4 RCSID $Id: CHANGES,v 1.165 2002/04/01 08:46:54 dhr Exp $
6 Changes since 1.96 release by D. Hugh Redelmeier <hugh@mimosa.com>
8 - fixed a bug that would make the following (pointless) sequence to
9 trigger a failure of Pluto assertion "c->routing == RT_ROUTED_TUNNEL":
12 ipsec auto --route conn
13 ipsec auto --down conn
15 - send Delete Notifications when deleting IPSEC SAs. We don't yet
16 understand ones we receive.
18 - added "keyid" (see ipsec_keyblobtoid(3)) to appropriate messages so
19 that RSA key being used is manifest.
21 - track whether information (security gateway, public key) came from
22 DNSsec or unauthenticated DNS. Untested since normal resolver calls
23 can no longer return DNSsec results. The information isn't used.
25 - use asynchronous DNS mechanism for all lookups during keying.
27 - added --interface flag to Pluto to constrain interfaces considered.
28 One use of this option is to specify which interface should be used
29 when two or more share the same IP address. Another is to assist
33 + fix compile without no -DKLIPS
34 + use ttodatav in place of atobytes and ttodata
36 + define and use close_any
37 + define and use USED_BY_KLIPS and USED_BY_DEBUG
38 + define and use happy, a kind of assertion macro
39 + define and use impossible, a kind of assertion macro
40 + when an unknown attribute value is seen in an ISAKMP transform,
41 reject only that transform, not the whole proposal.
42 + add Hybrid auth methods to table to improve diagnostics
44 Changes since 1.95 release by D. Hugh Redelmeier <hugh@mimosa.com>
46 - fixed bug in ipsec_doi.c:main_inR3 with unknown consequences.
47 When the Initiator finds out the peer's Phase 1 ID, it might
48 change which connection it thinks is being used. If so,
49 this routine used to perform an operation on the old connection
50 data structure -- a mistake now corrected. There are few cases
51 where the Responder surprises the Initiator about Phase 1 IDs.
53 - fixed an error in network error handling that caused a segfault if
54 there was a MSG_ERRQUEUE report on the last message of a Quick Mode
57 - fix leak (detected by assertion failure) triggered by missing
61 Changes since 1.94 release by D. Hugh Redelmeier <hugh@mimosa.com>
63 - added "whack --deletestate <state_object_number>" as a crude
64 tool for deleting instances of connections.
66 - fix assertion in quick_inI1_outR1 introduced with key rollover
67 support in 1.92. Assertion failed in Responder when Source
68 was not the same as Initiator.
70 - reduce level of routine logging. Add --debug-lifecycle,
71 a temporary hack: it controls some logging, not debugging.
73 - Reorganize code to prepare for asynchronous DNS.
75 - Arrange for our file descriptors to be close-on-exec so that
76 the updown script won't inherit them. Some library facilities
77 (syslog?) may not be as careful.
79 - Fix assertion failure in DNS record handling. Provoked by a
80 malformed key in a TXT record. Introduced in 1.93.
82 - Change Responder cookie generation algorithm so that a particular
83 peer no longer gets the same cookie each time.
85 - Tidy and correct setting and resetting cur_* variables. A per-connection
86 debug setting could provoke a GLOBALS_ARE_RESET assertion failure.
88 - Fix handing of pending list in release_dead_interfaces:
89 connection must be released before it is removed from host_pair list.
91 - Ignore IPv6 interface addresses that are of link-local scope.
92 We think that they are never relevant. Trying to bind to these
93 addresses without a scope-id causes bind to balk.
96 Changes since 1.93 release by D. Hugh Redelmeier <hugh@mimosa.com>
98 - Only run the up-* updown script for tunnel eroutes, not shunt
101 - Now only --routed connections may be initiated on demand
102 (i.e. triggered by SADB_ACQUIRE triggered by trapped outbound packet).
103 Among other things, this eliminates a bug whereby an ACQUIRE
104 could be ascribed by Pluto to a Road Warrior template connection.
105 Pluto will now refuse to --route a Road Warrior template.
107 - Correct bug that lost track of a bare shunt table entry.
