<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="7">
<package pkgid="a011e2a83fcf9165ba6b2918e5ae11c3925a08375e9637762152541018acf911" name="openvpn" arch="src">
  <version epoch="0" ver="2.8.20260727.74c2a96" rel="150600.2276.1"/>
  <changelog author="dmueller@suse.com" date="1654430400">- update to 2.5.7:
  * Limited OpenSSL 3.0 support
  * print OpenSSL error stack if decoding PKCS12 file fails
  * fix omission of cipher-negotiation.rst in tarballs
  * fix errno handling on Windows (Windows has different classes of
    error codes, GetLastError() and C runtime errno, these should now
    be handled correctly)
  * fix PATH_MAX build failure in auth-pam.c
  * fix t_net.sh self-test leaving around stale "ovpn-dummy0" interface
  * fix overlong path names, leading to missing pkcs11-helper patch
    in tarball</changelog>
  <changelog author="dmueller@suse.com" date="1662984000">- build with enable-iproute2 again to have root-less mode working (bsc#1202792)</changelog>
  <changelog author="dmueller@suse.com" date="1668772800">- update to 2.5.8:
  * allow running a default configuration with TLS libraries without BF-CBC
    (even if TLS cipher negotiation would not actually use BF-CBC, the
    long-term compatibility "default cipher BF-CBC" would trigger an error
    on such TLS libraries)
  * ``--auth-nocache'' was not always correctly clearing username+password
    after a renegotiation
  * ensure that auth-token received from server is cleared if requested
    by the management interface ("forget password" or automatically
    via ``--management-forget-disconnect'')
  * in a setup without username+password, but with auth-token and
    auth-token-username pushed by the server, OpenVPN would start asking
    for username+password on token expiry.  Fix.
  * using ``--auth-token`` together with ``--management-client-auth``
    (on the server) would lead to TLS keys getting out of sync and client
    being disconnected.  Fix.
  * management interface would sometimes get stuck if client and server
    try to write something simultaneously.  Fix by allowing a limited
    level of recursion in virtual_output_callback()
  * fix management interface not returning ERROR:/SUCCESS: response
    on "signal SIGxxx" commands when in HOLD state
  * tls-crypt-v2: abort connection if client-key is too short
  * make man page agree with actual code on replay-window backtrag log message
  * remove useless empty line from CR_RESPONSE message</changelog>
  <changelog author="max@suse.com" date="1673265600">- bsc#1123557: --suppress-timestamps isn't needed by default.</changelog>
  <changelog author="kukuk@suse.com" date="1676289600">- Remove migration from openvpn.service to openvpn@.service and
  depending requires, this is from pre SLE12 times and not supported
  anymore.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1677758400">- update to 2.5.9:
  * Optional ciphers in --data-ciphers Ciphers in --data-ciphers
    can now be prefixed with a ? to mark those as optional and only
    use them if the SSL library supports them.
  * when compiling from a git checkout, put proper branch names into
    windows builds
  * do not include auth-token in pulled-option digest (interferes
    with persist-tun when auth-token is in use, GH #200).
  * fix corner case that might lead to leaked file descriptor
  * fix parser bug (parse_line()) that can lead to buffer overflows
    on malformed command line or server ccd file handling.
    Not exploitable.
  * pull-filter: ignore leading spaces in option names (work around
    server side bug with erroneous extra spaces)
  * push: do not add leading spaces to "out of renegotiations" pushed
    auth-token fix NULL pointer crash on "openvpn --show-tls" with
    mbedtls</changelog>
  <changelog author="mohd.saquib@suse.com" date="1682424000">- update to 2.6.3:
  * For full changelog please refer to:
    https://github.com/OpenVPN/openvpn/blob/v2.6.3/Changes.rst
  * implement byte counter statistics for DCO Linux (p2mp server
    and client)
  * implement byte counter statistics for DCO Windows (client only)
  * '--dns server &lt;n&gt; address ...' now permits up to 8 v4 or v6
    addresses
  * fix a few cases of possibly undefined behaviour detected by ASAN
  * add more unit tests for Windows cryptoapi interface
  * Dynamic TLS Crypt When both peers are OpenVPN 2.6.1+, OpenVPN
    will dynamically create a tls-crypt key that is used for
    renegotiation. This ensure that only the previously authenticated
    peer can do trigger renegotiation and complete renegotiations.
  * Keying Material Exporters (RFC 5705) based key generation
  * As part of the cipher negotiation OpenVPN will automatically prefer
    the RFC5705 based key material generation to the current custom
    OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
  * OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
    has been made to check or implement all the requirements/
    recommendation of FIPS 140-2. This just allows OpenVPN to be run on
    a system that be configured OpenSSL in FIPS mode.
