OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.
A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive information, or cause a denial of service (SIGTERM) by triggering XM…
The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges.
OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (openvpn.exe).
The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service.
OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.
OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension().
OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTP-over-OpenVPN session using Blowfish in CBC mode, aka a "Sweet32" attack.
The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Fixed (8)
VuXML entries whose affected range this version has left.
security/openvpn-devel: Update to commit 22a24132da
This brings in the upstream development work of the last two months,
including two CVE fixes relevant for all platforms.
One of the bundled patch files was adjusted to take into account
upstream formatting changes on tests/t_cltsrv.sh.
PR: 298286
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q3
Security: CVE-2026-84790
Security: CVE-2026-84732
security/openvpn-devel: Update to latest commit
This brings in the upstream development work of the last three months,
including a number of CVE fixes.
The previous commit erroneously bumped the date string used as the
version number to "2027". Fix that, and upgrade EPOCH to make it work.
Some maintenance on the port Makefile itself to address "portlint"
complaints and upstream changes (--enable-strict configure argument has
been dropped because the flags are always on now).
- Remove unnecessary GNU_CONFIGURE_MANPREFIX.
- Improve post-install-EXAMPLES-on.
PR: 296874
Security: CVE-2026-11771
Security: CVE-2026-12932
Security: CVE-2026-12996
Security: CVE-2026-13117
Security: CVE-2026-13122
Security: CVE-2026-13698
Sponsored by: UNIS Labs
Co-authored-by: Vladimir Druzenko <vvd@FreeBSD.org>
Co-authored-by: Matthias Andree <mandree@FreeBSD.org>
MFH: 2026Q3
*/*: Use C.UTF-8 locale
Ports 02f27a83b44d fixed the ports tree to the C locale so it would work
correctly in environments where users use a locale that isn't compatible
with the C locale, e.g. xx_YY.UTF-8 where [A-Z] includes more than just
upper case letters. USE_LOCALE was introduced to let ports use another
locale if they needed it. The C.UTF-8 locale was created later on to be
mostly compatible with the C locale.
Switch the ports tree locale to C.UTF-8 and remove USE_LOCALE. The
world has moved to Unicode so all ports either require it or know how to
build correctly in a Unicode environment.
PR: 295945
Exp-run by: antoine
all: drop support for FreeBSD 13, mips and risc64sf
Reviewed by: many (*)
Differential Revision: https://reviews.freebsd.org/D55624
Differential Revision: https://reviews.freebsd.org/D55642 (merged in from bofh)
many (*)
acm arrowd brooks cmt dch decke dinoex eduardo fluffy fuz gahr garga
jbeich joerg jrm kai kenrap martymac matthew mfechner michaelo mizhka
nobutaka pkubaj se tagattie thj
Anton Saietskii
GenericRikka
Gert Doering
Jan Bramkamp
Oleh Hushchenkov
Oleksandr Kryvulia
Ralf van der Enden
Yamagi
desktop kde python tcltk office
security/openvpn-devel: upgrade to commit 64fae9d829
this brings in the upstream development work that has happened over
the last two months, plus two CVE fixes:
- fix race condition in TLS handshake that could lead to leaking of
packet data from a previous handshake under specific circumstances
(CVE-2026-40215)
(Bug found by XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com))
- fix server ASSERT() on receiving a suitably malformed packet with
a valid tls-crypt-v2 key (CVE-2026-35058)
(Bug found by XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com)
and independently by Emma Reuter of Cisco ASIG (TALOS-2026-2381))
besides this, most of the commits are code maintenance - modernizing
code, adjusting OpenSSL APIs used to be 4.0 compatible, adding more
unit tests, fixing integer related warnings, improve documentation,
some minor performance improvements wrt internal hashing.
Notable change for FreeBSD: fix use of ovpn(4) on kernels compiled
without INET (change use of ioctl() sockets to AF_LOCAL).
PR: 294712
security/openvpn-devel: Update 2.7_rc6 -> post-2.7 commit 38243844
OpenVPN 2.7.0 has been released and will show up as "security/openvpn"
soon.
This port skips 2.7.0 release and continues to track development versions,
which will focus on code cleanup / refactoring for the next few months.
