The Libreswan Project has released libreswan 5.3

This is a maintenance release. It allows re-using an IKEv1
lease address on multiple connections along with improved
"cisco split VPN" support. X.509 Certificate code was
revised to only use the NSS IPsec profile and no longer
uses the SSL profile and the CRL code was updated.

This latest version of libreswan can be downloaded from:

https://download.libreswan.org/libreswan-5.3.tar.gz
https://download.libreswan.org/libreswan-5.3.tar.gz.asc

The full changelog is available at: https://download.libreswan.org/CHANGES

Please report bugs either via one of the mailinglists or at our github
bug tracker:

https://lists.libreswan.org/
https://github.com/libreswan/libreswan/issues

See also https://libreswan.org/

v5.3 (July 3, 2025)

• PKIX (Public Key Infrastructure X.509)
  • moved cURL and LDAP CRL download code out of pluto [Andrew]
  • replaced CRL thread with libevent [Andrew]
  • fixed ipsec checkcrls [Andrew]
  • when configured, use cURL to download LDAP CRLs [Andrew]
  • verify using NSS's IPsec profile aka certificateUsageIPsec [Andrew]
  • only verify using certificateUsageSSL{Client,Server} when USE_NSS_TLS_SECURITY_PROFILE [Andrew]
• IKEv2:
  • fix PEXPECT when deleting crossed IKE SA [Andrew, Ilya Maximets #2101, Ondrej Moris #2123]
• IKEv1:
  • fix CISCO's split support (requires cisco-split=yes) [Andrew, Amirreza #2230 Erikas #633]
  • share-lease=yes|no (default yes) to share XAUTH/ModeCfg lease IP on multiple connections [Paul]
• initsystem:
  • remove unused _stackmanager [Tuomo #2080]
  • on BSD, default to syslog(LOG_NOTICE) and not pluto.log [Andrew #2295 #2298]
• config:
  • merge addconn (ipsec.conf) and whack connection option parsers [Andrew]
  • change whack to use same connection defaults as ipsec.conf [Andrew]
  • support ipsec addconn --name connname left=1.2.3.4 right=5.6.7.8 (experimental) [Andrew #2138]
  • drop undocumented ipsec readwriteconf --rootdir option [Andrew, #2152]
  • obsoleted virtual_private= and plutostderrlog= keywords [Tuomo]
  • warn when END-option= has no END [Andrew #663]
  • nflog= made an alias to nflog-group= [Andrew]
  • recognize ah=... as phase2=ah phase2alg=... [Andrew #712]
• ipsec pluto:
  • make ipsec.conf's config setup and pluto options consistent [Andrew]
  • fix --config file1 --config file2 [Andrew]
• ipsec connectionstatus:
  • support ipsec connectionstatus '"labeled"[1][2]' [Andrew #1308]
• testing:
  • eliminated all pyOpenSSL dependencies [Andrew]
  • review PKIX test coverage [Andrew]
  • upgrade Fedora test domain to f42
• building:
  • build with curl 8.14.1 [Andrew, Vincent #2319]

The Libreswan Project has released libreswan 5.2

This is a feature release. It adds support for RFC 5723 Session
Resumption, RFC 9347 IPTFS and draft-ietf-ipsecme-ikev2-qr-alt
protocol extensions. It adds support for ipsec interfaces on the
BSDs and improves the Linux ipsec interface support.

It fixes an interop issue with iOS/OSX IKEv1 padding interop,
supports Linux kernel 6.10+ requirements and other minor
bugfixes and features.

