Component: ipsec
296 changelog entries across 97 version(s)
Activity over time (changelog entries per month)
- fixed CHACHA20 typo in log messages;
- support Post-Quantum Pre-shared Key (PPK) with QKD integration (CLI only);
- fixed degraded IPsec performance for IPQ-6010 (introduced in v7.17);
- move raw RSA keys to /ip/ipsec/key/rsa;
- fixed responder on key exchange compute failure (introduced in v7.19);
- fixed system failure on MMIPS devices when using IPsec services;
- lower standalone cipher, hash priority when using ctr aead;
- added hardware acceleration support for hEX refresh;
- fixed chacha20 poly1305 proposal;
- fixed installed SAs update process when SAs are removed;
- fixed chacha20 poly1305 proposal;
- fixed installed SAs update process when SAs are removed;
- ike2 improved process for policies;
- changed default dpd-interval from 2 minutes to 8 seconds and dpd-maximum-failures from 5 to 4;
- improved installed SA statistics update;
- fixed Diffie-Hellman public value encoding size;
- fixed IPSec policy when using modp3072;
- fixed minor typo in logs;
- reduce disk writes when started without active configuration;
- fixed IPSec policy when using modp3072;
- fixed public key export (introduced in v7.10);
- fixed signature authentication using secp521r1 certificate (introduced in v7.10);
- improved IKE2 rekey process;
- properly check ph2 approval validity when using IKE1 exchange mode;
- added hardware acceleration support for IPQ-5010 (hAP ax lite);
- refactor public key authentication;
- removed "ec2n185" and "ec2n155" values from proposal configurations;
- added error log message when peer ID does not match certificate;
- fixed packet processing by hardware encryption engine on RB850Gx2 device;
- refactor X.509 implementation;
- added support for "Framed-Route" RADIUS attribute support;
- do not match incoming IKE requests by unresolved DNS name peers;
- fixed peer matcher for incoming connection with unresolved DNS;
- added "current-address" parameter for peers with DNS address;
- added hardware acceleration support for IPQ-6010;
- added support for AVX optimized SHA acceleration;
- improved "H" (hw-aead) flag presence for accelerated SA's;
- improved IKE payload processing;
- improved configuration of IPsec proposal auth-algorithms;
- removed Blowfish and Camellia encryption algorithms for IKE;
- added "invalid-packets" counter for Installed SA's menu;
- fixed packet processing by hardware encryption engine on MMIPS devices;
- fixed IPsec IRQ initialization on startup on TILE;
- fixed printing of active peer statistics;
- added hardware acceleration support for CCR2116;
- fixed "identities" menu emptying after RouterOS upgrade/reboot;
- fixed memory leak when processing DHCP packets;
- improved SA update by SPI;
- improved system stability on CHR;
- improved system stability on MMIPS devices;
- improved SA update by SPI;
- fixed SA address parameter exporting;
- fixed SA address parameter exporting;
- improved stability when processing IPv6 packets larger than interface MTU;
- added SHA384 hash algorithm support for phase 1;
- do not kill connection when peer's "name" or "comment" is changed;
- fixed client certificate usage when certificate is renewed with SCEP;
- fixed multiple warning message display for peers;
- inactivate peer's policy on disconnect;
- refresh peer's DNS only when phase 1 is down;
- do not update peer endpoints for generated policy entries (introduced in v6.47);
- added "split-dns" parameter support for mode configuration;
- added "use-responder-dns" parameter support;
- allow specifying two peers for a single policy for failover;
- control CRL validation with global "use-crl" setting;
- do full certificate validation for identities with explicit certificate;
- fixed minor spelling mistake in logs;
- improved IPsec service stability when receiving bogus packets;
- place dynamically created IPsec policies by L2TP client at the begining of the table;
- improved system stability when handling fragmented packets;
- improved system stability when handling fragmented packets;
- improved system stability when processing decrypted packet on unregistered interface;
- improved system stability when processing decrypted packet on unregistered interface;