Use this opportunity to bring option and dependency handling more in
line with main port
- X509ALTUSERNAME is gone (always-on now in upstream source)
- ASYNC_PUSH added, with freebsd-version dependent handling of
libinotify dependency (see PR 293176)
- UNITTEST added, with libcmocka dependency if unit tests are desired
security/openvpn-devel: Update 2.7_rc5 => 2.7_rc6
FreeBSD - notable changes for rc5 => rc6 update:
- bugfix on restarting a p2mp server instance with SIGUSR1
(inadvertedly closing fd 0, causing a crash on the next restart),
- prevent NULL pointer crash on suitable combination of --dns-updown
statements in openvpn config file (not pushable),
- prevent inappropriate management interface activity if a password is
set and --management-forget-disconnect or --management-signal are active,
- more conversion warnings fixed,
- remove #ifdefs around socket sendbuf/receive buf handling,
assuming that all platforms that have POSIX sockets have this,
- add mbedTLS 4 support,
- fix check for failed fork() in port-share code.
PR: 292829
Requested by: maintainer
security/openvpn-devel: Update 2.7_rc3 => 2.7_rc5
Some important changes for FreeBSD users rc3 -> rc5:
- CVE 2025-15497 in epoch key handling
- repair interaction between DCO and persist-tun after reconnection
- require "script-security 2" when using --dev unix:<program>
- improve documentation and error messages for a number of
deprecated options
- tun.c: unify read_tun()/write_tun() functions for all BSD
platforms
- more type conversion related cleanups
- add check for auth none / cipher none on FreeBSD DCO
- drop mbedtls 2.x support
PR: 292492
Sponsored by: Subcarpathian BSD User Group
-----
committer annotations by Matthias Andree
Approved by: Gert Doering (maintainer)
MFH: 2026Q1
security/openvpn-devel: Update 2.7_rc2 => 2.7_rc3
Relevant changes for FreeBSD users:
- more type conversion related warnings have been fixed
- --multihome behaviour regarding egress interface selection has been
changed. See Changes.rst and manpage for details.
- cleanup dead code in event handling code (leftover of the multisocket
patch set)
- add new feature, --tls-crypt-v2-max-age n. See Changes.rst and manpage
for details.
- improve documentation to point out the pitfalls of case-insensitive
filesystems and --client-config-dir
- split default gateway query logic in two:
- for --redirect-gateway functionality, query for the gateway
towards the actual IP address of the VPN server connecting to
- for the "net_gateway" special destination for --route, and the
corresponding environment variable, always query for 0.0.0.0 /
:: (this will only make a difference in certain scenarios using a local
proxy, or on a system with multiple interfaces, not using the "default
route" for the VPN connection - see github#890)
- upgrade embedded pkcs11-helper vcpkg + pkcs11-uri patch to 1.31
- CMake / autoconf cleanup wrt unused checks, outdated old-Linux checks,
Windows oddities
- DCO (primarily Linux): improve handling of bulk notifications from
kernel (do not lose notifications, do not crash) (github#900)
PR: 291414
Sponsored by: Subcarpathian BSD User Group
security/openvpn-devel: upgrade port to git commit d6ee27b4ff (2.7_rc2, 2025-11-17)
This commit brings the port to "openvpn 2.7_rc2"
Changes of interest for FreeBSD:
- IPv6 address parsing: fix buffer overread on invalid input
(CVE-2025-12106)
- HMAC verification check: fix incorrect memcmp() call
(CVE-2025-13086)
- even more type conversion related warnings have been fixed
- DCO FreeBSD improvements:
improving debug messages (verb 6)
implement client-side counter handling
repair --inactive (and document shortcomings)
repair handling of DCO disconnection notifications in --client mode
- improve cmocka unit test assert() handling
- PUSH_UPDATE server: fix reporting of client IPs in ``status`` output
after pushing a new IPv4/IPv6 address to client
- AEAD cipher safety margins: fix calculation of AEAD blocks in use
(old code would undercount blocks)
- fix invalid pointer creation / memory overread in tls_pre_decrypt
- deprecate ``--opt-verify`` (change into no-op + warning)
-- additions by mandree@ --
Security: 50a0c266-c3ff-11f0-b513-0da7be77c170
Security: CVE-2025-12106
Security: 17a40d76-c3fd-11f0-b513-0da7be77c170
Security: CVE-2025-13086
MFH: 2025Q4
security/openvpn-devel: upgrade port to git commit 4281449ba4 (2.7_rc1, 2025-10-31)
This commit brings the port to "openvpn 2.7_rc1".
