openikev2 ChangeLog ---------------------- Version 0.96 - 2011/01/19 ------------------------- o Support for several EAP methods for both, client and server. o Lots of bugfixes. o Solved building issues for new GCC versions. o Router Advertisement capabilities. o Experimental MOBIKE support (no documentation, read the code) Version 0.95 - 2008/02/20 ------------------------- o New experimental monitoring interface (openikev2_monitor application). o Changes to the configuration file format, in order to be adapted for the new configuration and authentication subsystems (see the example file). Version 0.94 - 2007/07/27 ------------------------- o Addded support for BTNS in the configuration file. o Addapted to the new libopenikev2 an libopenikev2_impl API (0.4 version). Version 0.93 - 2006/08/25 ------------------------- o No relevant changes. Addapted to the new libopenikev2 an libopenikev2_impl API (0.3 version). Version 0.92 - 2006/05/25 ------------------------- o Adapted the ConfigurerLibConfuse to the new Configuration API (using the AttributeMap values). o The statistical times have been improved. Now, rekeying times are also displayed and the no created IKE_SAs are hidden. o Now, openikev2 will check also for the kernel headers to avoid compilation errors. Version 0.91 - 2006/05/15 ------------------------- o Now there is a separate package for openikev2. o The changes listed here are against the openikev2 part of the OpenIKEv2-0.9 o Included a new option called "generate_allow_policies" in the "policies" section to set the propert policies to allow IKEv2 traffic. (see the openikev2.conf file in the samples directory to know more) o Now you can indicate "all" as the policy direction. In this case, the "in", "fwd" and "out" policies are created automatically. Be aware of specificate the policy in the same way that "out" direction. o Included a new option called "reauth_time" in the "ike" section to set the maximum time the responder wants to wait before peer forces a reauthentication. o Included a new option called "vendor_id" in the "general" section that allows to establish the VENDOR id to be sent. This vendor id must be a string. o Now, some debug statistical authentication times are calculated and printed when openikev2 finishes. o openikev2 now checks the effective UID in order to warn the user if it is not 0 (root permissions needed to run openikev2). o Bugs fixed. ---SPLIT---- OpenIKEv2 ChangeLog ------------------- Version 0.9 - 2006/05/02 ------------------------- * libopenikev2: o Certificate support. o Now it's possible to indicate a different authentication method for us and for the peer. In addition, we can indicate different PSK keys for each peer. o A warning message appears when the 1500 bytes IKE message limit is overflowed. If received message size exceeds 3000 bytes, the messsage is ommited. o Improved the authentication mechanism to support more authentication methods like PSK, CERT, RSA, ... o Some improvements in Thread subsystem in order to make it easier. o Policies : · Now is possible to indicate the policy priority in creation. · Now we can flush the policies database (SDP) and the SAs database (SAP). o Replaced the simple "extra" attribute by a more powerful mechanism of attribute storage (AttributeMap). o Some bugs fixed. * openikev2: o X509 certificate support and implemented the "HASH & URL" mechanism. o Some library version incompatibilities problems solved. o Use of http_fetcher library to download the certificates in the HASH & URL mechanims. o Now policies can be configured in the configuration file. It is useful to avoid the use of "setkey" or "ip xfrm" to set the policies. The policies needed to allow IKE traffic on IPv4 and IPv6 are installed automatically, so there is no need to indicate them in the configuration file. Also is allowed some kinds of ICMPv6 traffic for neighbour advertisements and solicitacions. Version 0.81 - 2006/03/30 ------------------------- * libopenikev2: o Bug fixed in message to event translation when error notify received in the EAP_INIT state. * openikev2: o Bug fixed in main function. In background mode there was an error dealing with threads and mutexes. o Now, openikev2 creates a file in the /var/run directory called openikev2.pid to avoid to have multiple instances running at the same time in the same machine. Version 0.8 - 2006/03/27 ------------------------ * libopenikev2: o Included EAP transport support. Note that all the EAP functionallity is out of this library scope. Concrete implementations should inherit from the EAP_Controller abstract class and implement the desired authentication method. We provide an EAP_Controller example using a MD5-Challenge authentication method (see openikev2). o Now, GeneralConfiguration class also has the "extra" attribute that allows to define new general configuration attributes dinamically. o Some bugs fixed. * openikev2: o EAP_Cotroller_OpenIKE implemented. This is a very experimental EAP controller class using MD5-Challenge authentication method. It shouldn't be used in real scenarios, so it doesn't provide Man-In-The-Middle protection and use a cleartext password file. o When Ctrl-C is pressed twice, openikev2 is forced to close. Sometimes, when Crtl-C is pressed, openikev2 may keep waiting so long for closing an IKE_SA. If you don't want to wait for that, you can press Ctrl-C another time in order to exit immediately. o Now, rfc822 identification type is allowed in the configuration file. o Some bugs fixed. Version 0.74 - 2006/03/17 ------------------------- * libopenikev2: o Adapted exchange collisions management to be compliant with the IKEv2 clarifications document version #07. o New notify payload management subsystem. Now it is possible to add dynamically new notification types and to define the associated behaviour to their processing from the libopenikev2 client applications (without recompile libopenikev2). This may be used to extend openikev2 to support MOBIKE (in example). o Notify payloads in INFORMATIONAL exchange processing added. o Improved INVALID_KE_PAYLOAD management in IKE_SA and CREATE_CHILD_SA rekeying. o Improved the dynamic address assignement subsystem. Added support of DHCP for address assignement. o Now IKE_Configuration and IPSEC_Configuration include a hash table that allows to define new configuration attributes dynamically. This method allows to use custom configuration attributes to be used in the custom notify payloads management. See UNAME example from openikev2 to see how to use. o Log output improvements. Better legibility of the log messages. o Some bug fixed and code cleanups. * openikev2: o NetworkControllerImpl_OpenIKE now supports to obtain a IPv4 address to be assigned from a DHCP server. In addition, when fixed address is used, it has a list of assigned addresses in order to avoid duplicated address assignements. o Now IPAddress_OpenIKE supports to resolve names that represents IPv6 addresses. o Included a new test NotifyController, called NotifyController_UNAME, that shows how the new notify payload management subsystem and extensible configuration attributes works. It uses the notification type 17000 and it is used to send "uname" information. o Now the initial thread pool size can be specified in the command line using the -p option. o Some bug fixed and code cleanups. * test: o Some bug fixed and code cleanups. Version 0.7 - 2006/01/18 ------------------------ * libopenikev2: o When initiator request a CHILD_SA REKEY and responder has that CHILD_SA already rekeyed or deleted, then the responder sends an NO_ADDITIONAL_SAS notify to avoid the exchange. If responder doesn't control that CHILD_SA, it sends INVALID_SPI notification (References: "IKEv2: invalid SPI in DELETE payload", Dec 2005, IETF IPsec mailing list). o All needed bus events (at the moment) are now sent thru the Event Bus. They allow receive IKE and CHILD SA notifications using the API. o Now all the CHILD SA SPI values are represented as an hexadecimal value. o Now, the IKE_SA_Controller::close() method is propertly implemented, so DELETE notifies are sent for all the CHILD SAs before closing the IKE_SA. o When a IKE_SA is closed without use the close() method, then all remaining CHILD_SAs are physically deleted before deleting the IKE_SA. o Some bugs fixed releted to address configuration code and multi-thread issues. * openikev2: o Now openikev2 shows its md5 checksum in the log output, in order to allow to know what version is being run. o IPSEC_Controller_PFKEYv2 has been hardly recoded. Now it can create and delete policies and its code is clearer. o Now log mask can be specified into configuration file. o Address configuration section has been added to the configuration file. o Now log implementation can be specified