Menu ▾ ▴
openvpn-devel — OpenVPN developers list
You can subscribe to this list here.
| 2002 | Jan | Feb | Mar | Apr (24) | May (14) | Jun (29) | Jul (33) | Aug (3) | Sep (8) | Oct (18) | Nov (1) | Dec (10) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2003 | Jan (3) | Feb (33) | Mar (7) | Apr (28) | May (30) | Jun (5) | Jul (10) | Aug (7) | Sep (32) | Oct (41) | Nov (20) | Dec (10) |
| 2004 | Jan (24) | Feb (18) | Mar (57) | Apr (40) | May (55) | Jun (48) | Jul (77) | Aug (15) | Sep (56) | Oct (80) | Nov (74) | Dec (52) |
| 2005 | Jan (38) | Feb (42) | Mar (39) | Apr (56) | May (79) | Jun (73) | Jul (16) | Aug (23) | Sep (68) | Oct (77) | Nov (52) | Dec (27) |
| 2006 | Jan (27) | Feb (18) | Mar (51) | Apr (62) | May (28) | Jun (50) | Jul (36) | Aug (33) | Sep (47) | Oct (50) | Nov (77) | Dec (13) |
| 2007 | Jan (15) | Feb (8) | Mar (14) | Apr (18) | May (25) | Jun (16) | Jul (16) | Aug (19) | Sep (32) | Oct (17) | Nov (5) | Dec (5) |
| 2008 | Jan (64) | Feb (25) | Mar (25) | Apr (6) | May (28) | Jun (20) | Jul (10) | Aug (27) | Sep (28) | Oct (59) | Nov (37) | Dec (43) |
| 2009 | Jan (40) | Feb (25) | Mar (12) | Apr (57) | May (46) | Jun (29) | Jul (39) | Aug (10) | Sep (20) | Oct (42) | Nov (50) | Dec (57) |
| 2010 | Jan (82) | Feb (165) | Mar (256) | Apr (260) | May (36) | Jun (87) | Jul (53) | Aug (89) | Sep (107) | Oct (51) | Nov (88) | Dec (117) |
| 2011 | Jan (69) | Feb (60) | Mar (113) | Apr (71) | May (67) | Jun (90) | Jul (88) | Aug (90) | Sep (48) | Oct (64) | Nov (69) | Dec (118) |
| 2012 | Jan (49) | Feb (528) | Mar (351) | Apr (190) | May (238) | Jun (193) | Jul (104) | Aug (100) | Sep (57) | Oct (41) | Nov (47) | Dec (51) |
| 2013 | Jan (94) | Feb (57) | Mar (96) | Apr (105) | May (77) | Jun (102) | Jul (27) | Aug (81) | Sep (32) | Oct (53) | Nov (127) | Dec (65) |
| 2014 | Jan (113) | Feb (59) | Mar (104) | Apr (259) | May (70) | Jun (70) | Jul (146) | Aug (45) | Sep (58) | Oct (149) | Nov (77) | Dec (83) |
| 2015 | Jan (53) | Feb (66) | Mar (86) | Apr (50) | May (135) | Jun (76) | Jul (151) | Aug (83) | Sep (97) | Oct (262) | Nov (245) | Dec (231) |
| 2016 | Jan (131) | Feb (233) | Mar (97) | Apr (138) | May (221) | Jun (254) | Jul (92) | Aug (248) | Sep (168) | Oct (275) | Nov (477) | Dec (445) |
| 2017 | Jan (218) | Feb (217) | Mar (146) | Apr (172) | May (216) | Jun (252) | Jul (164) | Aug (192) | Sep (190) | Oct (143) | Nov (255) | Dec (182) |
| 2018 | Jan (295) | Feb (164) | Mar (113) | Apr (147) | May (64) | Jun (262) | Jul (184) | Aug (90) | Sep (69) | Oct (364) | Nov (102) | Dec (101) |
| 2019 | Jan (119) | Feb (64) | Mar (64) | Apr (102) | May (57) | Jun (154) | Jul (84) | Aug (81) | Sep (76) | Oct (102) | Nov (233) | Dec (89) |
| 2020 | Jan (38) | Feb (170) | Mar (155) | Apr (172) | May (120) | Jun (223) | Jul (461) | Aug (227) | Sep (268) | Oct (113) | Nov (56) | Dec (124) |
| 2021 | Jan (121) | Feb (48) | Mar (334) | Apr (345) | May (207) | Jun (136) | Jul (71) | Aug (112) | Sep (122) | Oct (173) | Nov (184) | Dec (223) |
| 2022 | Jan (197) | Feb (206) | Mar (156) | Apr (212) | May (192) | Jun (170) | Jul (143) | Aug (380) | Sep (182) | Oct (148) | Nov (128) | Dec (269) |
| 2023 | Jan (248) | Feb (196) | Mar (264) | Apr (36) | May (123) | Jun (66) | Jul (120) | Aug (48) | Sep (157) | Oct (198) | Nov (300) | Dec (273) |
| 2024 | Jan (271) | Feb (147) | Mar (207) | Apr (78) | May (107) | Jun (168) | Jul (151) | Aug (51) | Sep (438) | Oct (221) | Nov (302) | Dec (357) |
| 2025 | Jan (451) | Feb (219) | Mar (326) | Apr (232) | May (306) | Jun (181) | Jul (452) | Aug (282) | Sep (620) | Oct (793) | Nov (682) | Dec |
| S | M | T | W | T | F | S |
|---|---|---|---|---|---|---|
| | | | | 1 (4) | 2 (7) | 3 |
| 4 | 5 (26) | 6 (2) | 7 (19) | 8 (6) | 9 (10) | 10 (8) |
| 11 | 12 (2) | 13 (20) | 14 (10) | 15 (15) | 16 (3) | 17 (16) |
| 18 (15) | 19 (20) | 20 (28) | 21 (3) | 22 (8) | 23 (19) | 24 (2) |
| 25 (2) | 26 (9) | 27 (17) | 28 (22) | 29 (1) | 30 (1) | 31 (11) |
| From: cron2 (C. Review) <ge...@op...> - 2025-05-31 21:01:26 |
Attention is currently required from: flichtenheld, plaisthos. cron2 has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/790?usp=email ) Change subject: Define a .clang-format file for the project ...................................................................... Patch Set 15: Code-Review-1 (1 comment) File .pre-commit-config.yaml: http://gerrit.openvpn.net/c/openvpn/+/790/comment/87528ad6_ed45d1b7 : PS15, Line 9: I don't really like this - call me oldfashioned, but requiring python to install something magic from an unknown github url into my most holy repo is not what I feel comfortable with. I'd really prefer to adjust the commit hook we have and keep all this "magic repo related stuff" *in* the repo. -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/790?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I40f6af10c5ee2f5aed4185d783fc622a2e3c19ff Gerrit-Change-Number: 790 Gerrit-PatchSet: 15 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: cron2 <ge...@gr...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Comment-Date: Sat, 31 May 2025 21:01:11 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Gerrit-MessageType: comment |
| From: cron2 (C. Review) <ge...@op...> - 2025-05-31 20:58:14 |
Attention is currently required from: flichtenheld, plaisthos. cron2 has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/1031?usp=email ) Change subject: git-pre-commit-uncrustify: Make sure to not run on branches with clang-format ...................................................................... Patch Set 1: Code-Review-1 (1 comment) File dev-tools/git-pre-commit-uncrustify.sh: http://gerrit.openvpn.net/c/openvpn/+/1031/comment/a69c76d3_77772c5a : PS1, Line 66: This is not exactly what I had in mind :-) - the commit hook is good, and I think we should run clang-format if we have a `.clang-format`, and uncrustify if we have an `uncrustify.conf`... -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1031?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: release/2.6 Gerrit-Change-Id: Ifd36651a3713dd6f2e585f0771f349178a494360 Gerrit-Change-Number: 1031 Gerrit-PatchSet: 1 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: cron2 <ge...@gr...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Comment-Date: Sat, 31 May 2025 20:58:00 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Gerrit-MessageType: comment |
| From: cron2 (C. Review) <ge...@op...> - 2025-05-31 20:53:43 |
cron2 has uploaded a new patch set (#5) to the change originally created by plaisthos. ( http://gerrit.openvpn.net/c/openvpn/+/1033?usp=email ) The following approvals got outdated and were removed: Code-Review+2 by cron2 Change subject: Add missing header in unit tests Makefile.am ...................................................................... Add missing header in unit tests Makefile.am make distcheck fails since we are not listing all headers that are used by the unit tests. Change-Id: I674af04e1a6449544b7def0725337c3b353ea276 Signed-off-by: Arne Schwabe <arn...@rf...> Acked-by: Gert Doering <ge...@gr...> Message-Id: <202...@gr...> URL: https://www.mail-archive.com/ope...@li.../msg31830.html Signed-off-by: Gert Doering <ge...@gr...> --- M tests/unit_tests/openvpn/Makefile.am 1 file changed, 24 insertions(+), 12 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/33/1033/5 diff --git a/tests/unit_tests/openvpn/Makefile.am b/tests/unit_tests/openvpn/Makefile.am index fc47287..b47b495 100644 --- a/tests/unit_tests/openvpn/Makefile.am +++ b/tests/unit_tests/openvpn/Makefile.am @@ -43,7 +43,8 @@ argv_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ argv_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -argv_testdriver_SOURCES = test_argv.c mock_msg.c mock_msg.h test_common.h \ +argv_testdriver_SOURCES = test_argv.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/platform.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -52,7 +53,8 @@ buffer_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ buffer_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -buffer_testdriver_SOURCES = test_buffer.c mock_msg.c mock_msg.h test_common.h \ +buffer_testdriver_SOURCES = test_buffer.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/win32-util.c \ $(top_srcdir)/src/openvpn/platform.c @@ -61,7 +63,8 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ crypto_testdriver_LDFLAGS = @TEST_LDFLAGS@ -crypto_testdriver_SOURCES = test_crypto.c mock_msg.c mock_msg.h test_common.h \ +crypto_testdriver_SOURCES = test_crypto.c \ + mock_msg.c mock_msg.h test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_mbedtls.c \ @@ -78,8 +81,10 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ ssl_testdriver_LDFLAGS = @TEST_LDFLAGS@ $(OPTIONAL_CRYPTO_LIBS) -ssl_testdriver_SOURCES = test_ssl.c mock_msg.c mock_msg.h test_common.h \ - mock_management.c mock_ssl_dependencies.c mock_win32_execve.c \ +ssl_testdriver_SOURCES = test_ssl.c \ + mock_msg.c mock_msg.h test_common.h \ + mock_management.c \ + mock_ssl_dependencies.c mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -114,7 +119,8 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ packet_id_testdriver_LDFLAGS = @TEST_LDFLAGS@ -packet_id_testdriver_SOURCES = test_packet_id.c mock_msg.c mock_msg.h test_common.h \ +packet_id_testdriver_SOURCES = test_packet_id.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/otime.c \ @@ -156,7 +162,8 @@ -Wl,--wrap=buffer_write_file \ -Wl,--wrap=parse_line \ -Wl,--wrap=rand_bytes -tls_crypt_testdriver_SOURCES = test_tls_crypt.c mock_msg.c mock_msg.h test_common.h \ +tls_crypt_testdriver_SOURCES = test_tls_crypt.c \ + mock_msg.c mock_msg.h test_common.h \ mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ @@ -229,7 +236,8 @@ @TEST_CFLAGS@ $(OPTIONAL_CRYPTO_CFLAGS) pkcs11_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -pkcs11_testdriver_SOURCES = test_pkcs11.c mock_msg.c \ +pkcs11_testdriver_SOURCES = test_pkcs11.c \ + mock_msg.c test_common.h \ pkey_test_utils.c cert_data.h mock_get_random.c \ $(top_srcdir)/src/openvpn/xkey_helper.c \ $(top_srcdir)/src/openvpn/xkey_provider.c \ @@ -251,7 +259,8 @@ auth_token_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -auth_token_testdriver_SOURCES = test_auth_token.c mock_msg.c \ +auth_token_testdriver_SOURCES = test_auth_token.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_epoch.c \ @@ -269,7 +278,8 @@ @TEST_CFLAGS@ user_pass_testdriver_LDFLAGS = @TEST_LDFLAGS@ -user_pass_testdriver_SOURCES = test_user_pass.c mock_msg.c \ +user_pass_testdriver_SOURCES = test_user_pass.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/console.c \ $(top_srcdir)/src/openvpn/env_set.c \ @@ -287,7 +297,8 @@ ncp_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -ncp_testdriver_SOURCES = test_ncp.c mock_msg.c \ +ncp_testdriver_SOURCES = test_ncp.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_epoch.c \ @@ -306,7 +317,8 @@ misc_testdriver_LDFLAGS = @TEST_LDFLAGS@ -misc_testdriver_SOURCES = test_misc.c mock_msg.c \ +misc_testdriver_SOURCES = test_misc.c \ + mock_msg.c test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/options_util.c \ -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1033?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I674af04e1a6449544b7def0725337c3b353ea276 Gerrit-Change-Number: 1033 Gerrit-PatchSet: 5 Gerrit-Owner: plaisthos <arn...@rf...> Gerrit-Reviewer: cron2 <ge...@gr...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-MessageType: newpatchset |
| From: cron2 (C. Review) <ge...@op...> - 2025-05-31 20:53:41 |
cron2 has submitted this change. ( http://gerrit.openvpn.net/c/openvpn/+/1033?usp=email ) Change subject: Add missing header in unit tests Makefile.am ...................................................................... Add missing header in unit tests Makefile.am make distcheck fails since we are not listing all headers that are used by the unit tests. Change-Id: I674af04e1a6449544b7def0725337c3b353ea276 Signed-off-by: Arne Schwabe <arn...@rf...> Acked-by: Gert Doering <ge...@gr...> Message-Id: <202...@gr...> URL: https://www.mail-archive.com/ope...@li.../msg31830.html Signed-off-by: Gert Doering <ge...@gr...> --- M tests/unit_tests/openvpn/Makefile.am 1 file changed, 24 insertions(+), 12 deletions(-) diff --git a/tests/unit_tests/openvpn/Makefile.am b/tests/unit_tests/openvpn/Makefile.am index fc47287..b47b495 100644 --- a/tests/unit_tests/openvpn/Makefile.am +++ b/tests/unit_tests/openvpn/Makefile.am @@ -43,7 +43,8 @@ argv_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ argv_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -argv_testdriver_SOURCES = test_argv.c mock_msg.c mock_msg.h test_common.h \ +argv_testdriver_SOURCES = test_argv.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/platform.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -52,7 +53,8 @@ buffer_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ buffer_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -buffer_testdriver_SOURCES = test_buffer.c mock_msg.c mock_msg.h test_common.h \ +buffer_testdriver_SOURCES = test_buffer.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/win32-util.c \ $(top_srcdir)/src/openvpn/platform.c @@ -61,7 +63,8 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ crypto_testdriver_LDFLAGS = @TEST_LDFLAGS@ -crypto_testdriver_SOURCES = test_crypto.c mock_msg.c mock_msg.h test_common.h \ +crypto_testdriver_SOURCES = test_crypto.c \ + mock_msg.c mock_msg.h test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_mbedtls.c \ @@ -78,8 +81,10 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ ssl_testdriver_LDFLAGS = @TEST_LDFLAGS@ $(OPTIONAL_CRYPTO_LIBS) -ssl_testdriver_SOURCES = test_ssl.c mock_msg.c mock_msg.h test_common.h \ - mock_management.c mock_ssl_dependencies.c mock_win32_execve.c \ +ssl_testdriver_SOURCES = test_ssl.c \ + mock_msg.c mock_msg.h test_common.h \ + mock_management.c \ + mock_ssl_dependencies.c mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -114,7 +119,8 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ packet_id_testdriver_LDFLAGS = @TEST_LDFLAGS@ -packet_id_testdriver_SOURCES = test_packet_id.c mock_msg.c mock_msg.h test_common.h \ +packet_id_testdriver_SOURCES = test_packet_id.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/otime.c \ @@ -156,7 +162,8 @@ -Wl,--wrap=buffer_write_file \ -Wl,--wrap=parse_line \ -Wl,--wrap=rand_bytes -tls_crypt_testdriver_SOURCES = test_tls_crypt.c mock_msg.c mock_msg.h test_common.h \ +tls_crypt_testdriver_SOURCES = test_tls_crypt.c \ + mock_msg.c mock_msg.h test_common.h \ mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ @@ -229,7 +236,8 @@ @TEST_CFLAGS@ $(OPTIONAL_CRYPTO_CFLAGS) pkcs11_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -pkcs11_testdriver_SOURCES = test_pkcs11.c mock_msg.c \ +pkcs11_testdriver_SOURCES = test_pkcs11.c \ + mock_msg.c test_common.h \ pkey_test_utils.c cert_data.h mock_get_random.c \ $(top_srcdir)/src/openvpn/xkey_helper.c \ $(top_srcdir)/src/openvpn/xkey_provider.c \ @@ -251,7 +259,8 @@ auth_token_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -auth_token_testdriver_SOURCES = test_auth_token.c mock_msg.c \ +auth_token_testdriver_SOURCES = test_auth_token.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_epoch.c \ @@ -269,7 +278,8 @@ @TEST_CFLAGS@ user_pass_testdriver_LDFLAGS = @TEST_LDFLAGS@ -user_pass_testdriver_SOURCES = test_user_pass.c mock_msg.c \ +user_pass_testdriver_SOURCES = test_user_pass.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/console.c \ $(top_srcdir)/src/openvpn/env_set.c \ @@ -287,7 +297,8 @@ ncp_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -ncp_testdriver_SOURCES = test_ncp.c mock_msg.c \ +ncp_testdriver_SOURCES = test_ncp.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_epoch.c \ @@ -306,7 +317,8 @@ misc_testdriver_LDFLAGS = @TEST_LDFLAGS@ -misc_testdriver_SOURCES = test_misc.c mock_msg.c \ +misc_testdriver_SOURCES = test_misc.c \ + mock_msg.c test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/options_util.c \ -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1033?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I674af04e1a6449544b7def0725337c3b353ea276 Gerrit-Change-Number: 1033 Gerrit-PatchSet: 5 Gerrit-Owner: plaisthos <arn...@rf...> Gerrit-Reviewer: cron2 <ge...@gr...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-MessageType: merged |
| From: Gert D. <ge...@gr...> - 2025-05-31 20:53:27 |
This is a more proper version of the patch I quickly hacked into the v2.7_alpha1 commit "to make it pass 'make distcheck'". I rebased so it would apply, and the resulting Makefile.am is what Arne had in his patch. (I fixed one "space + tab at the beginning of the line" whitespace error) Tested with "make distcheck". Passes :-) Your patch has been applied to the master branch. commit c2776ee0ff03832bb2213ebd19e9a14d37445bed Author: Arne Schwabe Date: Sat May 31 22:47:14 2025 +0200 Add missing header in unit tests Makefile.am Signed-off-by: Arne Schwabe <arn...@rf...> Acked-by: Gert Doering <ge...@gr...> Message-Id: <202...@gr...> URL: https://www.mail-archive.com/ope...@li.../msg31830.html Signed-off-by: Gert Doering <ge...@gr...> -- kind regards, Gert Doering |
| From: Gert D. <ge...@gr...> - 2025-05-31 20:47:34 |
From: Arne Schwabe <ar...@rf...> make distcheck fails since we are not listing all headers that are used by the unit tests. Change-Id: I674af04e1a6449544b7def0725337c3b353ea276 Signed-off-by: Arne Schwabe <arn...@rf...> Acked-by: Gert Doering <ge...@gr...> --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1033 This mail reflects revision 4 of this Change. Signed-off-by line for the author was added as per our policy. Acked-by according to Gerrit (reflected above): Gert Doering <ge...@gr...> diff --git a/tests/unit_tests/openvpn/Makefile.am b/tests/unit_tests/openvpn/Makefile.am index fc47287..b47b495 100644 --- a/tests/unit_tests/openvpn/Makefile.am +++ b/tests/unit_tests/openvpn/Makefile.am @@ -43,7 +43,8 @@ argv_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ argv_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -argv_testdriver_SOURCES = test_argv.c mock_msg.c mock_msg.h test_common.h \ +argv_testdriver_SOURCES = test_argv.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/platform.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -52,7 +53,8 @@ buffer_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ buffer_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -buffer_testdriver_SOURCES = test_buffer.c mock_msg.c mock_msg.h test_common.h \ +buffer_testdriver_SOURCES = test_buffer.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/win32-util.c \ $(top_srcdir)/src/openvpn/platform.c @@ -61,7 +63,8 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ crypto_testdriver_LDFLAGS = @TEST_LDFLAGS@ -crypto_testdriver_SOURCES = test_crypto.c mock_msg.c mock_msg.h test_common.h \ +crypto_testdriver_SOURCES = test_crypto.c \ + mock_msg.c mock_msg.h test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_mbedtls.c \ @@ -78,8 +81,10 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ ssl_testdriver_LDFLAGS = @TEST_LDFLAGS@ $(OPTIONAL_CRYPTO_LIBS) -ssl_testdriver_SOURCES = test_ssl.c mock_msg.c mock_msg.h test_common.h \ - mock_management.c mock_ssl_dependencies.c mock_win32_execve.c \ +ssl_testdriver_SOURCES = test_ssl.c \ + mock_msg.c mock_msg.h test_common.h \ + mock_management.c \ + mock_ssl_dependencies.c mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -114,7 +119,8 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ packet_id_testdriver_LDFLAGS = @TEST_LDFLAGS@ -packet_id_testdriver_SOURCES = test_packet_id.c mock_msg.c mock_msg.h test_common.h \ +packet_id_testdriver_SOURCES = test_packet_id.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/otime.c \ @@ -156,7 +162,8 @@ -Wl,--wrap=buffer_write_file \ -Wl,--wrap=parse_line \ -Wl,--wrap=rand_bytes -tls_crypt_testdriver_SOURCES = test_tls_crypt.c mock_msg.c mock_msg.h test_common.h \ +tls_crypt_testdriver_SOURCES = test_tls_crypt.c \ + mock_msg.c mock_msg.h test_common.h \ mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ @@ -229,7 +236,8 @@ @TEST_CFLAGS@ $(OPTIONAL_CRYPTO_CFLAGS) pkcs11_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -pkcs11_testdriver_SOURCES = test_pkcs11.c mock_msg.c \ +pkcs11_testdriver_SOURCES = test_pkcs11.c \ + mock_msg.c test_common.h \ pkey_test_utils.c cert_data.h mock_get_random.c \ $(top_srcdir)/src/openvpn/xkey_helper.c \ $(top_srcdir)/src/openvpn/xkey_provider.c \ @@ -251,7 +259,8 @@ auth_token_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -auth_token_testdriver_SOURCES = test_auth_token.c mock_msg.c \ +auth_token_testdriver_SOURCES = test_auth_token.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_epoch.c \ @@ -269,7 +278,8 @@ @TEST_CFLAGS@ user_pass_testdriver_LDFLAGS = @TEST_LDFLAGS@ -user_pass_testdriver_SOURCES = test_user_pass.c mock_msg.c \ +user_pass_testdriver_SOURCES = test_user_pass.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/console.c \ $(top_srcdir)/src/openvpn/env_set.c \ @@ -287,7 +297,8 @@ ncp_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -ncp_testdriver_SOURCES = test_ncp.c mock_msg.c \ +ncp_testdriver_SOURCES = test_ncp.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_epoch.c \ @@ -306,7 +317,8 @@ misc_testdriver_LDFLAGS = @TEST_LDFLAGS@ -misc_testdriver_SOURCES = test_misc.c mock_msg.c \ +misc_testdriver_SOURCES = test_misc.c \ + mock_msg.c test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/options_util.c \ |