  * mlock will now check if enough memlock-able memory has been reserved,
    and if less than 100MB RAM are available, use setrlimit() to upgrade
    the limit. See Trac #1390. Not available on OpenSolaris.
  * The --peer-fingerprint option has been introduced to give users an
    easy to use alternative to the tls-verify for matching the fingerprint
    of the peer. The option takes use a number of allowed SHA256
    certificate fingerprints.
  * When --peer-fingerprint is used, the --ca and --capath option become
    optional. This allows for small OpenVPN setups without setting up a
    PKI with Easy-RSA or similar software.
  * The --auth-user-pass-verify script supports now deferred authentication.
  * Both auth plugin and script can now signal pending authentication to
    the client when using deferred authentication. The new client-crresponse
    script option and OPENVPN_PLUGIN_CLIENT_CRRESPONSE plugin function can
    be used to parse a client response to a CR_TEXT two factor challenge.
  * The modernisation of defaults can impact the compatibility of OpenVPN
    2.6.0 with older peers. The options --compat-mode allows UIs to provide
    users with an easy way to still connect to older servers.
  * OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user
    visible but improve general compatibility with OpenSSL 3.0.
  - -tls-cert-profile insecure has been added to allow selecting the lowest
    OpenSSL security level (not recommended, use only if you must). OpenSSL
    3.0 no longer supports the Blowfish (and other deprecated) algorithm by
    default and the new option --providers allows loading the legacy provider
    to renable these algorithms.
  * Ciphers in --data-ciphers can now be prefixed with a ? to mark those as
    optional and only use them if the SSL library supports them.
  * The --mssfix and --fragment options now allow an optional mtu parameter to
    specify that different overhead for IPv4/IPv6 should taken into account
    and the resulting size is specified as the total size of the VPN packets
    including IP and UDP headers.
  * Instead of allocating a connection for each client on the initial packet
    OpenVPN server will now use an HMAC based cookie as its session id. This way
    the server can verify it on completing the handshake without keeping state.
    This eliminates the amplification and resource exhaustion attacks.
    For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later because
    the client needs to resend its client key on completing the hand shake.
    The tls-crypt-v2 option allows controlling if older clients are accepted.
- Removed openvpn-fips140-2.3.2.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1683892800">- Update to 2.6.4:
  * DCO: support kernel-triggered key rotation (avoid IV reuse after
    2^32 packets). This is the userland side, accepting a message
    from kernel, and initiating a TLS renegotiation. As of release,
  * fix pkcs#11 usage with OpenSSL 3.x and PSS signing (Github #323)
  * fix compile error on TARGET_ANDROID
  * fix typo in help text
  * manpage updates (--topology)
  * encoding of non-ASCII windows error messages in log + management fixed
- Update openvpn.keyring</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
</package>
<package pkgid="57cf9ee679ed62767fa475c5798ce540d936af0f33da4ac074056c56d742e076" name="openvpn" arch="x86_64">
  <version epoch="0" ver="2.8.20260727.74c2a96" rel="150600.2276.1"/>
  <changelog author="dmueller@suse.com" date="1654430400">- update to 2.5.7:
  * Limited OpenSSL 3.0 support
  * print OpenSSL error stack if decoding PKCS12 file fails
  * fix omission of cipher-negotiation.rst in tarballs
  * fix errno handling on Windows (Windows has different classes of
    error codes, GetLastError() and C runtime errno, these should now
    be handled correctly)
  * fix PATH_MAX build failure in auth-pam.c
  * fix t_net.sh self-test leaving around stale "ovpn-dummy0" interface
  * fix overlong path names, leading to missing pkcs11-helper patch
    in tarball</changelog>
  <changelog author="dmueller@suse.com" date="1662984000">- build with enable-iproute2 again to have root-less mode working (bsc#1202792)</changelog>
  <changelog author="dmueller@suse.com" date="1668772800">- update to 2.5.8:
  * allow running a default configuration with TLS libraries without BF-CBC
    (even if TLS cipher negotiation would not actually use BF-CBC, the
    long-term compatibility "default cipher BF-CBC" would trigger an error
    on such TLS libraries)
  * ``--auth-nocache'' was not always correctly clearing username+password
    after a renegotiation
  * ensure that auth-token received from server is cleared if requested
    by the management interface ("forget password" or automatically
    via ``--management-forget-disconnect'')
  * in a setup without username+password, but with auth-token and
    auth-token-username pushed by the server, OpenVPN would start asking
    for username+password on token expiry.  Fix.
  * using ``--auth-token`` together with ``--management-client-auth``
    (on the server) would lead to TLS keys getting out of sync and client
    being disconnected.  Fix.