Changes of interest for FreeBSD:
- even more type conversion related warnings have been fixed
- more bugfixes related to BYTECOUNT display on the management
interface and byte counters on DCO platforms in general
- numerous minibugs reported by ZeroPath AI have been fixed
(small memleaks, possible file descriptor leaks, improved
sanity checks, add ASSERT() on function contracts, etc.)
- add warning for unsupported combination of --push and --tls-server
- add warning for unsupported combination of --reneg-bytes or
--reneg-pkts with DCO
- remove perf_push()/perf_pop() infrastructure (because it did not
work anymore, and compiler profiling will give better results today)
- ensure compatibility with OpenSSL 3.6.0 - specifically, do not crash
in t_lpback.sh trying to use new encrypt-then-mac (ETM) ciphers
- improved PUSH_UPDATE server side support, which now handles changes
of pushed ifconfig/ifconfig-ipv6 addresses correctly (send packets
to new IP addresses to this client, stop sending packets to the old
addresses).
- bugfixes reconnect and PUSH_UPDATE handling on the client side
(notably handling of ifconfig/ifconfig-ipv6/redirect-gateway ipv6
if the server is not always pushing the same address families)
- improve CONTRIBUTING documentation
- clean up and remove outdated stuff from COPYING
- freshen URLs all over the tree, and change to HTTPS where possible
- on DCO Linux/FreeBSD, add support for clients receiving an IPv4/IPv6
address that is not part of the --server/--server-ipv6 subnet
(= install extra on-interface host routes).
- remove undocumented and unused --memstats feature
- improve "recursive routing checks", prepare the way for a
policy-based setup where "packets to VPN server" could end up
in the tunnel without interfering with OpenVPN operations
security/openvpn-devel: upgrade port to git commit 0fb5a00549 (2.7_beta2, 2025-09-25)
This commit brings the port to "openvpn 2.7_beta2".
Notable changes beta1 -> beta2 (relevant for FreeBSD) are:
- even more of signed/unsigned related warnings have been fixed
- #pragmas have been added to all to-be-fixed source files, so we can
now always enable -Wconversion to see if new code brings new warnings
(and the CI infra builds with -Werror)
- add proper input sanitation to DNS strings to prevent an attack
coming from a trusted-but-malicous OpenVPN server (CVE: 2025-10680,
affects unixoid systems with --dns-updown scripts and windows using
the built-in powershell call)
- Switch test_ssl certificate from RSA 2048 to secp384r1
(so "make check" runs with OpenSSL set to @SECLEVEL=3)
- clean up MI prefix handling
- replace all assert() calls with OpenVPN ASSERT()
PR: 289838
Security: e5cf9f44-9a64-11f0-8241-93c889bb8de1
Security: CVE-2025-10680
MFH: 2025Q3
security/openvpn-devel: fix mbedTLS3 bootstrapping
and switch to depend on the net/mbedtls3 port,
as we no longer carry mbedtls2 in ports.
Also, mbedTLS 3 supports TLSv1.3, so drop our local MBEDTLS_DESC
and go with the official description instead.
Approved by: Gert Doering (maintainer, via IRC)
Related to:
PR: 289315
security/openvpn-devel: Revert "disable ssl_testdriver test"
The cause wasn't OpenSSL 3.5 but a local tightening of the
settings, see https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289315#c6
This reverts commit e75cace158f73d560cb09b91f4915ea9e5689115.
PR: 289315
security/openvpn-devel: disable ssl_testdriver test
which embeds inline certificates that are inacceptable
for our openssl35 port, and possibly for FreeBSD 15.
PR: 289315
security/openvpn-devel: upgrade port to git commit 1e7b9a0fb0 (2.7_beta1, 2025-09-03)
This commit brings the port to "openvpn 2.7_beta1".
New features alpha3 -> beta1 are
- a large number of signed/unsigned related warnings have been fixed
- bugfixes in --dns-updown script for linux systems using resolvconf
- rewrite of the management interface "bytecount" infastructure to better
interact with DCO
- PUSH_UPDATE server support (via management interface)
- introduction of route_redirect_gateway_ipv4 and _ipv6 env variables
- speeding up t_client tests by reducing per-test startup delay 3s -> 1s
The biggest noticeable difference in beta1 is the reformatting using
clang-format, leaving uncrustify as that wasn't stable across versions.
