v3.14 (August 11, 2015)
* NSS: Major rewrite of PRF / PRFPLUS / integrity functions for FIPS [Andrew]
* FIPS: Added programs/pluto/cavp for NIST CVAS testing [Andrew]
* IKEv2: RFC 7383 IKEv2 Fragmentation support [Herbert/Hugh]
* IKEv2: RFC 7619 Auth Null support (authby=null) [Paul/Antony/Hugh]
* IKEv2: RFC 7619 ID Null support (leftid=%null) [Paul/Antony/Hugh]
* IKEv2: whack and smc related time out fixes [Antony]
* IKEv2: rekey, expire, delete refactoring and fixes [Antony]
* IKEv2: do not pad IKE messages (fix interop w. InsideSecure) [Paul]
* IKEv2: Fix esp=camellia to use the IKEv2 IANA registry number for ESP [Paul]
* IKEv2: Fix memory leaks in addresspool and child exchange sadb [Antony]
* IKEv2: Support for INVALID_KE DH group re-transmits [Paul/Hugh]
* IKEv2: if applicable, add CERTREQ payload to IKE_SA_INIT response [Antony]
* IKEv2: Various memory leak fixes [Hugh]
* IKEv2: Delete parent/child SA when IPsec SA expires due inactivity [Antony]
* IKEv2: Added pam-authorize= (default no) for userid verification [Antony]
* IKEv2: Informational exchange did not always update msgid counters [Paul]
* IKEv2: Don't send v2N_INVALID_MSGID in response to duplicate IKE_INIT packet
* IKEv2: Time all crypto operations, not just DH IKEv2 [Antony]
* IKEv2: reduce leaks involving sa_v2_convert [Hugh]
* IKEv2: eliminate leaks of st_tpacket [Hugh]
* IKEv2: fix send certreq [Antony]
* IKEv2: find_host_connection now checks RSA, PSK and NULL one by one [Antony]
* IKEv1: Don't copy isakmp_sa from received packet [Paul]
* IKEv1: Do not retransmit forever [Antony/Herbert]
* FIPS: Enforce crypto restrictions in FIPS mode (no md5,twofish, etc) [Paul]
* XAUTH: retransmit user/password request in 10s (instead of 30s) [Wolfgang]
* X509: Re-added CRL and OCSP support using NSS [Matt]
* X509: Expired certificate could crash pluto [Wolfgang]
* x509: New options: ocsp_enable= ocsp_strict= ocsp_timeout= [Matt]
ocsp_uri= and ocsp_trust_name=
* pluto: Converted select() loop to use libevent and subsecond timers [Antony]
* pluto: unroute IPSEC SA instead of hold, if oppo and CK_INSTANCE [Antony]
* pluto: Added --impair-send-no-ikev2-auth and --impair-force-fips [Paul]
* pluto: Added retransmit-timeout= (default 60s) [Antony]
* pluto: Added retransmit-interval= in ms (default 500) [Antony]
* pluto: Greatly reduce time to retransmit from 20s to 0.5s [Antony]
* pluto: Support for IKEv1 and IKEv2 AES_CTR (ike=aes_ctr) [Andrew Cagney]
* pluto: Support for CBC/CTR test vectors using NSS [Andrew Cagney]
* pluto: Remove last weary old FreeS/WAN X.509 code and use NSS instead [Matt]
* pluto: Static IP support using passwd file with addresspool= [Wolfgang]
* pluto: major tidy of labeled ipsec code [Hugh]
* pluto: fixes for uninitialized fields in output struct [Hugh/Paul]
* pluto: audit format and log item update as per audit spec [Paul]
* pluto: simplify and clarify sa_copy_sa and friends [Hugh]
* pluto: small steps improving crypto helpers [Hugh]
* pluto: plutostderrlog= renamed to logfile= [Paul]
* pluto: plutostderrlogtime= renamed to logtime= [Paul]
* pluto: New option logappend=yes|no (default yes) [Paul]
* pluto: Removed obsoleted loopback= support [Paul]
* pluto: advanced state counting (anon,auth,halfopen,child) [Paul/Andrew/Hugh]
(see ipsec whack --globalstatus)
* pluto/rsasigkey: added --seedbits option (and seedbits= option) [Paul]