  * management interface would sometimes get stuck if client and server
    try to write something simultaneously.  Fix by allowing a limited
    level of recursion in virtual_output_callback()
  * fix management interface not returning ERROR:/SUCCESS: response
    on "signal SIGxxx" commands when in HOLD state
  * tls-crypt-v2: abort connection if client-key is too short
  * make man page agree with actual code on replay-window backtrag log message
  * remove useless empty line from CR_RESPONSE message</changelog>
  <changelog author="max@suse.com" date="1673265600">- bsc#1123557: --suppress-timestamps isn't needed by default.</changelog>
  <changelog author="kukuk@suse.com" date="1676289600">- Remove migration from openvpn.service to openvpn@.service and
  depending requires, this is from pre SLE12 times and not supported
  anymore.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1677758400">- update to 2.5.9:
  * Optional ciphers in --data-ciphers Ciphers in --data-ciphers
    can now be prefixed with a ? to mark those as optional and only
    use them if the SSL library supports them.
  * when compiling from a git checkout, put proper branch names into
    windows builds
  * do not include auth-token in pulled-option digest (interferes
    with persist-tun when auth-token is in use, GH #200).
  * fix corner case that might lead to leaked file descriptor
  * fix parser bug (parse_line()) that can lead to buffer overflows
    on malformed command line or server ccd file handling.
    Not exploitable.
  * pull-filter: ignore leading spaces in option names (work around
    server side bug with erroneous extra spaces)
  * push: do not add leading spaces to "out of renegotiations" pushed
    auth-token fix NULL pointer crash on "openvpn --show-tls" with
    mbedtls</changelog>
  <changelog author="mohd.saquib@suse.com" date="1682424000">- update to 2.6.3:
  * For full changelog please refer to:
    https://github.com/OpenVPN/openvpn/blob/v2.6.3/Changes.rst
  * implement byte counter statistics for DCO Linux (p2mp server
    and client)
  * implement byte counter statistics for DCO Windows (client only)
  * '--dns server &lt;n&gt; address ...' now permits up to 8 v4 or v6
    addresses
  * fix a few cases of possibly undefined behaviour detected by ASAN
  * add more unit tests for Windows cryptoapi interface
  * Dynamic TLS Crypt When both peers are OpenVPN 2.6.1+, OpenVPN
    will dynamically create a tls-crypt key that is used for
    renegotiation. This ensure that only the previously authenticated
    peer can do trigger renegotiation and complete renegotiations.
  * Keying Material Exporters (RFC 5705) based key generation
  * As part of the cipher negotiation OpenVPN will automatically prefer
    the RFC5705 based key material generation to the current custom
    OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
  * OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
    has been made to check or implement all the requirements/
    recommendation of FIPS 140-2. This just allows OpenVPN to be run on
    a system that be configured OpenSSL in FIPS mode.
  * mlock will now check if enough memlock-able memory has been reserved,
    and if less than 100MB RAM are available, use setrlimit() to upgrade
    the limit. See Trac #1390. Not available on OpenSolaris.
  * The --peer-fingerprint option has been introduced to give users an
    easy to use alternative to the tls-verify for matching the fingerprint
    of the peer. The option takes use a number of allowed SHA256
    certificate fingerprints.
  * When --peer-fingerprint is used, the --ca and --capath option become
    optional. This allows for small OpenVPN setups without setting up a
    PKI with Easy-RSA or similar software.
  * The --auth-user-pass-verify script supports now deferred authentication.
  * Both auth plugin and script can now signal pending authentication to
    the client when using deferred authentication. The new client-crresponse
    script option and OPENVPN_PLUGIN_CLIENT_CRRESPONSE plugin function can
    be used to parse a client response to a CR_TEXT two factor challenge.
  * The modernisation of defaults can impact the compatibility of OpenVPN
    2.6.0 with older peers. The options --compat-mode allows UIs to provide
    users with an easy way to still connect to older servers.
  * OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user
    visible but improve general compatibility with OpenSSL 3.0.
  - -tls-cert-profile insecure has been added to allow selecting the lowest
    OpenSSL security level (not recommended, use only if you must). OpenSSL
    3.0 no longer supports the Blowfish (and other deprecated) algorithm by
    default and the new option --providers allows loading the legacy provider
    to renable these algorithms.
  * Ciphers in --data-ciphers can now be prefixed with a ? to mark those as
    optional and only use them if the SSL library supports them.
  * The --mssfix and --fragment options now allow an optional mtu parameter to
    specify that different overhead for IPv4/IPv6 should taken into account
    and the resulting size is specified as the total size of the VPN packets
    including IP and UDP headers.
  * Instead of allocating a connection for each client on the initial packet
    OpenVPN server will now use an HMAC based cookie as its session id. This way
    the server can verify it on completing the handshake without keeping state.
    This eliminates the amplification and resource exhaustion attacks.
    For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later because
    the client needs to resend its client key on completing the hand shake.
    The tls-crypt-v2 option allows controlling if older clients are accepted.