| From: cron2 (C. Review) <ge...@op...> - 2025-05-31 20:47:13 |
Attention is currently required from: flichtenheld, plaisthos. cron2 has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/1033?usp=email ) Change subject: Add missing header in unit tests Makefile.am ...................................................................... Patch Set 4: Code-Review+2 -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1033?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I674af04e1a6449544b7def0725337c3b353ea276 Gerrit-Change-Number: 1033 Gerrit-PatchSet: 4 Gerrit-Owner: plaisthos <arn...@rf...> Gerrit-Reviewer: cron2 <ge...@gr...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Comment-Date: Sat, 31 May 2025 20:47:03 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment |
| From: cron2 (C. Review) <ge...@op...> - 2025-05-31 20:45:56 |
Attention is currently required from: cron2, flichtenheld, plaisthos. cron2 has uploaded a new patch set (#4) to the change originally created by plaisthos. ( http://gerrit.openvpn.net/c/openvpn/+/1033?usp=email ) The following approvals got outdated and were removed: Code-Review+2 by cron2 Change subject: Add missing header in unit tests Makefile.am ...................................................................... Add missing header in unit tests Makefile.am make distcheck fails since we are not listing all headers that are used by the unit tests. Change-Id: I674af04e1a6449544b7def0725337c3b353ea276 --- M tests/unit_tests/openvpn/Makefile.am 1 file changed, 24 insertions(+), 12 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/33/1033/4 diff --git a/tests/unit_tests/openvpn/Makefile.am b/tests/unit_tests/openvpn/Makefile.am index fc47287..b47b495 100644 --- a/tests/unit_tests/openvpn/Makefile.am +++ b/tests/unit_tests/openvpn/Makefile.am @@ -43,7 +43,8 @@ argv_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ argv_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -argv_testdriver_SOURCES = test_argv.c mock_msg.c mock_msg.h test_common.h \ +argv_testdriver_SOURCES = test_argv.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/platform.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -52,7 +53,8 @@ buffer_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ buffer_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -buffer_testdriver_SOURCES = test_buffer.c mock_msg.c mock_msg.h test_common.h \ +buffer_testdriver_SOURCES = test_buffer.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/win32-util.c \ $(top_srcdir)/src/openvpn/platform.c @@ -61,7 +63,8 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ crypto_testdriver_LDFLAGS = @TEST_LDFLAGS@ -crypto_testdriver_SOURCES = test_crypto.c mock_msg.c mock_msg.h test_common.h \ +crypto_testdriver_SOURCES = test_crypto.c \ + mock_msg.c mock_msg.h test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_mbedtls.c \ @@ -78,8 +81,10 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ ssl_testdriver_LDFLAGS = @TEST_LDFLAGS@ $(OPTIONAL_CRYPTO_LIBS) -ssl_testdriver_SOURCES = test_ssl.c mock_msg.c mock_msg.h test_common.h \ - mock_management.c mock_ssl_dependencies.c mock_win32_execve.c \ +ssl_testdriver_SOURCES = test_ssl.c \ + mock_msg.c mock_msg.h test_common.h \ + mock_management.c \ + mock_ssl_dependencies.c mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -114,7 +119,8 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ packet_id_testdriver_LDFLAGS = @TEST_LDFLAGS@ -packet_id_testdriver_SOURCES = test_packet_id.c mock_msg.c mock_msg.h test_common.h \ +packet_id_testdriver_SOURCES = test_packet_id.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/otime.c \ @@ -156,7 +162,8 @@ -Wl,--wrap=buffer_write_file \ -Wl,--wrap=parse_line \ -Wl,--wrap=rand_bytes -tls_crypt_testdriver_SOURCES = test_tls_crypt.c mock_msg.c mock_msg.h test_common.h \ +tls_crypt_testdriver_SOURCES = test_tls_crypt.c \ + mock_msg.c mock_msg.h test_common.h \ mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ @@ -229,7 +236,8 @@ @TEST_CFLAGS@ $(OPTIONAL_CRYPTO_CFLAGS) pkcs11_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -pkcs11_testdriver_SOURCES = test_pkcs11.c mock_msg.c \ +pkcs11_testdriver_SOURCES = test_pkcs11.c \ + mock_msg.c test_common.h \ pkey_test_utils.c cert_data.h mock_get_random.c \ $(top_srcdir)/src/openvpn/xkey_helper.c \ $(top_srcdir)/src/openvpn/xkey_provider.c \ @@ -251,7 +259,8 @@ auth_token_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -auth_token_testdriver_SOURCES = test_auth_token.c mock_msg.c \ +auth_token_testdriver_SOURCES = test_auth_token.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_epoch.c \ @@ -269,7 +278,8 @@ @TEST_CFLAGS@ user_pass_testdriver_LDFLAGS = @TEST_LDFLAGS@ -user_pass_testdriver_SOURCES = test_user_pass.c mock_msg.c \ +user_pass_testdriver_SOURCES = test_user_pass.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/console.c \ $(top_srcdir)/src/openvpn/env_set.c \ @@ -287,7 +297,8 @@ ncp_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -ncp_testdriver_SOURCES = test_ncp.c mock_msg.c \ +ncp_testdriver_SOURCES = test_ncp.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_epoch.c \ @@ -306,7 +317,8 @@ misc_testdriver_LDFLAGS = @TEST_LDFLAGS@ -misc_testdriver_SOURCES = test_misc.c mock_msg.c \ +misc_testdriver_SOURCES = test_misc.c \ + mock_msg.c test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/options_util.c \ -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1033?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I674af04e1a6449544b7def0725337c3b353ea276 Gerrit-Change-Number: 1033 Gerrit-PatchSet: 4 Gerrit-Owner: plaisthos <arn...@rf...> Gerrit-Reviewer: cron2 <ge...@gr...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: cron2 <ge...@gr...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-MessageType: newpatchset |
| From: Gert D. <ge...@gr...> - 2025-05-31 20:42:29 |
Verified that this, indeed, only changes lines with "Copyright" in them ("git show -I Copyright.*202[45]"). Interestingly multi_io.[ch] sort of sidestepped the 2024 update :-) and ovpn_dco_win.h got stuck in 2021... Your patch has been applied to the master branch. commit 022f0a438772f265b6416fa25282cfea74a49725 Author: Frank Lichtenheld Date: Sat May 31 22:35:39 2025 +0200 Update copyright statements to 2025 Signed-off-by: Frank Lichtenheld <fr...@li...> Acked-by: Gert Doering <ge...@gr...> Message-Id: <202...@gr...> URL: https://www.mail-archive.com/ope...@li.../msg31826.html Signed-off-by: Gert Doering <ge...@gr...> -- kind regards, Gert Doering |
| From: Gert D. <ge...@gr...> - 2025-05-31 20:36:04 |
From: Frank Lichtenheld <fr...@li...> Change-Id: I3dfead8e60da93f223e3333db7b8e01ead01a856 Signed-off-by: Frank Lichtenheld <fr...@li...> Acked-by: Gert Doering <ge...@gr...> --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1035 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Gert Doering <ge...@gr...> diff --git a/COPYING b/COPYING index 00ecc27..3eb9468 100644 --- a/COPYING +++ b/COPYING @@ -1,6 +1,6 @@ OpenVPN (TM) -- An Open Source VPN daemon -Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> +Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> This distribution contains multiple components, some of which fall under different licenses. By using OpenVPN diff --git a/Makefile.am b/Makefile.am index 84b7112..8a28149 100644 --- a/Makefile.am +++ b/Makefile.am @@ -5,8 +5,8 @@ # packet encryption, packet authentication, and # packet compression. # -# Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> -# Copyright (C) 2010-2024 David Sommerseth <da...@eu...> +# Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> +# Copyright (C) 2010-2025 David Sommerseth <da...@eu...> # Copyright (C) 2006-2012 Alon Bar-Lev <alo...@gm...> # # This program is free software; you can redistribute it and/or modify diff --git a/PORTS b/PORTS index dadc6f8..6e68296 100644 --- a/PORTS +++ b/PORTS @@ -1,5 +1,5 @@ OpenVPN -Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> +Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> OpenVPN has been written to try to avoid features that are not standardized well across different diff --git a/configure.ac b/configure.ac index 1b908e6..c70892a 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl packet encryption, packet authentication, and dnl packet compression. dnl -dnl Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> +dnl Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> dnl Copyright (C) 2006-2012 Alon Bar-Lev <alo...@gm...> dnl dnl This program is free software; you can redistribute it and/or modify diff --git a/contrib/cmake/git-version.py b/contrib/cmake/git-version.py index a39cab4..a89b039 100644 --- a/contrib/cmake/git-version.py +++ b/contrib/cmake/git-version.py @@ -5,7 +5,7 @@ # packet encryption, packet authentication, and # packet compression. # -# Copyright (C) 2022-2024 OpenVPN Inc <sa...@op...> +# Copyright (C) 2022-2025 OpenVPN Inc <sa...@op...> # Copyright (C) 2022-2022 Lev Stipakov <le...@le...> # # This program is free software; you can redistribute it and/or modify diff --git a/contrib/cmake/parse-version.m4.py b/contrib/cmake/parse-version.m4.py index a7fbaf0..6297b92 100644 --- a/contrib/cmake/parse-version.m4.py +++ b/contrib/cmake/parse-version.m4.py @@ -5,7 +5,7 @@ # packet encryption, packet authentication, and # packet compression. # -# Copyright (C) 2022-2024 OpenVPN Inc <sa...@op...> +# Copyright (C) 2022-2025 OpenVPN Inc <sa...@op...> # Copyright (C) 2022-2022 Lev Stipakov <le...@le...> # # This program is free software; you can redistribute it and/or modify diff --git a/dev-tools/gen-release-tarballs.sh b/dev-tools/gen-release-tarballs.sh index 32bee80..6262dd4 100755 --- a/dev-tools/gen-release-tarballs.sh +++ b/dev-tools/gen-release-tarballs.sh @@ -1,7 +1,7 @@ #!/bin/sh # gen-release-tarballs.sh - Generates release tarballs with signatures # -# Copyright (C) 2017-2024 - David Sommerseth <da...@op...> +# Copyright (C) 2017-2025 - David Sommerseth <da...@op...> # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License diff --git a/dev-tools/gerrit-send-mail.py b/dev-tools/gerrit-send-mail.py index b581765..ec1b2bc 100755 --- a/dev-tools/gerrit-send-mail.py +++ b/dev-tools/gerrit-send-mail.py @@ -1,7 +1,7 @@ #!/usr/bin/env python3 -# Copyright (C) 2023-2024 OpenVPN Inc <sa...@op...> -# Copyright (C) 2023-2024 Frank Lichtenheld <fra...@op...> +# Copyright (C) 2023-2025 OpenVPN Inc <sa...@op...> +# Copyright (C) 2023-2025 Frank Lichtenheld <fra...@op...> # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 diff --git a/dev-tools/reformat-all.sh b/dev-tools/reformat-all.sh index 42d7368..02421c1 100755 --- a/dev-tools/reformat-all.sh +++ b/dev-tools/reformat-all.sh @@ -2,7 +2,7 @@ # reformat-all.sh - Reformat all git files in the checked out # git branch using uncrustify. # -# Copyright (C) 2016-2024 - David Sommerseth <da...@op...> +# Copyright (C) 2016-2025 - David Sommerseth <da...@op...> # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License diff --git a/dev-tools/update-copyright.sh b/dev-tools/update-copyright.sh index f126ad5..f6c8cdf 100755 --- a/dev-tools/update-copyright.sh +++ b/dev-tools/update-copyright.sh @@ -2,8 +2,8 @@ # update-copyright-sh - Simple tool to update the Copyright lines # in all files checked into git # -# Copyright (C) 2016-2024 OpenVPN Inc <sa...@op...> -# Copyright (C) 2016-2024 David Sommerseth <da...@op...> +# Copyright (C) 2016-2025 OpenVPN Inc <sa...@op...> +# Copyright (C) 2016-2025 David Sommerseth <da...@op...> # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License diff --git a/distro/Makefile.am b/distro/Makefile.am index 26f577b..94e4d59 100644 --- a/distro/Makefile.am +++ b/distro/Makefile.am @@ -5,7 +5,7 @@ # packet encryption, packet authentication, and # packet compression. # -# Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> +# Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> # Copyright (C) 2006-2012 Alon Bar-Lev <alo...@gm...> # diff --git a/distro/dns-scripts/Makefile.am b/distro/dns-scripts/Makefile.am index fc2db08..9fcd3f7 100644 --- a/distro/dns-scripts/Makefile.am +++ b/distro/dns-scripts/Makefile.am @@ -5,7 +5,7 @@ # packet encryption, packet authentication, and # packet compression. # -# Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> +# Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> # MAINTAINERCLEANFILES = \ diff --git a/distro/dns-scripts/systemd-dns-updown.sh b/distro/dns-scripts/systemd-dns-updown.sh index 6eadabc..9006e28 100644 --- a/distro/dns-scripts/systemd-dns-updown.sh +++ b/distro/dns-scripts/systemd-dns-updown.sh @@ -2,7 +2,7 @@ # # dns-updown - add/remove openvpn provided DNS information # -# Copyright (C) 2024 OpenVPN Inc <sa...@op...> +# Copyright (C) 2024-2025 OpenVPN Inc <sa...@op...> # # SPDX-License-Identifier: GPL-2.0 # diff --git a/distro/systemd/Makefile.am b/distro/systemd/Makefile.am index 8503a0c..f9fbe45 100644 --- a/distro/systemd/Makefile.am +++ b/distro/systemd/Makefile.am @@ -5,7 +5,7 @@ # packet encryption, packet authentication, and # packet compression. # -# Copyright (C) 2017-2024 OpenVPN Inc <sa...@op...> +# Copyright (C) 2017-2025 OpenVPN Inc <sa...@op...> # %.service: %.service.in Makefile diff --git a/doc/Makefile.am b/doc/Makefile.am index 634e4ce..0e7b3d5 100644 --- a/doc/Makefile.am +++ b/doc/Makefile.am @@ -5,7 +5,7 @@ # packet encryption, packet authentication, and # packet compression. # -# Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> +# Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> # Copyright (C) 2006-2012 Alon Bar-Lev <alo...@gm...> # diff --git a/include/Makefile.am b/include/Makefile.am index 3e93bf0..b4daa97 100644 --- a/include/Makefile.am +++ b/include/Makefile.am @@ -5,7 +5,7 @@ # packet encryption, packet authentication, and # packet compression. # -# Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> +# Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> # Copyright (C) 2006-2012 Alon Bar-Lev <alo...@gm...> # diff --git a/include/openvpn-msg.h b/include/openvpn-msg.h index 34b133b..e0d0bb0 100644 --- a/include/openvpn-msg.h +++ b/include/openvpn-msg.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2013-2024 Heiko Hund <hei...@so...> + * Copyright (C) 2013-2025 Heiko Hund <hei...@so...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/include/openvpn-plugin.h.in b/include/openvpn-plugin.h.in index cacef44..4d270da 100644 --- a/include/openvpn-plugin.h.in +++ b/include/openvpn-plugin.h.in @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/sample/Makefile.am b/sample/Makefile.am index e8799c4..9443cf3 100644 --- a/sample/Makefile.am +++ b/sample/Makefile.am @@ -5,7 +5,7 @@ # packet encryption, packet authentication, and # packet compression. # -# Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> +# Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> # Copyright (C) 2006-2012 Alon Bar-Lev <alo...@gm...> # diff --git a/sample/sample-keys/gen-sample-keys.sh b/sample/sample-keys/gen-sample-keys.sh index 726ba4a..0cd2511 100755 --- a/sample/sample-keys/gen-sample-keys.sh +++ b/sample/sample-keys/gen-sample-keys.sh @@ -3,7 +3,7 @@ # Run this script to set up a test CA, and test key-certificate pair for a # server, and various clients. # -# Copyright (C) 2014-2024 Steffan Karger <st...@ka...> +# Copyright (C) 2014-2025 Steffan Karger <st...@ka...> set -eu command -v openssl >/dev/null 2>&1 || { echo >&2 "Unable to find openssl. Please make sure openssl is installed and in your path."; exit 1; } diff --git a/sample/sample-plugins/Makefile.am b/sample/sample-plugins/Makefile.am index 799fe4c..95f877c 100644 --- a/sample/sample-plugins/Makefile.am +++ b/sample/sample-plugins/Makefile.am @@ -5,7 +5,7 @@ # packet encryption, packet authentication, and # packet compression. # -# Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> +# Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> # MAINTAINERCLEANFILES = \ diff --git a/sample/sample-plugins/Makefile.plugins b/sample/sample-plugins/Makefile.plugins index 3d2ec46..e366555 100644 --- a/sample/sample-plugins/Makefile.plugins +++ b/sample/sample-plugins/Makefile.plugins @@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0-only # -# Copyright (C) 2020-2024 OpenVPN Inc <sa...@op...> +# Copyright (C) 2020-2025 OpenVPN Inc <sa...@op...> # # diff --git a/sample/sample-plugins/client-connect/sample-client-connect.c b/sample/sample-plugins/client-connect/sample-client-connect.c index 1037758..18c2c6f 100644 --- a/sample/sample-plugins/client-connect/sample-client-connect.c +++ b/sample/sample-plugins/client-connect/sample-client-connect.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/sample/sample-plugins/defer/multi-auth.c b/sample/sample-plugins/defer/multi-auth.c index 109fa40..38db07f 100644 --- a/sample/sample-plugins/defer/multi-auth.c +++ b/sample/sample-plugins/defer/multi-auth.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/sample/sample-plugins/keying-material-exporter-demo/keyingmaterialexporter.c b/sample/sample-plugins/keying-material-exporter-demo/keyingmaterialexporter.c index a1b622a..cc256dd 100644 --- a/sample/sample-plugins/keying-material-exporter-demo/keyingmaterialexporter.c +++ b/sample/sample-plugins/keying-material-exporter-demo/keyingmaterialexporter.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/sample/sample-plugins/log/log.c b/sample/sample-plugins/log/log.c index 0debd2b..82595cf 100644 --- a/sample/sample-plugins/log/log.c +++ b/sample/sample-plugins/log/log.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/sample/sample-plugins/log/log_v3.c b/sample/sample-plugins/log/log_v3.c index 4601e2a..c90cc3d 100644 --- a/sample/sample-plugins/log/log_v3.c +++ b/sample/sample-plugins/log/log_v3.c @@ -5,8 +5,8 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> - * Copyright (C) 2010-2024 David Sommerseth <da...@eu...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> + * Copyright (C) 2010-2025 David Sommerseth <da...@eu...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/sample/sample-plugins/simple/base64.c b/sample/sample-plugins/simple/base64.c index 3a09eb5..6855966 100644 --- a/sample/sample-plugins/simple/base64.c +++ b/sample/sample-plugins/simple/base64.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2017-2024 David Sommerseth <da...@op...> + * Copyright (C) 2017-2025 David Sommerseth <da...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/sample/sample-plugins/simple/simple.c b/sample/sample-plugins/simple/simple.c index 7a53224..e17f3fa 100644 --- a/sample/sample-plugins/simple/simple.c +++ b/sample/sample-plugins/simple/simple.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/Makefile.am b/src/Makefile.am index 9fbdd40..61879c3 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -5,7 +5,7 @@ # packet encryption, packet authentication, and # packet compression. # -# Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> +# Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> # Copyright (C) 2006-2012 Alon Bar-Lev <alo...@gm...> # diff --git a/src/compat/Makefile.am b/src/compat/Makefile.am index 83bf423..615a433 100644 --- a/src/compat/Makefile.am +++ b/src/compat/Makefile.am @@ -5,7 +5,7 @@ # packet encryption, packet authentication, and # packet compression. # -# Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> +# Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> # Copyright (C) 2006-2012 Alon Bar-Lev <alo...@gm...> # diff --git a/src/compat/compat-gettimeofday.c b/src/compat/compat-gettimeofday.c index b03fd5a..997f360 100644 --- a/src/compat/compat-gettimeofday.c +++ b/src/compat/compat-gettimeofday.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/compat/compat-strsep.c b/src/compat/compat-strsep.c index e0b613b..25eae0c 100644 --- a/src/compat/compat-strsep.c +++ b/src/compat/compat-strsep.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2019-2024 Arne Schwabe <ar...@rf...> + * Copyright (C) 2019-2025 Arne Schwabe <ar...@rf...> * Copyright (C) 1992-2019 Free Software Foundation, Inc. * * This program is free software; you can redistribute it and/or modify diff --git a/src/openvpn/Makefile.am b/src/openvpn/Makefile.am index a6f2dc4..a5d4cdc 100644 --- a/src/openvpn/Makefile.am +++ b/src/openvpn/Makefile.am @@ -5,7 +5,7 @@ # packet encryption, packet authentication, and # packet compression. # -# Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> +# Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> # Copyright (C) 2006-2012 Alon Bar-Lev <alo...@gm...> # diff --git a/src/openvpn/argv.c b/src/openvpn/argv.c index 2ece991..95215c0 100644 --- a/src/openvpn/argv.c +++ b/src/openvpn/argv.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/argv.h b/src/openvpn/argv.h index 08b7368..098a1cb 100644 --- a/src/openvpn/argv.h +++ b/src/openvpn/argv.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/auth_token.h b/src/openvpn/auth_token.h index e024f95..5859905 100644 --- a/src/openvpn/auth_token.h +++ b/src/openvpn/auth_token.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/basic.h b/src/openvpn/basic.h index d1075b2..f603ecc 100644 --- a/src/openvpn/basic.h +++ b/src/openvpn/basic.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/buffer.c b/src/openvpn/buffer.c index b2a5bf5..fd81323 100644 --- a/src/openvpn/buffer.c +++ b/src/openvpn/buffer.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/buffer.h b/src/openvpn/buffer.h index 02e72dc..5f2ad5d 100644 --- a/src/openvpn/buffer.h +++ b/src/openvpn/buffer.