Secure IP/Ethernet tunnel daemon
openvpn:openvpn from the portpkg audit reports nothing for this version.| CVE-2026-12932 | 7.1 | 2026-07-30 | A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service… |
| CVE-2026-11771 | 7.0 | 2026-07-30 | OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a… |
| CVE-2026-12996 | 6.0 | 2026-07-30 | A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory v… |
| CVE-2026-13117 | 6.0 | 2026-07-30 | An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promoti… |
| CVE-2026-13379 | 5.1 | 2026-07-30 | The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted sear… |
CVE-2026-11771, CVE-2026-12932, CVE-2026-12996, CVE-2026-13117, CVE-2026-13122, CVE-2026-13698
no CVE referenced
CVE-2017-7508, CVE-2017-7512, CVE-2017-7520, CVE-2017-7521, CVE-2017-7522
no CVE referenced
security/openvpn: Security update 2.7.7 => 2.7.8 Changelog: https://github.com/OpenVPN/openvpn/blob/v2.7.8/Changes.rst PR: 299261 Security: CVE-2026-84790 Security: CVE-2026-88964 Security: CVE-2026-84256 Sponsored by: UNIS Labs (vvd, commit patch) Pull request: https://github.com/freebsd/freebsd-ports/pull/637 MFH: 2026Q44fbd626e70
security/openvpn: Security update 2.7.6 => 2.7.7 Changelog: https://github.com/OpenVPN/openvpn/blob/v2.7.7/Changes.rst PR: 298152 Pull request: https://github.com/freebsd/freebsd-ports/pull/610 Reported by: mandree (maintainer) Approved by: osa, vvd (Mentors, implicit) Security: CVE-2026-84732 MFH: 2026Q33d91d57f7f
security/openvpn: bugfix update to 2.7.6 This is not security-relevant on FreeBSD, one security fix affects Windows, the other one only affects builds against mbedTLS (which is not currently supported by the port), and a third one (second bullet point) turned out to not be exploitable. Note that the --dev option defaults to "tun" (if not specified). Note that --ping and --keepalive settings are now capped at 24 h. TCP-based configurations now always enable TCP_NODELAY. Changelog: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.6 MFH: 2026Q3 Pull Request: https://github.com/freebsd/freebsd-ports/pull/584bbddd98141
security/openvpn: Needs addition to SHEBANG_FILES and some cleanup - Remove unnecessary GNU_CONFIGURE_MANPREFIX. - Improve post-install-EXAMPLES-on. PR: 296890 Sponsored by: UNIS Labs Co-authored-by: Vladimir Druzenko <vvd@FreeBSD.org> MFH: 2026Q383283c284c
security/openvpn: Update 2.7.4 => 2.7.5 (fix 6 CVEs) Changelog: https://github.com/OpenVPN/openvpn/blob/v2.7.5/Changes.rst The upstream's signing sub-key expired yesterday, new key provided via https://swupdate.openvpn.net/community/keys/gpgkey-F554A3687412CFFEBDEFE0A312F5F7B42F2B01E7.gpg PR: 296429 Security: ffa897a0-756f-11f1-b291-a74de6bb0320 Security: CVE-2026-11771 Security: CVE-2026-12932 Security: CVE-2026-12996 Security: CVE-2026-13117 Security: CVE-2026-13122 Security: CVE-2026-13698 Sponsored by: UNIS Labs MFH: 2026Q27bcce8a1bb
*/*: Use C.UTF-8 locale Ports 02f27a83b44d fixed the ports tree to the C locale so it would work correctly in environments where users use a locale that isn't compatible with the C locale, e.g. xx_YY.UTF-8 where [A-Z] includes more than just upper case letters. USE_LOCALE was introduced to let ports use another locale if they needed it. The C.UTF-8 locale was created later on to be mostly compatible with the C locale. Switch the ports tree locale to C.UTF-8 and remove USE_LOCALE. The world has moved to Unicode so all ports either require it or know how to build correctly in a Unicode environment. PR: 295945 Exp-run by: antoineb6ec06f079
all: drop support for FreeBSD 13, mips and risc64sf Reviewed by: many (*) Differential Revision: https://reviews.freebsd.org/D55624 Differential Revision: https://reviews.freebsd.org/D55642 (merged in from bofh) many (*) acm arrowd brooks cmt dch decke dinoex eduardo fluffy fuz gahr garga jbeich joerg jrm kai kenrap martymac matthew mfechner michaelo mizhka nobutaka pkubaj se tagattie thj Anton Saietskii GenericRikka Gert Doering Jan Bramkamp Oleh Hushchenkov Oleksandr Kryvulia Ralf van der Enden Yamagi desktop kde python tcltk office2a7c056120
security/openvpn: Update to bugfix release 2.7.4 Remove --enable-strict option, now unsupported upstream Changelog: https://github.com/OpenVPN/openvpn/blob/v2.7.4/Changes.rst Obtained from: GitHub repo68035ac676
