The OpenBSD project has released OpenIKED 7.3, which develops the implementation of the IKEv2 protocol. Initially, the IKEv2 components were an inseparable part of the OpenBSD IPsec stack but were later separated into a standalone portable package that can now be used in other operating systems. The OpenIKED functionality has been verified on FreeBSD, NetBSD, macOS, and various Linux distributions, including Arch, Debian, Fedora, and Ubuntu. The code is written in C and is distributed under the ISC license.
OpenIKED allows for the deployment of virtual private networks based on IPsec. The IPsec stack consists of two main protocols: the key exchange protocol (IKE) and the protocol for transmitting encrypted traffic (ESP). OpenIKED implements authentication, configuration, key exchange, and security policy maintenance elements, while the traffic encryption protocol ESP is typically provided by the operating system's kernel. OpenIKED supports several authentication methods, including pre-shared keys, EAP MSCHAPv2 with X.509 certificates, and RSA and ECDSA public keys.
In the new version:
- Support has been added for sec tunnels created in OpenBSD to route IPsec traffic through the sec network interface, instead of using SPD (IPsec Security Policy Database) rules when establishing secure connections. VPN in point-to-point mode.
- Support for specifying multiple servers names with a single network interface on Linux has been added.
- It is now possible to use the libsystemd library for DNS configuration via DBUS in Linux, instead of calling the resolvectl utility.
- The dependency on the libapparmor library has been removed on the Linux platform; instead, direct access to the pseudo-filesystem /proc is now used to change AppArmor policies, allowing file descriptors to be opened before privilege drops.
- The ability to process full x509 certificate chains in the CERT payload has been provided.
- To improve process isolation, child processes are restarted after a fork() call.
- For OpenBSD 7.4, the internal API ibuf has been redesigned.
- The compatibility layer has been synchronized with the latest OpenBSD codebase.
- Fixes have been made to the OpenSSL configuration used in ikectl to ensure the renewal of expired certificates.
Source: opennet.ru