108 Add debugging logging for changes to that table.
111 Changes since 1.92 release by D. Hugh Redelmeier <hugh@mimosa.com>
113 - [andreas.steffen@strongsec.com] Bug fix: carrying Phase 1 ID
114 over when instantiating a different RW connection due to
115 revelation of Phase 2 IDs. This bug should only have affected
116 X509-authenticated negotiations.
118 - add more context to log and status lines. If the connection or
119 state is an instance, show the peer involved; if Opportunistic, also
120 show the client subnet.
122 - seed rand(3) with bytes from /dev/urandom.
124 - propose 1536 MODP Group before 1024 MODP Group. This generates
125 more entropy, so should be a little safer. And slower.
127 - add --debug-dns flag
129 - During Phase 1, when an RSA Public Key is require, only query DNS
130 for a KEY record for an Opportunistic connection. (This does not
131 change the whack --keyid way of querying for a KEY record during
134 - Multiple RSA public keys, if available, will be tried when
135 authenticating a signature. This facilitates key rollover.
136 New whack flag --addkey.
137 Multiple DNS TXT and KEY records are used if they are found
138 (but only one Responder is tried).
140 - no longer try to figure out --rsasig or --psk if neither specified.
141 This would require an extra DNS lookup for a KEY record.
143 Changes since 1.91 release by D. Hugh Redelmeier <hugh@mimosa.com>
145 - got rid of caching of DNS results. They might become stale.
147 - Added --dontrekey option for a connection. Crudely useful
148 for Road Warrior and Opportunistic connections.
150 - Ignore the Commit Flag. This should let us interoperate with
151 implementations that insist on it. The damage should be minor.
153 - Don't split the topology line of --status output. The output is now
154 more consistent (if wider).
156 - Improve diagnosis when ipsec.secrets has a non-indented "}"
157 at the end of an RSA private key.
159 - Savatier Sébastien <SebastienSavatier@lyon.msi-sa.fr>:
160 fix bug in emitting explicit IP address ID payload.
162 - Support inbound policy check of source and destination inner
163 addresses of tunneled packets. This will make it possible to
164 prevent one peer from successfully spoofing packets from another.
166 - Use poll(2) to check for MSG_ERRQUEUE messages before recvfrom:
167 even though select(2) says that there is a message, a plain
168 recvfrom(2) can block if the only message is on MSG_ERRQUEUE. I
169 think that this blocking is a kernel bug, or at least a
170 documentation bug. Also check for MSG_ERRQUEUE messages before
171 sendto(2): their presence can cause sendto to fail confusingly (i.e.
172 the failure has nothing to do with the actual sendto).
175 Changes since 1.9 release by D. Hugh Redelmeier <hugh@mimosa.com>
177 - SIGTERM now causes Pluto to exit cleanly.
179 - if --nofork is used, Pluto prints the line "Pluto initialized" to
180 standard out after creating the lock file and the control socket.
182 - the startup script relies on the property that whack can be
183 used immediately after the pluto command finishes (i.e.
184 right after the parent process of the daemon exits).
185 In the past, the control socket used by whack was created
186 after the fork: not necessarily before the parent exits.
187 This race condition has been eliminated.
189 - refined the code for DODGE_DH_MISSING_ZERO_BUG to ensure
190 Responder never drops a negotiation.
192 - added and exploited builddiag(), a routine make it easier to add
193 intermediate context to diagnostics.
195 - For purposes of IPv4, Pluto will now only consider interfaces that
196 are "up". It has always ignored those configured with address
197 0.0.0.0, thus ignoring "down" interfaces in most cases.
199 - add a list of interface pairs to --status output.
201 - replace signal(2) calls with sigaction(2) calls: glibc has further
202 broken the semantics of signal(2). We want slow system calls
203 to be interruptable and not be restarted.
205 - improved error message for lack of preshared key by showing
206 IDs that were used in lookup. Collateral tidying.
208 - documented complex logic of routing and erouting in routing.txt
210 - When a connection is --routed, a route is installed to direct
211 outbound packets destined for the peer's client to go to the ipsec
212 interface implicit in the connection. This is not allowed for Road
213 Warrior connections -- they are strictly inbound. For Opportunistic
214 connections, a new default root is installed that points to the
215 ipsec interface. Note that the route does not take into account the
216 source address. In addition, a TRAP shunt eroute is installed to
217 catch any traffic sent on the not-yet-initiated connection.