security/openvpn: security update to 2.7.2 (also includes OpenSSL 4.0 support, improved error messages and others) Changelog: https://github.com/OpenVPN/openvpn/blob/v2.7.2/Changes.rst Security: 549313db-3e93-11f1-8d38-7fbbe0285610 Security: CVE-2026-35058 Security: CVE-2026-40215 MFH: 2026Q2 PR: 2947141c4a695461
security/openvpn: Update to 2.7.1 This changes installed scripts, openvpn-client.up and .down scripts are no longer installed into libexec/, but instead a dns-updown script is placed into libexec/openvpn/ (all under $PREFIX). Based on a patch provided by Marek Zarychta. Changelog: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.1 PR: 293138, 28626351f1036a07
security/openvpn: Fix detection of native inotify on FreeBSD 15 This fixes build when ASYNC_PUSH option is enabled Fixed upstream in commit 38243844f225517fa1d288517db9a34a33c5ad13 Reference: https://github.com/OpenVPN/openvpn/commit/38243844f225517fa1d288517db9a34a33c5ad13 PR: 293176 Reported by: Ivo Karabojkov Approved by: mandree@ (via Matrix)72554c1241
security/openvpn: update to v2.6.19 (bugfixes) ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.6.19/Changes.rst#overview-of-changes-in-2619 MFH: 2026Q1 (after a few days)9e9d4c0573
security/openvpn: security update to 2.6.16 Changelog: https://github.com/OpenVPN/openvpn/blob/v2.6.16/Changes.rst#overview-of-changes-in-2616 MFH: 2025Q4 Security: 17a40d76-c3fd-11f0-b513-0da7be77c170 Security: CVE-2025-13086f0181a6845
security/openvpn: update to v2.6.15 ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.6.15/Changes.rst#overview-of-changes-in-2615 FreeBSD relevant changes: (note the DCO float notifications had previously been backported for the FreeBSD port already in 2.6.14_3, and we're not currently building with mbedTLS support for 2.6.x) New features / User visible changes ----------------------------------- - Apply more checks to incoming TLS handshake packets before creating new state - namely, verify message ID / acked ID for "valid range for an initial packet". This fixes a problem with clients that float very early but send control channel packet from the pre-float IP (Github: OpenVPN/openvpn#704), backported from 2.7_beta1. - update GPL license text to latest version from FSF Code maintenance ---------------- - remove a few extra newline characters at the end of rarely-seen log lines - replace assert() calls in the code with OpenVPN ASSERT() calls (not subject to -DNDEBUG, plus better logging on the actual cause) - remove "dh dh2048.pem" from all sample configurations, remove "dh2048.pem" file from source tree - OpenSSL 3.5 Seclevel=3 considers this "not secure enough" and OpenVPN has not needed an explit DH file in a long while. Documentation Updates --------------------- - improve ``--tmp-dir`` documentation5b06fb3b7d
security/openvpn: assert()->ASSERT() cleanup This reverts my prior assert -> if...return(false) change to Ralf Lici's backport, and replaces all assert() by ASSERT(). Gert Doering writes: | OpenVPN's ASSERT() macro will do a bit more than the standard-libc | assert() call, namely print out which function and what expression | failed, before calling _exit(1). Also, it can not be accidentially | compiled-away (-DNDEBUG). | | Use of ASSERT() generally only advised in cases of "this must not happen, | but if it does, it's a programming or state corruption error that we | must know about". Use of assert() is lacking the extra debug info, and as | such, not advised at all. This is a backport of OpenVPN master changes... Obtained from: Gert Doering <gert@greenie.muc.de> Obtained from: <https://gerrit.openvpn.net/c/openvpn/+/1171> PR: 289303 MFH: 2025Q3 (suggestion after 10 days)d92d41ca1a
security/openvpn: support DCO float notifications
The FreeBSD kernel added "if_ovpn: support floating clients"
on main on 2025-07-28, and merged it to 14/stable on 2025-08-13.
https://reviews.freebsd.org/D51468
https://cgit.freebsd.org/src/commit/?id=9c52600a5a150117b4396df3b868cf2516e1674c&h=main
https://cgit.freebsd.org/src/commit/?h=stable/14&id=fc387ed68f3c7b0b8da9bab13492b7bbafecb5bf
This adds a new notification from the kernel module to user space
named OVPN_NOTIF_FLOAT, which OpenVPN 2.6.14 does not support.
Backport support into OpenVPN 2.6.
