Version 0.9.14 of the X.509 patch has been released for freeswan-1.98b
and can be downloaded from
http://www.strongsec.com/freeswan
New features:
- In a connection definition an IP protocol and optionally
the source and/or destination ports can be specified. Example:
conn dhcp
right=%any
rightprotoport=udp/bootpc
left=%defaultroute
leftid=@pluto.strongsec.com
leftsubnet=0.0.0.0/0 #allows DHCP discovery broadcast
leftprotoport=udp/bootps
rekey=no
keylife=20s
rekeymargin=10s
auto=add
ipsec auto -status shows the following connection definition:
"dhcp": 0.0.0.0/0===160.85.106.10[@pulpo.strongsec.com]:17/67...%any:17/68
Important: KLIPS does not enforce these protocol/port restrictions so
that always the whole IP traffic is tunneled! Currently the protoport
parameter can be used as directions for an ipchains or iptables based
firewall, only. By means of the new environment variables
$PLUTO_MY_PROTOCOL, $PLUTO_PEER_PROTOCOL, $PLUTO_MY_PORT, and
$PLUTO_PEER_PORT, dynamical firewall rules can be set up and released
in a customized updown script (see next point below).
- The template utils/_updown.x509 can be used to dynamically insert and
delete firewall rules using iptables. The script also includes a facility
to log all established or disbanded VPN connections in a concise format.
- The new parameter "strictcrlpolicy" enforces a strict CRL policy.
With the ipsec.conf setting
config setup
strictcrlpolicy=yes
a received peer certificate will not be accepted if the corresponding
CRL is either not found in /etc/ipsec.d/crls or if the nextUpdate
date of the current CRL is reached and no new CRL has been made
available. Please be aware of the severe consequences of setting
strictcrlpolicy=yes. All connections will come to a sudden standstill
if you forget to update the CRL in time. The default setting is
strictcrlpolicy=no.
- The monitoring commands ipsec auto --listcerts | --listcacerts
now additionally list the size and the keyid of the RSA public key
contained in the certificate. The listing also indicates the possession
of a matching RSA private key.
Kind regards
Andreas
======================================================================
Andreas Steffen e-mail: andreas.steffen_at_strongsec.com
strongSec GmbH phone: +41 76 340 25 56
Alter Zürichweg 20 home: http://www.strongsec.com
CH-8952 Schlieren (Switzerland)
==========================================[strong internet security]==
_______________________________________________
Users mailing list
Users_at_lists.freeswan.org
http://lists.freeswan.org/mailman/listinfo/users
This archive was generated by hypermail 2.1.3 : Mon Jul 29 2002 - 05:20:25 CEST