219 - When an outbound packet is trapped by the TRAP shunt eroute,
220 Pluto attempts to initiate the corresponding connection.
221 If the attempt fails because an Opportunistic connection was used
222 and no gateway information was found, a PASS shunt eroute is
223 installed (with no provision for automatic removal).
225 - if negotiation fails at a later point, a shunt eroute is installed.
226 The kind of shunt is a policy decision. It is specified as part of
227 the connection. (Untested; can not be specified in ipsec.conf.)
229 - When an inbound negotiation doesn't match a specific connection,
230 and there is an Opportunistic connection, Pluto will try to respond
231 using that connection.
233 - Every 2 minutes (SHUNT_SCAN_INTERVAL seconds), Pluto scans for
235 + PASS eroutes that it installed that haven't been used recently.
236 These will be deleted.
238 + HOLD eroutes for which Pluto hasn't received a PFKEY_ACQUIRE message.
239 For any it finds, it will attempt an opportunistic initiate.
241 - We no longer allow Phase 1 negotiations that we initiate to switch
242 which connection is being used based on the Peer's Phase 1 ID.
243 The fact that we used to do so was probably a bug.
245 - When Pluto as the Responder receives the Peer's Phase 1 ID, it is
246 now willing to use a connection with a different ID and private
247 RSA key for our end. Nothing has committed us to the current guess.
249 - Changes in internal data structures to aid in better tracking of
250 history of attempted and successful communication. Needed for
251 effective Opportunism.
252 + struct host_pair represents information about pairs of hosts.
253 + "Orientation" is done as soon as possible rather than as late
255 + an arbitrary number of Quick Mode negotiations may now queue
256 for the completion of a Main Mode negotiation. Formerly,
257 a negotiation could only use a previously completed Keying Channel.
260 Changes since 1.8 release by D. Hugh Redelmeier <hugh@mimosa.com>
262 - [Svenning Soerensen] correct check requiring OAKLEY_LIFE_TYPE
263 attribute before OAKLEY_LIFE_DURATION.
265 - Improved whack diagnostics for various cases of failure to connect
268 - Added function state_with_serialno to allow a serial number to be
269 used as a safe reference to a state object. This avoids the risk
270 of dangling pointers.
272 - Add crude support for PF_KEY SADB_ACQUIRE messages from the kernel.
273 These cause the initiation of opportunistic negotiation.
275 - More processing of PF_KEY messages from the kernel. We check that
276 each message we send to the kernel elicits a response. Other messages
277 are queued to be processed at the head of the event loop.
279 - Fix bug in find_client_connection. The manifestation is a Pluto
280 segfault when a negotiation successfully gets to Phase 2, but there
281 is no connection with the appropriate clients AND there is no
282 wildcarded connection using our same host interface (not even an
285 - Purely internal change: simplify EVENT_SO_DISCARD logic.
287 - Accept GROUP_DESCRIPTION in IPCA (IPcomp SA) proposal. Although
288 this SHOULD NOT appear according to
289 draft-shacham-ippcp-rfc2393bis-05.txt 4.1, it should harmlessly help
292 - Adjust to whether KLIPS supports IPCOMP. If it does not, ignore
293 --compress policy flag in Connections. So Pluto would then neither
294 propose nor accept IPCOMP transforms.
297 Changes since 1.7 release by D. Hugh Redelmeier <hugh@mimosa.com>
299 - Allow IPcomp transformations to use "well known CPIs". This
300 perversion allows better interoperation.
302 - Added rather experimental code to exploit IP_RECVERR. This facility
303 allows us to report who refuses our packets when they are refused.
304 I don't understand the documentation of the mechanism, hence the
305 experimental nature of our use of it. Our code is pretty ugly too.
307 - [Svenning Soerensen] found a bug in the calculation of the verb for
308 the updown script and proposed a fix. The -host suffix was being
309 used when the client subnet contained only one IP address, even if
310 that address was not of the host.
312 - [Svenning Soerensen] Allow Phase 1 ID Payloads of type FQDN and
313 user@FQDN to specify UDP/500 explicitly as per RFC2407 (IPSEC DOI)
316 - When responding in Quick mode, after switching to an appropriate
317 connection based on the ID payloads, copy the connection's IPSEC
318 policy flags into the state object. Do this before consulting these
321 - --status output now indicates when a connection is an instance
322 of another. "POLICY_" has been removed from the display of each
323 policy flag, reducing clutter. An extra space has been added to
324 further indent lines in the --status report.