- Removed openvpn-fips140-2.3.2.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1683892800">- Update to 2.6.4:
  * DCO: support kernel-triggered key rotation (avoid IV reuse after
    2^32 packets). This is the userland side, accepting a message
    from kernel, and initiating a TLS renegotiation. As of release,
  * fix pkcs#11 usage with OpenSSL 3.x and PSS signing (Github #323)
  * fix compile error on TARGET_ANDROID
  * fix typo in help text
  * manpage updates (--topology)
  * encoding of non-ASCII windows error messages in log + management fixed
- Update openvpn.keyring</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
</package>
<package pkgid="850fbae25a4569996e157fc6f368fb34cac0e0a16f002004dbf27538a533f79f" name="openvpn-auth-pam-plugin" arch="x86_64">
  <version epoch="0" ver="2.8.20260727.74c2a96" rel="150600.2276.1"/>
  <changelog author="dmueller@suse.com" date="1654430400">- update to 2.5.7:
  * Limited OpenSSL 3.0 support
  * print OpenSSL error stack if decoding PKCS12 file fails
  * fix omission of cipher-negotiation.rst in tarballs
  * fix errno handling on Windows (Windows has different classes of
    error codes, GetLastError() and C runtime errno, these should now
    be handled correctly)
  * fix PATH_MAX build failure in auth-pam.c
  * fix t_net.sh self-test leaving around stale "ovpn-dummy0" interface
  * fix overlong path names, leading to missing pkcs11-helper patch
    in tarball</changelog>
  <changelog author="dmueller@suse.com" date="1662984000">- build with enable-iproute2 again to have root-less mode working (bsc#1202792)</changelog>
  <changelog author="dmueller@suse.com" date="1668772800">- update to 2.5.8:
  * allow running a default configuration with TLS libraries without BF-CBC
    (even if TLS cipher negotiation would not actually use BF-CBC, the
    long-term compatibility "default cipher BF-CBC" would trigger an error
    on such TLS libraries)
  * ``--auth-nocache'' was not always correctly clearing username+password
    after a renegotiation
  * ensure that auth-token received from server is cleared if requested
    by the management interface ("forget password" or automatically
    via ``--management-forget-disconnect'')
  * in a setup without username+password, but with auth-token and
    auth-token-username pushed by the server, OpenVPN would start asking
    for username+password on token expiry.  Fix.
  * using ``--auth-token`` together with ``--management-client-auth``
    (on the server) would lead to TLS keys getting out of sync and client
    being disconnected.  Fix.
  * management interface would sometimes get stuck if client and server
    try to write something simultaneously.  Fix by allowing a limited
    level of recursion in virtual_output_callback()
  * fix management interface not returning ERROR:/SUCCESS: response
    on "signal SIGxxx" commands when in HOLD state
  * tls-crypt-v2: abort connection if client-key is too short
  * make man page agree with actual code on replay-window backtrag log message
  * remove useless empty line from CR_RESPONSE message</changelog>
  <changelog author="max@suse.com" date="1673265600">- bsc#1123557: --suppress-timestamps isn't needed by default.</changelog>
  <changelog author="kukuk@suse.com" date="1676289600">- Remove migration from openvpn.service to openvpn@.service and
  depending requires, this is from pre SLE12 times and not supported
  anymore.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1677758400">- update to 2.5.9:
  * Optional ciphers in --data-ciphers Ciphers in --data-ciphers
    can now be prefixed with a ? to mark those as optional and only
    use them if the SSL library supports them.
  * when compiling from a git checkout, put proper branch names into
    windows builds
  * do not include auth-token in pulled-option digest (interferes
    with persist-tun when auth-token is in use, GH #200).
  * fix corner case that might lead to leaked file descriptor
  * fix parser bug (parse_line()) that can lead to buffer overflows
    on malformed command line or server ccd file handling.
    Not exploitable.
  * pull-filter: ignore leading spaces in option names (work around
    server side bug with erroneous extra spaces)
  * push: do not add leading spaces to "out of renegotiations" pushed
    auth-token fix NULL pointer crash on "openvpn --show-tls" with
    mbedtls</changelog>
  <changelog author="mohd.saquib@suse.com" date="1682424000">- update to 2.6.3:
  * For full changelog please refer to:
    https://github.com/OpenVPN/openvpn/blob/v2.6.3/Changes.rst
  * implement byte counter statistics for DCO Linux (p2mp server
    and client)
  * implement byte counter statistics for DCO Windows (client only)
  * '--dns server &lt;n&gt; address ...' now permits up to 8 v4 or v6
    addresses
  * fix a few cases of possibly undefined behaviour detected by ASAN
  * add more unit tests for Windows cryptoapi interface
  * Dynamic TLS Crypt When both peers are OpenVPN 2.6.1+, OpenVPN
    will dynamically create a tls-crypt key that is used for
    renegotiation. This ensure that only the previously authenticated
    peer can do trigger renegotiation and complete renegotiations.
