antony]

* NSS: Try harder finding private keys that reside on hardware tokens [Andrew]