326 - Fixed a bug in displaying subnets in the error message
327 "cannot respond to IPsec SA request..."
329 - In SA proposals, accept CPIs that are 4 bytes too, as long as
330 the high order 2 bytes are 0.
332 - bug fix: no longer allocate tunnel SPIs below IPSEC_DOI_SPI_OUR_MIN.
334 - Added recognition (not support) for new Assigned Numbers for AES
338 Changes since 1.6 release by D. Hugh Redelmeier <hugh@mimosa.com>
340 - only accept a proposal with compression if the connection has the
341 POLICY_COMPRESSION flag. Normally, these flags don't affect what we
342 propose. In this case, we need this control since our IPCOMP
343 implementation has a history of crashing.
345 - Fixed nasty bug in connections.c:fc_try(). For a Quick Mode
346 exchange, if Pluto picked a connection as a starting point
347 that had no peer client, it would not accept any proposed
348 peer client. On the other hand, if it picked a connection
349 with a peer client, it would not accept any proposal without
353 Changes since 1.5 release by D. Hugh Redelmeier <hugh@mimosa.com>
355 - added a global pluto option --uniqueids. If this is enabled,
356 whenever a new ISAKMP SA is established, any connections with
357 the same Peer Id but different Peer IP address are unoriented,
358 blowing away any of their SAs. This should help eliminate
359 dangling Road Warrior connections when the same Road Warrior
360 reconnects. It thus requires that IDs not be shared by hosts
361 (a previously legal but probably useless capability).
363 - introduced clearer notation:
364 + --host %any signifying any IP address, for Road Warrior,
365 replacing 0.0.0.0 or 0::0
366 + --nexthop %direct signifying "same IP as peer", replacing
368 + %any and %any6 as indices in ipsec.secrets to match IP addresses of
369 Road Warriors (replacing 0.0.0.0 or 0::0)
370 + --host %opportunistic signifying that the peer is actually
371 to be discovered from the reverse DNS entry for the peer's client.
372 This replaces --host 0.0.0.0 --client 0.0.0.0/32 (and IPv6 variants).
374 - be more strict about Phase 2 ID payloads (the ones that specify clients):
375 reject if they specify protocol or port (which we do not support).
377 - Remove support for Diffie Hellman MODP 768 Group. Increase
378 support for MODP 1536 Group.
380 - Remove NO_RSA option -- patent expired!!
382 - Improve support for newer resolvers.
384 - [initially from Svenning Soerensen <svenning@post5.tele.dk>]
385 support IPcomp (compression)
387 - [mostly Gerhard Gessler <gessler@iabg.de>] initial support for IPv6.
389 - As part of the IPv6 support, changes were made to the Pluto/updown
390 interface. See pluto(8) for the details. One oft-requested feature
391 is the new PLUTO_*_CLIENT environment variables. The changes are
392 "upward compatible", so the PLUTO_VERSION environment variable
393 setting was changed from 1.0 to 1.1. Unfortunately, this will break
394 many customized updown scripts.
396 - Prototype support for initiating and responding to opportunistic
397 negotiation. A connection is considered for instantiation for
398 opportunism if it has a peer of %opportunistic (the connection
399 description must not specify a client for the peer). Currently, the
400 only way to provoke an opportunistic initiation is to use whack to
401 simulate the interception of an outbound flow (do a "whack --help"
402 and look at opportunistic initiation). These features are not
403 documented because they are experimental. Limitations: no actual
404 interception of packets, DNS query synchronous.
406 - in ipsec.secrets, if multiple entries are the best match for the
407 connection, they must all have the same secret. In the past
408 there was no code to compare RSA keys, so separate RSA entries
409 were assumed to be different. Now they are compared.
411 - Introduce now() to protect against clock being set backwards. The
412 risk is that events might be delayed a lot. Still no protection
413 against clock being moved forward.
415 - Don't "discover" interfaces that share IP addresses with others.
416 This avoids an assertion failure. Eventually, Pluto will have to
417 ask KLIPS about interfaces.
419 - prevent infinite loop decoding certain malformed DNS records
421 - explain "Phase 1", "Phase 2", "Main Mode", and "Quick Mode"
423 - fiddled with "max number of retransmissions" diagnostic to add a bit
427 Changes since 1.4 release by D. Hugh Redelmeier <hugh@mimosa.com>
429 - reorganized how messages are logged. More of the serious messages
430 are distinguished with the code RC_LOG_SERIOUS and hence should
431 make it through ipsec auto's filter.
