OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.
A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive information, or cause a denial of service (SIGTERM) by triggering XM…
The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges.
OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (openvpn.exe).
The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service.
OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can be used to potentially trigger further information leaks.
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.
OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated attacker.
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension().
OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTP-over-OpenVPN session using Blowfish in CBC mode, aka a "Sweet32" attack.
The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.
VuXML only (0) · listed, port not fixed yet
None. pkg audit reports nothing for this version.
Fixed (8)
VuXML entries whose affected range this version has left.
security/openvpn-devel: Update to 2020-W49 snapshot
Update port to 2020-W49 development snapshot.
1387f526 Fix port-share option with TLS-Crypt v2
4d307ed4 tls-crypt-v2: also preload tls-crypt-v2 keys (if --persist-key)
fb169c3b tls-crypt-v2: fix server memory leak
dfd624b5 Remove auth_user_pass.wait_for_push variable
fb789947 Fix auth-token not being updated if auth-nocache is set
88dc4276 Make any auth failure tls_authentication_status return auth failed
55d5eaa3 Send AUTH_FAILED message to clients on renegotiation failures
3ac8e592 Rename DECRYPT_KEY_ENABLED to TLS_AUTHENTICATED
f9d3fbf9 Clean up tls_authentication_status and document it
f1f0f074 Improve keys out of sync message
8292102b Add more documentation about our internal TLS functions
cc5a7163 Replace key_scan array of static pointers with inline function
fc25ca3a build: Fix missing install of man page in certain environments
0d4069e4 Change travis build scripts to use https when fetching prerequisites.
PR: 251761
Submitted by: Eric F. Crist (maintainer)
openvpn-devel Update to post 2.5 release development snapshot.
=== Commit Notes ===
99d217b2 Remove --disable-def-auth configure argument
0d4ca79d Remove explicit setting of peer_id to false
cb70cf51 Remove NULL checks before calling free
2c8a9877 Align reliable_free with other free methods to accept NULL
0d5aab88 Inline function tls_get_peer_info
bbcada8a Avoid passing NULL to argv_printf_cat() in temp_file error case.
a4eeef17 Add function for common env setting of verify user/pass calls
a480eaae Ignore deprecation warning for daemon on macOS
14bd92b7 Fix compilation on pre-EKM mbedTLS libraries.
f0734e49 Simplify key material exporter backend API
6dc09d0d Implement generating data channel keys via EKM/RFC 5705
1e6e083e networking_iproute2: fix memory leak in net_iface_mtu_set()
c018fc00 Allow 'none' cipher being specified in --data-ciphers
3b04c34d Support X509 field list to be username
15d05243 Move openvpn specific key expansion into its own function
23e11e59 Fix redirecting of IPv4 default gateway if connecting over IPv6.
bfb28845 Added 'route_ipv6_metric_NN' environment variable for IPv6 route metric.
b68aa006 Speedup TCP remote hosts connections
a5409c0d Selectively reformat too long lines
0f44a908 compat/lz4: Update to v1.9.2
43cdb0c7 Improve error msg when all TAP adapters are in use 'or disabled'
e9e47f49 Fix update_time() and openvpn_gettimeofday() coexistence
d6720203 Alias ADAPTER_DOMAIN_SUFFIX to DOMAIN
66ad8727 Improve documentation of --username-as-common-name
70882f3e Set DNS Domain using iservice
7f7b0539 openvpnmsica: Simplify find_adapters() to void return
370395b3 netsh: Delete WINS servers on TUN close
dd754221 netsh: Clear existing IPv6 DNS servers before configuring new ones
6020e94b netsh: Specify interfaces by index rather than name
860a7bc7 Fix combination of --dev tap and --topology subnet across multiple platforms.
94cebf82 Add demo plugin that excercises "CLIENT_CONNECT" and "CLIENT_CONNECT_V2" paths
4dff2368 If IPv6 pool specification sets pool start to ::0 address, increment.
