<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="9">
<package pkgid="671b39d401d25af6af03cd70207ba57a7200a3787841d6b5a29eaa79321a28c2" name="openvpn" arch="src">
  <version epoch="0" ver="2.7.5" rel="150600.522.1"/>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="jslaby@suse.cz" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="frank@lichtenheld.com" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="frank@lichtenheld.com" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="frank@lichtenheld.com" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="frank@lichtenheld.com" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="frank@lichtenheld.com" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="rahul.jain@suse.com" date="1784635200">- - Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
</package>
<package pkgid="cbf584207a660be4896dc1ee20026540b1198a45b0062ff4b700b32c31c1d377" name="openvpn" arch="x86_64">
  <version epoch="0" ver="2.7.5" rel="150600.522.1"/>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="jslaby@suse.cz" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="frank@lichtenheld.com" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="frank@lichtenheld.com" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="frank@lichtenheld.com" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="frank@lichtenheld.com" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="frank@lichtenheld.com" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="rahul.jain@suse.com" date="1784635200">- - Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
</package>
<package pkgid="ae031d585f17a72d74d0ab5d8f0a384f194a3f3cbf6f304a975073e7e684fc52" name="openvpn-auth-pam-plugin" arch="x86_64">
  <version epoch="0" ver="2.7.5" rel="150600.522.1"/>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="jslaby@suse.cz" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="frank@lichtenheld.com" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="frank@lichtenheld.com" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="frank@lichtenheld.com" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="frank@lichtenheld.com" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="frank@lichtenheld.com" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="rahul.jain@suse.com" date="1784635200">- - Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
</package>
<package pkgid="1a58a1d1173437c79fe345be7a97fac88fc7c39100e3b9fdd86aa2fd01172122" name="openvpn-devel" arch="x86_64">
  <version epoch="0" ver="2.7.5" rel="150600.522.1"/>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="jslaby@suse.cz" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="frank@lichtenheld.com" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="frank@lichtenheld.com" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="frank@lichtenheld.com" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="frank@lichtenheld.com" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="frank@lichtenheld.com" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="rahul.jain@suse.com" date="1784635200">- - Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
</package>
<package pkgid="ae615a45cdefff561c5269d81fa90fddd07861dcf0f70c4f1d731101071d42b3" name="openvpn-down-root-plugin" arch="x86_64">
  <version epoch="0" ver="2.7.5" rel="150600.522.1"/>
  <changelog author="mohd.saquib@suse.com" date="1686744000">- update to 2.6.5:
  * apctl (windows): generate driver-specific names (if using tapctl
    to create additional tap/wintun/dco devices, and not using
  - -name) (Github #337)
  * interactive service (windows): do not force target desktop for
    openvpn.exe - this has no impact for normal use, but enables
    running of OpenVPN in a scripted way when no user is logged on
    (for example, via task scheduler) (Github OpenVPN/openvpn-gui#626)
  * fix use-after-free with EVP_CIPHER_free
  * fix building with MSVC from release tarball (missing version.m4.in)
  * dco-win: repair use of --dev-node to select specific DCO drivers
    (Github #336)
  * fix missing malloc() return check in dco_freebsd.c
  * windows: correctly handle unicode names for "exit event"
  * fix memleak in client-connect example plugin
  * fix fortify build problem in keying-material-exporter-demo plugin
  * fix memleak in dco_linux.c/dco_get_peer_stats_multi() - this will
    leak a small amount of memory every 15s on DCO enabled servers,
    leading to noticeable memory waste for long-running processes.
  * dco_linux.c: properly close dco version file (fd leak)</changelog>
  <changelog author="mohd.saquib@suse.com" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="mohd.saquib@suse.com" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="mohd.saquib@suse.com" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="mohd.saquib@suse.com" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="bwiedemann@suse.com" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="rahul.jain@suse.com" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="jengelh@inai.de" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="rahul.jain@suse.com" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="rrahl0@opensuse.org" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="jslaby@suse.cz" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="frank@lichtenheld.com" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="frank@lichtenheld.com" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="frank@lichtenheld.com" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="frank@lichtenheld.com" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="frank@lichtenheld.com" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="rahul.jain@suse.com" date="1784635200">- - Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
</package>
<package pkgid="c3fa7a5e1ce954646bcc4b6e10008314977c0f8ee5cb372330af61d0f13c45fb" name="ovpn-backports" arch="src">
  <version epoch="0" ver="7.1.0.2026070800" rel="150600.26.2"/>
</package>
<package pkgid="ac1f057f0b140ce9d1f39ae82cac3b8a238042adecde4458441ad5281848a413" name="ovpn-dco" arch="src">
  <version epoch="0" ver="0.2.20260526" rel="150600.26.2"/>
  <changelog author="jeffm@suse.com" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="jeffm@suse.com" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="jeffm@suse.com" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="jslaby@suse.cz" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="msuchanek@suse.de" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
  <changelog author="frank@lichtenheld.com" date="1773230400">- Debian: Change to use the full version number. We prefer this for
  Support reasons.
- Debian: This also fixes package build on Ubuntu 22.04. dh_dkms
  didn't automatically fall back to the version number and just
  left #MODULE_VERSION# in place.</changelog>
</package>
<package pkgid="2b89aca958aba3cb44e3e14f18d712716319aed123b37b5976c00ca34dcf42f0" name="ovpn-dco-kmp-default" arch="x86_64">
  <version epoch="0" ver="0.2.20260526_k6.4.0_150600.23.81" rel="150600.26.2"/>
  <changelog author="jeffm@suse.com" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="jeffm@suse.com" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="jeffm@suse.com" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="jslaby@suse.cz" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="jslaby@suse.cz" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="msuchanek@suse.de" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
  <changelog author="frank@lichtenheld.com" date="1773230400">- Debian: Change to use the full version number. We prefer this for
  Support reasons.
- Debian: This also fixes package build on Ubuntu 22.04. dh_dkms
  didn't automatically fall back to the version number and just
  left #MODULE_VERSION# in place.</changelog>
</package>
<package pkgid="782a14518b168e24c09df39c476f364dd73f12156a994117aa3eabe53da4dc02" name="ovpn-kmp-default" arch="x86_64">
  <version epoch="0" ver="7.1.0.2026070800_k6.4.0_150600.23.81" rel="150600.26.2"/>
</package>
</otherdata>