- added "error" topic for identity check failure logging messages;
- fixed DNS resolving when domain has only AAAA entries;
- fixed policy "sa-src-address" detection from "local-address" (introduced in v6.45);
- allow inline "passphrase" parameter when importing keys;
- fixed minor spelling mistakes in logs;
- allow inline "passphrase" parameter when importing keys;
- fixed "eap-radius" authentication method (introduced in v6.45);
- fixed minor spelling mistakes in logs;
- added "connection-mark" parameter for mode-config initiator;
- allow peer argument only for "encrypt" policies (introduced in v6.45);
- fixed peer configuration migration from versions older than v6.43 (introduced in v6.45);
- improved stability for peer initialization (introduced in v6.45);
- show warning for policies with "unknown" peer;
- added dynamic comment field for "active-peers" menu inherited from identity;
- added "ph2-total" counter to "active-peers" menu;
- added support for RADIUS accounting for "eap-radius" and "pre-shared-key-xauth" authentication methods;
- added traffic statistics to "active-peers" menu;
- disallow setting "src-address" and "dst-address" for transport mode policies;
- do not allow adding identity to a dynamic peer;
- fixed policies becoming invalid after changing priority;
- general improvements in policy handling;
- properly drop already established tunnel when address change detected;
- renamed "remote-peers" to "active-peers";
- renamed "rsa-signature" authentication method to "digital-signature";
- replaced policy SA address parameters with peer setting;
- use tunnel name for dynamic IPsec peer name;
- fixed freshly created identity not taken in action (introduced in v6.44);
- fixed possible configuration corruption after import (introduced in v6.44);
- allow identities with empty XAuth login and password if RADIUS is enabled (introduced in v6.44);
- fixed dynamic L2TP peer and identity configuration missing after reboot (introduced in v6.44);
- use "remote-id=ignore" for dynamic L2TP configuration (introduced in v6.44);
- fixed all policies not getting installed after startup (introduced in v6.43.8);
- fixed stability issues after changing peer configuration (introduced in v6.43);
- added account log message when user is successfully authenticated;
- added basic pre-shared-key strength checks;
- added new "remote-id" peer matcher;
- allow to specify single address instead of IP pool under "mode-config";
- fixed active connection killing when changing peer configuration;
- fixed all policies not getting installed after startup (introduced in v6.43.8);
- fixed stability issues after changing peer configuration (introduced in v6.43);
- hide empty prefixes on "peer" menu;
- improved invalid policy handling when a valid policy is uninstalled;
- made dynamic "src-nat" rule more specific;
- made peers autosort themselves based on reachability status;
- moved "profile" menu outside "peer" menu;
- properly detect AES-NI extension as hardware AEAD;
- removed limitation that allowed only single "auth-method" with the same "exchange-mode" as responder;
- require write policy for key generation;
- accept only valid path for "export-pub-key" parameter in "key" menu;
- accept only valid path for "export-pub-key" parameter in "key" menu;
- fixed hw-aead (H) flag presence under Installed SAs on startup;
- improved stability when uninstalling multiple SAs at once;
- properly handle peer profiles on downgrade;
- properly update warnings under peer menu;
- fixed hw-aead (H) flag presence under Installed SAs on startup;
- improved stability when uninstalling multiple SAs at once;
- properly update warnings under peer menu;
- allow multiple peers to the same address with different local-address (introduced in v6.43);
- improved invalid policy handling when a valid policy is uninstalled;
- improved stability when using IPsec with disabled route cache;
- added "responder" parameter for "mode-config" to allow multiple initiator configurations;
- added "src-address-list" parameter for "mode-config" that generates dynamic "src-nat" rule;
- added warning messages for incorrect peer configuration;