* pluto: do not terminate_connection() in-flight [Hugh]
* pluto: don't use an expired reserved kernel SPI as fallback [Herbert Xu]
* pluto: Use "third best" monotime() on mismatched kernel/glibc headers [Paul]
* pluto: removed bool inbound_only from delete_ipsec_sa() [Paul/Herbert]
* pluto: fix modecfg client/server status display (was swapped) [Herbert]
* pluto: Global NFLOG support via nflog-all= keyword (default off) [Paul]
* pluto: Per-conn NFLOG support via nflog= keyword (default off) [Paul]
* pluto: Reduce default logging for unknown/halfopen/opportunistic SA's [Paul]
* pluto: Fix bogus "no RSA public key known for '%fromcert'" [Herbert Xu]
* pluto: exclude ike/esp options from %default for never-negotiate conns [Paul]
* pluto: added xfrmlifetime= (default 300) to customise NETKEY acquires [Paul]
* pluto: added shuntlifetime= (default 15m) for bare shunts [Paul]
* pluto: added negotiationshunt= (default hold) [Paul]
* pluto: Obsoleted force-busy= for ddos-mode= [Paul]
* pluto: Added config setup keyword ddos-mode= (default auto) [Paul]
* pluto: Added config setup keyword ddos-ike-treshold= (default 25000) [Paul]
* pluto: Added config setup keyword max-halfopen-ike= (default 50000) [Paul]
* pluto: route_owner() don't passert on changed interface [Paul]
* pluto: Remove DNSSEC DLV support (DLV is decommissioned) [paul]
* pluto: Support for unbound < 1.4.21 [Tony Whyman]
* libipsecconf: Improve parser for pipe case (with NM) [Hugh/Lubomir Rintel]
* libcrypto/twofish: Fix CALC_SB_* macros [Lubomir Rintel]
* readwriteconf: improve error handling [Hugh]
* ipsec: ipsec --import does not need to run restorecon [Paul]
* ipsec: --checknss option automatically updates NSS DB to SQL [Matt]
* ipsec: --checknflog option installs nflog-group= iptables rules [Paul]
* rsasigkey: Rename --random to --seeddev [Paul]
* packaging: Various SPEC file fixes and Buildrequire: updates [Tuomo/Kim]
* packaging: Add v6neighbour-hole.conf for Neighbour Discovery hole [Paul]
* initsystems: run ipsec --checknss before start [Tuomo]
* building: overhaul of build system Makefiles (see mk/) [Andrew]
* testing: docker test type support [Antony]
* testing: test case updates/additions [Antony/Paul/Andrew/Matt]
* testing: more FIPS support and --imapir-force-fips option added [Paul]
* NETKEY: Fix bare shunt management code to work properly for NETKEY [Paul/Hugh/Antony]
* NETKEY: Increase netlink message buffer for larger SElinux labels [Paul]
* NETKEY: kernel netlink decode and log polixy expire message [Antony]
* KLIPS: move udp_encap_enable() to not be within spinlock [Wolfgang]
* KLIPS: ipsec_rcv_decap_ipip broken for IPv6 lsb#227 [Frank Schmirler]
* KLIPS: Support for SHA2 via CryptoAPI [Wolfgang]
* KLIPS: Support for sha2_truncbug [Wolfgang]
* whack: New ipsec whack --purgeocsp [Matt]
* whack: New ipsec whack --ddos-busy | --ddos-auto | --ddos-unlimited [Paul]
* whack: New ipsec whack --globalstatus [Paul]
* whack: New ipsec whack --shuntstatus [Paul]
* whack: New ipsec whack --deleteid --name <id> [Antony]
* whack: cleanup help text [Tuomo]
* _stackmanager: Don't load blacklisted modules (rhbz#1207689) [Paul/Tuomo]
* _stackmanager: Support for xfrmlifetime= ipsec.conf option [Paul]
* _updown: add proxy arp for cases where routing won't work [Tuomo/Wolfgang]
* Bugtracker bugs fixed:
#260: libswan: extra safetey around same_id() when ID_FROMCERT is used [Paul]