433 - Reserve Message IDs only within their ISAKMP SA. This eliminates
434 the unbounded memory requirement when reserving them per peer.
436 - Pluto's retransmission logic has been improved:
437 + the initial retransmission occurs after 10 seconds of silence,
438 down from 30 seconds. The theory is that this will ungum a
439 lost-packet situation more quickly
440 + the delay after each retransmission is twice the delay before
441 it -- exponential backoff
442 + In the special case of the first message initiating Main Mode,
443 when --keyingtries is 0 (meaning unlimited retries), Pluto
444 will attempt more retransmissions at the same rate (no
445 exponential backoff). This cuts down on the pointless
446 busywork while a peer isn't responding.
448 - Pluto will no longer generate SPIs in the range 0x100-0xFFF.
449 This has the effect of reserving this range for manual keying.
450 Of course Pluto will still allow its peer to use this range.
452 - Fixed another bug in Road Warrior support. In responding to Phase 2
453 / Quick Mode, once the client subnets (if any) are known, Pluto must
454 reselect which connection to use. If it didn't happen to be using
455 the right one already, and no ID was explicitly specified for the
456 peer, and the right one is a Road Warrior connection, the right one
460 Changes since 1.3 release by D. Hugh Redelmeier <hugh@mimosa.com>
462 - Pluto can now acquire a public key from DNS. It must be told
463 to do so. Hint: --pubkeyrsa is optional when specifying keyid.
465 - On the Responder, if a connection is to be routed, and the peer has
466 a client that is a fixed subnet, and that subnet is already routed
467 for other connections, and that route conflicts, Pluto will unorient
468 the old connections (deleting the SAs that depend on the old route)
469 on the theory that they have been superseded. Too bad we can't
470 otherwise tell when a connection is outdated.
472 - Support for netlink has been removed. We always use PFKEYV2.
473 Pluto no longer #includes any kernel headers!
477 - Road Warrior support is unconditionally included. No more need to
478 define ROAD_WARRIOR_FUDGE.
480 - Fixed bug preventing Road Warrior connections being instantiated
481 during the connection reselection prompted by receipt of Phase 1 ID
482 Payload [Kai Martius <kai@secunet.de>]. Fixed bug that caused Phase
483 1 ID to be ignored by connection reselection prompted by receipt of
487 Changes since 1.2 release by D. Hugh Redelmeier <hugh@mimosa.com>
489 - fixed deficiencies in id handling
491 - changed to use updown script for routing (and firewalling)
493 - In quick Mode, when Responder, avoid selecting same SPIs as
494 initiator. This prevents KEYMAT being the same in both directions.
495 See Ferguson and Schneier: "A Cryptographic Evaluation of IPsec",
496 http://www.counterpane.com/ipsec.pdf, 5.6 #2.
498 - In Quick Mode, when Responder, install inbound IPsec SA one
499 message earlier. This eliminates the chance of a message being
500 sent before the SA is established.
502 - slight complication to RSA private key lookup rules to allow
503 match to an entry with multiple identities for the host.
505 - support per-connection debugging flags
507 - more use of PFKEY (RGB+DHR)
509 - inbound SAs are now spigrped and an inbound IPIP SA is created
510 if tunneling is used. This more symmetric with outbound processing
511 and it allows KLIPS to check that the correct SAs are all applied.
513 - The way SA lifetime limits are proposed and accepted is better
514 documented. whack now complains when a specified value exceeds the
518 Changes since 1.1 release by D. Hugh Redelmeier <hugh@mimosa.com>
520 - Updated constants to track newer IETF drafts
522 - added support for RSA Signature authentication
523 + augmented demux.c to support packet syntax differences
524 due to authentication technique.
525 + preshared.c now can record RSA private keys
526 + whack --keyid --pubkeyrsa records RSA public keys
527 + whack --unlisten to allow a sequence of whack operations to be atomic
528 with respect to IKE traffic (eg. loading public keys)
529 + ipsec_doi.c will now do RSA Signature authentication
530 + new policy bits are added to select authentication method (--rsasig, --psk)
532 - started towards more general ids (@FQDN and user@FQDN,
533 in addition to IP addresses).
