openswan-2.6.32-9.0.1.AXS4

Openswan is a free implementation of IPsec & IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow youto build secure tunnels through untrusted networks. Everything passing through the untrusted net is encrypted by the ipsec gateway machine and decrypted by the gateway at the other end of the tunnel. The resulting tunnel is a virtual private network or VPN.
This package contains the daemons and userland tools for setting up Openswan. It supports the NETKEY/XFRM IPsec kernel stack that exists in the default Linux kernel.
Openswan 2.6.x also supports IKEv2 (RFC4306)
Security issues fixed with this release:
CVE-2011-4073
Use-after-free vulnerability in the cryptographic helper handler functionality in Openswan 2.3.0 through 2.6.36 allows remote authenticated users to cause a denial of service (pluto IKE daemon crash) via vectors related to the (1) quick_outI1_continue and (2) quick_outI1 functions.
Fixed bugs:
- When the ports were defined and the host was defined with its hostname, openswan did not handle protocol and port configuration correctly. This has been fixed.
- Previously, very large security label strings received from a peer were being truncated but still used. Those truncated strings could happen to be valid, lead ing to incorrect policy. This has been fixed.
- Erroneous queuing of on-demand requests of setting up an IPsec connection was discovered in the IKEv2 (Internet Key Exchange) code. This is not intended and has been removed.
- Openswan would process the AH (Authentication Header) mode as if it was the ESP (Encrypted Secure Payload) mode, and then fail to set up AH mode security associations (SAs) because it was waiting for an encryption key. This has been fixed.
- If a specific port was configured, IPsec connections over a loopback interface did not work properly. This has been fixed.
- Enabled the CRL functionality flags on compilation so that openswan supportretrieving Certificate Revocation Lists (CRLs) from HTTP or LDAP CRL Distribution Points (CDPs).
- Corrected the README.x509 file to provide accurate information regarding the directories to be scanned for certification files. openswan now discovers all certificates.
- The Network Manager padlock icon was not cleared after a VPN connection terminated unexpectedly. This has been fixed.
- Openswan sent wrong IKEv2 (Internet Key Exchange) ICMP (Internet Control Message Protocol) selectors to an IPsec destination. This has been fixed.
- When an IP address had been removed from end of an established IPsec tunnel and the other end of the tunnel attempted to reuse the particular IP address to create a new tunnel, the Pluto daemon terminated unexpectedly with a segmentation fault. This has been fixed.
Enhancement:
- Added the iptable-save command, which uses only iptables and does not load kernel modules, unlike the ipsec barf and ipsec verify commands.