This latest version of libreswan can be downloaded from:

https://download.libreswan.org/libreswan-5.2.tar.gz
https://download.libreswan.org/libreswan-5.2.tar.gz.asc

The full changelog is available at: https://download.libreswan.org/CHANGES

Please report bugs either via one of the mailinglists or at our github
bug tracker:

https://lists.libreswan.org/
https://github.com/libreswan/libreswan/issues

See also https://libreswan.org/

v5.2 (Feb 26, 2025)

• IKEv2:
  • add PPK in INTERMEDIATE exchange, draft-ietf-ipsecme-ikev2-qr-alt-04 [Vukasin]
  • add initial support for RFC 5723 IKE_SESSION_RESUME [Nupur Agrawal, Andrew]
  • fix crash in <> [Andrew, Ilya Maximets #1894]
  • fix bogus ERROR when deleting connection [Andrew, Ilya Maximets #1914]
• IPsec Interface:
  • add support on FreeBSD, NetBSD and OpenBSD [Andrew]
  • add ipsec-interface-managed=no for namespaces [Andrew]
• IKEv1:
  • removed compile-time SOFTREMOTE_CLIENT_WORKAROUND [Andrew]
  • fix INVALID_ID_INFORMATION response using corrupt IV [Andrew #1830]
  • fix reconnect with addresspool after restart [Andrew #1790]
  • fix padding of modecfg payloads [Andrew wmasilva #2023]
  • update ikepad= to allow {yes,no,auto} [Andrew]
• Linux:
  • packet offload counters supported in 6.7+ [Paul]
  • Add IPTFS support (RFC 9347) [Paul / Antony / Andrew]
  • 6.10+ need replay-window 0 on OUTBOUND SA [Paul]
  • Do not set nopmtudisc on inbound SA [Paul]
  • Set DSCP options only on the relevant direction SA [Paul]
• updown:
  • Use half-routes for IPv6 to cover whole address space #1994 [Tuomo]
  • Use sourceip= for all remote subnets when set [Tuomo]
• whack/addconn:
  • fix "duplicated flag ctlsocket" regression in 5.0 #1840 [Andrew, Ilya Maximets #1840]
  • orders of magnitude speedup of 'ipsec add' w/ protoports= [Ilya Maximets #1987]
• building:
  • fix build with USE_LIBCURL=false [Hans de Graaff #1845, Andrew]
  • fix build on OpenBSD 7.6 [Andrew]
  • fix build with GCC 15 / C 23 [Daiki Ueno]
  • fix init script on Alpine [Andrew #2042]
• testing:
  • update OpenBSD: 7.6; NetBSD: 10.1; FreeBSD: 14.2; Alpine: 3.21 [Andrew]
  • eliminate pyOpenSSL dependency when generating CRLs and PKCS12 files [Andrew #1990 #1996]

The Libreswan Project has released libreswan 5.1

This is a bugfix release. Most importantly, a fix to work properly with
Linux 6.9+ kernels, and a workaround for a but in reconnecting iOS/OSX
clients that use IKEv1 with XAUTH/ModeConfig. The handling of ipsec
interfaces was improved as well.

This latest version of libreswan can be downloaded from:

https://download.libreswan.org/libreswan-5.1.tar.gz
https://download.libreswan.org/libreswan-5.1.tar.gz.asc

The full changelog is available at: https://download.libreswan.org/CHANGES

Please report bugs either via one of the mailinglists or at our github
bug tracker:

https://lists.libreswan.org/
https://github.com/libreswan/libreswan/issues

See also https://libreswan.org/

v5.1 (Oct 8, 2024)