534 + Note: there is *no* meaning attached to the id used beyond
535 being an identifier. Almost no syntax checking is done.
536 + these forms of id work in:
537 o ipsec.secrets indices
538 o whack's --keyid for defining public keys
539 o id payloads (generated and accepted)
540 o --id option for each side in a connection description
541 + the Id may be an IP address that isn't that of one end
542 (but it must authenticate)
543 + once and ID payload is received, Pluto will reconsider which
544 potential connection should be used. It makes sure that any
545 authentication already done would apply to the new connection
546 too. This should make RSASIG + Road Warrior useful.
548 - [RGB, Peter Onion, and DHR] start of PFKEY2 support
551 Changes since 1.00 release by D. Hugh Redelmeier <hugh@mimosa.com>
554 + added --rekeyfuzz; defaults to 100% so lifetime must now be
555 more than twice rekeymargin
556 + added rekeying for responders (but rigged to favour initiators)
557 + [BUGFIX] responder of an exchange will not reinitiate
558 the exchange if it does not complete
560 - Renamed --rekeywindow to --rekeymargin to match ipsec.conf.
561 The old name will be accepted for a while.
563 - improved error and debugging messages
565 - updated list of notification messages (but we still don't support
568 - In ID payload, support range representation, but only for a subnet.
569 This may improve interoperability
571 - scatter asterisks in debugging code to support EMACS outline mode.
573 - many internal changes were made to improve to code. This should
574 make it easier to add new states. There should be few behaviour
577 - whack --status now shows the SPIs for established SAs.
579 - [BUGFIX] DH values are now represented with the length specified by
580 the group description, not the length actually needed. About one
581 time in 256, this will make a difference. In those cases, the new
582 Pluto won't interoperate with old Plutos. It looks as if this
583 change brings us in line with other IKE daemons. Added a fudge
584 (select with DODGE_DH_MISSING_ZERO_BUG) so that when a problem
585 arises, a new replacement exchange is initiated (idea from John
588 - [BUGFIX] whack no longer assumes that UNIX domain sockets preserve
589 record boundaries (they don't). This faulty assumption caused
590 whack's exit status to be unreliable
592 - [BUGFIX] pluto now correctly defaults the client subnet in a
593 connection created for a Road Warrior exchange.
595 - [BUGFIX] Road Warrior code now supports multiple connections
596 terminating in a particular Road Warrior node (allowing all
597 appropriate combinations of host and subnets to be simultaneously
600 - [BUGFIX] fix various peculiar Road Warrior crashes.
602 - [BUGFIX] fix spurious deletion of control socket when lock could
603 not be acquired (Thomas Bellman <bellman@cendio.se>)
605 - [BUGFIX] interface discovery properly ignores nonAF_NET interfaces
608 Changes since .92 release by D. Hugh Redelmeier <hugh@mimosa.com>
610 - Communication between whack and pluto is now done using UNIX domain
611 sockets. This channel can be secured!
613 - liberalized ISAKMP SA acceptance. Now anything up to and including
614 16 bytes long is accepted. How silly.
616 - All ISAKMP messages in UDP packets generated by pluto are now
617 explicitly padded to be a multiple of 4 octets long. This was wrong
618 if certain big numbers (eg. nonces) happened to have leading zero
621 - set socket option SO_REUSEADDR on pluto's whack socket. This allows
622 Pluto to quickly restart.
624 - Use new, consistent notation for topology:
625 client===host---nexthop...nexthop---host===client
627 - prefix every line of status output with connection name. This
628 allows selection of output using grep.
630 - Replaced system's assert with passert. This sends the diagnostic
633 - Changed secrets file name processing to support sh-like "globbing"
636 - Where appropriate, log messages are prefixed by their connection
637 name and state object serial numbers. Connection names are quoted
638 with double quotes and serial numbers are prefixed with the number
639 sign (#). Otherwise, where appropriate, log messages are prefixed
640 by the IP address and port number from which the current message
643 - some attempt at making the messages more helpful
644 + warnings when authentication (preshared secrets) failure is
645 likely cause of the observed symptom
646 + status message now highlights which SAs are the most recent
647 (those are the ones that are subject to rekeying)and which are
649 + state names are slightly improved
650 + status message prints the "meaning" of a state after its name.
