According to RFC 5996, we MAY send an INFORMATIONAL message having an
AUTHENTICATION_FAILED. We don't do any retransmits, though, but just close
the IKE_SA after one message has been sent, avoiding the danger that an
unauthenticated IKE_SA stays alive.
While this was problematic in earlier releases, it seems that it works just
fine the way we handle compression now. So there is no need to disable it over
NATed connections or when using forceencaps.
If uses of dlopen(), e.g. when loading plugins, produce errors an error
string could get allocated dynamically. At this point realloc() might not
yet be resolved and when dlsym() is later called by leak detective to do
so the error string might get freed while leak detective is disabled and
real_free() will be called with a pointer into one of leak detective's
memory blocks instead of a pointer to the block itself, causing a SIGSEGV.
The previous code did not properly check for the situation when the
DELETE for a redundant CHILD_SA created by a responder during a
CHILD_SA rekey collision arrives before the responder's answer to the
initiator's winning CREATE_CHILD_SA request.
Improves how plugin loader resolves dependencies between plugins. The
old loader had problems if plugins had dependencies on features provided
by plugins listed later in the plugin list. For instance, it was not
possible to use the X.509 implementation provided by the x509 plugin
while using all the crypto primitives provided by the openssl plugin.
Because the x509 plugin has a dependency on SHA1, the old loader skipped
that plugin until it loaded a SHA1 implementation. Because the loader
also loaded all features with resolved dependencies provided by a specific
plugin it would, while loading the openssl plugin's SHA1 implementation,
also load its X.509 implementation. So to use the x509 plugin it was
necessary to load the sha1 plugin before it so that its dependencies
could be properly resolved.
With the new implementation the plugins don't have to be in a specific
order to resolve dependencies. But the order still matters if two
plugins provide the same feature.
Also, support for the get_features() interface was added to all plugins.
With the new implementation the plugins don't have to be listed in any
special order, dependencies are properly resolved. The order only
matters if two plugins provide the same feature.
Martin Willi