  * Keying Material Exporters (RFC 5705) based key generation
  * As part of the cipher negotiation OpenVPN will automatically prefer
    the RFC5705 based key material generation to the current custom
    OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
  * OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
    has been made to check or implement all the requirements/
    recommendation of FIPS 140-2. This just allows OpenVPN to be run on
    a system that be configured OpenSSL in FIPS mode.
  * mlock will now check if enough memlock-able memory has been reserved,
    and if less than 100MB RAM are available, use setrlimit() to upgrade
    the limit. See Trac #1390. Not available on OpenSolaris.
  * The --peer-fingerprint option has been introduced to give users an
    easy to use alternative to the tls-verify for matching the fingerprint
    of the peer. The option takes use a number of allowed SHA256
    certificate fingerprints.
  * When --peer-fingerprint is used, the --ca and --capath option become
    optional. This allows for small OpenVPN setups without setting up a
    PKI with Easy-RSA or similar software.
  * The --auth-user-pass-verify script supports now deferred authentication.
  * Both auth plugin and script can now signal pending authentication to
    the client when using deferred authentication. The new client-crresponse
    script option and OPENVPN_PLUGIN_CLIENT_CRRESPONSE plugin function can
    be used to parse a client response to a CR_TEXT two factor challenge.
  * The modernisation of defaults can impact the compatibility of OpenVPN
    2.6.0 with older peers. The options --compat-mode allows UIs to provide
    users with an easy way to still connect to older servers.
  * OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user
    visible but improve general compatibility with OpenSSL 3.0.
  - -tls-cert-profile insecure has been added to allow selecting the lowest
    OpenSSL security level (not recommended, use only if you must). OpenSSL
    3.0 no longer supports the Blowfish (and other deprecated) algorithm by
    default and the new option --providers allows loading the legacy provider
    to renable these algorithms.
  * Ciphers in --data-ciphers can now be prefixed with a ? to mark those as
    optional and only use them if the SSL library supports them.
  * The --mssfix and --fragment options now allow an optional mtu parameter to
    specify that different overhead for IPv4/IPv6 should taken into account
    and the resulting size is specified as the total size of the VPN packets
    including IP and UDP headers.
  * Instead of allocating a connection for each client on the initial packet
    OpenVPN server will now use an HMAC based cookie as its session id. This way
    the server can verify it on completing the handshake without keeping state.
    This eliminates the amplification and resource exhaustion attacks.
    For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later because
    the client needs to resend its client key on completing the hand shake.
    The tls-crypt-v2 option allows controlling if older clients are accepted.
- Removed openvpn-fips140-2.3.2.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1683892800">- Update to 2.6.4:
  * DCO: support kernel-triggered key rotation (avoid IV reuse after
    2^32 packets). This is the userland side, accepting a message
    from kernel, and initiating a TLS renegotiation. As of release,
  * fix pkcs#11 usage with OpenSSL 3.x and PSS signing (Github #323)
  * fix compile error on TARGET_ANDROID
  * fix typo in help text
  * manpage updates (--topology)
  * encoding of non-ASCII windows error messages in log + management fixed
- Update openvpn.keyring</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
</package>
<package pkgid="ba0d340d320c28cf40c4c6316a5e8c494f790e816fb9413bfc73ab80a5ad7e92" name="openvpn-devel" arch="x86_64">
  <version epoch="0" ver="2.8.20260727.74c2a96" rel="150600.2276.1"/>
  <changelog author="dmueller@suse.com" date="1654430400">- update to 2.5.7:
  * Limited OpenSSL 3.0 support
  * print OpenSSL error stack if decoding PKCS12 file fails
  * fix omission of cipher-negotiation.rst in tarballs
  * fix errno handling on Windows (Windows has different classes of
    error codes, GetLastError() and C runtime errno, these should now
    be handled correctly)
  * fix PATH_MAX build failure in auth-pam.c
  * fix t_net.sh self-test leaving around stale "ovpn-dummy0" interface
  * fix overlong path names, leading to missing pkcs11-helper patch
    in tarball</changelog>
  <changelog author="dmueller@suse.com" date="1662984000">- build with enable-iproute2 again to have root-less mode working (bsc#1202792)</changelog>
  <changelog author="dmueller@suse.com" date="1668772800">- update to 2.5.8:
  * allow running a default configuration with TLS libraries without BF-CBC
    (even if TLS cipher negotiation would not actually use BF-CBC, the
    long-term compatibility "default cipher BF-CBC" would trigger an error
    on such TLS libraries)
  * ``--auth-nocache'' was not always correctly clearing username+password
    after a renegotiation
  * ensure that auth-token received from server is cleared if requested
    by the management interface ("forget password" or automatically
    via ``--management-forget-disconnect'')
  * in a setup without username+password, but with auth-token and
    auth-token-username pushed by the server, OpenVPN would start asking
    for username+password on token expiry.  Fix.