3ad86c25 Fix fatal error at switching remotes (#629)
6345cea8 build: Fix make distclean/distcheck
0b5141d8 sample-plugins: Partially autotoolize the sample-plugins build
81b6a7e7 Fix netbits setting (in TAP mode) for IPv6 on Windows.
b8625abb Allow --dhcp-option in config file when windows-driver is wintun
97ff6436 man: Improve --remote entry
eebeaa02 socks.c: fix alen for DOMAIN type addresses, bump up buffer sizes
fb94fbc3 msvc: better support for 32bit architecture
37aab49b Fix --show-gateway for IPv6 on NetBSD/i386.
a61c08a2 Handle NULL returns from calloc() in sample plugins.
8120e1ad man: Add missing --server-ipv6
50c7700d Fix description of --client-disconnect calling convention in manpage.
81f9bb3a Replace 'echo -n' with 'printf' in tests/t_lpback.sh
5b815eb4 Add a remark on dropping privileges when --mlock is used
aa346849 Fix handling of 'route remote_host' for IPv6 transport case.
505d5ad8 Fix best gateway selection over netlink
a4e0ac06 Fix TUNSETGROUP compatibility with very old Linux systems.
a09a2fad Fix error detection / abort in --inetd corner case.
5fd66510 Document that --push-remove is generally more suitable than --push-reset
b341b1c5 openvpnmsica: make adapter renaming non-fatal
f3f09541 In tap.c use DiInstallDevice to install the driver on a new adapter
6ffe64e3 Fix client NCP OCC fallback when server and client cipher are identical
136c5f01 Fix compilation with older mbed TLS versions (mbedtls_tls_prf_types undefined)
PR: 250743
Submitted by: Eric F. Crist (maintainer)
Approved by: Eric F. Crist (maintainer)
security/openvpn-devel: Update to 2020-W35 snapshot (take 2 + 1/2)
This also adds a fix to the optional TUNNELBLICK extra-patch that removes
context now gone from the upstream code.
Here are the changes in the W35 snapshot:
136c5f01 Fix compilation with older mbed TLS versions (mbedtls_tls_prf_types undefined)
5e19cc2c Workaround FreeBSD 12+ race condition on tun/tap open with IPv6.
10abd656 Refactor key_state_export_keying_material functions
62560e2a Fixes a bug in management_callback_send_cc_message, should be strlen instead of sizeof
2ab0a924 Fix client's poor man NCP fallback
ed47c097 tun.c: enable using wintun driver under SYSTEM
2da29362 Improve the documentation for --dhcp-option
bf911882 Changes.rst: fix mistyped option names
e33f4475 doc: fix typos in cipher-negotiation.rst
7e65483d Fix stack overflow in OpenSolaris NEXTADDR()
f7432a97 Change version.m4 to 2.6_git
c1c43d46 Improve sections about older OpenVPN clients in cipher-negotiation.rst
26b658ea Changes.rst updates in preparation to 2.5_beta1
079fca54 Add depreciation notice for --ncp-disable to protocol-options.rst
16249959 Cleanup tls_pre_decrypt_lite and tls_pre_encrypt
a6a15f70 Refactor/Reformat tls_pre_decrypt
Poudriere test builds succeed on:
11.3 i386, amd64
12.1 i386, amd64, arm64
mips64 currently left in the dust because a build req. for py-docutils
winds up requiring gcc9, which isn't available for MIPS64.
PR: 248969
Submitted by: Eric F. Crist (maintainer)
security/openvpn-devel: Update to 2020-W33 snapshot
Update to Week 33 snapshot:
e02616d8 Document comp-lzo no and compress being incompatible
c13d20fa Remove S_OP_NORMAL key state.
