New
5.0
This is major version release with some incompatible changes in default options.
- IKEv1:
- globally disabled by default (ikev1-policy=drop); see RFC9395 [Daniel]
- limit default cryptosuite [Andrew, Paul, Tuomo] IKE={AES_CBC,3DES_CBC}-{HMAC_SHA2_256,HMAC_SHA2_512HMAC_SHA1}-{MODP2048,MODP1536,DH19,DH31} ESP={AES_CBC,3DES_CBC}-{HMAC_SHA1_96,HMAC_SHA2_512_256,HMAC_SHA2_256_128}-{AES_GCM_16_128,AES_GCM_16_256} AH=HMAC_SHA1_96+HMAC_SHA2_512_256+HMAC_SHA2_256_128
- remove support for Labeled IPsec [Andrew]
- properly ignore dpdaction= [Andrew]
- see also IKEv2 routing/revival changes
- IKEv2:
- warn that fragmentation=force is ignored [Andrew]
- avoid post-authentication crash on corrupt TS payload [Andrew]
- support addresspool=v4/mask,v6/mask [Andrew]
- support subnet=SELECTOR,... using a single Child SA [Andrew]
- when non-MOBIKE never update NATed endpoint [#1492/Wofferl/Andrew]
- fix revival of IKE_AUTH (first) Child SA [Andrew]
- properly ignore dpdaction=, keyingtries= [Andrew]
- when reviving, install trap then block [Andrew]
- for auto=keep only retry once [Andrew]