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/circ_list.h b/src/openvpn/circ_list.h index 41db0a9..0189c8b 100644 --- a/src/openvpn/circ_list.h +++ b/src/openvpn/circ_list.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/clinat.c b/src/openvpn/clinat.c index 2d3b359..f040724 100644 --- a/src/openvpn/clinat.c +++ b/src/openvpn/clinat.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/clinat.h b/src/openvpn/clinat.h index 94141f5..334b3f2 100644 --- a/src/openvpn/clinat.h +++ b/src/openvpn/clinat.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/common.h b/src/openvpn/common.h index 3a84541..5d4cf2e 100644 --- a/src/openvpn/common.h +++ b/src/openvpn/common.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/comp-lz4.c b/src/openvpn/comp-lz4.c index b35df4a..ab37164 100644 --- a/src/openvpn/comp-lz4.c +++ b/src/openvpn/comp-lz4.c @@ -5,8 +5,8 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> - * Copyright (C) 2013-2024 Gert Doering <ge...@gr...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> + * Copyright (C) 2013-2025 Gert Doering <ge...@gr...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/comp-lz4.h b/src/openvpn/comp-lz4.h index 38f76d4..09d0dc7 100644 --- a/src/openvpn/comp-lz4.h +++ b/src/openvpn/comp-lz4.h @@ -5,8 +5,8 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> - * Copyright (C) 2013-2024 Gert Doering <ge...@gr...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> + * Copyright (C) 2013-2025 Gert Doering <ge...@gr...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/comp.c b/src/openvpn/comp.c index 21c6fd8..b2aa07e 100644 --- a/src/openvpn/comp.c +++ b/src/openvpn/comp.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/comp.h b/src/openvpn/comp.h index f9f9598..0bb0d32 100644 --- a/src/openvpn/comp.h +++ b/src/openvpn/comp.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/compstub.c b/src/openvpn/compstub.c index 449a6e8..109d691 100644 --- a/src/openvpn/compstub.c +++ b/src/openvpn/compstub.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/console.c b/src/openvpn/console.c index fdfb001..617e146 100644 --- a/src/openvpn/console.c +++ b/src/openvpn/console.c @@ -5,9 +5,9 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * Copyright (C) 2014-2015 David Sommerseth <da...@re...> - * Copyright (C) 2016-2024 David Sommerseth <da...@op...> + * Copyright (C) 2016-2025 David Sommerseth <da...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/console.h b/src/openvpn/console.h index 81876d3..589f778 100644 --- a/src/openvpn/console.h +++ b/src/openvpn/console.h @@ -5,9 +5,9 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * Copyright (C) 2014-2015 David Sommerseth <da...@re...> - * Copyright (C) 2016-2024 David Sommerseth <da...@op...> + * Copyright (C) 2016-2025 David Sommerseth <da...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/console_builtin.c b/src/openvpn/console_builtin.c index cb4cb16..ba61d3f 100644 --- a/src/openvpn/console_builtin.c +++ b/src/openvpn/console_builtin.c @@ -5,9 +5,9 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * Copyright (C) 2014-2015 David Sommerseth <da...@re...> - * Copyright (C) 2016-2024 David Sommerseth <da...@op...> + * Copyright (C) 2016-2025 David Sommerseth <da...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c index ed70f51..7564f82 100644 --- a/src/openvpn/crypto.c +++ b/src/openvpn/crypto.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * Copyright (C) 2010-2021 Fox Crypto B.V. <op...@fo...> * * This program is free software; you can redistribute it and/or modify diff --git a/src/openvpn/crypto.h b/src/openvpn/crypto.h index 94f1f7f..5bd1ad5 100644 --- a/src/openvpn/crypto.h +++ b/src/openvpn/crypto.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * Copyright (C) 2010-2021 Fox Crypto B.V. <op...@fo...> * * This program is free software; you can redistribute it and/or modify diff --git a/src/openvpn/crypto_backend.h b/src/openvpn/crypto_backend.h index 71e8228..8bb7f47 100644 --- a/src/openvpn/crypto_backend.h +++ b/src/openvpn/crypto_backend.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * Copyright (C) 2010-2021 Fox Crypto B.V. <op...@fo...> * * This program is free software; you can redistribute it and/or modify diff --git a/src/openvpn/crypto_epoch.c b/src/openvpn/crypto_epoch.c index 67bc910..14727c7 100644 --- a/src/openvpn/crypto_epoch.c +++ b/src/openvpn/crypto_epoch.c @@ -5,8 +5,8 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2024 OpenVPN Inc <sa...@op...> - * Copyright (C) 2024 Arne Schwabe <ar...@rf...> + * Copyright (C) 2024-2025 OpenVPN Inc <sa...@op...> + * Copyright (C) 2024-2025 Arne Schwabe <ar...@rf...> * * * This program is free software; you can redistribute it and/or modify diff --git a/src/openvpn/crypto_epoch.h b/src/openvpn/crypto_epoch.h index 9290482..c16f966 100644 --- a/src/openvpn/crypto_epoch.h +++ b/src/openvpn/crypto_epoch.h @@ -5,8 +5,8 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2024 OpenVPN Inc <sa...@op...> - * Copyright (C) 2024 Arne Schwabe <ar...@rf...> + * Copyright (C) 2024-2025 OpenVPN Inc <sa...@op...> + * Copyright (C) 2024-2025 Arne Schwabe <ar...@rf...> * * * This program is free software; you can redistribute it and/or modify diff --git a/src/openvpn/crypto_mbedtls.c b/src/openvpn/crypto_mbedtls.c index 2696330..c05902d 100644 --- a/src/openvpn/crypto_mbedtls.c +++ b/src/openvpn/crypto_mbedtls.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * Copyright (C) 2010-2021 Fox Crypto B.V. <op...@fo...> * * This program is free software; you can redistribute it and/or modify diff --git a/src/openvpn/crypto_mbedtls.h b/src/openvpn/crypto_mbedtls.h index 4a36d6f..6575bad 100644 --- a/src/openvpn/crypto_mbedtls.h +++ b/src/openvpn/crypto_mbedtls.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * Copyright (C) 2010-2021 Fox Crypto B.V. <op...@fo...> * * This program is free software; you can redistribute it and/or modify diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c index 50e7a8f..88b3580 100644 --- a/src/openvpn/crypto_openssl.c +++ b/src/openvpn/crypto_openssl.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * Copyright (C) 2010-2021 Fox Crypto B.V. <op...@fo...> * * This program is free software; you can redistribute it and/or modify diff --git a/src/openvpn/crypto_openssl.h b/src/openvpn/crypto_openssl.h index bed8844..85f53f6 100644 --- a/src/openvpn/crypto_openssl.h +++ b/src/openvpn/crypto_openssl.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * Copyright (C) 2010-2021 Fox Crypto B.V. <op...@fo...> * * This program is free software; you can redistribute it and/or modify diff --git a/src/openvpn/dco.c b/src/openvpn/dco.c index c61cbda..98cbb72 100644 --- a/src/openvpn/dco.c +++ b/src/openvpn/dco.c @@ -5,9 +5,9 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2021-2024 Arne Schwabe <ar...@rf...> - * Copyright (C) 2021-2024 Antonio Quartulli <a...@un...> - * Copyright (C) 2021-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2021-2025 Arne Schwabe <ar...@rf...> + * Copyright (C) 2021-2025 Antonio Quartulli <a...@un...> + * Copyright (C) 2021-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/dco.h b/src/openvpn/dco.h index ed194cc..f38316d 100644 --- a/src/openvpn/dco.h +++ b/src/openvpn/dco.h @@ -5,9 +5,9 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2021-2024 Arne Schwabe <ar...@rf...> - * Copyright (C) 2021-2024 Antonio Quartulli <a...@un...> - * Copyright (C) 2021-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2021-2025 Arne Schwabe <ar...@rf...> + * Copyright (C) 2021-2025 Antonio Quartulli <a...@un...> + * Copyright (C) 2021-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/dco_internal.h b/src/openvpn/dco_internal.h index 4bbcc82..27d03ef 100644 --- a/src/openvpn/dco_internal.h +++ b/src/openvpn/dco_internal.h @@ -5,8 +5,8 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2022-2024 Antonio Quartulli <a...@un...> - * Copyright (C) 2022-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2022-2025 Antonio Quartulli <a...@un...> + * Copyright (C) 2022-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/dco_linux.c b/src/openvpn/dco_linux.c index 3f7965e..49dbdad 100644 --- a/src/openvpn/dco_linux.c +++ b/src/openvpn/dco_linux.c @@ -1,9 +1,9 @@ /* * Interface to linux dco networking code * - * Copyright (C) 2020-2024 Antonio Quartulli <a...@un...> - * Copyright (C) 2020-2024 Arne Schwabe <ar...@rf...> - * Copyright (C) 2020-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2020-2025 Antonio Quartulli <a...@un...> + * Copyright (C) 2020-2025 Arne Schwabe <ar...@rf...> + * Copyright (C) 2020-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/dco_linux.h b/src/openvpn/dco_linux.h index f3abc15..273a6ad 100644 --- a/src/openvpn/dco_linux.h +++ b/src/openvpn/dco_linux.h @@ -1,9 +1,9 @@ /* * Interface to linux dco networking code * - * Copyright (C) 2020-2024 Antonio Quartulli <a...@un...> - * Copyright (C) 2020-2024 Arne Schwabe <ar...@rf...> - * Copyright (C) 2020-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2020-2025 Antonio Quartulli <a...@un...> + * Copyright (C) 2020-2025 Arne Schwabe <ar...@rf...> + * Copyright (C) 2020-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/dco_win.c b/src/openvpn/dco_win.c index a386e53..2a13658 100644 --- a/src/openvpn/dco_win.c +++ b/src/openvpn/dco_win.c @@ -1,8 +1,8 @@ /* * Interface to ovpn-win-dco networking code * - * Copyright (C) 2020-2024 Arne Schwabe <ar...@rf...> - * Copyright (C) 2020-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2020-2025 Arne Schwabe <ar...@rf...> + * Copyright (C) 2020-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/dco_win.h b/src/openvpn/dco_win.h index e8e4e22..4513f3f 100644 --- a/src/openvpn/dco_win.h +++ b/src/openvpn/dco_win.h @@ -1,8 +1,8 @@ /* * Interface to ovpn-win-dco networking code * - * Copyright (C) 2020-2024 Arne Schwabe <ar...@rf...> - * Copyright (C) 2020-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2020-2025 Arne Schwabe <ar...@rf...> + * Copyright (C) 2020-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/dhcp.c b/src/openvpn/dhcp.c index f137b01..da7a932 100644 --- a/src/openvpn/dhcp.c +++ b/src/openvpn/dhcp.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/dhcp.h b/src/openvpn/dhcp.h index dabefd2..c578c6a 100644 --- a/src/openvpn/dhcp.h +++ b/src/openvpn/dhcp.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/dns.c b/src/openvpn/dns.c index 283ce67..7cf1b63 100644 --- a/src/openvpn/dns.c +++ b/src/openvpn/dns.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2022-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2022-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/dns.h b/src/openvpn/dns.h index c56d603..60f5471 100644 --- a/src/openvpn/dns.h +++ b/src/openvpn/dns.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2022-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2022-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/env_set.c b/src/openvpn/env_set.c index 3fe23fd..f20ee8a 100644 --- a/src/openvpn/env_set.c +++ b/src/openvpn/env_set.c @@ -5,9 +5,9 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Technologies, Inc. <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Technologies, Inc. <sa...@op...> * Copyright (C) 2014-2015 David Sommerseth <da...@re...> - * Copyright (C) 2016-2024 David Sommerseth <da...@op...> + * Copyright (C) 2016-2025 David Sommerseth <da...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/env_set.h b/src/openvpn/env_set.h index 70d01e2..52c5312 100644 --- a/src/openvpn/env_set.h +++ b/src/openvpn/env_set.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Technologies, Inc. <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Technologies, Inc. <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/errlevel.h b/src/openvpn/errlevel.h index 1f54ed8..fc3e64a 100644 --- a/src/openvpn/errlevel.h +++ b/src/openvpn/errlevel.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/error.c b/src/openvpn/error.c index d5bb802..049cd92 100644 --- a/src/openvpn/error.c +++ b/src/openvpn/error.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/error.h b/src/openvpn/error.h index 9a4577b..e0a2730 100644 --- a/src/openvpn/error.h +++ b/src/openvpn/error.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/event.c b/src/openvpn/event.c index a81ca1e..c3907b9 100644 --- a/src/openvpn/event.c +++ b/src/openvpn/event.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/event.h b/src/openvpn/event.h index c212e07..389f80d 100644 --- a/src/openvpn/event.h +++ b/src/openvpn/event.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/fdmisc.c b/src/openvpn/fdmisc.c index 3d664ac..3d8654c 100644 --- a/src/openvpn/fdmisc.c +++ b/src/openvpn/fdmisc.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/fdmisc.h b/src/openvpn/fdmisc.h index 8299f67..17b6994 100644 --- a/src/openvpn/fdmisc.h +++ b/src/openvpn/fdmisc.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c index a83b258..a4f260a 100644 --- a/src/openvpn/forward.c +++ b/src/openvpn/forward.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/forward.h b/src/openvpn/forward.h index 74c6036..318691f 100644 --- a/src/openvpn/forward.h +++ b/src/openvpn/forward.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/fragment.c b/src/openvpn/fragment.c index 2158a0b..287eb9b 100644 --- a/src/openvpn/fragment.c +++ b/src/openvpn/fragment.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/fragment.h b/src/openvpn/fragment.h index 91f4a26..5003c96 100644 --- a/src/openvpn/fragment.h +++ b/src/openvpn/fragment.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/gremlin.c b/src/openvpn/gremlin.c index 99ad803..b58defe 100644 --- a/src/openvpn/gremlin.c +++ b/src/openvpn/gremlin.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/gremlin.h b/src/openvpn/gremlin.h index 27213fd..bf1cfea 100644 --- a/src/openvpn/gremlin.h +++ b/src/openvpn/gremlin.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/helper.c b/src/openvpn/helper.c index 9e28e87..8761826 100644 --- a/src/openvpn/helper.c +++ b/src/openvpn/helper.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/helper.h b/src/openvpn/helper.h index 6b42e13..ec5fe9e 100644 --- a/src/openvpn/helper.h +++ b/src/openvpn/helper.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/httpdigest.c b/src/openvpn/httpdigest.c index 59fb777..8665402 100644 --- a/src/openvpn/httpdigest.c +++ b/src/openvpn/httpdigest.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/httpdigest.h b/src/openvpn/httpdigest.h index a3458dd..50cf451 100644 --- a/src/openvpn/httpdigest.h +++ b/src/openvpn/httpdigest.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/init.c b/src/openvpn/init.c index 15eacab..7d4eb85 100644 --- a/src/openvpn/init.c +++ b/src/openvpn/init.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/init.h b/src/openvpn/init.h index 50b38e3..5c6b9c1 100644 --- a/src/openvpn/init.h +++ b/src/openvpn/init.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/integer.h b/src/openvpn/integer.h index 34088ab..c568036 100644 --- a/src/openvpn/integer.h +++ b/src/openvpn/integer.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/interval.c b/src/openvpn/interval.c index 8821e0b..f1abeee 100644 --- a/src/openvpn/interval.c +++ b/src/openvpn/interval.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/interval.h b/src/openvpn/interval.h index 06db779..60030fd 100644 --- a/src/openvpn/interval.h +++ b/src/openvpn/interval.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/list.c b/src/openvpn/list.c index 6987def..1f33b5f 100644 --- a/src/openvpn/list.c +++ b/src/openvpn/list.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/list.h b/src/openvpn/list.h index 6af7262..783570f 100644 --- a/src/openvpn/list.h +++ b/src/openvpn/list.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/lzo.c b/src/openvpn/lzo.c index bd7e2f9..01db221 100644 --- a/src/openvpn/lzo.c +++ b/src/openvpn/lzo.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/lzo.h b/src/openvpn/lzo.h index c271527..03da2af 100644 --- a/src/openvpn/lzo.h +++ b/src/openvpn/lzo.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/manage.c b/src/openvpn/manage.c index 3936320..8836e79 100644 --- a/src/openvpn/manage.c +++ b/src/openvpn/manage.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/manage.h b/src/openvpn/manage.h index 02ceb82..eb19a4e 100644 --- a/src/openvpn/manage.h +++ b/src/openvpn/manage.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/mbuf.c b/src/openvpn/mbuf.c index 823babd..3346a11 100644 --- a/src/openvpn/mbuf.c +++ b/src/openvpn/mbuf.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/mbuf.h b/src/openvpn/mbuf.h index e6c9162..b9c1645 100644 --- a/src/openvpn/mbuf.h +++ b/src/openvpn/mbuf.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/memdbg.h b/src/openvpn/memdbg.h index c1fba48..6947275 100644 --- a/src/openvpn/memdbg.h +++ b/src/openvpn/memdbg.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/misc.c b/src/openvpn/misc.c index 70ba5e4..4695700 100644 --- a/src/openvpn/misc.c +++ b/src/openvpn/misc.c @@ -5,9 +5,9 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * Copyright (C) 2014-2015 David Sommerseth <da...@re...> - * Copyright (C) 2016-2024 David Sommerseth <da...@op...> + * Copyright (C) 2016-2025 David Sommerseth <da...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/misc.h b/src/openvpn/misc.h index 5f55a060..c6e2fa51 100644 --- a/src/openvpn/misc.h +++ b/src/openvpn/misc.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/mroute.c b/src/openvpn/mroute.c index 24b9543..a617b33 100644 --- a/src/openvpn/mroute.c +++ b/src/openvpn/mroute.c @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 diff --git a/src/openvpn/mroute.h b/src/openvpn/mroute.h index fbe102a..c359fd2 100644 --- a/src/openvpn/mroute.h +++ b/src/openvpn/mroute.h @@ -5,7 +5,7 @@ * packet encryption, packet authentication, and * packet compression. * - * Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> + * Copyr... [truncated message content] |
| From: cron2 (C. Review) <ge...@op...> - 2025-05-31 20:35:41 |
Attention is currently required from: flichtenheld, plaisthos. cron2 has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/1035?usp=email ) Change subject: Update copyright statements to 2025 ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1035?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I3dfead8e60da93f223e3333db7b8e01ead01a856 Gerrit-Change-Number: 1035 Gerrit-PatchSet: 1 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: cron2 <ge...@gr...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Comment-Date: Sat, 31 May 2025 20:35:24 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment |
| From: Frank L. <fr...@li...> - 2025-05-30 09:32:30 |
The OpenVPN community project team is proud to release OpenVPN 2.7_alpha1. This is the first Alpha release for the feature release 2.7.0. As the "Alpha" name implies this is an early release build, this is not intended for production use. Highlights of this release include: * Multi-socket support for servers -- Handle multiple addresses/ports/protocols within one server * Improved Client support for DNS options * Client implementations for Linux/BSD, included with the default install * New client implementation for Windows, adding support for features like split DNS and DNSSEC * Architectural improvements on Windows * The block-local flag is now enforced with WFP filters * Windows network adapters are now generated on demand * Windows automatic service now runs as an unprivileged user * Support for server mode in win-dco driver * Note: Support for the wintun driver has been removed. win-dco is now the default, tap-windows6 is the fallback solution for use-cases not covered by win-dco. * Improved data channel * Enforcement of AES-GCM usage limit * Epoch data keys and packet format * Support for new upstream DCO Linux kernel module * This release supports the new ovpn DCO Linux kernel module which will be available in future upstream Linux kernel releases. Backports of the new module to current kernels are available via the ovpn-backports project. More details can be found in the Changes document: <https://github.com/OpenVPN/openvpn/blob/master/Changes.rst> Source code and Windows installers can be downloaded from our download page: <https://openvpn.net/community-downloads/> Packages for Debian, Ubuntu, Fedora, RHEL, and openSUSE are available in the various official Community repositories: <https://community.openvpn.net/Pages/OpenVPN%20software%20repos> Regards, -- Frank Lichtenheld |
| From: Johan D. <jo...@op...> - 2025-05-29 10:00:31 |
Meeting summary for 28 May 2025: * *Updated: Release 2.7* We are going for an alpha release - this was released 28 May 2025. Main website to be updated 29 May 2025 somewhere. Currently collecting all the changes that are new to 2.7 and making a changes.rst and reviewing anything still left to handle. Together with 2.7 a new Linux DCO module based on upstreamed (linux kernel) codebase will be released, the code for this is 'done' although there are still bugs being fixed. Together with 2.7 a new Windows DCO module with server support will be released. The code for this is done but needs more testing. DNS changes are in but there are still some minor bug fixes and such on the way.\ * *Updated: Changes to community pages on main website* Company reached out to novaflash about proposed changes. novaflash involved ordex and lev__ for feedback/ideas. An initial design suggestion was put forward, hoping to get feedback from community on it to finetune it. https://crashed.computer/new.png There was no immediate feedback in the community meeting, so novaflash, ordex, and lev__, will work together to come up with something sensible. As always you're welcome to join at #openvpn-meeting on Libera IRC network every Wednesday at 14:00 Central European Time. Kind regards, Johan Draaisma |
