Upcoming ipsec-tools 0.8.1

[dhatz]

http://sourceforge.net/mailarchive/forum.php?thread_name=20120829150102.08edec4c%40vostro&forum_name=ipsec-tools-devel

[Ipsec-tools-devel] time for 0.8.1 ?
From: Timo Teras <timo.teras@ik…>- 2012-08-23 11:55

Hi,

It's been almost 1.5 years since 0.8.0 was released. There's been only
a handful [see below] of commits to 0.8 branch, but some of them are
quite essential.

I'm planning to do 0.8.1 release tarball soon. Please yell if we need
to cherry-pick more commits, or you have pending things for the
0_8-branch.

Thanks,
Timo

ChangeLog for the 0.8 branch since 0.8.0 tagging:

2012-08-23  Timo Teras <timo.teras@…>* src/racoon/crypto_openssl.c: From Nakano Takaharu: Fix bignum
          memory allocation.

2012-01-01  Timo Teras <timo.teras@...>* src/racoon/isakmp_unity.c: From Rainer Weikusat
          <rweikusat@...>: Fix one byte too short memory
          allocation in isakmp_unity.c:splitnet_list_2str().

2011-11-17  Yvan Vanhullebus <vanhu@...>* src/racoon/handler.c: fixed some crashes in LIST_FOREACH where
          current element could be removed during the loop

2011-11-14  Timo Teras <timo.teras@...>* src/libipsec/pfkey.c: From Marcelo Leitner <mleitner@...>:
          do not shrink pfkey socket buffers (if system default is larger than
          what we want as minimum)

2011-08-12  Timo Teras <timo.teras@...>* src/racoon/privsep.c: Have privilege separation child process
          exit if the parent exits.

* Makefile.am: Create ChangeLog for proper CVS branch.

2011-03-18  tag ipsec-tools-0_8_0</timo.teras@...></mleitner@...></timo.teras@...></vanhu@...></rweikusat@...></timo.teras@...></timo.teras@…></timo.teras@ik…>

[dhatz]

Something seems to be moving afterall in the ipsec-tools front:

http://sourceforge.net/mailarchive/forum.php?thread_name=20121212115419.1e94b02b%40vostro&forum_name=ipsec-tools-devel

The patches applied since the original mail are:

2012-08-29  Timo Teras <timo.teras@…>* src/racoon/isakmp_inf.c: From Roman Hoog Antink <rha@...>:
          Accept DPD messages with cookies also in reversed order for
          compatiblity. At least Cisco 836 running IOS 12.3(8)T does this.

* src/racoon/oakley.c: From Roman Hoog Antink <rha@...>: add
          remote's IP address to the "certificate not verified" error message.

* src/racoon/oakley.c: From Roman Hoog Antink <rha@...>: do not
          print unnecessary warning about non-verified certificate when using
          raw plain-rsa.

* src/racoon/isakmp.c: From Rainer Weikusat
          <rweikusat@...>: Release unused phase2 of
          passive remotes after acquire.

* src/racoon/isakmp.c: From Wolfgang Schmieder
          <wolfgang.schmieder@...>: setup phase1 port properly.

* src/racoon/: cfparse.y, cftoken.l, racoon.conf.5: Allow inherited
          remote blocks without additional remote statements to be specified
          in a simpler way. patch by Roman Hoog Antink<rha@...></rha@...></wolfgang.schmieder@...></rweikusat@...></rha@...></rha@...></rha@...></timo.teras@…>

According to the discussion, there are two last patches to be committed any day now:

Attached patch is a somewhat smarter X509 subject name compare.
X509 names may contain entries with different encodings (like UTF-8)
The old code (some copy from the ancient openssl 0.9.7 release)
did not handle that.
The new code does only handle stripping of the wildcards from the name
and let openssl do the compare of all non wildcard entries…

And another patch to check that building ipsec-tools is done with a reasonably recent OpenSSL 0.9.7 or newer