with "-l" option, log output file with "-o" option and ipsec implementation with "-i" option. *tests: o test_API example has been completed. It shows how use the libopenikev2 API to create and controls an IKE_SA. Version 0.62 - 2005/12/28 ------------------------- * libopenikev2: o Fixed some race conditions when a peer requests the creation of a CHILD_SA and the other peer requets a IKE_SA rekey at the same time. We use NO_ADDITIONAL_SAS notification (References: "Problem with exchanges collisions", Dec 2005, IETF IPsec mailing list). o When redundant IKE_SA are created, none of them are started until we know what is the winning one. This will be the only one that inherits the CHILD_SAs. o Some other bugs fixed. * tests: o Fixed some compilation problems with test_direction.cpp (related by Väisänen Teemu) Version 0.6 - 2005/12/12 ------------------------ * libopenikev2: o Retransmition time is increased after each retransmition with a configurable factor. o IPSEC_Controller allows create and delete IPSEC policies. o Better libopenikev2 and openikev2 decoupling. o Support and use of INVALID_IKE_SPI notifies. o IKE_SA_Controller has an Alarm to notify when it is "half open" too time. o Several bugs and memory leaks are fixed. o Detection and deletion of redundant IKE_SAs. * openikev2: o Now it uses the EventBus to determine when program must exit, using the ALL_SAS_CLOSED event. * tests: o New test_API test that shows how to use the libopenikev2 API inside any program to perform IKEv2 exchanges. Still not complete. Version 0.52 - 2005/11/17 ------------------------- * libopenikev2: o SA bundles removed due to code simplification. IKEv2 actually doesn't support them. o Support of Perfect Forward Secret in CHILD_SA creation. o New configuration subsystem has been included in libopenikev2. It allows to dynamically updates configuration to the API client applications. o New event bus subsystem is included into libopenikev2. It allows to receive system events (new IKE_SA, delete IKE_SA, IKE_SA creation success, IKE_SA creation failure, new CHILD_SA...) to the API client applications. * openikev2: o Finally the libconfig++ has been removed from the project. Now libconfuse is used to read and parse a more complex configuration file in openikev2. Version 0.5 - 2005/11/15 ------------------------ * libspike: o Name changed to libopenikev2. Now the library is implementation independent. All concrete implementations must be keeped out of the library. o SA bundles support. o Cookie mechanism support. o INFORMATIONAL exchange finished. Now we can delete SAs. o IKE_SA and CHILD_SA rekey support. o Detection and deletion of redundant CHILD_SAs. o Remote address configuration support. Roadwarrior scenario. o Now all the SAs lifetimes are jittered in order to avoid simultaneous rekeyings. * spike: o Name changed to openikev2. Now all the concrete implementations must be here (PF_KEY, POSIX Threads...) o Now IPSEC_Controller_PFKEY is independent of the libipsec library. o New IPSEC concrete implementation using XFRM. This implementation allows narrowing but it only can be used in Linux environments. o Removed the ECC support due to IPR issues. o Removed the extended MODP groups support due to IPR issues. o Now the libconfig++ library is added to the project, so there is no need to install it separatelly. Version 0.42 - 2005/08/06 ------------------------- * libspike: o Support of ECC groups using borzoi library. o Support of extended MODP groups. Version 0.4 - 2005/07/28 ------------------------- * spike: o Now we have a simple configuration file. Use of libconfig++ to read and parse it. o CREATE_CHILD_SA exchange finished. Now we can add new CHILD_SAs to an existing IKE_SA. Version 0.32 - 2005/07/11 ------------------------- * libspike: o Support of transport mode. Version 0.3 - 2005/05/05 ------------------------ * libspike: o First IKE_SA_INIT + IKE_AUTH exchange success. Only tunnel mode. o IPv6 suppport added and tested. Version 0.22 - 2005/04/25 ------------------------- * libspike: o IKE_SA_INIT exchange finished. o Designed a configuration subsystem. Version 0.2 - 2005/03/03 ------------------------- * spike: o Translated to english. o Splited into libspike (all classes), spike (main program) and test. o Implemented a lot of classes. o Still without functionality. Version 0.1 - 2005/01/31 ------------------------ * spike: o Project begins.