- do not allow removal of "proposal" and "mode-config" entries that are in use;
- fixed AES-192-CTR fallback to software AEAD on ARM devices with wireless and RB3011UiAS-RM;
- fixed AES-CTR and AES-GCM key size proposing as initiator;
- fixed "static-dns" value storing;
- improved invalid policy handling when a valid policy is uninstalled;
- improved reliability on generated policy addition when IKEv1 or IKEv2 used;
- improved stability when using IPsec with disabled route cache;
- install all DNS server addresses provided by "mode-config" server;
- separate phase1 proposal configuration from peer menu;
- use monotonic timer for SA lifetime check;
- fixed policies becoming invalid if added after a disabled policy;
- fixed "sa-src-address" deduction from "src-address" in tunnel mode;
- improved invalid policy handling when a valid policy is uninstalled;
- improved reliability on IPsec hardware encryption for RB1100Dx4;
- fixed policies becoming invalid if added after a disabled policy;
- improved reliability on IPsec hardware encryption for ARM devices except RB1100Dx4;
- fixed AES-CTR and AES-GCM support on RB1200;
- improved single tunnel hardware acceleration performance on MMIPS devices;
- properly detect interface for "mode-config" client IP address assignment;
- fixed incorrect esp proposal key size usage;
- properly update IPsec secret for IPIP/EoIP/GRE dynamic peer;
- properly update IPsec secret for IPIP/EoIP/GRE dynamic peer;
- added DH groups 19, 20 and 21 support for phase1 and phase2;
- allow to specify "remote-peer" address as DNS name;
- fixed incorrect esp proposal key size usage;
- fixed policy enable/disable;
- improved hardware accelerated IPSec performance on 750Gr3;
- improved reliability on certificate usage;
- renamed "firewall" argument to "notrack-chain" in peer configuration;
- skip invalid policies for phase2;
- fixed lost value for "remote-certificate" parameter after disable/enable;
- do not deduct "dst-address" from "sa-dst-address" for "/0" policies;
- kill PH1 on "mode-config" address failure;
- do not deduct policy src/dst address for tunnel policies;
- fixed generated policy priority;
- fixed peer "my-id" address reset;
- fixed generated policy priority;
- fixed peer "my-id" address reset;
- renamed "remote-dynamic-address" to "dynamic-address";
- added "last-seen" parameter to active connection list;
- allow mixing aead algorithms in proposal;
- better responder flag calculator for console;
- disallow AH+ESP combined policies ;
- do not loose "use-ipsec=yes" parameter after downgrade;
- enable aes-ni on i386 and x64 for cbc, ctr and gcm modes;
- fixed "/ip ipsec policy group export verbose";
- fixed "mode-cfg" verbose export;
- fixed SA authentication flag;
- renamed "hw-authenc" flag to "hw-aead";
- show hardware accelerated authenticated SAs;
- updated tilera classifier for UDP encapsulated ESP;
- deducted policy SA src/dst address from src/dst address;
- do not require "sa-dst-address" if "action=none" or "action=discard";
- fixed SA address check in policy lookup;
- hide SA address for transport policies;
- keep policy in kernel even with bad proposal;
- kill ph2 on policy removal;
- updated/fixed Radius attributes;
- added ability to kill particular remote-peer;
- fixed flush speed and SAs on startup;
- fixed peer port export;
- port is used only for initiators;
- fixed kernel failure on tile with sha256 when hardware encryption is not being used;
- added ability to specify static IP address at "send-dns" option;
- added ph2 accounting for each policy "/ip ipsec policy ph2-count";
- allow to specify explicit split dns address;
- changed logging topic from error to debug when empty pfkey messages are received;
- do not auto-negotiate more SAs than needed;
- ensure generated policy refers to valid proposal;
- fixed camellia crypto algorithm module loading;
- fixed IPv6 remote prefix;
- fixed kernel failure on tile with sha256 when hardware encryption is not being used;
- fixed peer configuration my-id IPv4 address endianness;
- fixed ph2 auto-negotiation by checking policies in correct order;
- load ipv6 related modules only when ipv6 package is enabled;
- make generated policies always as unique;
- non passive peers will also establish SAs from policy without waiting for the first packet;