  * using ``--auth-token`` together with ``--management-client-auth``
    (on the server) would lead to TLS keys getting out of sync and client
    being disconnected.  Fix.
  * management interface would sometimes get stuck if client and server
    try to write something simultaneously.  Fix by allowing a limited
    level of recursion in virtual_output_callback()
  * fix management interface not returning ERROR:/SUCCESS: response
    on "signal SIGxxx" commands when in HOLD state
  * tls-crypt-v2: abort connection if client-key is too short
  * make man page agree with actual code on replay-window backtrag log message
  * remove useless empty line from CR_RESPONSE message</changelog>
  <changelog author="max@suse.com" date="1673265600">- bsc#1123557: --suppress-timestamps isn't needed by default.</changelog>
  <changelog author="kukuk@suse.com" date="1676289600">- Remove migration from openvpn.service to openvpn@.service and
  depending requires, this is from pre SLE12 times and not supported
  anymore.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1677758400">- update to 2.5.9:
  * Optional ciphers in --data-ciphers Ciphers in --data-ciphers
    can now be prefixed with a ? to mark those as optional and only
    use them if the SSL library supports them.
  * when compiling from a git checkout, put proper branch names into
    windows builds
  * do not include auth-token in pulled-option digest (interferes
    with persist-tun when auth-token is in use, GH #200).
  * fix corner case that might lead to leaked file descriptor
  * fix parser bug (parse_line()) that can lead to buffer overflows
    on malformed command line or server ccd file handling.
    Not exploitable.
  * pull-filter: ignore leading spaces in option names (work around
    server side bug with erroneous extra spaces)
  * push: do not add leading spaces to "out of renegotiations" pushed
    auth-token fix NULL pointer crash on "openvpn --show-tls" with
    mbedtls</changelog>
  <changelog author="mohd.saquib@suse.com" date="1682424000">- update to 2.6.3:
  * For full changelog please refer to:
    https://github.com/OpenVPN/openvpn/blob/v2.6.3/Changes.rst
  * implement byte counter statistics for DCO Linux (p2mp server
    and client)
  * implement byte counter statistics for DCO Windows (client only)
  * '--dns server &lt;n&gt; address ...' now permits up to 8 v4 or v6
    addresses
  * fix a few cases of possibly undefined behaviour detected by ASAN
  * add more unit tests for Windows cryptoapi interface
  * Dynamic TLS Crypt When both peers are OpenVPN 2.6.1+, OpenVPN
    will dynamically create a tls-crypt key that is used for
    renegotiation. This ensure that only the previously authenticated
    peer can do trigger renegotiation and complete renegotiations.
  * Keying Material Exporters (RFC 5705) based key generation
  * As part of the cipher negotiation OpenVPN will automatically prefer
    the RFC5705 based key material generation to the current custom
    OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
  * OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
    has been made to check or implement all the requirements/
    recommendation of FIPS 140-2. This just allows OpenVPN to be run on
    a system that be configured OpenSSL in FIPS mode.
  * mlock will now check if enough memlock-able memory has been reserved,
    and if less than 100MB RAM are available, use setrlimit() to upgrade
    the limit. See Trac #1390. Not available on OpenSolaris.
  * The --peer-fingerprint option has been introduced to give users an
    easy to use alternative to the tls-verify for matching the fingerprint
    of the peer. The option takes use a number of allowed SHA256
    certificate fingerprints.
  * When --peer-fingerprint is used, the --ca and --capath option become
    optional. This allows for small OpenVPN setups without setting up a
    PKI with Easy-RSA or similar software.
  * The --auth-user-pass-verify script supports now deferred authentication.
  * Both auth plugin and script can now signal pending authentication to
    the client when using deferred authentication. The new client-crresponse
    script option and OPENVPN_PLUGIN_CLIENT_CRRESPONSE plugin function can
    be used to parse a client response to a CR_TEXT two factor challenge.
  * The modernisation of defaults can impact the compatibility of OpenVPN
    2.6.0 with older peers. The options --compat-mode allows UIs to provide
    users with an easy way to still connect to older servers.
  * OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user
    visible but improve general compatibility with OpenSSL 3.0.
  - -tls-cert-profile insecure has been added to allow selecting the lowest
    OpenSSL security level (not recommended, use only if you must). OpenSSL
    3.0 no longer supports the Blowfish (and other deprecated) algorithm by
    default and the new option --providers allows loading the legacy provider
    to renable these algorithms.
  * Ciphers in --data-ciphers can now be prefixed with a ? to mark those as
    optional and only use them if the SSL library supports them.