| From: cron2 (C. Review) <ge...@op...> - 2025-05-28 19:20:10 |
cron2 has submitted this change. ( http://gerrit.openvpn.net/c/openvpn/+/1034?usp=email ) Change subject: Remove contrib/pull-resolv-conf ...................................................................... Remove contrib/pull-resolv-conf We have an official solution for this now. Change-Id: Ic30f8514b50f561e7ea8f1ce12d740ac53f202e5 Signed-off-by: Frank Lichtenheld <fr...@li...> Acked-by: Gert Doering <ge...@gr...> Message-Id: <202...@gr...> URL: https://www.mail-archive.com/ope...@li.../msg31820.html Signed-off-by: Gert Doering <ge...@gr...> --- D contrib/pull-resolv-conf/client.down D contrib/pull-resolv-conf/client.up 2 files changed, 0 insertions(+), 155 deletions(-) diff --git a/contrib/pull-resolv-conf/client.down b/contrib/pull-resolv-conf/client.down deleted file mode 100644 index 0cbb476..0000000 --- a/contrib/pull-resolv-conf/client.down +++ /dev/null @@ -1,51 +0,0 @@ -#!/bin/sh - -# Copyright (c) 2005-2018 OpenVPN Inc -# Licensed under the GPL version 2 - -# First version by Jesse Adelman -# someone at boldandbusted dink com -# http://www.boldandbusted.com/ - -# PURPOSE: This script automatically removes the /etc/resolv.conf entries previously -# set by the companion script "client.up". - -# INSTALL NOTES: -# Place this in /etc/openvpn/client.down -# Then, add the following to your /etc/openvpn/<clientconfig>.conf: -# client -# up /etc/openvpn/client.up -# down /etc/openvpn/client.down -# Next, "chmod a+x /etc/openvpn/client.down" - -# USAGE NOTES: -# Note that this script is best served with the companion "client.up" -# script. - -# Tested under Debian lenny with OpenVPN 2.1_rc11 -# It should work with any UNIX with a POSIX sh, /etc/resolv.conf or resolvconf - -# This runs with the context of the OpenVPN UID/GID -# at the time of execution. This generally means that -# the client "up" script will run fine, but the "down" script -# will require the use of the OpenVPN "down-root" plugin -# which is in the plugins/ directory of the OpenVPN source tree -# The config example above would have to be changed to: -# client -# up /etc/openvpn/client.up -# plugin openvpn-plugin-down-root.so "/etc/openvpn/client.down" - -# A horrid work around, from a security perspective, -# is to run OpenVPN as root. THIS IS NOT RECOMMENDED. You have -# been WARNED. -PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin - -if type resolvconf >/dev/null 2>&1; then - resolvconf -d "${dev}" -f -elif [ -e /etc/resolv.conf.ovpnsave ] ; then - # cp + rm rather than mv in case it's a symlink - cp /etc/resolv.conf.ovpnsave /etc/resolv.conf - rm -f /etc/resolv.conf.ovpnsave -fi - -exit 0 diff --git a/contrib/pull-resolv-conf/client.up b/contrib/pull-resolv-conf/client.up deleted file mode 100644 index 220aeb7..0000000 --- a/contrib/pull-resolv-conf/client.up +++ /dev/null @@ -1,104 +0,0 @@ -#!/bin/sh - -# Copyright (c) 2005-2018 OpenVPN Inc -# Licensed under the GPL version 2 - -# First version by Jesse Adelman -# someone at boldandbusted dink com -# http://www.boldandbusted.com/ - -# PURPOSE: This script automatically sets the proper /etc/resolv.conf entries -# as pulled down from an OpenVPN server. - -# INSTALL NOTES: -# Place this in /etc/openvpn/client.up -# Then, add the following to your /etc/openvpn/<clientconfig>.conf: -# client -# up /etc/openvpn/client.up -# Next, "chmod a+x /etc/openvpn/client.up" - -# USAGE NOTES: -# Note that this script is best served with the companion "client.down" -# script. - -# Tested under Debian lenny with OpenVPN 2.1_rc11 -# It should work with any UNIX with a POSIX sh, /etc/resolv.conf or resolvconf - -# This runs with the context of the OpenVPN UID/GID -# at the time of execution. This generally means that -# the client "up" script will run fine, but the "down" script -# will require the use of the OpenVPN "down-root" plugin -# which is in the plugins/ directory of the OpenVPN source tree - -# A horrid work around, from a security perspective, -# is to run OpenVPN as root. THIS IS NOT RECOMMENDED. You have -# been WARNED. -PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin - -# init variables - -i=1 -domains= -fopt= -ndoms=0 -nns=0 -nl=' -' - -# $foreign_option_<n> is something like -# "dhcp-option DOMAIN example.com" (multiple allowed) -# or -# "dhcp-option DNS 10.10.10.10" (multiple allowed) - -# each DNS option becomes a "nameserver" option in resolv.conf -# if we get one DOMAIN, that becomes "domain" in resolv.conf -# if we get multiple DOMAINS, those become "search" lines in resolv.conf -# if we get no DOMAINS, then don't use either domain or search. - -while true; do - eval fopt=\$foreign_option_${i} - [ -z "${fopt}" ] && break - - case ${fopt} in - dhcp-option\ DOMAIN\ *) - ndoms=$((ndoms + 1)) - domains="${domains} ${fopt#dhcp-option DOMAIN }" - ;; - dhcp-option\ DNS\ *) - nns=$((nns + 1)) - if [ $nns -le 3 ]; then - dns="${dns}${dns:+$nl}nameserver ${fopt#dhcp-option DNS }" - else - printf "%s\n" "Too many nameservers - ignoring after third" >&2 - fi - ;; - *) - printf "%s\n" "Unknown option \"${fopt}\" - ignored" >&2 - ;; - esac - i=$((i + 1)) -done - -ds="" -if [ $ndoms -eq 1 ]; then - ds="${nl}domain" -elif [ $ndoms -gt 1 ]; then - ds="${nl}search" -fi - -# This is the complete file - "$domains" has a leading space already -out="# resolv.conf autogenerated by ${0} (${dev})${nl}${dns}${ds}${domains}" - -# use resolvconf if it's available -if type resolvconf >/dev/null 2>&1; then - printf "%s\n" "${out}" | resolvconf -a "${dev}" -else - # Preserve the existing resolv.conf - if [ -e /etc/resolv.conf ] ; then - cp /etc/resolv.conf /etc/resolv.conf.ovpnsave - fi - printf "%s\n" "${out}" > /etc/resolv.conf - chmod 644 /etc/resolv.conf -fi - -exit 0 -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1034?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ic30f8514b50f561e7ea8f1ce12d740ac53f202e5 Gerrit-Change-Number: 1034 Gerrit-PatchSet: 2 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: cron2 <ge...@gr...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-MessageType: merged |
| From: cron2 (C. Review) <ge...@op...> - 2025-05-28 19:20:10 |
cron2 has uploaded a new patch set (#2) to the change originally created by flichtenheld. ( http://gerrit.openvpn.net/c/openvpn/+/1034?usp=email ) The following approvals got outdated and were removed: Code-Review+2 by cron2 Change subject: Remove contrib/pull-resolv-conf ...................................................................... Remove contrib/pull-resolv-conf We have an official solution for this now. Change-Id: Ic30f8514b50f561e7ea8f1ce12d740ac53f202e5 Signed-off-by: Frank Lichtenheld <fr...@li...> Acked-by: Gert Doering <ge...@gr...> Message-Id: <202...@gr...> URL: https://www.mail-archive.com/ope...@li.../msg31820.html Signed-off-by: Gert Doering <ge...@gr...> --- D contrib/pull-resolv-conf/client.down D contrib/pull-resolv-conf/client.up 2 files changed, 0 insertions(+), 155 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/34/1034/2 diff --git a/contrib/pull-resolv-conf/client.down b/contrib/pull-resolv-conf/client.down deleted file mode 100644 index 0cbb476..0000000 --- a/contrib/pull-resolv-conf/client.down +++ /dev/null @@ -1,51 +0,0 @@ -#!/bin/sh - -# Copyright (c) 2005-2018 OpenVPN Inc -# Licensed under the GPL version 2 - -# First version by Jesse Adelman -# someone at boldandbusted dink com -# http://www.boldandbusted.com/ - -# PURPOSE: This script automatically removes the /etc/resolv.conf entries previously -# set by the companion script "client.up". - -# INSTALL NOTES: -# Place this in /etc/openvpn/client.down -# Then, add the following to your /etc/openvpn/<clientconfig>.conf: -# client -# up /etc/openvpn/client.up -# down /etc/openvpn/client.down -# Next, "chmod a+x /etc/openvpn/client.down" - -# USAGE NOTES: -# Note that this script is best served with the companion "client.up" -# script. - -# Tested under Debian lenny with OpenVPN 2.1_rc11 -# It should work with any UNIX with a POSIX sh, /etc/resolv.conf or resolvconf - -# This runs with the context of the OpenVPN UID/GID -# at the time of execution. This generally means that -# the client "up" script will run fine, but the "down" script -# will require the use of the OpenVPN "down-root" plugin -# which is in the plugins/ directory of the OpenVPN source tree -# The config example above would have to be changed to: -# client -# up /etc/openvpn/client.up -# plugin openvpn-plugin-down-root.so "/etc/openvpn/client.down" - -# A horrid work around, from a security perspective, -# is to run OpenVPN as root. THIS IS NOT RECOMMENDED. You have -# been WARNED. -PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin - -if type resolvconf >/dev/null 2>&1; then - resolvconf -d "${dev}" -f -elif [ -e /etc/resolv.conf.ovpnsave ] ; then - # cp + rm rather than mv in case it's a symlink - cp /etc/resolv.conf.ovpnsave /etc/resolv.conf - rm -f /etc/resolv.conf.ovpnsave -fi - -exit 0 diff --git a/contrib/pull-resolv-conf/client.up b/contrib/pull-resolv-conf/client.up deleted file mode 100644 index 220aeb7..0000000 --- a/contrib/pull-resolv-conf/client.up +++ /dev/null @@ -1,104 +0,0 @@ -#!/bin/sh - -# Copyright (c) 2005-2018 OpenVPN Inc -# Licensed under the GPL version 2 - -# First version by Jesse Adelman -# someone at boldandbusted dink com -# http://www.boldandbusted.com/ - -# PURPOSE: This script automatically sets the proper /etc/resolv.conf entries -# as pulled down from an OpenVPN server. - -# INSTALL NOTES: -# Place this in /etc/openvpn/client.up -# Then, add the following to your /etc/openvpn/<clientconfig>.conf: -# client -# up /etc/openvpn/client.up -# Next, "chmod a+x /etc/openvpn/client.up" - -# USAGE NOTES: -# Note that this script is best served with the companion "client.down" -# script. - -# Tested under Debian lenny with OpenVPN 2.1_rc11 -# It should work with any UNIX with a POSIX sh, /etc/resolv.conf or resolvconf - -# This runs with the context of the OpenVPN UID/GID -# at the time of execution. This generally means that -# the client "up" script will run fine, but the "down" script -# will require the use of the OpenVPN "down-root" plugin -# which is in the plugins/ directory of the OpenVPN source tree - -# A horrid work around, from a security perspective, -# is to run OpenVPN as root. THIS IS NOT RECOMMENDED. You have -# been WARNED. -PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin - -# init variables - -i=1 -domains= -fopt= -ndoms=0 -nns=0 -nl=' -' - -# $foreign_option_<n> is something like -# "dhcp-option DOMAIN example.com" (multiple allowed) -# or -# "dhcp-option DNS 10.10.10.10" (multiple allowed) - -# each DNS option becomes a "nameserver" option in resolv.conf -# if we get one DOMAIN, that becomes "domain" in resolv.conf -# if we get multiple DOMAINS, those become "search" lines in resolv.conf -# if we get no DOMAINS, then don't use either domain or search. - -while true; do - eval fopt=\$foreign_option_${i} - [ -z "${fopt}" ] && break - - case ${fopt} in - dhcp-option\ DOMAIN\ *) - ndoms=$((ndoms + 1)) - domains="${domains} ${fopt#dhcp-option DOMAIN }" - ;; - dhcp-option\ DNS\ *) - nns=$((nns + 1)) - if [ $nns -le 3 ]; then - dns="${dns}${dns:+$nl}nameserver ${fopt#dhcp-option DNS }" - else - printf "%s\n" "Too many nameservers - ignoring after third" >&2 - fi - ;; - *) - printf "%s\n" "Unknown option \"${fopt}\" - ignored" >&2 - ;; - esac - i=$((i + 1)) -done - -ds="" -if [ $ndoms -eq 1 ]; then - ds="${nl}domain" -elif [ $ndoms -gt 1 ]; then - ds="${nl}search" -fi - -# This is the complete file - "$domains" has a leading space already -out="# resolv.conf autogenerated by ${0} (${dev})${nl}${dns}${ds}${domains}" - -# use resolvconf if it's available -if type resolvconf >/dev/null 2>&1; then - printf "%s\n" "${out}" | resolvconf -a "${dev}" -else - # Preserve the existing resolv.conf - if [ -e /etc/resolv.conf ] ; then - cp /etc/resolv.conf /etc/resolv.conf.ovpnsave - fi - printf "%s\n" "${out}" > /etc/resolv.conf - chmod 644 /etc/resolv.conf -fi - -exit 0 -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1034?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ic30f8514b50f561e7ea8f1ce12d740ac53f202e5 Gerrit-Change-Number: 1034 Gerrit-PatchSet: 2 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: cron2 <ge...@gr...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-MessageType: newpatchset |
| From: Gert D. <ge...@gr...> - 2025-05-28 19:19:52 |
Indeed - "because why ship something which is not doing a good job when we have something new that does a better job" ;-) - and out it goes. Your patch has been applied to the master branch. commit 26a5c094bddbf528be4f6f2f26d9831717d5139d Author: Frank Lichtenheld Date: Wed May 28 21:11:20 2025 +0200 Remove contrib/pull-resolv-conf Signed-off-by: Frank Lichtenheld <fr...@li...> Acked-by: Gert Doering <ge...@gr...> Message-Id: <202...@gr...> URL: https://www.mail-archive.com/ope...@li.../msg31820.html Signed-off-by: Gert Doering <ge...@gr...> -- kind regards, Gert Doering |
| From: Gert D. <ge...@gr...> - 2025-05-28 19:11:39 |
From: Frank Lichtenheld <fr...@li...> We have an official solution for this now. Change-Id: Ic30f8514b50f561e7ea8f1ce12d740ac53f202e5 Signed-off-by: Frank Lichtenheld <fr...@li...> Acked-by: Gert Doering <ge...@gr...> --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1034 This mail reflects revision 1 of this Change. Acked-by according to Gerrit (reflected above): Gert Doering <ge...@gr...> diff --git a/contrib/pull-resolv-conf/client.down b/contrib/pull-resolv-conf/client.down deleted file mode 100644 index 0cbb476..0000000 --- a/contrib/pull-resolv-conf/client.down +++ /dev/null @@ -1,51 +0,0 @@ -#!/bin/sh - -# Copyright (c) 2005-2018 OpenVPN Inc -# Licensed under the GPL version 2 - -# First version by Jesse Adelman -# someone at boldandbusted dink com -# http://www.boldandbusted.com/ - -# PURPOSE: This script automatically removes the /etc/resolv.conf entries previously -# set by the companion script "client.up". - -# INSTALL NOTES: -# Place this in /etc/openvpn/client.down -# Then, add the following to your /etc/openvpn/<clientconfig>.conf: -# client -# up /etc/openvpn/client.up -# down /etc/openvpn/client.down -# Next, "chmod a+x /etc/openvpn/client.down" - -# USAGE NOTES: -# Note that this script is best served with the companion "client.up" -# script. - -# Tested under Debian lenny with OpenVPN 2.1_rc11 -# It should work with any UNIX with a POSIX sh, /etc/resolv.conf or resolvconf - -# This runs with the context of the OpenVPN UID/GID -# at the time of execution. This generally means that -# the client "up" script will run fine, but the "down" script -# will require the use of the OpenVPN "down-root" plugin -# which is in the plugins/ directory of the OpenVPN source tree -# The config example above would have to be changed to: -# client -# up /etc/openvpn/client.up -# plugin openvpn-plugin-down-root.so "/etc/openvpn/client.down" - -# A horrid work around, from a security perspective, -# is to run OpenVPN as root. THIS IS NOT RECOMMENDED. You have -# been WARNED. -PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin - -if type resolvconf >/dev/null 2>&1; then - resolvconf -d "${dev}" -f -elif [ -e /etc/resolv.conf.ovpnsave ] ; then - # cp + rm rather than mv in case it's a symlink - cp /etc/resolv.conf.ovpnsave /etc/resolv.conf - rm -f /etc/resolv.conf.ovpnsave -fi - -exit 0 diff --git a/contrib/pull-resolv-conf/client.up b/contrib/pull-resolv-conf/client.up deleted file mode 100644 index 220aeb7..0000000 --- a/contrib/pull-resolv-conf/client.up +++ /dev/null @@ -1,104 +0,0 @@ -#!/bin/sh - -# Copyright (c) 2005-2018 OpenVPN Inc -# Licensed under the GPL version 2 - -# First version by Jesse Adelman -# someone at boldandbusted dink com -# http://www.boldandbusted.com/ - -# PURPOSE: This script automatically sets the proper /etc/resolv.conf entries -# as pulled down from an OpenVPN server. - -# INSTALL NOTES: -# Place this in /etc/openvpn/client.up -# Then, add the following to your /etc/openvpn/<clientconfig>.conf: -# client -# up /etc/openvpn/client.up -# Next, "chmod a+x /etc/openvpn/client.up" - -# USAGE NOTES: -# Note that this script is best served with the companion "client.down" -# script. - -# Tested under Debian lenny with OpenVPN 2.1_rc11 -# It should work with any UNIX with a POSIX sh, /etc/resolv.conf or resolvconf - -# This runs with the context of the OpenVPN UID/GID -# at the time of execution. This generally means that -# the client "up" script will run fine, but the "down" script -# will require the use of the OpenVPN "down-root" plugin -# which is in the plugins/ directory of the OpenVPN source tree - -# A horrid work around, from a security perspective, -# is to run OpenVPN as root. THIS IS NOT RECOMMENDED. You have -# been WARNED. -PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin - -# init variables - -i=1 -domains= -fopt= -ndoms=0 -nns=0 -nl=' -' - -# $foreign_option_<n> is something like -# "dhcp-option DOMAIN example.com" (multiple allowed) -# or -# "dhcp-option DNS 10.10.10.10" (multiple allowed) - -# each DNS option becomes a "nameserver" option in resolv.conf -# if we get one DOMAIN, that becomes "domain" in resolv.conf -# if we get multiple DOMAINS, those become "search" lines in resolv.conf -# if we get no DOMAINS, then don't use either domain or search. - -while true; do - eval fopt=\$foreign_option_${i} - [ -z "${fopt}" ] && break - - case ${fopt} in - dhcp-option\ DOMAIN\ *) - ndoms=$((ndoms + 1)) - domains="${domains} ${fopt#dhcp-option DOMAIN }" - ;; - dhcp-option\ DNS\ *) - nns=$((nns + 1)) - if [ $nns -le 3 ]; then - dns="${dns}${dns:+$nl}nameserver ${fopt#dhcp-option DNS }" - else - printf "%s\n" "Too many nameservers - ignoring after third" >&2 - fi - ;; - *) - printf "%s\n" "Unknown option \"${fopt}\" - ignored" >&2 - ;; - esac - i=$((i + 1)) -done - -ds="" -if [ $ndoms -eq 1 ]; then - ds="${nl}domain" -elif [ $ndoms -gt 1 ]; then - ds="${nl}search" -fi - -# This is the complete file - "$domains" has a leading space already -out="# resolv.conf autogenerated by ${0} (${dev})${nl}${dns}${ds}${domains}" - -# use resolvconf if it's available -if type resolvconf >/dev/null 2>&1; then - printf "%s\n" "${out}" | resolvconf -a "${dev}" -else - # Preserve the existing resolv.conf - if [ -e /etc/resolv.conf ] ; then - cp /etc/resolv.conf /etc/resolv.conf.ovpnsave - fi - printf "%s\n" "${out}" > /etc/resolv.conf - chmod 644 /etc/resolv.conf -fi - -exit 0 |
| From: cron2 (C. Review) <ge...@op...> - 2025-05-28 19:11:08 |
Attention is currently required from: flichtenheld, plaisthos. cron2 has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/1034?usp=email ) Change subject: Remove contrib/pull-resolv-conf ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1034?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ic30f8514b50f561e7ea8f1ce12d740ac53f202e5 Gerrit-Change-Number: 1034 Gerrit-PatchSet: 1 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: cron2 <ge...@gr...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Comment-Date: Wed, 28 May 2025 19:10:55 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment |
| From: cron2 (C. Review) <ge...@op...> - 2025-05-28 19:10:05 |