- optimized logging under ipsec topic;
- show active flag when policy has active SA;
- show SA "enc-key-size";
- split "mode-config" and "send-dns" arguments;
- changed logging topic from error to debug for ph2 transform mismatch messages;
- fixed crash with enabled fragmentation;
- fixed dynamic policy not deleted on disconnect for nat-t peers;
- fixed fragmentation use negotiation;
- fixed kernel crash when sha512 was used;
- don't log authtype mismatch as critical;
- fixed xauth parameter printing in terminal;
- add dead ph2 detection exception for windows msgid noncompliance with rfc;
- added dead ph2 reply detection;
- don't register temporary ph2 on dead list;
- fix initiator modecfg dynamic dns;
- fixed AH with SHA2;
- fixed checks before accessing ph1 nat options;
- fixed mode-config export;
- fixed route cache overflow when using ipsec with route cache disabled;
- fixed windows msgid check on x86 devices;
- show remote peer address in error messages when possible;
- store udp encapsulation type in proposal;
- fixed mode-config export;
- fixed route cache overflow when using ipsec with route cache disabled;
- better flush on proposal change;
- fixed crash on policy update;
- always re-key ph1 because it was possible that ph1 without DPD would expire;
- better flush on proposal change;
- fixed crash on policy update;
- fixed fast ph2 SA addition;
- fixed larval SA refresh for display;
- fixed multiple consecutive dynamic policy flush;
- take into account ip protocol in kernel policy matcher;
- fix console peer aes enc algorithm display;
- fixed kernel failure after underlying tunnel has been disabled/enabled;
- improved TCP performance on CCRs;
- allow my-id address specification in main mode;
- prioritize proposals;
- support multiple DH groups for phase 1;
- fix phase2 hmac-sha-256-128 truncation len from 96 to 128
- make sure that dynamic policy always has dynamic flag;
- fixed active SAs flushing;
- force flow cache validation once in 1h;
- fix set on multiple policies which could result in adding non existent dynamic policies to the list;
- fix transport mode ph2 ID ports when policy selects specific ip protocol on initiator;
- use local-address for phase 1 matching and initiation;
- fix replay window, was accidentally disabled since version 6.30;
- fixed kernel failure when packets were not ordered on first call;
- fix sockaddr buf size on id generation for ipv6 address;
- added compatibility option skip-peer-id-check;
- fix potential memory leak;
- use local-address for phase 1 matching and initiation;
- fix transport mode ph2 ID ports when policy selects specific ip protocol on initiator;
- fixed crash in when gcm encryption was used
- disallow changing dynamic peer;
- fail ph2 negitioation when initiator proposed key length
- increase replay window to 128;
- allow to specify custom IP address for my_id parameter;
- fixed crash that happened in specific situation;
- fix downgrade problem to v5;
- disallow template-policy-group=none in peer config and set it to 'default';
- support fqdn as my id;
- allow binding modeconf address to username;
- when peer config is changed kill only relevant SAs;
- fix addition of default policy template;
- fix AH proposal and problem when sometimes policy was not generated;
- allow multiple encryption algorithms per peer;
- support IPv4 over IPv6 and vice versa;
- fix aes-cbc hardware acceleration on CCR with key sizes 192 and 256;
- added aes-gcm icv16 encryption mode;
- added aes-ctr encryption mode;
- added sha256 and sha512 support;
- proposal defaults changed to aes-128 and sha1 for both phase1 and phase2;
- fix policy bypass on IPv6 gre, ipip, eoip tunnels when policy
- fix peer mathing with non byte aligned masks;
- fixed peer address matching;
- fix phase1 autonegotiation on little endian platforms;
- for peers with full IP address specified system will
- added /peer passive option which will prevent starting ISAKMP negotiation
- added pre-shared-key-xauth and rsa-signature-hybrid
- support authorization with raw RSA keys;
- new exchange mode (main-l2tp) for l2tp tunnel users to allow
- fixed problem of RB1200 rebooting when large amount of UDP traffic is