  * The --mssfix and --fragment options now allow an optional mtu parameter to
    specify that different overhead for IPv4/IPv6 should taken into account
    and the resulting size is specified as the total size of the VPN packets
    including IP and UDP headers.
  * Instead of allocating a connection for each client on the initial packet
    OpenVPN server will now use an HMAC based cookie as its session id. This way
    the server can verify it on completing the handshake without keeping state.
    This eliminates the amplification and resource exhaustion attacks.
    For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later because
    the client needs to resend its client key on completing the hand shake.
    The tls-crypt-v2 option allows controlling if older clients are accepted.
- Removed openvpn-fips140-2.3.2.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1683892800">- Update to 2.6.4:
  * DCO: support kernel-triggered key rotation (avoid IV reuse after
    2^32 packets). This is the userland side, accepting a message
    from kernel, and initiating a TLS renegotiation. As of release,
  * fix pkcs#11 usage with OpenSSL 3.x and PSS signing (Github #323)
  * fix compile error on TARGET_ANDROID
  * fix typo in help text
  * manpage updates (--topology)
  * encoding of non-ASCII windows error messages in log + management fixed
- Update openvpn.keyring</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
</package>
<package pkgid="c20d821c75374051fe101c9877cca2b239ed4d47b626f988b939b305c16391ef" name="openvpn-down-root-plugin" arch="x86_64">
  <version epoch="0" ver="2.8.20260727.74c2a96" rel="150600.2276.1"/>
  <changelog author="dmueller@suse.com" date="1654430400">- update to 2.5.7:
  * Limited OpenSSL 3.0 support
  * print OpenSSL error stack if decoding PKCS12 file fails
  * fix omission of cipher-negotiation.rst in tarballs
  * fix errno handling on Windows (Windows has different classes of
    error codes, GetLastError() and C runtime errno, these should now
    be handled correctly)
  * fix PATH_MAX build failure in auth-pam.c
  * fix t_net.sh self-test leaving around stale "ovpn-dummy0" interface
  * fix overlong path names, leading to missing pkcs11-helper patch
    in tarball</changelog>
  <changelog author="dmueller@suse.com" date="1662984000">- build with enable-iproute2 again to have root-less mode working (bsc#1202792)</changelog>
  <changelog author="dmueller@suse.com" date="1668772800">- update to 2.5.8:
  * allow running a default configuration with TLS libraries without BF-CBC
    (even if TLS cipher negotiation would not actually use BF-CBC, the
    long-term compatibility "default cipher BF-CBC" would trigger an error
    on such TLS libraries)
  * ``--auth-nocache'' was not always correctly clearing username+password
    after a renegotiation
  * ensure that auth-token received from server is cleared if requested
    by the management interface ("forget password" or automatically
    via ``--management-forget-disconnect'')
  * in a setup without username+password, but with auth-token and
    auth-token-username pushed by the server, OpenVPN would start asking
    for username+password on token expiry.  Fix.
  * using ``--auth-token`` together with ``--management-client-auth``
    (on the server) would lead to TLS keys getting out of sync and client
    being disconnected.  Fix.
  * management interface would sometimes get stuck if client and server
    try to write something simultaneously.  Fix by allowing a limited
    level of recursion in virtual_output_callback()
  * fix management interface not returning ERROR:/SUCCESS: response
    on "signal SIGxxx" commands when in HOLD state
  * tls-crypt-v2: abort connection if client-key is too short
  * make man page agree with actual code on replay-window backtrag log message
  * remove useless empty line from CR_RESPONSE message</changelog>
  <changelog author="max@suse.com" date="1673265600">- bsc#1123557: --suppress-timestamps isn't needed by default.</changelog>
  <changelog author="kukuk@suse.com" date="1676289600">- Remove migration from openvpn.service to openvpn@.service and
  depending requires, this is from pre SLE12 times and not supported
  anymore.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1677758400">- update to 2.5.9:
  * Optional ciphers in --data-ciphers Ciphers in --data-ciphers
    can now be prefixed with a ? to mark those as optional and only
    use them if the SSL library supports them.
  * when compiling from a git checkout, put proper branch names into
    windows builds
  * do not include auth-token in pulled-option digest (interferes
    with persist-tun when auth-token is in use, GH #200).
  * fix corner case that might lead to leaked file descriptor
  * fix parser bug (parse_line()) that can lead to buffer overflows
    on malformed command line or server ccd file handling.
    Not exploitable.