PR: 289315
security/openvpn-devel: upgrade port to git commit 7b1b283478 (2.7_alpha3, 2025-07-31)
This commit brings the port to "openvpn 2.7_alpha3".
For FreeBSD, the most significant change is that "floating clients with
DCO" are supported, if the kernel has support for it (-current).
Platform-independent the "big new feature" is client side support
for PUSH_UPDATE (send new configuration data while a client-server
connection is established).
security/openvpn-devel: upgrade port to git commit df4863aa0e (2025-06-27)
This commit brings the port to "openvpn 2.7_alpha2" with a few extra
bugfixes.
There is one significant change here: the "old way" to update DNS
config via "--up contrib/pull-resolv-conf/client.up" and plugin-down-root.sh
has been replaced by a built-in mechanism (--dns-updown $script),
which is no loger "contributed" but maintained upstream, and brings
its own privilege separation / down-root mechanism. The old
contrib/pull-resolv-conf scripts have been removed from the upstream
distribution.
The port-specific "openvpn-client" script has been adjusted to do
the same thing ("run a client config with DNS setup") with the new
mechanism.
Besides this, this update has a number of minor bugfixes and improvements
to documentation, logging and testing infrastructure.
PR: 287892
security/openvpn-devel: upgrade port to git commit b75849ba36 (2025-04-02)
Fixes CVE-2025-2704 (servers using --tls-crypt-v2 can be made to ASSERT()
by sending a particular sequence of authenticated and malformed packets).
New feature: Multisocket support (listening to multiple sockets, UDP and
TCP, in one server) - with a number of minor bug fixes to that.
New feature: --override-username (see manpage for details)
Other minor features, polishing and bugfixes.
Security: 2cad4541-0f5b-11f0-89f8-411aefea0df9
Security: CVE-2025-2704
MFH: 2025Q2
security/openvpn-devel: upgrade port to git commit 9f4670fc71 (2025-02-12)
Contains a number of bugfixes and minor improvements, especially adding
more unit tests and cleaning up code all over the place.
The most important new feature in here is the "epoch data format",
which is a suitable data channel format & rekeying strategy for 10G+
links where regular AES rekeying starts to become a limiting factor.
When using FreeBSD DCO, epoch data format is not yet being used, because
this needs kernel changes in ovpn(4). This is on the roadmap.
-- Additional edits by mandree@: --
reset PORTREVISION
PR: 284766
security/mbedtls: Move to security/mbedtls2
The port has expired but isn't removed yet because there are still too
many consumers. Rename it because the name "security/mbedtls" makes it
look like it's the default version.
PR: 283792
security/openvpn-devel: upgrade port to git commit 91b057a2b5 (2024-02-11)
contains a number of bugfixes and minor improvements, especially adding
more unit tests.
There is one FreeBSD relevant bugfix for servers with DCO, where reporting
of kernel peer statistics to userland failed due to static buffers sized
too small (ENOSPC). Buffer handling here has been made dynamic.
PR: 276973
security/openvpn-devel: upgrade port to git commit efad93d049 (2023-11-17)
contains a number of bugfixes and minor improvements, plus fixes
for two bugs that have been assigned CVEs:
- CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly use
a send buffer after it has been free()d in some circumstances, causing
some free()d memory to be sent to the peer. All configurations using TLS
(e.g. not using --secret) are affected by this issue.
(found while tracking down CVE-2023-46849 / Github #400, #417)
- CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
restore "--fragment" configuration in some circumstances, leading to
a division by zero when "--fragment" is used. On platforms where
division by zero is fatal, this will cause an OpenVPN crash.
see also https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements
Also adjust files/patch-tests__t_cltsrv.sh because upstream commit
d623aa6c29 conflicts with this patch.