652 - the policy options of a connection (--pfs, --authenticate, --encrypt,
653 (but not --tunnel)) now apply to negotiations being responded to.
654 They continue to apply to negotiations initiated by Pluto.
656 - The Oakley group used for PFS in Phase 2 is dictated by the initiator.
657 We used to dictate one of our choice. To increase the chances for
658 success, we now dictate the same group as was used in Phase 1.
660 - First, some context. The "negotiated" lifetime of an SA is actually
661 dictated by the initiator. If the responder doesn't like this
662 lifetime, it can tell the initiator in a NOTIFY message. Pluto
663 doesn't do this. Instead, it will just expire the lifetime sooner
664 than negotiated. In the past, Pluto only initiated rekeying if it
665 was the initiator. Now, a responder Pluto will initiate rekeying if
666 it is going to expire the SA earlier than negotiated. To prevent an
667 explosion of SAs, rekeying will only be done if the SA is the newest
668 one for its connection. Rekeying of IPsec SA will respect the
669 security properties of the old SA at the level of policy options
670 (i.e. --pfs, --authenticate, --encrypt, --tunnel).
672 - Replaced --rekeytries with --keyingtries. This option now applies
673 to initial keying as well as rekeying, hence the name change. Even
674 though initial keying will now try more than once, whack logging
675 will be stopped after the first attempt. The value 0 is taken to
676 mean, effectively, infinity: don't give up.
679 Changes since .91 release by D. Hugh Redelmeier <hugh@mimosa.com>
681 - A hack has been added to support mobile or anonymous initiators.
683 - The isakmp-secrets file has been renamed ipsec.secrets and the
684 format spruced up to aid scalability. Entries now can be shared
685 between relevant machines verbatim. An include facility was added.
686 The file is now only read upon --listen commands.
688 - If --firewall appears on our end of a connection, Pluto will
689 add a firewall rule to enable appropriate forwarding, without
690 masquerading for any route it adds. It will delete the rule
691 when it deletes the route.
693 - When Pluto thinks whack's message is malformed, it now says so
694 to whack, not just syslog.
696 - In addition to the messages traditionally sent back to whack,
697 non-debugging messages sent to the log that relate to whack's
698 current activity are copied to whack. Whack's exit status now
699 reflects the last message (if any) returned by Pluto. This should
700 allow a script to tell, for example, if an SA was established.
702 - top-level payload parsing has been centralized. This should make
703 it easier to add new features. Payload ordering constraints have
704 are now just those required by RFC2409 (IKE). In most cases,
705 Pluto will now ignore duplicated packets. It should recover better
706 from the reception of a corrupt packet.
708 - Interface discovery is more clever. It notes each configured
709 interface with a name ipsec[0-9] as a virtual public interface and
710 considers any interface with a different kind of name and the same
711 IP address to be the corresponding real public interface. This is
712 only done when Pluto starts, so any interfaces of interest must be
713 configured before then. This feature allows Pluto to support multiple
716 - Pluto now exploits the fact that eroutes only conflict if their
717 local clients AND peer clients are the same. So we can now support
718 multiple subnets behind our security gateway all talking to clients
719 behind another security gateway.
721 - Switched to using ipsec_spi_t to represent SPIs. In the process
722 fixed a related bug found by Peter Onion.
725 Changes since .9 release by D. Hugh Redelmeier <hugh@mimosa.com>
728 - Message IDs are now random, rather than counting up from 1. This
729 should help keep messages in different but simultaneous Phase 2
730 exchanges being mixed up.
731 - syslogged informative (i.e. debugging) messages are now prefixed
732 with "| " to make the easier to ignore.
733 - forbid zero cookies. Among other things, this prevents feedback
735 - Use serial numbers to cause most recent of available ISAKMP SAs
736 to be chosen. Also useful in debugging output.
737 - Pluto will now only listen to Whack on the loopback interface
738 (important security limitation).
739 - implement rekeying, based on time, for ISAKMP and IPsec SAs
740 - Whack now talks to Pluto using TCP. This allows status information
741 to be returned to Whack. For now, not much interesting is sent back.
742 The TCP port is the *same* as the IKE port -- no longer 1 greater.
743 Pluto closes the socket once the "goal" is established or the
744 state object is freed. All this will evolve.