Reported by: Marek Zarychta <zarychtam@plan-b.pwste.edu.pl>
Obtained from: Kristof Provost <kp@FreeBSD.org>
Obtained from: Ralf Lici <ralf@mandelbit.com>
- modified to avoid assert() in nvlist_to_sockaddr()
in src/openvpn/dco_freebsd.c
Obtained from: Gert Doering <gert@greenie.muc.de>
Tested by: Marek Zarychta <zarychtam@plan-b.pwste.edu.pl>
PR: 289303
MFH: 2025Q3 (suggestion after 10 days)5ecf19f037security/openvpn: remove 2048-bit legacy Diffie Hellman I received a fallout complaint from i386 FreeBSD 15-PRERELEASE builders that, as of now, has no other explanation than a tightened (if intermediately) SECLEVEL on that machine, and that's due to Diffie-Hellman 2048 bit parameters, and self-tests are failing with stereotypical "ee key too small" and "dh key too small". While it's not clear what the exact cause of the failure is and if we had a glitch in the OpenSSL 3.5.1 import (Enji updated the main branch to 3.5.2 shortly after), let's modernize the setup a bit. Fallout and Builder logs (I take it the 2nd URL states that the FreeBSD src branch was at commit c6778f3a442): https://pkg-status.freebsd.org/beefy17/data/main-i386-default/p98b748365fe6_sc6778f3a442/logs/openvpn-2.6.14.log https://pkg-status.freebsd.org/beefy17/build.html?mastername=main-i386-default&build=p98b748365fe6_sc6778f3a442 2025-08-20 11:46:39 OpenVPN 2.6.14 i386-portbld-freebsd15.0 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] [DCO] 2025-08-20 11:46:39 Note: dev-type not tun, disabling data channel offload. 2025-08-20 11:46:39 library versions: OpenSSL 3.5.1 1 Jul 2025, LZO 2.10 2025-08-20 11:46:39 OpenVPN 2.6.14 i386-portbld-freebsd15.0 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] [DCO] 2025-08-20 11:46:39 DCO version: FreeBSD 15.0-PRERELEASE 1500061 2025-08-20 11:46:39 library versions: OpenSSL 3.5.1 1 Jul 2025, LZO 2.10 2025-08-20 11:46:39 DCO version: FreeBSD 15.0-PRERELEASE 1500061 2025-08-20 11:46:39 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2025-08-20 11:46:39 GDG: problem writing to routing socket: Invalid argument (errno=22) 2025-08-20 11:46:39 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 2025-08-20 11:46:39 OpenSSL: error:030000A8:digital envelope routines::unknown security bits: 2025-08-20 11:46:39 OpenSSL: error:0A00018A:SSL routines::dh key too small: 2025-08-20 11:46:39 SSL_CTX_set0_tmp_dh_pkey 2025-08-20 11:46:39 Exiting due to fatal error 2025-08-20 11:46:39 OpenSSL: error:030000A8:digital envelope routines::unknown security bits: 2025-08-20 11:46:39 OpenSSL: error:0A00018F:SSL routines::ee key too small: 2025-08-20 11:46:39 Cannot load inline certificate file 2025-08-20 11:46:39 Exiting due to fatal error FAIL: t_cltsrv.sh That prompted upstream to file a bug and the suggestion to strip dh2048.pem from installing the demo file and sample configuration should not affect existing setups, however, if someone would have used the shipped dh2048.pem file, that would have to be regenerated with openssl dhparam -out dh2048.pem 2048. https://github.com/OpenVPN/openvpn/issues/819 https://gerrit.openvpn.net/c/openvpn/+/1145 Upstream changelog, as of v3 of the latter: | Remove use of 'dh dh2048.pem' from sample configs, remove 'dh2048.pem' file | | Since commit bd9aa06feb41 (Jan 2015) OpenVPN has allowed to use | '--dh none' to disable traditional Diffie Hellman, since more secure | ECDH algorithms are available that do not use explicit DH parameters. | | If configured with a suffiently high securelevel (3+), or if running in | FIPS mode, OpenSSL 3.5 will refuse 2048 bit DH files, making our tests | fail. | | Thus, remove all the DH2048 stuff from our sample configs. Obtained from: Gert Doering While here, delete files/patch-src_plugins_auth-pam_auth-pam.c because upstream (namely Antonio Quartulli) had fixed that omission in v2.6-beta1 already (in 2022, as of OpenVPN's commit 0fed64a91d894b46). Nobody has been able yet to reproduce the test failure other than by forcing SECLEVEL=3, so let's just push this and see if we receive pkg-fallout again next time i386 gets its ports built. Upstream considers the patch necessary anyways, so let's not waste too much time on testing on a dying system.acfe37ddd7
security/openvpn: clean up CONFLICTS_INSTALLe20a69e3dc
security/openvpn: security update to 2.6.14 "Fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2 Security scope: OpenVPN servers between 2.6.1 and 2.6.13 using --tls-crypt-v2 can be made to abort with an ASSERT() message by sending a particular combination of authenticated and malformed packets. To trigger the bug, a valid tls-crypt-v2 client key is needed, or network observation of a handshake with a valid tls-crypt-v2 client key No crypto integrity is violated, no data is leaked, and no remote code execution is possible. This bug does not affect OpenVPN clients." ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.6.14/Changes.rst#overview-of-changes-in-2614 Security: 2cad4541-0f5b-11f0-89f8-411aefea0df9 Security: CVE-2025-2704 MFH: 2025Q270a3176764
security/openvpn: critical update to 2.6.13 ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.6.13/Changes.rst#overview-of-changes-in-2613 Notably: Security fixes improve server-side handling of clients sending usernames or passwords longer than USER_PASS_LEN - this would not result in a crash, buffer overflow or other security issues, but the server would then misparse incoming IV_* variables and produce misleading error messages. Security: 47bc292a-d472-11ef-aaab-7d43732cb6f5 MFH: 2025Q1874ce689ef