cron2 has submitted this change. ( http://gerrit.openvpn.net/c/openvpn/+/1032?usp=email ) Change subject: OpenVPN Release 2.7_alpha1 ...................................................................... OpenVPN Release 2.7_alpha1 version.m4, ChangeLog, Changes.rst (ChangeLog in "master" will revert to its normal state of "empty" after release/2.7 is forked off into its own branch) Additionally, add test_common.h to tests/unit_tests/openvpn/Makefile.am (..._SOURCES) so it's packed into the "make dist" tarball Change-Id: I80a14b77fcc2fabf51af9f2d5ea0c36362cccb91 Signed-off-by: Frank Lichtenheld <fr...@li...> --- M ChangeLog M Changes.rst M tests/unit_tests/openvpn/Makefile.am M version.m4 4 files changed, 903 insertions(+), 46 deletions(-) diff --git a/ChangeLog b/ChangeLog index c26dd2e..c6e626b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,759 @@ OpenVPN ChangeLog -Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> +Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> -This file is not maintained in this branch of the OpenVPN git repository. +2025.05.28 -- Version 2.7_alpha1 -Release branches (release/2.5, release/2.4, etc) have individual ChangeLog -files with all changes relevant for these releases. +5andr0 (1): + Implement server_poll_timeout for socks + +Alexander von Gluck (4): + Haiku: Introduce basic platform / tun support + Haiku: Add calls to manage routing table + Haiku: change del to delete in route command. del is undocumented + Haiku: Fix short interface path length + +Antonio Quartulli (32): + disable DCO if --secret is specified + dco: properly re-initialize dco_del_peer_reason + dco: bail out when no peer-specific message is delivered + dco: improve comment about hidden debug message + dco: print proper message in case of transport disconnection + dco_linux: update license for ovpn_dco_linux.h + Update issue templates + Avoid warning about missing braces when initialising key struct + dco: don't use NetLink to exchange control packets + dco: print version to log if available + dco-linux: remove M_ERRNO flag when printing netlink error message + multi: don't call DCO APIs if DCO is disabled + dco-freebsd: use m->instances[] instead of m->hash + dco-linux: implement dco_get_peer_stats{, multi} API + configure.ac: fix typ0 in LIBCAPNG_CFALGS + dco: fix crash when --multihome is used with --proto tcp + dco: mark peer as deleted from kernel after receiving CMD_DEL_PEER notification + event/multi: add event_arg object to make event handling more generic + pass link_socket object to i/o functions + io_work: convert shift argument to uintptr_t + io_work: pass event_arg object to event handler in case of socket event + sitnl: replace NLMSG_TAIL macro with noinline function + override ai_family if 'local' numeric address was specified + Adapt socket handling to support listening on multiple sockets + allow user to specify 'local' multiple times in config files + dco_linux: extend netlink error cb with extra info + man: extend --persist-tun section + dco: pass remoteaddr only for UDP peers + socket: use remote proto when creating client sockets + dco_linux: fix peer stats parsing with new ovpn kernel module + socket: don't transfer bind family to socket in case of ANY address + dco_linux: avoid bogus text when netlink message is not parsed + +Aquila Macedo (1): + doc: Correct typos in multiple documentation files + +Arne Schwabe (190): + Fix connection cookie not including address and fix endianness in test + Fix unit test of test_pkt on little endian Linux + Disable DCO when TLS mode is not used + Ignore connection attempts while server is shutting down + Improve debug logging of DCO swap key message and Linux dco_new_peer + Trigger a USR1 if dco_update_keys fails + Set DCO_NOT_INSTALLED also for keys not in the get_key_scan range + Ensure that argument to parse_line has always space for final sentinel + Improve documentation on user/password requirement and unicodize function + Eliminate or comment empty blocks and switch fallthrough + Remove unused gc_arena + Fix corner case that might lead to leaked file descriptor + Deprecate NTLMv1 proxy auth method. + Use include "buffer.h" instead of include <buffer.h> + Ensure that dco keepalive and mssfix options are also set in pure p2p mode + Make management password check constant time + Rename TM_UNTRUSTED to TM_INITIAL, always start session in TM_INITIAL rather than TM_ACTIVE or TM_INITIAL + Move dco_installed back to link_socket from link_socket.info.actual + Do not set nl socket buffer size + Also drop incoming dco packet content when dropping the packet + Improve logging when seeing a message for an unkown peer + Ignore OVPN_DEL_PEER_REASON_USERSPACE to avoid race conditions + Replace custom min macro and use more C99 style in man_remote_entry_get + Replace realloc with new gc_realloc function + Add connect-freq-initial option to limit initial connection responses + Log peer-id if loglevel is D_DCO_DEBUG and dco is enabled + Deprecate OCC checking + Workaround: make ovpn-dco more reliable + Fix unaligned access in auth-token + Update LibreSSL to 3.7.0 in Github actions + Add printing USAN stack trace on github actions + Fix LibreSSL not building in Github Actions + Add missing stdint.h includes in unit tests files + Combine extra_tun/frame parameter of frame_calculate_payload_overhead + Update the last sections in the man page to a be a bit less outdated + Add building unit tests with mingw to github actions + Revise the cipher negotiation info about OpenVPN3 in the man page + Exit if a proper message instead of segfault on Android without management + Use proper print format/casting when converting msg_channel handle + Reduce initialisation spam from verb <= 3 and print summary instead + Dynamic tls-crypt for secure soft_reset/session renegotiation + Set netlink socket to be non-blocking + Ensure n = 2 is set in key2 struct in tls_crypt_v2_unwrap_client_key + Fix memory leaks in open_tun_dco() + Fix memory leaks in HMAC initial packet generation + Use key_state instead of multi for tls_send_payload parameter + Make sending plain text control message session aware + Only update frame calculation if we have a valid link sockets + Improve description of compat-mode + Simplify --compress parsing in options.c + Refuse connection if server pushes an option contradicting allow-compress + Add 'allow-compression stub-only' internally for DCO + Parse compression options and bail out when compression is disabled + Remove unused variable line + Add Apache2 linking with for new commits + Fix compile error on TARGET_ANDROID + Fix use-after-free with EVP_CIPHER_free + Remove key_type argument from generate_key_random + add basic CMake based build + Avoid unused function warning/error on FreeBSD (and potientially others) + Do not blindly assume python3 is also the interpreter that runs rst2html + Only add -Wno-stringop-truncation on supported compilers + fix warning with gcc 12.2.0 (compiler bug?) + Fix CR_RESPONSE mangaement message using wrong key_id + Print a more user-friendly error when tls-crypt-v2 client auth fails + Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7 + Mock openvpn_exece on win32 also for test_tls_crypt + Check if the -wrap argument is actually supported by the platform's ld + Revert commit 423ced962d + Implement using --peer-fingerprint without CA certificates + show extra info for OpenSSL errors + Remove ability to use configurations without TLS by default + Add warning for the --show-groups command that some groups are missing + Print peer temporary key details + Add warning if a p2p NCP client connects to a p2mp server + Remove openssl engine method for loading the key + Add undefined and abort on error to clang sanitize builds + Add --enable-werror to all platforms in Github Actions + Remove saving initial frame code + Double check that we do not use a freed buffer when freeing a session + Fix using to_link buffer after freed + Remove CMake custom compiler flags for RELEASE and DEBUG build + Do not check key_state buffers that are in S_UNDEF state + Remove unused function prototype crypto_adjust_frame_parameters + Introduce report_command_status helper function + Log SSL alerts more prominently + Remove unused/unneeded/add missing defines from configure/cmake + Document tls-exit option mainly as test option + Remove dead remains of extract_x509_field_test + Replace character_class_debug with proper unit test + Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway + Fix check_session_buf_not_used using wrong index + Add missing check for nl_socket_alloc failure + Add check for nice in cmake config + Minimal Solaris/OpenIndiana support to Cmake and clean up -Werror + Remove compat versionhelpers.h and remove cmake/configure check for it + Rename state_change to continue_tls_process + Move tls_get_cipher_name_pair and get_num_elements to ssl_utils.c + Fix building mbed TLS with CMake and allow specifying custom directories + Extend the error message when TLS 1.0 PRF fails + Fix unaligned access in macOS, FreeBSD, Solaris hwaddr + Check PRF availability on initialisation and add --force-tls-key-material-export + Make it more explicit and visible when pkg-config is not found + Clarify that the tls-crypt-v2-verify has a very limited env set + Move get_tmp_dir to win32-util.c and error out on failure + Implement the --tls-export-cert feature + Use mingw compile definition also to unit tests + Add test_ssl unit test and test export of PEM to file + Remove conditional text for Apache2 linking exception + Fix ssl unit tests on OpenSSL 1.0.2 + Ensure that all unit tests use unbuffered stdout and stderr + Allow unit tests to fall back to hard coded location + Add unit test for encrypting/decrypting data channel + Print SSL peer signature information in handshake debug details + Implement generating TLS 1.0 PRF using new OpenSSL 3.0 APIs + Turn dead list test code into unit test + Use snprintf instead of sprintf for get_ssl_library_version + Fix snprintf/swnprintf related compiler warnings + Add bracket in fingerprint message and do not warn about missing verification + Match ifdef for get_sigtype function with if ifdef of caller + Remove/combine redundant call of EVP_CipherInit before EVP_CipherInit_Ex + Add missing EVP_KDF_CTX_free in ssl_tls1_PRF + Replace macos11 with macos14 in github runners + Remove openvpn_snprintf and similar functions + Repeat the unknown command in errors from management interface + Only run coverity scan in OpenVPN/OpenVPN repository + Support OpenBSD with cmake + Workaround issue in LibreSSL crashing when enumerating digests/ciphers + Remove OpenSSL 1.0.2 support + Remove custom TLS 1.0 PRF implementation only used by LibreSSL/wolfSSL + Allow the TLS session to send out TLS alerts + Properly handle null bytes and invalid characters in control messages + Allow trailing \r and \n in control channel message + Add Ubuntu 24.04 runner to Github Actions + Implement support for AEAD tag at the end + Remove check for anonymous unions from configure and cmake config + Make read/write_tun_header static + Avoid SIGUSR1 to SIGHUP remapping when the configuration is read from stdin + Move to common backend_driver type in struct tuntap + Introduce DRIVER_AFUNIX backend for use with lwipovpn + Change dev null to be a driver type instead of a special mode of tun/tap + Use print_tun_backend_driver instead of custom code to print type + Automatically enable ifconfig-exec/route-exec behaviour for afunix tun/tap + Ensure that the AF_UNIX socket pair has at least 65k of buffer space + Fix check for CMake not detecting struct cmsg + Remove null check after checking for checking for did_open_tun + Remove a large number of unused structs and functions + Remove unused methods write_key/read_key + Refuse clients if username or password is longer than USER_PASS_LEN + Move should_trigger_renegotiation into its own function + Change --reneg-bytes and --reneg-packets to 64 bit counters + Use XOR instead of concatenation for calculation of IV from implicit IV + Trigger renegotiation of data key if getting close to the AEAD usage limit + Implement HKDF expand function based on RFC 8446 + Split init_key_ctx_bi into send/recv init + Move initialisation of implicit IVs to init_key_ctx_bi methods + Change internal id of packet id to uint64 + Add small unit test for buf_chomp + Add building/testing with msbuild and the clang compiler + Ensure that Python3 is available + Change API of init_key_ctx to use struct key_parameters + Allow DEFAULT in data-ciphers and report both expanded and user set option + Do not attempt to decrypt packets anymore after 2**36 failed decryptions + Add methods to read/write packet ids for epoch data + Implement methods to generate and manage OpenVPN Epoch keys + Rename aead-tag-at-end to aead-epoch + Improve peer fingerprint documentation + Remove comparing username to NULL in tls_lock_username + Print warnings/errors when numerical parameters cannot be parsed + Add unit tests for atoi parsing options helper + Improve error reporting from AF_UNIX tun/tap support + Fix typo in positive_atoi + Fix oversight of link socket code change in Android code path + Implement epoch key data format + Extend the unit test for data channel packets with aead limit tests + Add (fake) Android cmake building + Add android build to Github Actions + Reconnect when TCP is on use on network-change management command + Implement override-username + Fix incorrect condition for checking password related check + Directly use _countof in array initialisation + Improve documentation for override-username + Mention address if not unspecific on DNS failure + Do not leave half-initialised key wrap struct when dynamic tls-crypt fails + Allow tls-crypt-v2 to be setup only on initial packet of a session + Use SSL_get0_peer_signature_name instead of SSL_get_peer_signature_nid + Use USER_PASS_LEN instead of TLS_USERNAME_LEN for override-username + Also print key agreement when printing negotiated details + Fix mbed TLS key exporter functionality in 3.6.x and cmake + Make --dh none behaviour default if not specified + +Ben Boeckel (1): + console_systemd: remove the timeout when using 'systemd-ask-password' + +Christoph Schug (1): + Update documentation references in systemd unit files + +Corubba Smith (3): + Support IPv6 towards port-share proxy receiver + Document x509-username-fields oid usage + Remove x509-username-fields uppercasing + +David Sommerseth (4): + ssl_verify: Fix memleak if creating deferred auth control files fails + ntlm: Clarify details on NTLM phase 3 decoding + Remove --tls-export-cert + Remove superfluous x509_write_pem() + +Franco Fichtner (1): + Allow to set ifmode for existing DCO interfaces in FreeBSD + +Frank Lichtenheld (174): + options.c: fix format security error when compiling without optimization + options.c: update usage description of --cipher + Update copyright year to 2023 + xkey_pkcs11h_sign: fix dangling pointer + options: Always define options->management_flags + check_engine_keys: make pass with OpenSSL 3 + documentation: update 'unsupported options' section + Changes.rst: document removal of --keysize + Windows: fix unused function setenv_foreign_option + Windows: fix unused variables in delete_route_ipv6 + Windows: fix wrong printf format in x_check_status + Windows: fix unused variable in win32_get_arch + configure: enable DCO by default on FreeBSD/Linux + Windows: fix signedness errors with recv/send + configure: fix formatting of --disable-lz4 and --enable-comp-stub + tests/unit_tests: Fix 'make distcheck' with subdir-objects enabled + GHA: remove Ubuntu 18.04 builds + vcpkg: request "tools" feature of openssl for MSVC build + Do not include net/in_systm.h + version.sh: remove + doc: run rst2* with --strict to catch warnings + man page: Remove cruft from --topology documentation + tests: do not include t_client.sh in dist + vcpkg-ports/pkcs11-helper: Make compatible with mingw build + vcpkg-ports/pkcs11-helper: Convert CONTROL to vcpkg.json + vcpkg-ports/pkcs11-helper: reference upstream PRs in patches + dco_linux: properly close dco version file + DCO: fix memory leak in dco_get_peer_stats_multi for Linux + Fix two unused assignments + sample-plugins: Fix memleak in client-connect example plugin + tests: Allow to override openvpn binary used + test_buffer: add tests for buf_catrunc and its caller format_hex_ex + buffer: use memcpy in buf_catrunc + options: remove --key-method from usage message + msvc-generate: include version.m4.in in tarball + dist: add more missing files only used in the MSVC build + vcpkg-ports/pkcs11-helper: rename patches to make file names shorter + unit_tests: Add missing cert_data.h to source list for unit tests + dist: Include all documentation in distribution + CMake: Add complete MinGW and MSVC build + Remove all traces of the previous MSVC build system + CMake: Add /Brepro to MSVC link options + GHA: update to run-vcpkg@v11 + test_tls_crypt: Improve mock() usage to be more portable + CMake: Throw a clear error when config.h in top-level source directory + CMake: Support doc builds on Windows machines that do not have .py file association + Remove old Travis CI related files + README.cmake.md: Add new documentation for CMake buildsystem + GHA: refactor mingw UTs and add missing tls_crypt + GHA: Add macos-13 + options: Do not hide variables from parent scope + pkcs11_openssl: Disable unused code + route: Fix overriding return value of add_route3 + CMake: various small non-functional improvements + GHA: do not trigger builds in openvpn-build anymore + Remove --no-replay option + GHA: new workflow to submit scan to Coverity Scan service + doc: fix argument name in --route-delay documentation + Change type of frame.mss_fix to uint16_t + Remove last uses of inet_ntoa + mss/mtu: make all size calculations use size_t + dev-tools/gerrit-send-mail.py: tool to send Gerrit patchsets to Patchwork + gerrit-send-mail.py: Add patch version to subject + Add mbedtls3 GHA build + platform.c: Do not depend Windows build on HAVE_CHDIR + sample-keys: renew for the next 10 years + GHA: clean up libressl builds with newer libressl + configure.ac: Remove unused AC_TYPE_SIGNAL macro + documentation: remove reference to removed option --show-proxy-settings + unit_tests: remove includes for mock_msg.h + buffer: add documentation for string_mod and extend related UT + tests: disable automake serial_tests + documentation: improve documentation of --x509-track + configure: allow to disable NTLM + configure: enable silent rules by default + misc: make get_auth_challenge static + Remove support for NTLM v1 proxy authentication + GHA: increase verbosity for make check + NTLM: add length check to add_security_buffer + NTLM: increase size of phase 2 response we can handle + Fix various 'Uninitialized scalar variable' warnings from Coverity + proxy-options.rst: Add proper documentation for --http-proxy-user-pass + NTLM: when NTLMv1 is requested, try NTLMv2 instead + buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0' + --http-proxy-user-pass: allow to specify in either order with --http-proxy + test_user_pass: new UT for get_user_pass + test_user_pass: Add UTs for character filtering + gerrit-send-mail: Make output consistent across systems + README.cmake.md: Document minimum required CMake version for --preset + documentation: Update and fix documentation for --push-peer-info + documentation: Fixes for previous fixes to --push-peer-info + test_user_pass: add basic tests for static/dynamic challenges + Fix typo --data-cipher-fallback + samples: Remove tls-*.conf + check_compression_settings_valid: Do not test for LZ4 in LZO check + t_client.sh: Allow to skip tests + gerrit-send-mail: add missing Signed-off-by + Update Copyright statements to 2024 + GHA: general update March 2024 + samples: Update sample configurations + documentation: make section levels consistent + phase2_tcp_server: fix Coverity issue 'Dereference after null check' + script-options.rst: Update ifconfig_* variables + crypto_backend: fix type of enc parameter + tests: fork default automake test-driver + forked-test-driver: Show test output always + Change default of "topology" to "subnet" + Use topology default of "subnet" only for server mode + Fix 'binary or' vs 'boolean or' related to server_bridge_proxy_dhcp + configure: update old copy of pkg.m4 + LZO: do not use lzoutils.h macros + test_user_pass: Fix building with --enable-systemd + Remove "experimental" denotation for --fast-io + t_server_null.sh: Fix failure case + configure: Add -Wstrict-prototypes and -Wold-style-definition + configure: Try to detect LZO with pkg-config + configure: Switch to C11 by default + Fix missing spaces in various messages + console_systemd: rename query_user_exec to query_user_systemd + configure: Allow to detect git checkout if .git is not a directory + GHA: Configure Renovate + configure: Try to use pkg-config to detect mbedTLS + tun: use is_tun_p2p more consistently + Various fixes for -Wconversion errors + generate_auth_token: simplify code + GHA: Update dependency Mbed-TLS/mbedtls to v3.6.1 + GHA: Enable t_server_null tests + configure: Handle libnl-genl and libcap-ng consistent with other libs + configure: Review use of standard AC macros + socket: Change return types of link_socket_write* to ssize_t + GHA: Pin dependencies + GHA: Update macOS runners + GHA: Simplify macOS builds + Remove support for compression on send + Fix wrong doxygen comments + Various typo fixes + macOS: Assume that net/if_utun.h is always present + Fix some formatting related to if/else and macros + Fix memory leak in ntlm_support + forward: Fix potential unaligned access in drop_if_recursive_routing + GHA: General update December 2024 + Review doxygen warnings + Regenerate doxygen config file with doxygen -u + Fix 'uninitialized pointer read' in openvpn_decrypt_aead + ssl_openssl: Clean up unused functions and add missing "static" + Fix some trivial sign-compare compiler warnings + tls_crypt_v2_write_client_key_file: Fix missing-field-initializers compiler warning + openvpnserv: Fix some inconsistent usages of TEXT() + Fix doxygen warnings in crypto_epoch.h + GHA: Drop Ubuntu 20.04 and other maintenance + GHA: Publish Doxygen documentation to Github Pages + Add more 'intentional fallthrough' comments + Remove various unused function parameters + Remove unused function check_subnet_conflict + options: Cleanup and simplify options_postprocess_verify_ce + Apply text-removal.sh script to Windows codebase + openvpnserv: Clean up use of TEXT() from DNS patches + Post tchar.h removal cleanup + Fix compatibility with mbedTLS 2.28.10+ and 3.6.3+ + t_server_null_default.rc: Add some tests with --data-ciphers + GHA: Pin version of CMake for all builds + GHA: Dependency and Actions update April 2025 + GHA: Make sure renovate notifies us about AWS LC releases + Doxygen: Fix obsolete links to OpenSSL documentation + GHA: Use CMake 4.0 and apply required fixes + Doxygen: Clean up tls-crypt documentation + Doxygen: Remove useless Python information + Manually reformat some long trailing comments + CMake: Make sure to treat UNIT_TEST_SOURCEDIR as path + CMake: Sync list of compiler flags with configure.ac + CMake: Reorganize header and symbol tests + GHA: Dependency and Actions update May 2025 + Doxygen: Fix missing parameter warnings + Changes.rst: Collect, fix, and improve entries for 2.7 release + +George