745 - For SAs that were initiated by Pluto, Pluto will try to replace
746 the SA before it expires. There is a 10 minute window
747 (SA_REPLACEMENT_WINDOW) in which this can occur.
748 - Support --peer_nexthop for initiator of ISAKMP SA.
749 - Support --optionsfrom <file>
750 - be more specific about error conditions: for each STF_FAIL,
751 designate which notification message most applies.
752 - use these results in reporting to whack
753 - make whack back-talk look like FTP messages
754 - add and use notion of (potential) connection database. All scripts change!
755 - fix handling of the variable form of attribute
756 - don't allow --initiate before --listen
757 - use new number for ESP_NULL
758 - demand each transform include an ENCAPSULATION_MODE attribute
759 - demand each AH transform include an appropriate AUTH_ALGORITHM attribute
760 - add not-yet-standardized OAKLEY_GROUP 5 (MODP 1536)
761 - since KLIPS only allows one IPsec SA to be routed to a particular
762 subnet (for a peer's client), detect when a subnet is engaged.
763 If we are replacing that SA, OK. Otherwise, balk.
764 - [experimental] exploit the new UDP 500 hole to support host mode.
765 - add --route and --unroute: hysteresis in routing should prevent
766 packets flowing in the clear during IPsec SA transitions.
767 - add --status to display the internal state of Pluto.
768 - deleted misleading README; other resources fulfill its role
769 - eliminated EVENT_CLEANUP: using EVENT_RETRANSMIT seemed more correct
770 - gave special meaning to combination of delete and add
771 - improved and documented combinations of whack command types
773 - added and used LEAK_DETECTIVE. Fixed some leaks.
776 Changes between .85 and .9 release by D. Hugh Redelmeier <hugh@mimosa.com>
779 - change pluto and whack's argument processing to use getopt_long:
780 the syntax and expressive power is quite different.
781 - allow selection of debugging output. Change pluto to accept
782 arguments for specifying this. Change whack and pluto allow
783 settings to change during a run.
784 - make most controls for debugging run-time rather than compile-time.
785 This required the addition of many command line arguments (see README)
786 - support 3DES encryption of Oakley messages (OAKLEY_3DES_CBC)
787 - accept modestly long attribute values (32 bits) for
788 OAKLEY_LIFE_DURATION and SA_LIFE_DURATION.
791 Changes between .7alpha and .85 (highlights) by D. Hugh Redelmeier <hugh@mimosa.com>
793 - support RHL5.0 (glibc): avoid clash between
794 <netinet/in.h> and <asm/byteorder.h>
795 - Lessons from porting to Solaris: endianness, careful typing, alignment,
796 correct fd_set bugs in call_server(), correct rnd.c to use sig_atomic_t
797 - Makefile: add distlist target to put out names of files in distribution
798 - Makefile: when installing binaries, move old ones to .OLD
799 - add and exploit pb_stream mechanism for systematically decoding and
801 - More flexible security policy, but still hard-wired.
802 - support new Oakley group (2 -- modp 1024)
803 - make returned IPsec proposal for acceptance a copy of winning proposal
805 - add and use generic interface to hash functions
806 - add many comments referencing the draft standards
807 - change all uses of stdout to use stderr instead (choice between stdout
808 and stderr was haphazard)
809 - fix SPI stuff: Oakley and IPSEC SPIs are different beasts
810 - generate initial IPSEC SPI as a random number (avoid clashes)
811 - fix layout bug for struct isakmp_transform
812 - fix several dangerous memory allocation and buffer overflow errors;
813 eliminate all inline uses of calloc (use a wrapper)
814 - avoid memory leak due to uncleared mpz variables
815 - general tidying and restructuring; get rid of many "magic" numbers
816 - de-lint everywhere (add -Wall -Wmissing-prototypes to Makefile)
817 - switch from BSD b* functions to ANSI mem* functions
818 - get rid of bitfields
819 - generate the correct amount of keying material (PRF feedback, if needed)
820 - improve get_preshared_key (new format too)
821 - improve handling of informational exchanges. Still poor.
822 - improve tracing output
823 - print version information (whack and pluto)
824 - wherever an enum-like value is printed, print the name of the value
825 - make duplicate_state() duplicate the st_myidentity_type field.
826 - make kernel interface do required route commands
827 - open and close /dev/ipsec more carefully
828 - support separate keys for esp encryption and esp authentication
OSDN Git Service