• IKEv2:
  • fix race when initiator-responder cross rekey requests [Andrew]
  • don't ignore Delete IKE SA request while waiting for Delete IKE SA response [Andrew]
  • log arrival of first IKE_AUTH request that triggers DH [Andrew]
  • rate limit logging of packets with invalid payloads
• IKEv1:
  • fix Quick mode installing 0.0.0.0/0 when no MSG_CONFIG exchange [Andrew, Tuomo]
  • fix iOS Quick mode request needing to re-recover lease [Andrew, Tuomo]
  • fix regression where deleting ISAKMP deleted IPsec [Andrew, Tuomo]
  • add config options of ah=sha2{256,512} [Andrew]
  • add DH29,DH31 to default proposals [Andrew]
  • reject ESP AEAD combined with non-NULL integrity [Andrew]
• Crypto:
  • update IKE to use NSS's FIPS compliant PK11_AEADOp() [Andrew, Robert Relyea]
  • support ESP with CHACHA20POLY1305 on FreeBSD and OpenBSD [Andrew]
• IPsec Interface:
  • fix check for an existing IPsec Interface address (Linux) [Wolfgang]
  • add IPsec Interface address when connection establishes [Wolfgang]
  • fix adding IPv6 address to IPsec interface [Wolfgang]
  • delete Ipsec Interface address when connection unroutes [Wolfgang]
  • fix setting metric on IPsec Interface [Wolfgang]
  • add IPsec Interface device when connection orients [Andrew]
  • support existing IPsec interface on FreeBSD and OpenBSD [Andrew]
  • log addition of IPsec Interface or Address [Andrew]
  • don't delete existing ipsec1 interface (Linux) [Andrew]
  • handle repeated connection adds [Wolfgang]
• Linux:
  • handle NLMSG_DONE at end of response for > 6.9.0 kernels [Andrew]
  • fix hang because of unhandled NLMSG_DONE at end of response (6.9.0-rc1) [Andrew, Ilya, github/1675]
  • fix hang when initiating an on-demand TCP connection [Daiki, github/1156]
• updown:
  • restore 4.x behaviour of running "updown unroute|down" when initiate fails [Wolfgang, Andrew]
  • add test demonstrating redundant tunnels [Wolfgang]
  • add plutodebug=updown for debugging updown scripts [Andrew]
• config:
  • verbosely ignore x-* style comments in ipsec.conf [Andrew, github/1725]
• whack:
  • ignore older whack as could trigger core dump [Andrew, github/1709]
  • add --narrowing {yes,no}, retain undocumented --allow-narrowing [Andrew]
• building:
  • replace calloc(size,nr) with alloc_things(), fixing compile error [Daiki]
  • remove USE_NSS_AVA_COPY and copy of nss source, remove license exception [Tuomo]
  • fix syntax error in ckaid.c allowed by GCC [yuncang123]

This is major version release with some incompatible changes in default options.