security/openvpn: bug fix upgrade → 2.6.12 ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.6.12/Changes.rst#overview-of-changes-in-2612 MFH: 2024Q3b84a620b11
security/openvpn: security fix upgrade to 2.6.11 ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.6.11/Changes.rst#overview-of-changes-in-2611 Security: 142c538e-b18f-40a1-afac-c479effadd5c Security: CVE-2024-5594 Security: CVE-2024-28882 MFH: 2024Q297a30e46bd
security/openvpn: update to bugfix release 2.6.10 Changelog: https://github.com/OpenVPN/openvpn/blob/v2.6.10/Changes.rst#overview-of-changes-in-2610 Note that the security-related fixes only pertain to the Windows operating system.c2fc14bde2
security/openvpn: update to 2.6.9 bug-fix release ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.6.9/Changes.rst#overview-of-changes-in-269 MFH: 2024Q1a84abd0caa
*: Move manpages to share/man Approved by: portmgr (blanket)f139e51116
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree - Remove all references to defunct ARCH arm - Remove all references to defunct ARCH sparc64 - Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64 ARCH - Remove sysutils/afbinit requires defunct sparc64 ARCH - Remove all references to bktr driver - Remove all references to defunct FreeBSD_12 - Remove all references to OSVERSION/OSREL corresponding to 12 - Remove conditionals in Mk/Uses/cabal.mk - Remove sparc reference from Mk/Uses/qt-dist.mk - Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64 - Remove BROKEN_FreeBSD_12* from: - Remove OpenSSL patches from: - Remove conditional flags for OSVERSION >= 1300000 to fixed flags. Also move conditional flags for non sparc64/arm ARCH to fixed flags. Reviewed by: brooks, jbeich, rene, salvadore Differential Revision: https://reviews.freebsd.org/D42068bbab7f59e9
security/openvpn: add missing 2.6.x documentation, ...for instance, README.dco.md but also others. Update DCO help text to refer to this .md file. Found while debugging PR: 275206 MFH: 2023Q4d67975600c
security/openvpn: update to 2.6.8 bug-fix release hopefully fixes... PR: 275206 Changelog: https://github.com/OpenVPN/openvpn/blob/v2.6.8/Changes.rst#overview-of-changes-in-268 MFH: 2023Q4f6ef06771b
security/openvpn: fix regressions and some documentation bits Add two patches cherry-picked from upstream Git repository: OpenVPN 2.6.7 regressed and experienced crashes in some situations, https://github.com/OpenVPN/openvpn/issues/449 Reported by: Vladimir Druzenko (vvd@) Reported by: Patrick Cable (upstream) Obtained from: https://github.com/openvpn/openvpn/commit/b90ec6dabfb151dd93ef00081bbc3f55e7d3450f Also, some typos in the documentation are fixed, Obtained from: https://github.com/OpenVPN/openvpn/commit/457f468a76f324a14b1236988cc5f5a95f14abf5 Bump PORTREVISION. PR: 275055 MFH: 2023Q48d2e9d99db
security/openvpn: security update to 2.6.7 PR: 275055 Changelog: https://github.com/OpenVPN/openvpn/blob/v2.6.7/Changes.rst#overview-of-changes-in-267 Security: CVE-2023-46849 Security: CVE-2023-46850 MFH: 2023Q403b2c6723f
security/openvpn: bugfix update → 2.6.6 Changelog: https://github.com/OpenVPN/openvpn/blob/release/2.6/Changes.rst#overview-of-changes-in-266128360b8e8
security/openvpn: bugfix update to 2.6.5 ChangeLog: https://github.com/OpenVPN/openvpn/blob/release/2.6/Changes.rst#overview-of-changes-in-265e4bef35891
security/openvpn: update to 2.6.4 https://github.com/OpenVPN/openvpn/blob/v2.6.4/Changes.rst#overview-of-changes-in-264 MFH: 2023Q20512092a1f
security/openvpn: bugfix update to v2.6.3 I separately verified the OpenVPN signature and ran more tests, which the PR did not announce if it did. Changelog: https://github.com/OpenVPN/openvpn/blob/release/2.6/Changes.rst#overview-of-changes-in-263 PR: 270831 MFH: 2023Q29152aca618
security/openvpn: update to new upstream release 2.6.2 Changes: https://github.com/OpenVPN/openvpn/blob/release/2.6/Changes.rst#overview-of-changes-in-262 Note that --inactive does not yet work on FreeBSD.ff146af949
security/openvpn: remove leftover comment17fb7fd94e
security/openvpn: remove header file that now ships with 2.6.1 tarball Since this is identical to what's in the tarball, no PORTREVISION bump is required.50d615894f
security/openvpn: update to v2.6.1 Changelog: https://github.com/OpenVPN/openvpn/blob/v2.6.1/Changes.rstbc733dffe0
security/openvpn: default-enable DCO (on FreeBSD but not 12 and 13, because the relevant if_ovpn module is to appear in FreeBSD 14.) Reported by: Kristof Provost (kp@)118eb978b4
security/openvpn*: update to 2.6.0, keep openvpn25 - copy openvpn to openvpn25, mark as deprecated and to expire March 31 - update openvpn to openvpn 2.6.0, highlights from Frank Lichtenheld's release announcement e-mail, slightly edited: * Data Channel Offload (DCO) kernel acceleration support for Windows, Linux, and FreeBSD [14]. * OpenSSL 3 support * Improved handling of tunnel MTU, including support for pushable MTU. * Outdated cryptographic algorithms disabled by default, but there are options to override if necessary. * Reworked TLS handshake, making OpenVPN immune to replay-packet state exhaustion attacks. * Added --peer-fingerprint mode for a more simplistic certificate setup and verification. * Improved protocol negotiation, leading to faster connection setup. ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.6.0/Changes.rst6853ab171e
security/openvpn: update to 2.5.8 Changelog: https://github.com/OpenVPN/openvpn/blob/release/2.5/Changes.rst#overview-of-changes-in-258ae33c30fb0
security/openvpn: fix up ${name}_flags option
was broken in previous commit; bumping PORTREVISION again
PR: 266796ae6cc1b955security/openvpn: support ${name}_FLAGS
and bump PORTREVISION.