Pchelkin (1): + fix typo: dhcp-options to dhcp-option in vpn-network-options.rst + +Gert Doering (21): + Change version.m4 to 2.7_git + bandaid fix for TCP multipoint server crash with Linux-DCO + Undo FreeBSD 12.x workaround on IPv6 ifconfig for 12.4 and up + Reduce logspam about 'dco_update_keys: peer_id=-1' in p2p server mode + Fix OVPN_DEL_PEER_REASON_TRANSPORT_DISCONNECT breakage on FreeBSD+DCO + Repair special-casing of EEXIST for Linux/SITNL route install + Get rid of unused 'bool tuntap_buffer' arguments. + FreeBSD 12.x workaround for IPv6 ifconfig is needed on 12.4 as well + Make received OCC exit messages more visible in log. + OpenBSD: repair --show-gateway + get_default_gateway() HWADDR overhaul + make t_server_null 'server alive?' check more robust + t_client.sh: conditionally skip ifconfig+route check + send uname() release as IV_PLAT_VER= on non-windows versions + options: add IPv4 support to '--show-gateway <arg>' + get_default_gateway(): implement platform support for Linux/SITNL + get_default_gateway(): implement platform support for Linux/IPROUTE2 + add missing (void) to win32 function declarations + add more (void) to windows specific function prototypes and declarations + Make 'lport 0' no longer sufficient to do '--bind'. + Add information-gathering about DNS resolvers configured to t_client.sh(.in) + +Gianmarco De Gregori (17): + Persist-key: enable persist-key option by default + Minor fix to process_ip_header + Http-proxy: fix bug preventing proxy credentials caching + Ensures all params are ready before invoking dco_set_peer() + Route: remove incorrect routes on exit + Fix for msbuild/mingw GHA failures + multiproto: move generic event handling code in dedicated files + Fix PASS_BY_VALUE issue in options_postprocess_mutate_le() + mroute: adapt to new protocol handling and hashing improvements + mroute/management: repair mgmt client-kill for mroute with proto + Add support for simultaneous use of UDP and TCP sockets + Rename occurences of 'struct link_socket' from 'ls' to 'sock' + Fix FreeBSD-DCO and Multisocket interaction + manpage: fix HTML format for --local + Fix dco_win and multisocket interaction + dco_linux: Introduce new uAPIs + Explicit-exit-notify and multisocket interaction + +Heiko Hund (21): + dns option: allow up to eight addresses per server + work around false positive warning with mingw 12 + dns option: remove support for exclude-domains + cmake: create and link compile_commands.json file + cmake: symlink whole build dir not just .json file + Windows: enforce 'block-local' with WFP filters + add and send IV_PROTO_DNS_OPTION_V2 flag + dns: store IPv4 addresses in network byte order + dns: clone options via pointer instead of copy + service: add utf8to16 function that takes a size + dns: support multiple domains without DHCP + dns: do not use netsh to set name server addresses + win: calculate address string buffer size + win: implement --dns option support with NRPT + dns: apply settings via script on unixoid systems + fix typo in haikuos dns-updown script + dns: support running up/down command with privsep + dns: don't publish env vars to non-dns scripts + dns: fix potential NULL pointer dereference + win: match search domains when creating exclude rules + win: fix collecting DNS exclude data + +Heiko Wundram (1): + Implement Windows CA template match for Crypto-API selector + +Ilia Shipitsin (3): + src/openvpn/init.c: handle strdup failures + sample/sample-plugins/defer/multi-auth.c: handle strdup errors + tests/unit_tests/openvpn/test_auth_token.c: handle strdup errors + +Ilya Shipitsin (1): + src/openvpn/dco_freebsd.c: handle malloc failure + +Juliusz Sosinowicz (1): + Change include order for tests + +Klemens Nanni (1): + Fix tmp-dir documentation + +Kristof Provost (10): + Read DCO traffic stats from the kernel + dco: Update counters when a client disconnects + Read the peer deletion reason from the kernel + dco: cleanup FreeBSD dco_do_read() + options.c: enforce a minimal fragment size + configure: improve FreeBSD DCO check + dco: define OVPN_DEL_PEER_REASON_TRANSPORT_DISCONNECT on FreeBSD + dco: print FreeBSD version + DCO: support key rotation notifications + dco-freebsd: dynamically re-allocate buffer if it's too small + +Lev Stipakov (63): + Rename dco_get_peer_stats to dco_get_peer_stats_multi + management: add timer to output BYTECOUNT + Introduce dco_get_peer_stats API and Windows implementation + git-version.py: proper support for tags + msvc: upgrade to Visual Studio 2022 + tun: move print_windows_driver() out of tun.h + openvpnmsica: remove dco installer custom actions + openvpnmsica: remove unused declarations + openvpnmsica: fix adapters discovery logic for DCO + Allow certain DHCP options to be used without DHCP server + dco-win: use proper calling convention on x86 + Improve format specifier for socket handle in Windows + Disable DCO if proxy is set via management + Add logging for windows driver selection process + Avoid management log loop with verb >= 6 + Support --inactive option for DCO + Fix '--inactive <time> 0' behavior for DCO + Print DCO client stats on SIGUSR2 + Don't overwrite socket flags when using DCO on Windows + Support of DNS domain for DHCP-less drivers + dco-win: support for --dev-node + tapctl: generate driver-specific adapter names + openvpnmsica: link C runtime statically + tun.c: enclose DNS domain in single quotes in WMIC call + manage.c: document missing KID parameter + Set WINS servers via interactice service + CMake: fix broken daemonization and syslog functionality + Warn user if INFO control command is too long + CMake: fix HAVE_DAEMON detection on Linux + dco-win: get driver version + dco: warn if DATA_V1 packets are sent to userspace + config.h: fix incorrect defines for _wopen() + Make --dns options apply for tap-windows6 driver + Warn if pushed options require DHCP + tun.c: don't attempt to delete DNS and WINS servers if they're not set + win32: Enforce loading of plugins from a trusted directory + interactive.c: disable remote access to the service pipe + interactive.c: Fix potential stack overflow issue + Disable DCO if proxy is set via management + misc.c: remove unused code + interactive.c: Improve access control for gui<->service pipe + Use a more robust way to get dco-win version + dco: better naming for function parameters + repair DNS address option + dco-win: factor out getting dco version + dco-win: enable mode server on supported configuration + dco-win: simplify do_close_link_socket() + route.c: change the signature of get_default_gateway() + route.c: improve get_default_gateway() logic on Windows + mudp.c: keep offset value when resetting buffer + multi.c: add iroutes after dco peer is added + dco-win: disable dco in server mode if multiple --local options defined + dco-win: multipeer support + dco-win: simplify control packets prepend code + dco-win: kernel notifications + dco-win: support for iroutes + dco-win: Fix crash when cancelling pending operation + Remove UINT8_MAX definition + win: allow OpenVPN service account to use any command-line options + ssl_openssl.c: Prevent potential double-free + win: refactor get_windows_version() + win: create adapter on demand + win: remove Wintun support + +Marc Becker (5): + unify code path for adding PKCS#11 providers + use new pkcs11-helper interface to add providers + special handling for PKCS11 providers on win32 + vcpkg-ports/pkcs11-helper: support loader flags + vcpkg-ports/pkcs11-helper: bump to version 1.30 + +Marco Baffo (3): + tun: removed unnecessary route installations + IPv6 MADDR LOG: Wrap IPv6 addresses in square brackets and print port when the port is specified + get_default_gateway(): Prevent passing IPV4_INVALID_ADDR as a destination + +Martin Rys (1): + openvpn-[client|server].service: Remove syslog.target + +Matthias Andree (1): + make dist: Ship ovpn_dco_freebsd.h, too + +Max Fillinger (10): + Correct tls-crypt-v2 metadata length in man page + Fix message for too long tls-crypt-v2 metadata + Add support for mbedtls 3.X.Y + Update README.mbedtls + Disable TLS 1.3 support with mbed TLS + Enable key export with mbed TLS 3.x.y + Remove license warning from README.mbedtls + mbedtls: Remove support for old TLS versions + mbedtls: Warn if --tls-version-min is too low + Remove HAVE_EXPORT_KEYING_MATERIAL macro + +Michael Baentsch (1): + using OpenSSL3 API for EVP PKEY type name reporting + +Michael Nix (1): + fix typo in help text: --ignore-unknown-option + +Qingfang Deng (1): + dco: fix source IP selection when multihome + +Ralf Lici (3): + Fix check_addr_clash argument order + Handle missing DCO peer by restarting the session + Implement ovpn version detection + +Reynir Björnsson (2): + protocol_dump: tls-crypt support + Only schedule_exit() once + +Rémi Farault (1): + Add calls to nvlist_destroy to avoid leaks + +Samuli Seppänen (6): + Add t_server_null test suite + t_server_null: multiple improvements and fixes + t_server_null: persist test log files + t_server_null: forcibly kill misbehaving servers + t_server_null: use wait instead of marker files + Add lwip support to t_server_null + +Selva Nair (63): + Reduce default restart pause to 1 second + Do not include auth-token in pulled option digest + Persist DCO client data channel traffic stats on restart + Add remote-count and remote-entry query via management + Permit unlimited connection entries and remotes + Use a template for 'unsupported management commands' error + Allow skipping multple remotes via management interface + Properly unmap ring buffer file-map in interactive service + Use undo_lists for saving ring-buffer handles in interactive service + Cleanup: Close duplicated handles in interactive service + Preparing for better signal handling: some code refactoring + Refactor signal handling in openvpn_getaddrinfo + Use IPAPI for setting ipv6 routes when iservice not available + Fix signal handling on Windows + Assign and honour signal priority order + Distinguish route addition errors from route already exists + Propagate route error to initialization_completed() + Include CE_DISABLED status of remote in "remote-entry-get" response + Define and use macros for route addition status code + Warn when pkcs11-id or pkcs11-id-management options are ignored + Cleanup route error and debug logging on Windows + Fix one more 'existing route may get deleted' case + block-dns using iservice: fix a potential double free + Conditionally add subdir-objects option to automake + Build unit tests in mingw Windows build + cyryptapi.c: log the selected certificate's name + cryptoapi.c: remove pre OpenSSL-3.01 support + cryptoapi.c: simplify parsing of thumbprint hex string + Option --cryptoapicert: support issuer name as a selector + Add a unit test for functions in cryptoapi.c + Do not save pointer to 'struct passwd' returned by getpwnam etc. + Bugfix: Convert ECDSA signature form pkcs11-helper to DER encoded form + Import some sample certificates into Windows store for testing + Add tests for finding certificates in Windows cert store + Refactor SSL_CTX_use_CryptoAPI_certificate() + Add a test for signing with certificates in Windows store + Unit tests: add test for SSL_CTX_use_Cryptoapi_certificate() + Improve error message on short read from socks proxy + Make error in setting metric for IPv6 interface non-fatal + Bug-fix: segfault in dco_get_peer_stats() + Move digest_sign_verify out of test_cryptoapi.c + Unit tests: Test for PKCS#11 using a softhsm2 token + Enable pkcs11 an dtest_pkcs11 in github actions + Make cert_data.h and test_cryptoapi/pkcs11.c MSVC compliant + Format Windows error message in Unicode + Bugfix: dangling pointer passed to pkcs11-helper + Correctly handle Unicode names for exit event + Interactive service: do not force a target desktop for openvpn.exe + Improve signal handling using POSIX sigaction + signal_reset(): combine check and reset operations + Log OpenSSL errors on failure to set certificate + Document that auth-user-pass may be inlined + test_pkcs11.c: set file offset to 0 after ftruncate + proxy.c: Clear sensitive data after use + Protect cached username, password and token on client + Interpret --key and --cert option argument as URI + Add a test for loading certificate and key to ssl context + Add a test for loading certificate and key using file: URI + Initialize before use struct user_pass in ui_reader() + Static-challenge concatenation option + Add test for static-challenge concatenation option + Fix more of uninitialized struct user_pass local vars + Do not stop reading from file/uri when OPENSSL_STORE_load() returns error + +Sergey Korolev (1): + dco-linux: fix counter print format + +Shubham Mittal (2): + Add compatibility to build OpenVPN with AWS-LC. + Adding AWS-LC to the OpenVPN CI + +Shuji Furukawa (1): + Improve shuffling algorithm of connection list + +Steffan Karger (2): + Fix IPv6 route add/delete message log level + Improve data channel crypto error messages + +Timo Rothenpieler (1): + Don't clear capability bounding set on capng_change_id + +corubba (2): + Fix IPv6 in port-share journal + Fix port-share journal doc + +orbea (1): + configure: disable engines if OPENSSL_NO_ENGINE is defined + +rein.vanbaaren (1): + Fix MBEDTLS_DEPRECATED_REMOVED build errors + +wellweek (1): + remove repetitive words in documentation and comments + +yatta (1): + fix(ssl): init peer_id when init tls_multi + + diff --git a/Changes.rst b/Changes.rst index e297334..3ffa2cb 100644 --- a/Changes.rst +++ b/Changes.rst @@ -2,25 +2,58 @@ ========================== New features ------------ -TLS alerts - OpenVPN 2.7 will send out TLS alerts to peers informing them if the TLS - session shuts down or when the TLS implementation informs the peer about - an error in the TLS session (e.g. mismatching TLS versions). This improves - the user experience as the client shows an error instead of running into - a timeout when the server just stops responding completely. +Multi-socket support for servers + OpenVPN servers now can listen on multiple sockets at the same time. + Multiple ``--local`` statements in the configuration can be used to + configure this. This way the same server can e.g. listen for UDP + and TCP connections at the same time, or listen on multiple addresses + and/or ports. -Support for tun/tap via unix domain socket and lwipovpn support - To allow better testing and emulating a full client with a full - network stack OpenVPN now allows a program executed to provide - a tun/tap device instead of opening a device. +Client implementations for DNS options sent by server for Linux/BSD + Linux and BSD versions of OpenVPN now ship with a default ``dns-updown`` + script that implements proper handling of DNS configuration sent + by the server. The scripts should work on systems that use + ``systemd`` or ``resolveconf`` to manage the DNS setup, as well as + raw ``/etc/resolv.conf`` files. However, the exact features supported + will depend on the configuration method. On Linux this should usually + mean that split-DNS configurations are supported out-of-the-box now. - The co-developed lwipovpn program based on lwIP stack allows to - simulate full IP stack and an OpenVPN client using - ``--dev-node unix:/path/to/lwipovpn`` can emulate a full client that - can be pinged, can serve a website and more without requiring any - elevated permission. This can make testing OpenVPN much easier. + Note that this new script will not be used by default if a ``--up`` + script is already in use to reduce problems with + backwards compatibility. - For more details see [lwipovpn on Gihtub](https://github.com/OpenVPN/lwipovpn). + See documentation for ``--dns-updown`` and ``--dns`` for more details. + +New client implementation for DNS options sent by server for Windows + The Windows client now uses NRPT (Name Resolution Policy Table) to + handle DNS configurations. This adds support for split-DNS and DNSSEC + and improves the compatbility with local DNS resolvers. Requires the + interactive service. + +On Windows the ``block-local`` flag is now enforced with WFP filters. + The ``block-local`` flag to ``--redirect-gateway`` and + ``--redirect-private`` is now also enforced via the Windows Firewall, + making sure packets can't be sent to the local network. + This provides stronger protection against TunnelCrack-style attacks. + +Windows network adapters are now generated on demand + This means that on systems that run multiple OpenVPN connections at + the same time the users don't need to manually create enough network + adapters anymore (in addition to the ones created by the installer). + +Windows automatic service now runs as an unpriviledged user + All tasks that need privileges are now delegated to the interactive + service. + +Support for new version of Linux DCO module + OpenVPN DCO module is moving upstream and being merged into the + main Linux kernel. For this process some API changes were required. + OpenVPN 2.7 will only support the new API. The new module is called + ``ovpn``. Out-of-tree builds for older kernels are available. Please + see the release announcements for futher information. + +Support for server mode in win-dco driver + On Windows the win-dco driver can now be used in server setups. Enforcement of AES-GCM usage limit OpenVPN will now enforce the usage limits on AES-GCM with the same @@ -30,11 +63,6 @@ https://datatracker.ietf.org/doc/draft-irtf-cfrg-aead-limits/ -Default ciphers in ``--data-ciphers`` - Ciphers in ``--data-ciphers`` can contain the string DEFAULT that is - replaced by the default ciphers used by OpenVPN, making it easier to - add an allowed cipher without having to spell out the default ciphers. - Epoch data keys and packet format This introduces the epoch data format for AEAD data channel ciphers in TLS mode ciphers. This new data format has a number of @@ -49,15 +77,46 @@ - IV constructed with XOR instead of concatenation to not have (parts) of the real IV on the wire +Default ciphers in ``--data-ciphers`` + Ciphers in ``--data-ciphers`` can contain the string DEFAULT that is + replaced by the default ciphers used by OpenVPN, making it easier to + add an allowed cipher without having to spell out the default ciphers. + +TLS alerts + OpenVPN 2.7 will send out TLS alerts to peers informing them if the TLS + session shuts down or when the TLS implementation informs the peer about + an error in the TLS session (e.g. mismatching TLS versions). This improves + the user experience as the client shows an error instead of running into + a timeout when the server just stops responding completely. + +Support for tun/tap via unix domain socket and lwipovpn support + To allow better testing and emulating a full client with a full + network stack OpenVPN now allows a program executed to provide + a tun/tap device instead of opening a device. + + The co-developed lwipovpn program based on lwIP stack allows to + simulate full IP stack. An OpenVPN client using + ``--dev-node unix:/path/to/lwipovpn`` can emulate a full client that + can be pinged, can serve a website and more without requiring any + elevated permission. This can make testing OpenVPN much easier. + + For more details see [lwipovpn on Gihtub](https://github.com/OpenVPN/lwipovpn). + Allow overriding username with ``--override-username`` This is intended to allow using auth-gen-token in scenarios where the clients use certificates and multi-factor authentication. This will also generate a 'push "auth-token-user newusername"' directives in push replies. +``--port-share`` now properly supports IPv6 + Issues with logging of IPv6 addresses were fixed. The feature now allows + IPv6 connections towards the proxy receiver. + +Support for Haiku OS + Deprecated features ------------------- -``secret`` support has been removed by default. +``secret`` support has been removed (by default). static key mode (non-TLS) is no longer considered "good and secure enough" for today's requirements. Use TLS mode instead. If deploying a PKI CA is considered "too complicated", using ``--peer-fingerprint`` makes @@ -67,6 +126,14 @@ ``--allow-deprecated-insecure-static-crypto`` but will be removed in OpenVPN 2.8. +Support for wintun Windows driver has been removed. + OpenVPN 2.6 added support for the new dco-win driver, so it supported + three different device drivers: dco-win, wintun, and tap-windows6. + OpenVPN 2.7 now drops the support for wintun driver. By default + all modern configs should be supported by dco-win driver. In all + other cases OpenVPN will fall back automatically to tap-windows6 + driver. + NTLMv1 authentication support for HTTP proxies has been removed. This is considered an insecure method of authentication that uses obsolete crypto algorithms. @@ -78,28 +145,34 @@ ``persist-key`` option has been enabled by default. All the keys will be kept in memory across restart. -Default for ``--topology`` changed to ``subnet`` for ``--mode server`` - Previous releases always used ``net30`` as default. This only affects - configs with ``--mode server`` or ``--server`` (the latter implies the - former), and ``--dev tun``, and only if IPv4 is enabled. - Note that this changes the semantics of ``--ifconfig``, so if you have - manual settings for that in your config but not set ``--topology`` - your config might fail to parse with the new version. Just adding - ``--topology net30`` to the config should fix the problem. - By default ``--topology`` is pushed from server to client. - -OpenSSL 1.0.2 support +OpenSSL 1.0.2 support has been