• IKEv1:
  • globally disabled by default (ikev1-policy=drop); see RFC9395 [Daniel]
  • limit default cryptosuite [Andrew, Paul, Tuomo]
    IKE={AES_CBC,3DES_CBC}-{HMAC_SHA2_256,HMAC_SHA2_512HMAC_SHA1}-{MODP2048,MODP1536,DH19,DH31}
    ESP={AES_CBC,3DES_CBC}-{HMAC_SHA1_96,HMAC_SHA2_512_256,HMAC_SHA2_256_128}-{AES_GCM_16_128,AES_GCM_16_256}
    AH=HMAC_SHA1_96+HMAC_SHA2_512_256+HMAC_SHA2_256_128
  • remove support for Labeled IPsec [Andrew]
  • properly ignore dpdaction= [Andrew]
  • see also IKEv2 routing/revival changes
• IKEv2:
  • warn that fragmentation=force is ignored [Andrew]
  • avoid post-authentication crash on corrupt TS payload [Andrew]
  • support addresspool=v4/mask,v6/mask [Andrew]
  • support subnet=SELECTOR,... using a single Child SA [Andrew]
  • when non-MOBIKE never update NATed endpoint [#1492/Wofferl/Andrew]
  • fix revival of IKE_AUTH (first) Child SA [Andrew]
  • properly ignore dpdaction=, keyingtries= [Andrew]
  • when reviving, install trap then block [Andrew]
  • for auto=keep only retry once [Andrew]
  • when redirect fails, fall back to revival [Andrew]
• Linux:
  • HW packet offload support [Raed Salem raeds@nvidia.com,Paul]
  • XFRM interface IP management with ref-counting [Brady Johnson]
  • fix IPcomp with XFRM interfaces [Wolfgang]
• BSD:
  • fix esp=aes_gcm [github/1220, Igor V. Gubenko, Andrew]
• whack:
  • review ipsec-whack.8 [Tuomo, Andrew, Paul]
  • change defaults to match addconn [Andrew]
  • add --{rekey,delete,down}-{ike,child} --name [Andrew]
  • match whack and addconn option names [Andrew]
  • drop NNN_ prefix from all output [Andrew]
• config (ipsec.conf, addconn):
  • update ipsec.conf.5 [Tuomo, Andrew, Paul]
  • log ipsec.conf errors and warnings in Pluto [Andrew]
  • <<include {a,b,c}.conf>> no longer supported [Andrew]
  • fix keyexchange={ikev1,ikev2}; deprecate ikev2= [Andrew]
  • remove nic-offload=auto option, only accept packet,crypto,yes [Paul]
  • warn when converting legacy ",," to "," in {left,right}id= [Andrew]
  • change also= to expand inline (more like C's #include) [Andrew]
  • fix KEYWORD= sometimes causing Pluto to exit [Andrew]
  • parse <<KEYWORD=>> as <<KEYWORD=''>>, i.e., empty [Andrew]
  • warn when, within a conn, there are duplicate keys [Andrew]
  • add encap-dscp= [Wolfgang]
  • implement interface-ip= [Brady]
  • implement subnet=SELECTOR,SELECTOR,... [Andrew]
  • default ikev1-policy to drop [Daniel]
  • add ppk-ids= [Vukasin]
  • add experimental per-connection debug= [Andrew]
  • drop obsolete forceencaps= [Andrew]
  • add groundhog= [Andrew]
  • reject non-numeric sourceip= [Andrew]
  • fix crash when dpdtimeout= missing [Andrew]
• building:
  • remove dependency on libxz via libsystemd [Tuomo Andrew]
  • use INSTALL_INITSYSTEM=false to prevent update of /etc/ [Andrew]
  • use INSTALL_CONFIGS=false prevents update of /etc/ipsec.d et.al. [Andrew]
  • drop FINAL* make variables; see mk/config.mk for alternatives [Andrew]
  • remove old copy of unbound headers [Andrew]
  • use DESTDIR instead of FINAL* env vars [Andrew]
  • fix "make git-rpm" [Paul/Tuomo]
  • check return values of libcap-ng functions [Paul]
  • don't call ischar(signed char) [Andrew]
• packaging:
  • fix Debian systemd service install [Antonio Silva]
• testing:
  • fix namespace tests for super long dir names [Paul]
  • add Alpine, Debian, NetBSD and FreeBSD KVMs [Andrew]
  • add Alpine, Debian, NetBSD, FreeBSD and OpenBSD to nightly builds [Andrew]
  • add man pages to nightly build [Andrew]
• initsystem:
  • use documented ipsec sub-commands [Tuomo]
  • stop using _stackmanager [Tuomo]
• documentation:
  • update to docbook xml 4.5 [Tuomo]
  • re-org pages adding libreswan.5 [Andrew]
• ipsec utilities:
  • ipsec auto sub-command: deprecate [Tuomo]
  • ipsec auto --{cmd} connection -> ipsec {cmd} connection [Tuomo]
  • ipsec look: script moved to contrib/; use ip xfrm et.al. [Andrew]
  • ipsec portexcludes: script moved to contrib/ [Andrew]
  • ipsec barf: script moved to contrib/ [Andrew]
  • ipsec _secretsensor: script moved to contrib/ [Andrew]
  • ipsec show: drop ipsec subcommand (old, incomplete) [Paul]
  • ipsec verify: drop ipsec subcommand (old, incomplete) [Paul]

has fix to CVE-2024-3652

Address CVE-2024-3652

this is where 5.0 was cut from mainline

The first pre-release of the libreswan 5.x series. Please test and give us feedback. Read the CHANGES file and the updated man pages for any incompatibility changes between 4.x and 5.x

This is a medium risk security release.
All CVEs addressed in this release require the peer to successfully authenticate before it can start a Denial of Service attack.

Fix for medium security CVE-2023-30570