What’s New in strongSwan 6.1

Please refer to the full release notes for a complete list of changes.

IKEv1 Disabled by Default

The IKEv1 protocol is disabled by default. Support for the protocol will be removed completely in a future release, likely within the next year (there is no definitive timeline yet).

  • When building, IKEv1 has to be enabled explicitly via --enable-ikev1. A warning about its impending removal is logged.

  • In the configuration, version now defaults to 2. If it is set to 0 or 1, a warning is logged when the configuration is loaded.

Removed Plugins

The following plugins have been removed:

Plugin Name Description

af-alg

AF_ALG crypto interface to Linux crypto API

android-dns

Android-specific DNS handler

blowfish

Blowfish software implementation

duplicheck

Duplicate checking plugin using liveness checks

gcrypt

GNU libgcrypt crypto backend

keychain

macOS Keychain Services credential set

led

IKE activity to Linux LED subsystem interface

medcli

Mediation client configuration database

medsrv

Mediation server configuration database and daemon integration

padlock

VIA Padlock crypto backend

soup

libsoup-based HTTP fetcher

tnc-ifmap

TNC IF-MAP 2.0 client

tnccs-11

TNCCS 1.1 protocol implementation

tnccs-dynamic

Dynamic TNCCS protocol discovery

smp

XML-based configuration and control interface

Note that medcli and medsrv were part of a Web-based PoC and their removal is unrelated to the basic IKEv2 mediation extension functionality that may be enabled via --enable-mediation.

Removed Components

The following components have been removed:

Component Name Description

charon-xpc

macOS client application and helper daemon (PoC)

libfast

Library to implement FastCGI-based application servers with templates

manager

Web-based management interface (PoC)

medsrv

Mediation server web interface (PoC)