summaryrefslogtreecommitdiff
path: root/debian/NEWS
diff options
context:
space:
mode:
authorYves-Alexis Perez <corsac@debian.org>2014-03-12 10:31:40 +0100
committerYves-Alexis Perez <corsac@debian.org>2014-03-12 10:56:08 +0100
commit72448f305c65fb08b0e8db0b56435a2486226f31 (patch)
treeb74656121dd9a129deff8e58913d6b317ea5933e /debian/NEWS
parent0932ba90885dd077017853610c42b49b125f68ba (diff)
downloadvyos-strongswan-72448f305c65fb08b0e8db0b56435a2486226f31.tar.gz
vyos-strongswan-72448f305c65fb08b0e8db0b56435a2486226f31.zip
Fix spurious entry in debian/NEWS.
* debian/NEWS: - fix spurious entry.
Diffstat (limited to 'debian/NEWS')
-rw-r--r--debian/NEWS32
1 files changed, 0 insertions, 32 deletions
diff --git a/debian/NEWS b/debian/NEWS
index af017f769..a1703e49b 100644
--- a/debian/NEWS
+++ b/debian/NEWS
@@ -65,35 +65,3 @@ strongswan (4.5.0-1) unstable; urgency=low
Local variables:
mode: debian-changelog
End:
-strongswan (5.1.0-1) unstable; urgency=low
-
- Starting with strongswan 4.5.0 upstream, the IKEv2 protocol is now the
- default. This can easily be changed using the keyexchange=ikev1 config
- option (either in the respective "conn" section or by putting it in the
- "default" section and therefore applying it to all existing connections).
-
- The IKEv2 protocol has less overhead, more features (e.g. NAT-Traversal by
- default, MOBIKE, Mobile IPv6), and provides better error messages in case
- the connection can not be established. It is therefore highly recommended
- to use it when the other side also supports it.
-
- Addtionally, strongswan 4.5.0-1 now enables support for NAT Traversal in
- combination with IPsec transport mode (the support for this has existed
- for a long time, but was disabled due to security concerns). This is
- required e.g. to let mobile phone clients (notably Android, iPhone)
- connect to an L2TP/IPsec gateway using strongswan. The security
- implications as described in the original README.NAT-Traversal file from
- the openswan distribution are:
-
- * Transport Mode can't be used without NAT in the IPSec layer. Otherwise,
- all packets for the NAT device (including all hosts behind it) would be
- sent to the NAT-T Client. This would create a sort of blackhole between
- the peer which is not behind NAT and the NAT device.
-
- * In Tunnel Mode with roadwarriors, we CAN'T accept any IP address,
- otherwise, an evil roadwarrior could redirect all trafic for one host
- (including a host on the private network) to himself. That's why, you have
- to specify the private IP in the configuration file, use virtual IP
- management, or DHCP-over-IPSec.
-
- -- Yves-Alexis Perez <corsac@debian.org> Mon, 30 Sep 2013 20:43:03 +0200