4b4f5fe2 Move parsing IV_PROTO to separate function
4edcf571 Skip existing interfaces on opening the first available utun on macOS
42b39e98 Merge check_coarse_timers and check_coarse_timers_dowork
cd88d947 Eliminate check_tls wrapper function
eed645b3 Eliminate check_incoming_control_channel wrapper function
b7aebba2 Eliminate check_fragment function
76ea0859 Rename check_ping_restart_dowork to trigger_ping_timeout_signal
ce7ddaaf Split pf_check_reload check and check timer in process_coarse_timers
feacd01c travis: don't run t_net.sh test
e9639044 Remove a number of check/do_work wrapper calls from coarse_timers
60200b9e Remove buf argument from link_socket_set_outgoing_addr
33773a02 Clean up a number of leftover C89 initialisations in ssl.c
2fdd3329 Minor cleanup in push.c
bf42466d Document different behaviour of dynamic cipher negotiation
2c1d8c33 Rework NCP compability logic and drop BF-CBC support by default
dab34fdd Fix compilation with --disable-lzo and --disable-lz4
992e9cec Log serial number of revoked certificate
71d56aea client-connect: Add documentation for the deferred client connect feature
20b39474 Abort client-connect handler loop after first handler sets 'disable'.
08f3c1ca Fix sequence of events for async plugin v1 handler.
0a7af784 Gently push users towards --data-ciphers in --show-ciphers output
5fde831c Fix stack buffer overruns in NEXTADDR() macro:
342f9b78 Add a note that ncp-ciphers is replaced by data-ciphers
30d19c6e Rename ncp-ciphers to data-ciphers
a3b21a76 Avoid sending push request after receving push reply
7cadbe24 Simplify calling logic of check_connection_established_dowork
1d86fae8 Include utun device number in utun error message
PR: 248600
Submitted by: Eric F. Crist (maintainer)
security/openvpn-devel: update to 2020-W30 snapshot
This is from the PR, with the addition of
BUILD_DEPENDS+=rst2man:textproc/py-docutils
such that the manpage gets built (it doesn't ship with
snapshots - which are from Git - any longer).
changes:
08469ca1 Remove --client-cert-not-required
2d5facaa Remove --ifconfig-pool-linear
94edc7c5 Require AEAD support in the crypto library
ec7d0e8e Drop support for OpenSSL 1.0.1
df85950a travis: Fix make distcheck failure
aad16b6c client-connect: Implement deferred connect support for plugin API v2
3658e577 Separate handling of non-deferred return values for client-connect-scripts.
3d2af156 client-connect: Add deferred support to the client-connect v1 plugin handler
290bb269 client-connect: Use inotify for the deferred client-connect status file
529b1ab2 client-connect: Add deferred support to the client-connect script handler
82241468 Remove CAS_PARTIAL state
4cabd28a doc/man: Do not install man *.rst files
4b4b34da Remove --no-iv
19fab1f6 options: don't leak inline'd key material in logfile
83d6da50 Merge Makefile.am's AUTOMAKE_OPTIONS into configure.ac's AM_INIT_AUTOMAKE.
dfb40edc client-connect: Add CC_RET_DEFERRED and cope with deferred client-connect
ee6830c3 doc/man: Add misssing renegotiation.rst to Makefile.am
8d0b1def doc/man: Documentation for --bind-dev / VRFs on Linux
5c5544d4 doc/man: Update --txqueuelen default setting (Now OS default)
ed593e65 doc/man: Adopt compression documentation
850fd5fa doc/man: Mark compression options as deprecated
f500c49c doc/man: convert openvpn.8 to split-up .rst files
c83b197a Add deferred authentication support to plugin-auth-pam
90ed0fd2 reformat multi_client_generate_tls_keys according to uncrustify
708d1694 client-connect: Move adding inotify watch into its own function
4d500451 client-connect: Change cas_context from int to enum
07a69fd2 client-connect: Refactor client-connect handling to calling a bunch of hooks in a loop
4f29b73b client-connect: Refactor to use return values instead of modifying a passed-in flag
380a142a client-connect: Move multi_client_connect_setenv into early_setup
62a840e2 client-connect: Refactor multi_client_connect_source_ccd
78359a04 Added support for DHCP option 119 (dns search suffix list) for Windows.
0c8c50ca client-connect: Split multi_connection_established into separate functions
b15fcceb Handle connecting clients without NCP or OCC without crashing.