Security: 2fe004f5-83fd-11ee-9f5d-31909fb2f495
Security: CVE-2023-46849
Security: CVE-2023-46850
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree
- Remove all references to defunct ARCH arm
- Remove all references to defunct ARCH sparc64
- Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64
ARCH
- Remove sysutils/afbinit requires defunct sparc64 ARCH
- Remove all references to bktr driver
- Remove all references to defunct FreeBSD_12
- Remove all references to OSVERSION/OSREL corresponding to 12
- Remove conditionals in Mk/Uses/cabal.mk
- Remove sparc reference from Mk/Uses/qt-dist.mk
- Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64
- Remove BROKEN_FreeBSD_12* from:
- Remove OpenSSL patches from:
- Remove conditional flags for OSVERSION >= 1300000 to fixed flags.
Also move conditional flags for non sparc64/arm ARCH to fixed flags.
Reviewed by: brooks, jbeich, rene, salvadore
Differential Revision: https://reviews.freebsd.org/D42068
bsd.sites.mk: Update all ports using USE_GITLAB
Replace GL_COMMIT by GL_TAGNAME in all ports. The new GL_TAGNAME is
backwards-compatible (accepting any commit hash as before), but also
understands an actual tag name. Moving to tag names where appropriate is
left to individual ports' maintainers.
Approved by: portmgr (tcberner, mentor)
Differential Revision: https://reviews.freebsd.org/D37077
security/openvpn-devel: upgrade port to git commit fafb05f6f3 (2023-03-31)
This brings openvpn-devel to the current HEAD of the development tree,
which is still very close to OpenVPN 2.6.3.
Adjust config handling of option "DCO" to match upstream changes - that
is, DCO is enabled by default, so we pass "--disable-dco" to configure
now if the option is unchecked.
security/openvpn-devel: upgrade port to git commit 480ad2a84e (2023-01-13)
this commit is also 2.6_rc2 (+ a freebsd/linux build fix).
contains a number of bugfixes and minor improvements, see
https://github.com/OpenVPN/openvpn/blob/v2.6_rc2/Changes.rst
Most notable improvement: this contains a default-enabled ratelimiter
for initial TLS handshake packets (100 per 10s), significantly reducing
the usefulness of abusing an OpenVPN server as a DDoS reflection engine.
Use '--connect-freq-initial' to tune parameters if needed.
security/openvpn-devel: upgrade port to git commit 84e70c479e (2022-12-28)
this commit is also 2.6_rc1.
contains a number of bugfixes and minor improvements, see
https://github.com/OpenVPN/openvpn/blob/v2.6_rc1/Changes.rst
security/openvpn-devel: upgrade port to git commit 566c0791ca (2022-12-15)
this commit is also 2.6_beta2.
contains a number of bugfixes and minor improvements
user visible changes since last port upgrade
- freebsd + DCO now has working byte counters in DCO mode
- server no longer accepts new inbound client connections
while in "explicit-exit-notify" shutdown phase
- logging improvements for DCO key handling
security/openvpn-devel: upgrade port to git commit e778a6fd26d (2022-12-01)
this commit is also 2.6_beta1.
contains a good number of bugfixes and minor improvements
user visible changes since last port upgrade
- binary identifies itself as "2.6_beta1"
- client reconnect in p2p TLS mode works now with DCO enabled (on FreeBSD 14)
- more robust handling of cipher negotiation issues in p2p TLS mode
- supports server-pushable "tun-mtu" now
- support DCO with AES-192-GCM on sufficiently-new FreeBSD 14 kernels
security/openvpn-devel: fix up shebang of totpauth.py script
...and we also need to add USES+=python:build to fix
stage-qa complaints of the following kind:
Error: '/usr/local/bin/python' is an invalid shebang you need
USES=shebangfix for 'share/examples/openvpn/sample-scripts/totpauth.py'
ALTHOUGH the shebangfix has worked and replaced /usr/bin/python3
by /usr/local/bin/python (with /usr/local from LOCALBASE apparently).
security/openvpn-devel: upgrade port to git commit ecad4839ca (2022-10-27)
contains a good number of bugfixes and minor improvements, no new features.
user visible changes:
- "topology subnet" tun interfaces will now use IFF_POINTOPOINT
- DCO option on FreeBSD 14 will default to "on" now
- DCO on FreeBSD now requires a FreeBSD kernel after
commit 2e797555f701c38d9d to get kernel-side ovpn(4)
improvements, necessary for proper subnet + iroute support
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.
There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.
The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.