PR: 26679629d16aeb44Remove WWW entries moved into port Makefiles Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)fb16dfecae
Add WWW entries to port Makefiles It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)b7f05445c0
security/openvpn: remove obsolete pkg-helpb351c098c4
security: remove 'Created by' lines A big Thank You to the original contributors of these ports: * <ports@c0decafe.net> * Aaron Dalton <aaron@FreeBSD.org> * Adam Weinberger <adamw@FreeBSD.org> * Ade Lovett <ade@FreeBSD.org> * Aldis Berjoza <aldis@bsdroot.lv> * Alex Dupre <ale@FreeBSD.org> * Alex Kapranoff <kappa@rambler-co.ru> * Alex Samorukov <samm@freebsd.org> * Alexander Botero-Lowry <alex@foxybanana.com> * Alexander Kriventsov <avk@vl.ru> * Alexander Leidinger <netchild@FreeBSD.org> * Alexander Logvinov <ports@logvinov.com> * Alexander Y. Grigoryev <alexander.4mail@gmail.com> * Alexey Dokuchaev <danfe@FreeBSD.org> * Alfred Perlstein * Alfred Perlstein <alfred@FreeBSD.org> * Anders Nordby <anders@FreeBSD.org> * Anders Nordby <anders@fix.no> * Andreas Klemm <andreas@klemm.gtn.com> * Andrew Lewis <freeghb@gmail.com> * Andrew Pantyukhin <infofarmer@FreeBSD.org> * Andrew St. Jean <andrew@arda.homeunix.net> * Anes Mukhametov <anes@anes.su> * Antoine Brodin <antoine@FreeBSD.org> * Anton Berezin <tobez@FreeBSD.org> * Antonio Carlos Venancio Junior (<antonio@inf.ufsc.br>) * Antonio Carlos Venancio Junior <antonio@inf.ufsc.br> * Ashish SHUKLA <ashish@FreeBSD.org> * Attila Nagy <bra@fsn.hu> * Autrijus Tang <autrijus@autrijus.org> * Axel Rau <axel.rau@chaos1.de> * Babak Farrokhi <farrokhi@FreeBSD.org> * Ben Woods <woodsb02@FreeBSD.org> * Bernard Spil <brnrd@FreeBSD.org> * Bernard Spil <brnrd@freebsd.org> * Blaz Zupan <blaz@si.FreeBSD.org> * Bob Hockney <zeus@ix.netcom.com> * Boris Kochergin <spawk@acm.poly.edu> * Brendan Molloy <brendan+freebsd@bbqsrc.net> * Bruce M Simpson * Bruce M Simpson <bms@FreeBSD.org> * Bruce M. Simpson <bms@FreeBSD.org> * Carlo Strub * Carlo Strub <cs@FreeBSD.org> * Carlos J Puga Medina <cpm@FreeBSD.org> * Carlos J Puga Medina <cpm@fbsd.es> * Charlie Root <se@FreeBSD.org> * Cheng-Lung Sung <clsung@FreeBSD.org> * Cheng-Lung Sung <clsung@dragon2.net> * Chie Taguchi <taguchi.ch@gmail.com> * Chris Cowart <ccowart@rescomp.berkeley.edu> * Chris D. Faulhaber <jedgar@FreeBSD.org> * Christer Edwards <christer.edwards@gmail.com> * Christian Lackas * Christopher Hall <hsw@bitmark.com> * Clement Laforet <sheepkiller@cultdeadsheep.org> * Clive Lin <clive@CirX.ORG> * Colin Percival * Cory McIntire (loon@noncensored.com) * Craig Leres <leres@FreeBSD.org> * Cristiano Deana <cris@gufi.org> * Cy Schubert (Cy.Schubert@uumail.gov.bc.ca) * Cy Schubert <Cy.Schubert@uumail.gov.bc.ca> * Cy Schubert <cy@FreeBSD.org> * Damian Gerow <dgerow@afflictions.org> * Damien Bobillot * Dan Langille * Dan Langille <dan@freebsddiary.org> * Dan Langille <dvl@FreeBSD.org> * Dan Langille <dvl@freebsd.org> * Dan Langille <dvl@sourcefire.com> * Daniel Kahn Gillmor <dkg@fifthhorseman.net> * Daniel Roethlisberger <daniel@roe.ch> * Danilo Egea Gondolfo <danilo@FreeBSD.org> * Danton Dorati <urisso@bsd.com.br> * Dave McKay <dave@mu.org> * David E. Thiel <lx@FreeBSD.org> * David O'Brien (obrien@NUXI.com) * David O'Brien <obrien@FreeBSD.org> * David Thiel <lx@redundancy.redundancy.org> * Dean Hollister <dean@odyssey.apana.org.au> * Denis Shaposhnikov <dsh@vlink.ru> * Dereckson <dereckson@gmail.com> * Dirk Froemberg <dirk@FreeBSD.org> * Ditesh Shashikant Gathani <ditesh@gathani.org> * Dom Mitchell <dom@happygiraffe.net> * Dominic Marks <dominic.marks@btinternet.com> * Don Croyle <croyle@gelemna.org> * Douglas Thrift <douglas@douglasthrift.net> * Edson Brandi <ebrandi@fugspbr.org> * Edwin Groothuis <edwin@mavetju.org> * Ekkehard 'Ekki' Gehm <gehm@physik.tu-berlin.de> * Emanuel Haupt <ehaupt@FreeBSD.org> * Emanuel Haupt <ehaupt@critical.ch> * Eric Crist <ecrist@secure-computing.net> * Erwin Lansing <erwin@FreeBSD.org> * Eugene Grosbein <eugen@FreeBSD.org> * Fabian Keil <fk@fabiankeil.de> * Felix Palmen <felix@palmen-it.de> * Florent Thoumie <flz@xbsd.org> * Foxfair Hu <foxfair@FreeBSD.org> * Frank Laszlo <laszlof@vonostingroup.com> * Frank Wall <fw@moov.de> * Franz Bettag <franz@bett.ag> * Gabor Kovesdan * Gabor Kovesdan <gabor@FreeBSD.org> * Gabriel M. Dutra <0xdutra@gmail.com> * Gary Hayers <Gary@Hayers.net> * Gasol Wu <gasol.wu@gmail.com> * Gea-Suan Lin <gslin@gslin.org> * George Reid <greid@ukug.uk.freebsd.org> * George Reid <services@nevernet.net> * Greg Larkin <glarkin@FreeBSD.org> * Greg V <greg@unrelenting.technology> * Gregory Neil Shapiro <gshapiro@FreeBSD.org> * Grzegorz Blach <gblach@FreeBSD.org> * Guangyuan Yang <ygy@FreeBSD.org> * Hakisho Nukama <nukama@gmail.com> * Hammurabi Mendes <hmendes@brturbo.com> * Henk van Oers <hvo.pm@xs4all.nl> * Horia Racoviceanu <horia@racoviceanu.com> * Hung-Yi Chen <gaod@hychen.org> * Jaap Akkerhuis <jaap@NLnetLabs.nl> * Jaap Boender <jaapb@kerguelen.org> * Jacek Serwatynski <tutus@trynet.eu.org> * James FitzGibbon <jfitz@FreeBSD.org> * James Thomason <james@divide.org> * Jan-Peter Koopmann <Jan-Peter.Koopmann@seceidos.de> * Janky Jay <ek@purplehat.org> * Janos Mohacsi * Janos Mohacsi <janos.mohacsi@bsd.hu> * Jean-Yves Lefort <jylefort@brutele.be> * Jim Geovedi <jim@corebsd.or.id> * Jim Ohlstein <jim@ohlste.in> * Joe Clarke <marcus@marcuscom.com> * Joe Marcus Clarke <marcus@FreeBSD.org> * Johann Visagie <johann@egenetics.com> * Johann Visagie <wjv@FreeBSD.org> * John Ferrell <jdferrell3@yahoo.com> * John Hixson <jhixson@gmail.com> * John Polstra <jdp@polstra.com> * John W. O'Brien <john@saltant.com> * John-Mark Gurney <jmg@FreeBSD.org> * Jose Alonso Cardenas Marquez <acardenas@bsd.org.pe> * Joseph Benden <joe@thrallingpenguin.com> * Joshua D. Abraham <jabra@ccs.neu.edu> * Jov <amutu@amutu.com> * Jui-Nan Lin <jnlin@freebsd.cs.nctu.edu.tw> * Ka Ho Ng <khng300@gmail.com> * Kay Lehmann <kay_lehmann@web.de> * Keith J. Jones <kjones@antihackertoolkit.com> * Kevin Zheng <kevinz5000@gmail.com> * Kimura Fuyuki <fuyuki@hadaly.org> * Kimura Fuyuki <fuyuki@mj.0038.net> * Klayton Monroe <klm@uidzero.org> * Konstantin Menshikov <kostjnspb@yandex.ru> * Koop Mast <kwm@FreeBSD.org> * Kris Kennaway <kris@FreeBSD.org> * Kubilay Kocak <koobs@FreeBSD.org> * Kurt Jaeger <fbsd-ports@opsec.eu> * LEVAI Daniel <leva@ecentrum.hu> * Lars Engels <lme@FreeBSD.org> * Lars Thegler <lth@FreeBSD.org> * Laurent LEVIER <llevier@argosnet.com> * Luiz Eduardo R. Cordeiro * Lukas Slebodnik <lukas.slebodnik@intrak.sk> * Lukasz Komsta * Mageirias Anastasios <anastmag@gmail.com> * Marcel Prisi <marcel.prisi@virtua.ch> * Marcello Coutinho * Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org> * Mark Felder <feld@FreeBSD.org> * Mark Hannon <markhannon@optusnet.com.au> * Mark Murray <markm@FreeBSD.org> * Mark Pulford <mark@kyne.com.au> * Marko Njezic <sf@maxempire.com> * Martin Matuska <martin@tradex.sk> * Martin Matuska <mm@FreeBSD.org> * Martin Mersberger * Martin Wilke <miwi@FreeBSD.org> * Martti Kuparinen <martti.kuparinen@ericsson.com> * Mateusz Piotrowski <0mp@FreeBSD.org> * Matt <matt@xtaz.net> * Matt Behrens <matt@zigg.com> * Matthias Andree <mandree@FreeBSD.org> * Matthias Fechner <mfechner@FreeBSD.org> * Matthieu BOUTHORS <matthieu@labs.fr> * Maxim Sobolev <sobomax@FreeBSD.org> * Meno Abels <meno.abels@adviser.com> * Michael Haro <mharo@FreeBSD.org> * Michael Johnson <ahze@FreeBSD.org> * Michael Nottebrock <lofi@FreeBSD.org> * Michael