PR: 248147
Submitted by: Eric F. Crist (maintainer)
security/openvpn-devel: Update to 202028 (2020-W28 snapshot)
ChangeLog:
<https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=247974#c0>
While here:
* add cmocka as build-time requisite to include the engine test.
* use PLUGINDIR rather than hacking CPPFLAGS for PLUGIN_LIBDIR,
the latter breaks -fPIC detection by configure (breaking the
shared lib build for the engine unit tests)
PR: 247974
Submitted by: Eric F. Crist (maintainer)
security/openvpn-devel: Maintainer update to 201935
This commit updates the port to the latest development snapshot.
Additional changes over PR:
- leave CATEGORIES alone (leaving net-vpn in)
- move IGNORE_SSL upwards and remove USE_LDCONFIG to please portlint -CA
PR: 240376
Submitted by: ecrist@secure-computing.net (maintainer)
Patch sed(1) regexp in self-test script from GNU to POSIX syntax.
PR: 240307
Submitted by: kevans@
Approved by: ecrist@secure-computing.net (maintainer)
Implement new virtual category: net-vpn for VPN related ports
based on discussion at ports@ [1]. As VPN softwares are put in different
physical category net and security. This is a little bit confusing. Let's
give them new virtual category net-vpn.
[1] https://lists.freebsd.org/pipermail/freebsd-ports/2019-April/115915.html
PR: 239395
Submitted by: myself
Approved by: portmgr (mat)
Differential Revision: https://reviews.freebsd.org/D21174
Update to new snapshot.
Note I didn't take the original patch because it needed to NOT conflict
with itself, and I had to fix indentation - be sure to use TAB, not
blanks, after the VARIABLE= part.
PR: 219305
Submitted by: ecrist@secure-computing.net (maintainer)
Update openvpn-devel to 2016-52 snapshot.
Align with security/openvpn for RC script improvements, dropping the
TUNNELBLICK patch (integrated upstream) and pkg-help file (no longer
required).
Note that pkcs11* and mbedTLS currently do not mix (I randomly checked
different option sets), an issue this port shares with security/openvpn.
"checking mbedtls pkcs11 support...
configure: error: mbedtls has no pkcs11 wrapper compiled in"
PR: 215734
Submitted by: Eric F. Crist (maintainer)
security/openvpn-devel: 201607 -> 201623
Port Changes:
- password-save option is always on now, no longer optional
- LibreSSL has been renamed mbed TLS
Upstream Changes:
- Implement --push-remove option to remove options pushed by server
- Use mbedTLS 2.x now, instead of PolarSSL 1.x
PR: 210259
Submitted by: ecrist@secure-computing.net (maintainer)
By default libtool replaces -export-symbols <file> with -retain-symbols-file <file> on ELF systems, but this doesn't really do what -export-symbols is meant to do. On GNU ELF systems it converts <file> to a simple version script first and then uses -version-script instead of -retain-symbols-file. Let USES=libtool patch libtool scripts to do this on all systems with GNU ld(1).
Bump PORTREVISION on all ports where the build log contains -export-symbols.
audio/calf: This port builds a module that now exports only one function,
but it also builds a number of executables that link to this module and
expect to see other functions. Because it's already a bit dodgy to link to
a module (libtool warns about this) let the module continue to export only
one function and instead build an ordinary library from the same source that
the executables can link to. Fix a number of other issues in the same
Makefile.am and clean up the port Makefile.
japanese/scim-honoka: Tries to hide all symbols that start with an
underscore, but because this library is written in C++ all symbols start
with _Z so it ends up hiding everything. Just don't hide anything at all
like the textproc/scim configure script does.
multimedia/schroedinger: Apply an upstream patch.
textproc/scim-input-pad: Same as japanese/scim-honoka.
PR: 201922
Approved by: portmgr (antoine)
Exp-run by: antoine
- Update security/polarssl13 to 1.3.11 - Patch a Makefile so regular make install works - Replace a patch with MAKE_ENV - Bump dependent ports
PR: 200816