Approved by: portmgr (tcberner)
security/openvpn-devel: options cleanup
- Drop TUNNELBLICK option and patch, which fails PATCH and if your force
it, build. security/openvpn removed the option earlier this year.
Drop pkg-help along with it
- Exclude DCO-option on FreeBSD 12 and 13. It requires FreeBSD 14
kernel features, and FreeBSD 11 and older are no longer supported.
Approved by: portmgr (blanket)
security/openvpn-devel: Upgrade to current git revision, add DCO option
commits up to 734de8f9aa2df bring a number new developments, especially
inclusion of the "Data Channel Offload" (OpenVPN in kernel space)
feature.
Since this is still considered not very well tested and needs a
very recent FreeBSD 14 kernel, this is off by default, and a new option
[ ] DCO
has been added to enable it.
security/openvpn-devel: Upgrade to current git revision
commits up to 413877f522e bring a number new developments, especially
hardening the server against TLS state exhaustion and being abused
for reflection/amplification attacks, a full MTU/MSS handling rehaul,
and proper OpenSSL 3.0.x support.
PR: 263818
*/*: Remove redundant '-[0-9]*' from CONFLICTS_INSTALL
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Approved by: portmgr (blanket)
security/openvpn-devel: switch to Gitlab and new maintainer
The previous maintainer asked that the port be removed, but
we seem to have found a better solution. Gert Doering volunteered
to take over the port and reference Git directly.
Import security/openvpn fix for leftover .orig files.
PR: 256209
Maintainer change implicitly
Approved by: ecrist@secure-computing.net (removal request)
New contents reviewed and
Approved by: gert@greenie.muc.de (new maintainer, by IRC/mail)
security/openvpn-devel: Update to 2021-W13 development snapshot
Commit history from 202049 to 202113:
5ac8c3c7 Fix async push broken after auth deferred refactor
8ccce69d log file descriptor in more socket related error messages
c5fec838 Move auth deferred related members into its own struct
6ea62d50 Remove deprecated option '--keysize'
60f5889a Deprecate non TLS mode in OpenVPN
79ff3f79 Allow running a default configuration with TLS libraries without BF-CBC
9e702a5d Always disable TLS renegotiations
203afbe9 reliable: retransmit if 3 follow-up ACKs are received
343b6119 Remove do_init_socket_2 and do_init_socket_1 wrapper function
9fe0b2c2 Extract multi_assign_peer_id into its own function
18b4a838 Remove thread_mode field of multi_context
aba8776e Fix 'compress migrate' for 2.2 clients.
8fa8a175 Implement '--compress migrate' to migrate to non-compression setup
72e1ecb5 Move is_proto function to the socket.h header
9eb285f4 Remove unused variable pass_config_info
c0b36e9f Remove unused function tls_test_auth_deferred_interval
3667df1d Remove unused field txqueuelen from struct tuntap
14061e3e Remove pointless tun_adjust_frame_parameters function
137eb670 Remove code for aligning non-swapped compression
bdc11ae4 Rename tunnel_server_udp_single_threaded to tunnel_server_udp
213fd3ee Remove superflous ifdefs around enum like defines
997b006a Get rid of last PLUGIN_DEF_AUTH #ifdef
76ccc62d Stop using deprecated getpass()
2d5c437f Remove automatic service
d11c273b Fix #elif TARGET_LINUX missing defined() call
f91e2116 Remove support for non ISO C99 vararg support
7975e33b Remove flexible array member autoconf check
ca570706 Cleanup print_details and add signature/ED certificate print
467b16dc Use correct types for OpenSSL and Windows APIs
e756e12a Fix socket related functions using int instead of socket_descriptor_t
7fc608da Make buffer related function conversion explicit when narrowing
5a2ed714 Restore also ping related options on a reconnect
7064ccb9 Move NCP saving and restore to the prepush restore code
528a78fb Move restoring pre pull options to initialising of c2 context
1e938c50 openvpnserv: Cache last error before it is overridden
1b71f859 Remove empty dummy functions
5b8a1231 Deprecate the --verify-hash option
26117a82 Document the simple self-signed certificate setup in examples
423ced96 Support fingerprint authentication without CA certificate
e5e9a07e tapctl: Resolve MSVC C4996 warnings
c3a7065d Implement peer-fingerprint to check fingerprint of peer certificate
d1fe6d52 Extend verify-hash to allow multiple hashes
df471f4d iservice: Resolve MSVC C4996 warnings
709c3810 interactive.c: Resolve MSVC C4996 warning
26540310 tun.c: Remove dead code
6eb28f7c Wipe Socks5 credentials after use
f9d9fe55 Move extract_iv_proto to ssl_util.c/h
45e7d412 Fix multiple problems when compiling with LLVM/Windows (clang-cl)
1480903e README.wolfssl Update
9b2e8034 Remove compat-lz4 references from VS project files
60c18b45 build: Add support for pkg-config < 0.28 for old autoconf versions
f38819b7 Add README.wolfssl documentating the state of WolfSSL in OpenVPN
f6dca235 Support for wolfSSL in OpenVPN
4524feb2 Avoid generating unecessary mbed debug messages
24596b25 build: Remove compat-lz4
4170da07 Do not print Diffie Hellman parameters file to log file
476990d4 EVP_DigestSignFinal siglen parameter correction
b0bff559 Require at least 100MB of mlock()-able memory if --mlock is used.