Reifenberger <mr@FreeBSD.org> * Michael Schout <mschout@gkg.net> * Michal Bielicki <m.bielicki@llizardfs.com> * Michiel van Baak <michiel@vanbaak.eu * Mij <mij@bitchx.it> * Mike Heffner <mheffner@vt.edu> * Mikhail T. <m.tsatsenko@gmail.com> * Mikhail Teterin <mi@aldan.algebra.com> * Milan Obuch * Mosconi <mosconi.rmg@gmail.com> * Muhammad Moinur Rahman <5u623l20@gmail.com> * Mustafa Arif <ma499@doc.ic.ac.uk> * Neil Booth * Neil Booth <kyuupichan@gmail.com> * Nick Barkas <snb@threerings.net> * Nicola Vitale <nivit@FreeBSD.org> * Niels Heinen * Nikola Kolev <koue@chaosophia.net> * Nobutaka Mantani <nobutaka@FreeBSD.org> * Oliver Lehmann * Oliver Lehmann <oliver@FreeBSD.org> * Olivier Duchateau * Olivier Duchateau <duchateau.olivier@gmail.com> * Olli Hauer * Patrick Li <pat@databits.net> * Paul Chvostek <paul@it.ca> * Paul Schmehl <pauls@utdallas.edu> * Pavel I Volkov <pavelivolkov@googlemail.com> * Pete Fritchman <petef@databits.net> * Peter Ankerstal <peter@pean.org> * Peter Haight <peterh@sapros.com> * Peter Johnson <johnson.peter@gmail.com> * Peter Pentchev <roam@FreeBSD.org> * Petr Rehor <rx@rx.cz> * Philippe Audeoud <jadawin@tuxaco.net> * Philippe Rocques <phil@teaser.fr> * Piotr Kubaj <pkubaj@FreeBSD.org> * Piotr Kubaj <pkubaj@anongoth.pl> * Po-Chuan Hsieh <sunpoet@FreeBSD.org> * RaRa Rasputin <rasputin@submonkey.net> * Radim Kolar * Ralf Meister * Remington Lang <MrL0Lz@gmail.com> * Renaud Chaput <renchap@cocoa-x.com> * Roderick van Domburg <r.s.a.vandomburg@student.utwente.nl> * Roland van Laar <roland@micite.net> * Romain Tartiere <romain@blogreen.org> * Roman Bogorodskiy * Roman Bogorodskiy <novel@FreeBSD.org> * Roman Shterenzon <roman@xpert.com> * Rong-En Fan <rafan@FreeBSD.org> * Ryan Steinmetz <zi@FreeBSD.org> * Sahil Tandon <sahil@tandon.net> * Sascha Holzleiter <sascha@root-login.org> * SeaD * Seamus Venasse <svenasse@polaris.ca> * Sean Greven <sean.greven@gmail.com> * Sebastian Schuetz <sschuetz@fhm.edu> * Sergei Kolobov <sergei@FreeBSD.org> * Sergei Kolobov <sergei@kolobov.com> * Sergei Vyshenski * Sergei Vyshenski <svysh.fbsd@gmail.com> * Sergey Skvortsov <skv@protey.ru> * Seth Kingsley <sethk@meowfishies.com> * Shaun Amott <shaun@inerd.com> * Simeon Simeonov <sgs@pichove.org> * Simon Dick <simond@irrelevant.org> * Sofian Brabez <sbrabez@gmail.com> * Stanislav Sedov <ssedov@mbsd.msk.ru> * Stefan Esser <se@FreeBSD.org> * Stefan Grundmann * Stefan Walter <sw@gegenunendlich.de> * Stephon Chen <stephon@gmail.com> * Steve Wills <steve@mouf.net> * Steve Wills <swills@FreeBSD.org> * Steven Kreuzer * Steven Kreuzer <skreuzer@exit2shell.com> * Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org> * TAKAHASHI Kaoru <kaoru@kaisei.org> * TAKATSU Tomonari <tota@FreeBSD.org> * Tatsuki Makino <tatsuki_makino@hotmail.com> * Thibault Payet <monwarez@mailoo.org> * Thierry Thomas (<thierry@pompo.net>) * Thierry Thomas <thierry@pompo.net> * Thomas Hurst <tom@hur.st> * Thomas Quinot <thomas@cuivre.fr.eu.org> * Thomas Zander <riggs@FreeBSD.org> * Thomas von Dein <freebsd@daemon.de> * Tilman Linneweh <arved@FreeBSD.org> * Tim Bishop <tim@bishnet.net> * Tom Judge <tom@tomjudge.com> * Tomoyuki Sakurai <cherry@trombik.org> * Toni Viemerö <toni.viemero@iki.fi> * Tony Maher * Torsten Zuhlsdorff <ports@toco-domains.de> * Travis Campbell <hcoyote@ghostar.org> * Tsung-Han Yeh <snowfly@yuntech.edu.tw> * Ulf Lilleengen * Vaida Bogdan <vaida.bogdan@gmail.com> * Valentin Zahariev <curly@e-card.bg> * Valerio Daelli <valerio.daelli@gmail.com> * Veniamin Gvozdikov <vg@FreeBSD.org> * Victor Popov * Victor Popov <v.a.popov@gmail.com> * Vsevolod Stakhov * Vsevolod Stakhov <vsevolod@FreeBSD.org> * Wen Heping <wen@FreeBSD.org> * Wen Heping <wenheping@gmail.com> * Yarodin <yarodin@gmail.com> * Yen-Ming Lee <leeym@FreeBSD.org> * Yen-Ming Lee <leeym@cae.ce.ntu.edu.tw> * Yen-Ming Lee <leeym@leeym.com> * Ying-Chieh Liao <ijliao@FreeBSD.org> * Yonatan <Yonatan@Xpert.com> * Yonatan <onatan@gmail.com> * Yoshisato YANAGISAWA * Yuri Victorovich * Yuri Victorovich <yuri@rawbw.com> * Zach Thompson <hideo@lastamericanempire.com> * Zane C. Bowers <vvelox@vvelox.net> * Zeus Panchenko <zeus@gnu.org.ua> * ache * adamw * ajk@iu.edu * alex@FreeBSD.org * allan@saddi.com * alm * andrej@ebert.su * andrew@scoop.co.nz * andy@fud.org.nz * antoine@FreeBSD.org * arved * barner * brix@FreeBSD.org * buganini@gmail.com * chinsan * chris@still.whet.org * clement * clsung * crow * cy@FreeBSD.org * dominik karczmarski <dominik@karczmarski.com> * dwcjr@inethouston.net * eivind * erich@rrnet.com * erwin@FreeBSD.org * girgen@FreeBSD.org * glen.j.barber@gmail.com * hbo@egbok.com * ijliao * jesper * jfitz * johans * joris * kftseng@iyard.org * kris@FreeBSD.org * lx * markm * mharo@FreeBSD.org * michaelnottebrock@gmx.net * mnag@FreeBSD.org * mp39590@gmail.com * nbm * nectar@FreeBSD.org * nork@FreeBSD.org * nork@cityfujisawa.ne.jp * nsayer@FreeBSD.org * nsayer@quack.kfu.com * ntarmos@cs.uoi.gr * oly * onatan@gmail.com * pandzilla * patrick@mindstep.com * pauls * perl@FreeBSD.org * petef@FreeBSD.org * peter.thoenen@yahoo.com * ports@c0decafe.net * ports@rbt.ca * roam@FreeBSD.org * rokaz * sada@FreeBSD.org * scrappy * se * shane@freebsdhackers.net aka modsix@gmail.com * snb@threerings.net * sumikawa * sviat * teramoto@comm.eng.osaka-u.ac.jp * thierry@pompo.net * tobez@FreeBSD.org * torstenb@FreeBSD.org * trasz <trasz@pin.if.uz.zgora.pl> * trevor * truckman * vanhu * vanilla@ * wen@FreeBSD.org * will With hat: portmgr857c05f867
security/openvpn: Bump PORTREVISION to be newer than on quarterly. This is to make sure that with 2022Q3 branching off of this version, the package will look newer and flush out the old package, with MBEDTLS and TUNNELBLICK options now removed.1dc25fd358
security/openvpn: update to v2.5.7
FreeBSD-related changes from Changes.rst:
- Limited OpenSSL 3.0 support
OpenSSL 3.0 support has been added. OpenSSL 3.0 support in 2.5 relies
on the compatiblity layer and full OpenSSL 3.0 support is coming with
OpenVPN 2.6. Only features that impact usage directly have been
backported:
``--tls-cert-profile insecure`` has been added to allow selecting the
lowest OpenSSL security level (not recommended, use only if you must).
OpenSSL 3.0 no longer supports the Blowfish (and other deprecated)
algorithm by default and the new option ``--providers`` allows loading
the legacy provider to renable these algorithms. Most notably,
reading of many PKCS#12 files encrypted with the RC2 algorithm fails
unless ``--providers legacy default`` is configured.
The OpenSSL engine feature ``--engine`` is not enabled by default
anymore if OpenSSL 3.0 is detected.
- print OpenSSL error stack if decoding PKCS12 file fails
- fix PATH_MAX build failure in auth-pam.c
- fix t_net.sh self-test leaving around stale "ovpn-dummy0" interface
detailed changes: https://github.com/OpenVPN/openvpn/releases/tag/v2.5.79acfd1b4afsecurity/openvpn: drop man source patch There has been a report of sporadic man-page rebuilds on OpenZFS. While the patch order is correct, we do not intend to rebuild the manpage (after a nobody -> openvpn change, for instance), and we also patch the output files. So just remove the source patch. This should go without any functional changes, so ships without bumping PORTREVISION. There is an upstream ticket reporting a missing source file in the tarball. https://community.openvpn.net/openvpn/ticket/1461 Reported by: Jan Martin Mikkelsen PR: 2631165f10d01ce1