  * pull-filter: ignore leading spaces in option names (work around
    server side bug with erroneous extra spaces)
  * push: do not add leading spaces to "out of renegotiations" pushed
    auth-token fix NULL pointer crash on "openvpn --show-tls" with
    mbedtls</changelog>
  <changelog author="mohd.saquib@suse.com" date="1682424000">- update to 2.6.3:
  * For full changelog please refer to:
    https://github.com/OpenVPN/openvpn/blob/v2.6.3/Changes.rst
  * implement byte counter statistics for DCO Linux (p2mp server
    and client)
  * implement byte counter statistics for DCO Windows (client only)
  * '--dns server &lt;n&gt; address ...' now permits up to 8 v4 or v6
    addresses
  * fix a few cases of possibly undefined behaviour detected by ASAN
  * add more unit tests for Windows cryptoapi interface
  * Dynamic TLS Crypt When both peers are OpenVPN 2.6.1+, OpenVPN
    will dynamically create a tls-crypt key that is used for
    renegotiation. This ensure that only the previously authenticated
    peer can do trigger renegotiation and complete renegotiations.
  * Keying Material Exporters (RFC 5705) based key generation
  * As part of the cipher negotiation OpenVPN will automatically prefer
    the RFC5705 based key material generation to the current custom
    OpenVPN PRF. This feature requires OpenSSL or mbed TLS 2.18+.
  * OpenVPN will now work with OpenSSL in FIPS mode. Note, no effort
    has been made to check or implement all the requirements/
    recommendation of FIPS 140-2. This just allows OpenVPN to be run on
    a system that be configured OpenSSL in FIPS mode.
  * mlock will now check if enough memlock-able memory has been reserved,
    and if less than 100MB RAM are available, use setrlimit() to upgrade
    the limit. See Trac #1390. Not available on OpenSolaris.
  * The --peer-fingerprint option has been introduced to give users an
    easy to use alternative to the tls-verify for matching the fingerprint
    of the peer. The option takes use a number of allowed SHA256
    certificate fingerprints.
  * When --peer-fingerprint is used, the --ca and --capath option become
    optional. This allows for small OpenVPN setups without setting up a
    PKI with Easy-RSA or similar software.
  * The --auth-user-pass-verify script supports now deferred authentication.
  * Both auth plugin and script can now signal pending authentication to
    the client when using deferred authentication. The new client-crresponse
    script option and OPENVPN_PLUGIN_CLIENT_CRRESPONSE plugin function can
    be used to parse a client response to a CR_TEXT two factor challenge.
  * The modernisation of defaults can impact the compatibility of OpenVPN
    2.6.0 with older peers. The options --compat-mode allows UIs to provide
    users with an easy way to still connect to older servers.
  * OpenSSL 3.0 has been added. Most of OpenSSL 3.0 changes are not user
    visible but improve general compatibility with OpenSSL 3.0.
  - -tls-cert-profile insecure has been added to allow selecting the lowest
    OpenSSL security level (not recommended, use only if you must). OpenSSL
    3.0 no longer supports the Blowfish (and other deprecated) algorithm by
    default and the new option --providers allows loading the legacy provider
    to renable these algorithms.
  * Ciphers in --data-ciphers can now be prefixed with a ? to mark those as
    optional and only use them if the SSL library supports them.
  * The --mssfix and --fragment options now allow an optional mtu parameter to
    specify that different overhead for IPv4/IPv6 should taken into account
    and the resulting size is specified as the total size of the VPN packets
    including IP and UDP headers.
  * Instead of allocating a connection for each client on the initial packet
    OpenVPN server will now use an HMAC based cookie as its session id. This way
    the server can verify it on completing the handshake without keeping state.
    This eliminates the amplification and resource exhaustion attacks.
    For tls-crypt-v2 clients, this requires OpenVPN 2.6 clients or later because
    the client needs to resend its client key on completing the hand shake.
    The tls-crypt-v2 option allows controlling if older clients are accepted.
- Removed openvpn-fips140-2.3.2.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1683892800">- Update to 2.6.4:
  * DCO: support kernel-triggered key rotation (avoid IV reuse after
    2^32 packets). This is the userland side, accepting a message
    from kernel, and initiating a TLS renegotiation. As of release,
  * fix pkcs#11 usage with OpenSSL 3.x and PSS signing (Github #323)
  * fix compile error on TARGET_ANDROID
  * fix typo in help text
  * manpage updates (--topology)
  * encoding of non-ASCII windows error messages in log + management fixed
- Update openvpn.keyring</changelog>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
</package>
<package pkgid="f02dacd7d2533ccf90ccba8b9eef9928bedad1b6a0a9b3959d2ab65e260f7747" name="ovpn-backports" arch="src">
  <version epoch="0" ver="7.1.0.2026070601~git2f0c507" rel="150600.67.2"/>
</package>
<package pkgid="0cb924c1e62c2aaed602902265812cad84022ff00c9bca4be83f62674b1b56a2" name="ovpn-kmp-default" arch="x86_64">
  <version epoch="0" ver="7.1.0.2026070601~git2f0c507_k6.4.0_150600.23.81" rel="150600.67.2"/>
</package>
</otherdata>