fdb4f276 Allow pending auth to be send from a auth plugin
d8ed5932 Change parameter of send_auth_pending_messages from context to tls_multi
88664aba Refactor extract_var_peer_info into standalone function and add ssl_util.c
53229047 Implement server side of AUTH_PENDING with extending timeout
4cf01c8e Fix EVP_PKEY_CTX_... compilation with LibreSSL
06f6cf3f Prefer TLS libraries TLS PRF function, fix OpenVPN in FIPS mode
3338f2d5 Quote the domain name argument passed to the wmic command
04876274 Add S_EXITCODE flag for openvpn_run_script to report exit code
b29f7dff Introduce management client state for AUTH_PENDING notifications
3f8fb2b2 Implement client side handling of AUTH_PENDING message
0714ed80 Check return values in md_ctx_init and hmac_ctx_init
fdfbd444 Explain structver usage in sample defer plugin.
413580b6 Change pull request timeout use a timeout rather than a number
ce652e7d Remove inetd support from OpenVPN
a385a3e8 More explicit versioning compatibility in sample-plugins/defer/simple.c
7d1361c1 Update openvpn_plugin_func_v2 to _v3 in sample-plugins/defer/simple.c
595be121 Documentation fixes around openvpn_plugin_func_v3 in openvpn-plugin.h.in
2d7e1954 Fix naming error in sample-plugins/defer/simple.c
452e016c clean up / rewrite sample-plugins/defer/simple.c
6a0c51ba Make OPENVPN_PLUGIN_ENABLE_PF failures FATAL
ef2405a6 Document common uses of 'echo' directive, re-enable logging for 'echo'.
15daa988 Fix tls-auth mismatch OCC message when tls-cryptv2 is used.
3b1ded39 Man page sections corrections
e0e7625c Skip DHCP renew with Wintun adapter
b1a8213e Remove 1 second delay before running netsh
8a8ee283 Clarify --block-ipv6 intent and direction.
aa58035a Zero initialise msghdr prior to calling sendmesg
86d7e990 ssl_common.h: fix 'not all control paths return a value' msvc warning
ab4688e3 Fix too early argv freeing when registering DNS
a686f7e2 Fix line number reporting on config file errors after <inline> segments
PR: 254785
Submitted by: Eric F. Crist (maintainer)
-- Diese und die folgenden Zeilen werden ignoriert --
> Description of fields to fill in above: 76 columns --|
> PR: If and which Problem Report is related.
> Submitted by: If someone else sent in the change.
> Reported by: If someone else reported the issue.
> Reviewed by: If someone else reviewed your modification.
> Approved by: If you needed approval for this commit.
> Obtained from: If the change is from a third party.
> MFC after: N [day[s]|week[s]|month[s]]. Request a reminder email.
> MFH: Ports tree branch name. Request approval for merge.
> Relnotes: Set to 'yes' for mention in release notes.
> Security: Vulnerability reference (one per line) or description.
> Sponsored by: If the change was sponsored by an organization (each collaborator).
> Differential Revision: https://reviews.freebsd.org/D### (*full* phabric URL needed).
> Empty fields above will be automatically removed.
M openvpn-devel/Makefile
M openvpn-devel/distinfo