removed. Support for building with OpenSSL 1.0.2 has been removed. The minimum supported OpenSSL version is now 1.1.0. -Compression on send +Support for mbedTLS older than 2.18.0 has been removed. + We now require all SSL libraries to have support for exporting + keying material. The only previously supported library versions + this affects are older mbedTLS releases. + +Compression on send has been removed. OpenVPN 2.7 will never compress data before sending. Decompression of received data is still supported. ``--allow-compression yes`` is now an alias for ``--allow-compression asym``. + User-visible Changes -------------------- +- Default for ``--topology`` changed to ``subnet`` for ``--mode server``. + Previous releases always used ``net30`` as default. This only affects + configs with ``--mode server`` or ``--server`` (the latter implies the + former), and ``--dev tun``, and only if IPv4 is enabled. + Note that this changes the semantics of ``--ifconfig``, so if you have + manual settings for that in your config but not set ``--topology`` + your config might fail to parse with the new version. Just adding + ``--topology net30`` to the config should fix the problem. + By default ``--topology`` is pushed from server to client. + - ``--x509-username-field`` will no longer automatically convert fieldnames to uppercase. This is deprecated since OpenVPN 2.4, and has now been removed. @@ -108,6 +181,38 @@ And finite field Diffie Hellman is in the proces of being deprecated (see draft-ietf-tls-deprecate-obsolete-kex) +- ``--lport 0`` does not imply ``--bind`` anymore. + +- ``--redirect--gateway`` now works correctly if the VPN remote is not + reachable by the default gateway. + +- ``--show-gateway`` now supports querying the gateway for IPv4 addresses. + +- ``--static-challenge`` option now has a third parameter ``format`` that + can change how password and challenge response should be combined. + +- ``--key`` and ``--cert`` now accept URIs implemented in OpenSSL 3 as well as + optional OpenSSL 3 providers loaded using ``--providers`` option. + +- ``--cryptoapicert`` now supports issuer name as well as Windows CA template + name or OID as selector string. + +- TLS handshake debugging information contains much more details now when + using recent versions of OpenSSL. + +- The ``IV_PLAT_VER`` variable sent by Windows clients now contains the + full Windows build version to make it possible to determine the + Windows 10 or Windows 11 version used. + +- The ``--windows-driver`` option to select between various windows + drivers will no longer do anything - it's kept so existing configs + will not become invalid, but it is ignored with a warning. The default + is now ``ovpn-dco`` if all options used are compatible with DCO, with + a fallback to ``tap-windows6``. To force TAP (for example because a + server pushes DCO incompatible options), use the ``--disable-dco`` + option. + + Overview of changes in 2.6 ========================== diff --git a/tests/unit_tests/openvpn/Makefile.am b/tests/unit_tests/openvpn/Makefile.am index 471389b..fc47287 100644 --- a/tests/unit_tests/openvpn/Makefile.am +++ b/tests/unit_tests/openvpn/Makefile.am @@ -43,7 +43,7 @@ argv_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ argv_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -argv_testdriver_SOURCES = test_argv.c mock_msg.c mock_msg.h \ +argv_testdriver_SOURCES = test_argv.c mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/platform.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -52,7 +52,7 @@ buffer_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ buffer_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -buffer_testdriver_SOURCES = test_buffer.c mock_msg.c mock_msg.h \ +buffer_testdriver_SOURCES = test_buffer.c mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/win32-util.c \ $(top_srcdir)/src/openvpn/platform.c @@ -61,7 +61,7 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ crypto_testdriver_LDFLAGS = @TEST_LDFLAGS@ -crypto_testdriver_SOURCES = test_crypto.c mock_msg.c mock_msg.h \ +crypto_testdriver_SOURCES = test_crypto.c mock_msg.c mock_msg.h test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_mbedtls.c \ @@ -78,7 +78,7 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ ssl_testdriver_LDFLAGS = @TEST_LDFLAGS@ $(OPTIONAL_CRYPTO_LIBS) -ssl_testdriver_SOURCES = test_ssl.c mock_msg.c mock_msg.h \ +ssl_testdriver_SOURCES = test_ssl.c mock_msg.c mock_msg.h test_common.h \ mock_management.c mock_ssl_dependencies.c mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ @@ -114,7 +114,7 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ packet_id_testdriver_LDFLAGS = @TEST_LDFLAGS@ -packet_id_testdriver_SOURCES = test_packet_id.c mock_msg.c mock_msg.h \ +packet_id_testdriver_SOURCES = test_packet_id.c mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/otime.c \ @@ -128,7 +128,7 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ pkt_testdriver_LDFLAGS = @TEST_LDFLAGS@ -pkt_testdriver_SOURCES = test_pkt.c mock_msg.c mock_msg.h mock_win32_execve.c \ +pkt_testdriver_SOURCES = test_pkt.c mock_msg.c mock_msg.h mock_win32_execve.c test_common.h \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -156,7 +156,7 @@ -Wl,--wrap=buffer_write_file \ -Wl,--wrap=parse_line \ -Wl,--wrap=rand_bytes -tls_crypt_testdriver_SOURCES = test_tls_crypt.c mock_msg.c mock_msg.h \ +tls_crypt_testdriver_SOURCES = test_tls_crypt.c mock_msg.c mock_msg.h test_common.h \ mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ diff --git a/version.m4 b/version.m4 index 091cc5d..4c3b7c8 100644 --- a/version.m4 +++ b/version.m4 @@ -3,7 +3,7 @@ define([PRODUCT_TARNAME], [openvpn]) define([PRODUCT_VERSION_MAJOR], [2]) define([PRODUCT_VERSION_MINOR], [7]) -define([PRODUCT_VERSION_PATCH], [_git]) +define([PRODUCT_VERSION_PATCH], [_alpha1]) m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_MAJOR]) m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_MINOR], [[.]]) m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_PATCH], [[]]) -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1032?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I80a14b77fcc2fabf51af9f2d5ea0c36362cccb91 Gerrit-Change-Number: 1032 Gerrit-PatchSet: 7 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: cron2 <ge...@gr...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-CC: selvanair <sel...@gm...> Gerrit-CC: stipa <lst...@gm...> Gerrit-MessageType: merged |
| From: cron2 (C. Review) <ge...@op...> - 2025-05-28 19:10:03 |
cron2 has uploaded a new patch set (#7) to the change originally created by flichtenheld. ( http://gerrit.openvpn.net/c/openvpn/+/1032?usp=email ) Change subject: OpenVPN Release 2.7_alpha1 ...................................................................... OpenVPN Release 2.7_alpha1 version.m4, ChangeLog, Changes.rst (ChangeLog in "master" will revert to its normal state of "empty" after release/2.7 is forked off into its own branch) Additionally, add test_common.h to tests/unit_tests/openvpn/Makefile.am (..._SOURCES) so it's packed into the "make dist" tarball Change-Id: I80a14b77fcc2fabf51af9f2d5ea0c36362cccb91 Signed-off-by: Frank Lichtenheld <fr...@li...> --- M ChangeLog M Changes.rst M tests/unit_tests/openvpn/Makefile.am M version.m4 4 files changed, 903 insertions(+), 46 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/32/1032/7 diff --git a/ChangeLog b/ChangeLog index c26dd2e..c6e626b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,759 @@ OpenVPN ChangeLog -Copyright (C) 2002-2024 OpenVPN Inc <sa...@op...> +Copyright (C) 2002-2025 OpenVPN Inc <sa...@op...> -This file is not maintained in this branch of the OpenVPN git repository. +2025.05.28 -- Version 2.7_alpha1 -Release branches (release/2.5, release/2.4, etc) have individual ChangeLog -files with all changes relevant for these releases. +5andr0 (1): + Implement server_poll_timeout for socks + +Alexander von Gluck (4): + Haiku: Introduce basic platform / tun support + Haiku: Add calls to manage routing table + Haiku: change del to delete in route command. del is undocumented + Haiku: Fix short interface path length + +Antonio Quartulli (32): + disable DCO if --secret is specified + dco: properly re-initialize dco_del_peer_reason + dco: bail out when no peer-specific message is delivered + dco: improve comment about hidden debug message + dco: print proper message in case of transport disconnection + dco_linux: update license for ovpn_dco_linux.h + Update issue templates + Avoid warning about missing braces when initialising key struct + dco: don't use NetLink to exchange control packets + dco: print version to log if available + dco-linux: remove M_ERRNO flag when printing netlink error message + multi: don't call DCO APIs if DCO is disabled + dco-freebsd: use m->instances[] instead of m->hash + dco-linux: implement dco_get_peer_stats{, multi} API + configure.ac: fix typ0 in LIBCAPNG_CFALGS + dco: fix crash when --multihome is used with --proto tcp + dco: mark peer as deleted from kernel after receiving CMD_DEL_PEER notification + event/multi: add event_arg object to make event handling more generic + pass link_socket object to i/o functions + io_work: convert shift argument to uintptr_t + io_work: pass event_arg object to event handler in case of socket event + sitnl: replace NLMSG_TAIL macro with noinline function + override ai_family if 'local' numeric address was specified + Adapt socket handling to support listening on multiple sockets + allow user to specify 'local' multiple times in config files + dco_linux: extend netlink error cb with extra info + man: extend --persist-tun section + dco: pass remoteaddr only for UDP peers + socket: use remote proto when creating client sockets + dco_linux: fix peer stats parsing with new ovpn kernel module + socket: don't transfer bind family to socket in case of ANY address + dco_linux: avoid bogus text when netlink message is not parsed + +Aquila Macedo (1): + doc: Correct typos in multiple documentation files + +Arne Schwabe (190): + Fix connection cookie not including address and fix endianness in test + Fix unit test of test_pkt on little endian Linux + Disable DCO when TLS mode is not used + Ignore connection attempts while server is shutting down + Improve debug logging of DCO swap key message and Linux dco_new_peer + Trigger a USR1 if dco_update_keys fails + Set DCO_NOT_INSTALLED also for keys not in the get_key_scan range + Ensure that argument to parse_line has always space for final sentinel + Improve documentation on user/password requirement and unicodize function + Eliminate or comment empty blocks and switch fallthrough + Remove unused gc_arena + Fix corner case that might lead to leaked file descriptor + Deprecate NTLMv1 proxy auth method. + Use include "buffer.h" instead of include <buffer.h> + Ensure that dco keepalive and mssfix options are also set in pure p2p mode + Make management password check constant time + Rename TM_UNTRUSTED to TM_INITIAL, always start session in TM_INITIAL rather than TM_ACTIVE or TM_INITIAL + Move dco_installed back to link_socket from link_socket.info.actual + Do not set nl socket buffer size + Also drop incoming dco packet content when dropping the packet + Improve logging when seeing a message for an unkown peer + Ignore OVPN_DEL_PEER_REASON_USERSPACE to avoid race conditions + Replace custom min macro and use more C99 style in man_remote_entry_get + Replace realloc with new gc_realloc function + Add connect-freq-initial option to limit initial connection responses + Log peer-id if loglevel is D_DCO_DEBUG and dco is enabled + Deprecate OCC checking + Workaround: make ovpn-dco more reliable + Fix unaligned access in auth-token + Update LibreSSL to 3.7.0 in Github actions + Add printing USAN stack trace on github actions + Fix LibreSSL not building in Github Actions + Add missing stdint.h includes in unit tests files + Combine extra_tun/frame parameter of frame_calculate_payload_overhead + Update the last sections in the man page to a be a bit less outdated + Add building unit tests with mingw to github actions + Revise the cipher negotiation info about OpenVPN3 in the man page + Exit if a proper message instead of segfault on Android without management + Use proper print format/casting when converting msg_channel handle + Reduce initialisation spam from verb <= 3 and print summary instead + Dynamic tls-crypt for secure soft_reset/session renegotiation + Set netlink socket to be non-blocking + Ensure n = 2 is set in key2 struct in tls_crypt_v2_unwrap_client_key + Fix memory leaks in open_tun_dco() + Fix memory leaks in HMAC initial packet generation + Use key_state instead of multi for tls_send_payload parameter + Make sending plain text control message session aware + Only update frame calculation if we have a valid link sockets + Improve description of compat-mode + Simplify --compress parsing in options.c + Refuse connection if server pushes an option contradicting allow-compress + Add 'allow-compression stub-only' internally for DCO + Parse compression options and bail out when compression is disabled + Remove unused variable line + Add Apache2 linking with for new commits + Fix compile error on TARGET_ANDROID + Fix use-after-free with EVP_CIPHER_free + Remove key_type argument from generate_key_random + add basic CMake based build + Avoid unused function warning/error on FreeBSD (and potientially others) + Do not blindly assume python3 is also the interpreter that runs rst2html + Only add -Wno-stringop-truncation on supported compilers + fix warning with gcc 12.2.0 (compiler bug?) + Fix CR_RESPONSE mangaement message using wrong key_id + Print a more user-friendly error when tls-crypt-v2 client auth fails + Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7 + Mock openvpn_exece on win32 also for test_tls_crypt + Check if the -wrap argument is actually supported by the platform's ld + Revert commit 423ced962d + Implement using --peer-fingerprint without CA certificates + show extra info for OpenSSL errors + Remove ability to use configurations without TLS by default + Add warning for the --show-groups command that some groups are missing + Print peer temporary key details + Add warning if a p2p NCP client connects to a p2mp server + Remove openssl engine method for loading the key + Add undefined and abort on error to clang sanitize builds + Add --enable-werror to all platforms in Github Actions + Remove saving initial frame code + Double check that we do not use a freed buffer when freeing a session + Fix using to_link buffer after freed + Remove CMake custom compiler flags for RELEASE and DEBUG build + Do not check key_state buffers that are in S_UNDEF state + Remove unused function prototype crypto_adjust_frame_parameters + Introduce report_command_status helper function + Log SSL alerts more prominently + Remove unused/unneeded/add missing defines from configure/cmake + Document tls-exit option mainly as test option + Remove dead remains of extract_x509_field_test + Replace character_class_debug with proper unit test + Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway + Fix check_session_buf_not_used using wrong index + Add missing check for nl_socket_alloc failure + Add check for nice in cmake config + Minimal Solaris/OpenIndiana support to Cmake and clean up -Werror + Remove compat versionhelpers.h and remove cmake/configure check for it + Rename state_change to continue_tls_process + Move tls_get_cipher_name_pair and get_num_elements to ssl_utils.c + Fix building mbed TLS with CMake and allow specifying custom directories + Extend the error message when TLS 1.0 PRF fails + Fix unaligned access in macOS, FreeBSD, Solaris hwaddr + Check PRF availability on initialisation and add --force-tls-key-material-export + Make it more explicit and visible when pkg-config is not found + Clarify that the tls-crypt-v2-verify has a very limited env set + Move get_tmp_dir to win32-util.c and error out on failure + Implement the --tls-export-cert feature + Use mingw compile definition also to unit tests + Add test_ssl unit test and test export of PEM to file + Remove conditional text for Apache2 linking exception + Fix ssl unit tests on OpenSSL 1.0.2 + Ensure that all unit tests use unbuffered stdout and stderr + Allow unit tests to fall back to hard coded location + Add unit test for encrypting/decrypting data channel + Print SSL peer signature information in handshake debug details + Implement generating TLS 1.0 PRF using new OpenSSL 3.0 APIs + Turn dead list test code into unit test + Use snprintf instead of sprintf for get_ssl_library_version + Fix snprintf/swnprintf related compiler warnings + Add bracket in fingerprint message and do not warn about missing verification + Match ifdef for get_sigtype function with if ifdef of caller + Remove/combine redundant call of EVP_CipherInit before EVP_CipherInit_Ex + Add missing EVP_KDF_CTX_free in ssl_tls1_PRF + Replace macos11 with macos14 in github runners + Remove openvpn_snprintf and similar functions + Repeat the unknown command in errors from management interface + Only run coverity scan in OpenVPN/OpenVPN repository + Support OpenBSD with cmake + Workaround issue in LibreSSL crashing when enumerating digests/ciphers + Remove OpenSSL 1.0.2 support + Remove custom TLS 1.0 PRF implementation only used by LibreSSL/wolfSSL + Allow the TLS session to send out TLS alerts + Properly handle null bytes and invalid characters in control messages + Allow trailing \r and \n in control channel message + Add Ubuntu 24.04 runner to Github Actions + Implement support for AEAD tag at the end + Remove check for anonymous unions from configure and cmake config + Make read/write_tun_header static + Avoid SIGUSR1 to SIGHUP remapping when the configuration is read from stdin + Move to common backend_driver type in struct tuntap + Introduce DRIVER_AFUNIX backend for use with lwipovpn + Change dev null to be a driver type instead of a special mode of tun/tap + Use print_tun_backend_driver instead of custom code to print type + Automatically enable ifconfig-exec/route-exec behaviour for afunix tun/tap + Ensure that the AF_UNIX socket pair has at least 65k of buffer space + Fix check for CMake not detecting struct cmsg + Remove null check after checking for checking for did_open_tun + Remove a large number of unused structs and functions + Remove unused methods write_key/read_key + Refuse clients if username or password is longer than USER_PASS_LEN + Move should_trigger_renegotiation into its own function + Change --reneg-bytes and --reneg-packets to 64 bit counters + Use XOR instead of concatenation for calculation of IV from implicit IV + Trigger renegotiation of data key if getting close to the AEAD usage limit + Implement HKDF expand function based on RFC 8446 + Split init_key_ctx_bi into send/recv init + Move initialisation of implicit IVs to init_key_ctx_bi methods + Change internal id of packet id to uint64 + Add small unit test for buf_chomp + Add building/testing with msbuild and the clang compiler + Ensure that Python3 is available + Change API of init_key_ctx to use struct key_parameters + Allow DEFAULT in data-ciphers and report both expanded and user set option + Do not attempt to decrypt packets anymore after 2**36 failed decryptions + Add methods to read/write packet ids for epoch data + Implement methods to generate and manage OpenVPN Epoch keys + Rename aead-tag-at-end to aead-epoch + Improve peer fingerprint documentation + Remove comparing username to NULL in tls_lock_username + Print warnings/errors when numerical parameters cannot be parsed + Add unit tests for atoi parsing options helper + Improve error reporting from AF_UNIX tun/tap support + Fix typo in positive_atoi + Fix oversight of link socket code change in Android code path + Implement epoch key data format + Extend the unit test for data channel packets with aead limit tests + Add (fake) Android cmake building + Add android build to Github Actions + Reconnect when TCP is on use on network-change management command + Implement override-username + Fix incorrect condition for checking password related check + Directly use _countof in array initialisation + Improve documentation for override-username + Mention address if not unspecific on DNS failure + Do not leave half-initialised key wrap struct when dynamic tls-crypt fails + Allow tls-crypt-v2 to be setup only on initial packet of a session + Use SSL_get0_peer_signature_name instead of SSL_get_peer_signature_nid + Use USER_PASS_LEN instead of TLS_USERNAME_LEN for override-username + Also print key agreement when printing negotiated details + Fix mbed TLS key exporter functionality in 3.6.x and cmake + Make --dh none behaviour default if not specified + +Ben Boeckel (1): + console_systemd: remove the timeout when using 'systemd-ask-password' + +Christoph Schug (1): + Update documentation references in systemd unit files + +Corubba Smith (3): + Support IPv6 towards port-share proxy receiver + Document x509-username-fields oid usage + Remove x509-username-fields uppercasing + +David Sommerseth (4): + ssl_verify: Fix memleak if creating deferred auth control files fails + ntlm: Clarify details on NTLM phase 3 decoding + Remove --tls-export-cert + Remove superfluous x509_write_pem() + +Franco Fichtner (1): + Allow to set ifmode for existing DCO interfaces in FreeBSD + +Frank Lichtenheld (174): + options.c: fix format security error when compiling without optimization + options.c: update usage description of --cipher + Update copyright year to 2023 + xkey_pkcs11h_sign: fix dangling pointer + options: Always define options->management_flags + check_engine_keys: make pass with OpenSSL 3 + documentation: update 'unsupported options' section + Changes.rst: document removal of --keysize + Windows: fix unused function setenv_foreign_option + Windows: fix unused variables in delete_route_ipv6 + Windows: fix wrong printf format in x_check_status + Windows: fix unused variable in win32_get_arch + configure: enable DCO by default on FreeBSD/Linux + Windows: fix signedness errors with recv/send + configure: fix formatting of --disable-lz4 and --enable-comp-stub + tests/unit_tests: Fix 'make distcheck' with subdir-objects enabled + GHA: remove Ubuntu 18.04 builds + vcpkg: request "tools" feature of openssl for MSVC build + Do not include net/in_systm.h + version.sh: remove + doc: run rst2* with --strict to catch warnings + man page: Remove cruft from --topology documentation + tests: do not include t_client.sh in dist + vcpkg-ports/pkcs11-helper: Make compatible with mingw build + vcpkg-ports/pkcs11-helper: Convert CONTROL to vcpkg.json + vcpkg-ports/pkcs11-helper: reference upstream PRs in patches + dco_linux: properly close dco version file + DCO: fix memory leak in dco_get_peer_stats_multi for Linux + Fix two unused assignments + sample-plugins: Fix memleak in client-connect example plugin + tests: Allow to override openvpn binary used + test_buffer: add tests for buf_catrunc and its caller format_hex_ex + buffer: use memcpy in buf_catrunc + options: remove --key-method from usage message + msvc-generate: include version.m4.in in tarball + dist: add more missing files only used in the MSVC build + vcpkg-ports/pkcs11-helper: rename patches to make file names shorter + unit_tests: Add missing cert_data.h to source list for unit tests + dist: Include all documentation in distribution + CMake: Add complete MinGW and MSVC build + Remove all traces of the previous MSVC build system + CMake: Add /Brepro to MSVC link options + GHA: update to run-vcpkg@v11 + test_tls_crypt: Improve mock() usage to be more portable + CMake: Throw a clear error when config.h in top-level source directory + CMake: Support doc builds on Windows machines that do not have .py file association + Remove old Travis CI related files + README.cmake.md: Add new documentation for CMake buildsystem + GHA: refactor mingw UTs and add missing tls_crypt + GHA: Add macos-13 + options: Do not hide variables from parent scope + pkcs11_openssl: Disable unused code + route: Fix overriding return value of add_route3 + CMake: various small non-functional improvements + GHA: do not trigger builds in openvpn-build anymore + Remove --no-replay option + GHA: new workflow to submit scan to Coverity Scan service + doc: fix argument name in --route-delay documentation + Change type of frame.mss_fix to uint16_t + Remove last uses of inet_ntoa + mss/mtu: make all size calculations use size_t + dev-tools/gerrit-send-mail.py: tool to send Gerrit patchsets to Patchwork + gerrit-send-mail.py: Add patch version to subject + Add mbedtls3 GHA build + platform.c: Do not depend Windows build on HAVE_CHDIR + sample-keys: renew for the next 10 years + GHA: clean up libressl builds with newer libressl + configure.ac: Remove unused AC_TYPE_SIGNAL macro + documentation: remove reference to removed option --show-proxy-settings + unit_tests: remove includes for mock_msg.h + buffer: add documentation for string_mod and extend related UT + tests: disable automake serial_tests + documentation: improve documentation of --x509-track + configure: allow to disable NTLM + configure: enable silent rules by default + misc: make get_auth_challenge static + Remove support for NTLM v1 proxy authentication + GHA: increase verbosity for make check + NTLM: add length check to add_security_buffer + NTLM: increase size of phase 2 response we can handle + Fix various 'Uninitialized scalar variable' warnings from Coverity + proxy-options.rst: Add proper documentation for --http-proxy-user-pass + NTLM: when NTLMv1 is requested, try NTLMv2 instead + buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0' + --http-proxy-user-pass: allow to specify in either order with --http-proxy + test_user_pass: new UT for get_user_pass + test_user_pass: Add UTs for character filtering + gerrit-send-mail: Make output consistent across systems + README.cmake.md: Document minimum required CMake version for --preset + documentation: Update and fix documentation for --push-peer-info + documentation: Fixes for previous fixes to --push-peer-info + test_user_pass: add basic tests for static/dynamic challenges + Fix typo --data-cipher-fallback + samples: Remove tls-*.conf + check_compression_settings_valid: Do not test for LZ4 in LZO check + t_client.sh: Allow to skip tests + gerrit-send-mail: add missing Signed-off-by + Update Copyright statements to 2024 + GHA: general update March 2024 + samples: Update sample configurations + documentation: make section levels consistent + phase2_tcp_server: fix Coverity issue 'Dereference after null check' + script-options.rst: Update ifconfig_* variables + crypto_backend: fix type of enc parameter + tests: fork default automake test-driver + forked-test-driver: Show test output always + Change default of "topology" to "subnet" + Use topology default of "subnet" only for server mode + Fix 'binary or' vs 'boolean or' related to server_bridge_proxy_dhcp + configure: update old copy of pkg.m4 + LZO: do not use lzoutils.h macros + test_user_pass: Fix building with --enable-systemd + Remove "experimental" denotation for --fast-io + t_server_null.sh: Fix failure case + configure: Add -Wstrict-prototypes and -Wold-style-definition + configure: Try to detect LZO with pkg-config + configure: Switch to C11 by default + Fix missing spaces in various messages + console_systemd: rename query_user_exec to query_user_systemd + configure: Allow to detect git checkout if .git is not a directory + GHA: Configure Renovate + configure: Try to use pkg-config to detect mbedTLS + tun: use is_tun_p2p more consistently + Various fixes for -Wconversion errors + generate_auth_token: simplify code + GHA: Update dependency Mbed-TLS/mbedtls to v3.6.1 + GHA: Enable t_server_null tests + configure: Handle libnl-genl and libcap-ng consistent with other libs + configure: Review use of standard AC macros + socket: Change return types of link_socket_write* to ssize_t + GHA: Pin dependencies + GHA: Update macOS runners + GHA: Simplify macOS builds + Remove support for compression on send + Fix wrong doxygen comments + Various typo fixes + macOS: Assume that net/if_utun.h is always present + Fix some formatting related to if/else and macros + Fix memory leak in ntlm_support + forward: Fix potential unaligned access in drop_if_recursive_routing + GHA: General update December 2024 + Review doxygen warnings + Regenerate doxygen config file with doxygen -u + Fix 'uninitialized pointer read' in openvpn_decrypt_aead + ssl_openssl: Clean up unused functions and add missing "static" + Fix some trivial sign-compare compiler warnings + tls_crypt_v2_write_client_key_file: Fix missing-field-initializers compiler warning + openvpnserv: Fix some inconsistent usages of TEXT() + Fix doxygen warnings in crypto_epoch.h + GHA: Drop Ubuntu 20.04 and other maintenance + GHA: Publish Doxygen documentation to Github Pages + Add more 'intentional fallthrough' comments + Remove various unused function parameters + Remove unused function check_subnet_conflict + options: Cleanup and simplify options_postprocess_verify_ce + Apply text-removal.sh script to Windows codebase + openvpnserv: Clean up use of TEXT() from DNS patches + Post tchar.h removal cleanup + Fix compatibility with mbedTLS 2.28.10+ and 3.6.3+ + t_server_null_default.rc: Add some tests with --data-ciphers + GHA: Pin version of CMake for all builds + GHA: Dependency and Actions update April 2025 + GHA: Make sure renovate notifies us about AWS LC releases + Doxygen: Fix obsolete links to OpenSSL documentation + GHA: Use CMake 4.0 and apply required fixes + Doxygen: Clean up tls-crypt documentation + Doxygen: Remove useless Python information + Manually reformat some long trailing comments + CMake: Make sure to treat UNIT_TEST_SOURCEDIR as path + CMake: Sync list of compiler flags with configure.ac + CMake: Reorganize header and symbol tests + GHA: Dependency and Actions update May 2025 + Doxygen: Fix missing parameter warnings + Changes.rst: Collect, fix, and improve entries for 2.7 release + +George Pchelkin (1): + fix typo: dhcp-options to dhcp-option in vpn-network-options.rst + +Gert Doering (21): + Change version.m4 to 2.7_git + bandaid fix for TCP multipoint server crash with Linux-DCO + Undo FreeBSD 12.x workaround on IPv6 ifconfig for 12.4 and up + Reduce logspam about 'dco_update_keys: peer_id=-1' in p2p server mode + Fix OVPN_DEL_PEER_REASON_TRANSPORT_DISCONNECT breakage on FreeBSD+DCO + Repair special-casing of EEXIST for Linux/SITNL route install + Get rid of unused 'bool tuntap_buffer' arguments. + FreeBSD 12.x workaround for IPv6 ifconfig is needed on 12.4 as well + Make received OCC exit messages more visible in log. + OpenBSD: repair --show-gateway + get_default_gateway() HWADDR overhaul + make t_server_null 'server alive?' check more robust + t_client.sh: conditionally skip ifconfig+route check + send uname() release as IV_PLAT_VER= on non-windows versions + options: add IPv4 support to '--show-gateway <arg>' + get_default_gateway(): implement platform support for Linux/SITNL + get_default_gateway(): implement platform support for Linux/IPROUTE2 + add missing (void) to win32 function declarations + add more (void) to windows specific function prototypes and declarations + Make 'lport 0' no longer sufficient to do '--bind'. + Add information-gathering about DNS resolvers configured to t_client.sh(.in) + +Gianmarco De Gregori (17): + Persist-key: enable persist-key option by default + Minor fix to process_ip_header + Http-proxy: fix bug preventing proxy credentials caching + Ensures all params are ready before invoking dco_set_peer() + Route: remove incorrect routes on exit + Fix for msbuild/mingw GHA failures + multiproto: move generic event handling code in dedicated files + Fix PASS_BY_VALUE issue in options_postprocess_mutate_le() + mroute: adapt to new protocol handling and hashing improvements + mroute/management: repair mgmt client-kill for mroute with proto + Add support for simultaneous use of UDP and TCP sockets + Rename occurences of 'struct link_socket' from 'ls' to 'sock' + Fix FreeBSD-DCO and Multisocket interaction + manpage: fix HTML format for --local + Fix dco_win and multisocket interaction + dco_linux: Introduce new uAPIs + Explicit-exit-notify and multisocket interaction + +Heiko Hund (21): + dns option: allow up to eight addresses per server + work around false positive warning with mingw 12 + dns option: remove support for exclude-domains + cmake: create and link compile_commands.json file + cmake: symlink whole build dir not just .json file + Windows: enforce 'block-local' with WFP filters + add and send IV_PROTO_DNS_OPTION_V2 flag + dns: store IPv4 addresses in network byte order + dns: clone options via pointer instead of copy + service: add utf8to16 function that takes a size + dns: support multiple domains without DHCP + dns: do not use netsh to set name server addresses + win: calculate address string buffer size + win: implement --dns option support with NRPT + dns: apply settings via script on unixoid systems + fix typo in haikuos dns-updown script + dns: support running up/down command with privsep + dns: don't publish env vars to non-dns scripts + dns: fix potential NULL pointer dereference + win: match search domains when creating exclude rules + win: fix collecting DNS exclude data + +Heiko Wundram (1): + Implement Windows CA template match for Crypto-API selector + +Ilia Shipitsin (3): + src/openvpn/init.c: handle strdup failures + sample/sample-plugins/defer/multi-auth.c: handle strdup errors + tests/unit_tests/openvpn/test_auth_token.c: handle strdup errors + +Ilya Shipitsin (1): + src/openvpn/dco_freebsd.c: handle malloc failure + +Juliusz Sosinowicz (1): + Change include order for tests + +Klemens Nanni (1): + Fix tmp-dir documentation + +Kristof Provost (10): + Read DCO traffic stats from the kernel + dco: Update counters when a client disconnects + Read the peer deletion reason from the kernel + dco: cleanup FreeBSD dco_do_read() + options.c: enforce a minimal fragment size + configure: improve FreeBSD DCO check + dco: define OVPN_DEL_PEER_REASON_TRANSPORT_DISCONNECT on FreeBSD + dco: print FreeBSD version + DCO: support key rotation notifications + dco-freebsd: dynamically re-allocate buffer if it's too small + +Lev Stipakov (63): + Rename dco_get_peer_stats to dco_get_peer_stats_multi + management: add timer to output BYTECOUNT + Introduce dco_get_peer_stats API and Windows implementation + git-version.py: proper support for tags + msvc: upgrade to Visual Studio 2022 + tun: move print_windows_driver() out of tun.h + openvpnmsica: remove dco installer custom actions + openvpnmsica: remove unused declarations + openvpnmsica: fix adapters discovery logic for DCO + Allow certain DHCP options to be used without DHCP server + dco-win: use proper calling convention on x86 + Improve format specifier for socket handle in Windows + Disable DCO if proxy is set via management + Add logging for windows driver selection process + Avoid management log loop with verb >= 6 + Support --inactive option for DCO + Fix '--inactive <time> 0' behavior for DCO + Print DCO client stats on SIGUSR2 + Don't overwrite socket flags when using DCO on Windows + Support of DNS domain for DHCP-less drivers + dco-win: support for --dev-node + tapctl: generate driver-specific adapter names + openvpnmsica: link C runtime statically + tun.c: enclose DNS domain in single quotes in WMIC call + manage.c: document missing KID parameter + Set WINS servers via interactice service + CMake: fix broken daemonization and syslog functionality + Warn user if INFO control command is too long + CMake: fix HAVE_DAEMON detection on Linux + dco-win: get driver version + dco: warn if DATA_V1 packets are sent to userspace + config.h: fix incorrect defines for _wopen() + Make --dns options apply for tap-windows6 driver + Warn if pushed options require DHCP + tun.c: don't attempt to delete DNS and WINS servers if they're not set + win32: Enforce loading of plugins from a trusted directory + interactive.c: disable remote access to the service pipe + interactive.c: Fix potential stack overflow issue + Disable DCO if proxy is set via management + misc.c: remove unused code + interactive.c: Improve access control for gui<->service pipe + Use a more robust way to get dco-win version + dco: better naming for function parameters + repair DNS address option + dco-win: factor out getting dco version + dco-win: enable mode server on supported configuration + dco-win: simplify do_close_link_socket() + route.c: change the signature of get_default_gateway() + route.c: improve get_default_gateway() logic on Windows + mudp.c: keep offset value when resetting buffer + multi.c: add iroutes after dco peer is added + dco-win: disable dco in server mode if multiple --local options defined + dco-win: multipeer support + dco-win: simplify control packets prepend code + dco-win: kernel notifications + dco-win: support for iroutes + dco-win: Fix crash when cancelling pending operation + Remove UINT8_MAX definition + win: allow OpenVPN service account to use any command-line options + ssl_openssl.c: Prevent potential double-free + win: refactor get_windows_version() + win: create adapter on demand + win: remove Wintun support + +Marc Becker (5): + unify code path for adding PKCS#11 providers + use new pkcs11-helper interface to add providers + special handling for PKCS11 providers on win32 + vcpkg-ports/pkcs11-helper: support loader flags + vcpkg-ports/pkcs11-helper: bump to version 1.30 + +Marco Baffo (3): + tun: removed unnecessary route installations + IPv6 MADDR LOG: Wrap IPv6 addresses in square brackets and print port when the port is specified + get_default_gateway(): Prevent passing IPV4_INVALID_ADDR as a destination + +Martin Rys (1): + openvpn-[client|server].service: Remove syslog.target + +Matthias Andree (1): + make dist: Ship ovpn_dco_freebsd.h, too + +Max Fillinger (10): + Correct tls-crypt-v2 metadata length in man page + Fix message for too long tls-crypt-v2 metadata + Add support for mbedtls 3.X.Y + Update README.mbedtls + Disable TLS 1.3 support with mbed TLS + Enable key export with mbed TLS 3.x.y + Remove license warning from README.mbedtls + mbedtls: Remove support for old TLS versions + mbedtls: Warn if --tls-version-min is too low + Remove HAVE_EXPORT_KEYING_MATERIAL macro + +Michael Baentsch (1): + using OpenSSL3 API for EVP PKEY type name reporting + +Michael Nix (1): + fix typo in help text: --ignore-unknown-option + +Qingfang Deng (1): + dco: fix source IP selection when multihome + +Ralf Lici (3): + Fix check_addr_clash argument order + Handle missing DCO peer by restarting the session + Implement ovpn version detection + +Reynir Björnsson (2): + protocol_dump: tls-crypt support + Only schedule_exit() once + +Rémi Farault (1): + Add calls to nvlist_destroy to avoid leaks + +Samuli Seppänen (6): + Add t_server_null test suite + t_server_null: multiple improvements and fixes + t_server_null: persist test log files + t_server_null: forcibly kill misbehaving servers + t_server_null: use wait instead of marker files + Add lwip support to t_server_null + +Selva Nair (63): + Reduce default restart pause to 1 second + Do not include auth-token in pulled option digest + Persist DCO client data channel traffic stats on restart + Add remote-count and remote-entry query via management + Permit unlimited connection entries and remotes + Use a template for 'unsupported management commands' error + Allow skipping multple remotes via management interface + Properly unmap ring buffer file-map in interactive service + Use undo_lists for saving ring-buffer handles in interactive service + Cleanup: Close duplicated handles in interactive service + Preparing for better signal handling: some code refactoring + Refactor signal handling in openvpn_getaddrinfo + Use IPAPI for setting ipv6 routes when iservice not available + Fix signal handling on Windows + Assign and honour signal priority order + Distinguish route addition errors from route already exists + Propagate route error to initialization_completed() + Include CE_DISABLED status of remote in "remote-entry-get" response + Define and use macros for route addition status code + Warn when pkcs11-id or pkcs11-id-management options are ignored + Cleanup route error and debug logging on Windows + Fix one more 'existing route may get deleted' case + block-dns using iservice: fix a potential double free + Conditionally add subdir-objects option to automake + Build unit tests in mingw Windows build + cyryptapi.c: log the selected certificate's name + cryptoapi.c: remove pre OpenSSL-3.01 support + cryptoapi.c: simplify parsing of thumbprint hex string + Option --cryptoapicert: support issuer name as a selector + Add a unit test for functions in cryptoapi.c + Do not save pointer to 'struct passwd' returned by getpwnam etc. + Bugfix: Convert ECDSA signature form pkcs11-helper to DER encoded form + Import some sample certificates into Windows store for testing + Add tests for finding certificates in Windows cert store + Refactor SSL_CTX_use_CryptoAPI_certificate() + Add a test for signing with certificates in Windows store + Unit tests: add test for SSL_CTX_use_Cryptoapi_certificate() + Improve error message on short read from socks proxy + Make error in setting metric for IPv6 interface non-fatal + Bug-fix: segfault in dco_get_peer_stats() + Move digest_sign_verify out of test_cryptoapi.c + Unit tests: Test for PKCS#11 using a softhsm2 token + Enable pkcs11 an dtest_pkcs11 in github actions + Make cert_data.h and test_cryptoapi/pkcs11.c MSVC compliant + Format Windows error message in Unicode + Bugfix: dangling pointer passed to pkcs11-helper + Correctly handle Unicode names for exit event + Interactive service: do not force a target desktop for openvpn.exe + Improve signal handling using POSIX sigaction + signal_reset(): combine check and reset operations + Log OpenSSL errors on failure to set certificate + Document that auth-user-pass may be inlined + test_pkcs11.c: set file offset to 0 after ftruncate + proxy.c: Clear sensitive data after use + Protect cached username, password and token on client + Interpret --key and --cert option argument as URI + Add a test for loading certificate and key to ssl context + Add a test for loading certificate and key using file: URI + Initialize before use struct user_pass in ui_reader() + Static-challenge concatenation option + Add test for static-challenge concatenation option + Fix more of uninitialized struct user_pass local vars + Do not stop reading from file/uri when OPENSSL_STORE_load() returns error + +Sergey Korolev (1): + dco-linux: fix counter print format + +Shubham Mittal (2): + Add compatibility to build OpenVPN with AWS-LC. + Adding AWS-LC to the OpenVPN CI + +Shuji Furukawa (1): + Improve shuffling algorithm of connection list + +Steffan Karger (2): + Fix IPv6 route add/delete message log level + Improve data channel crypto error messages + +Timo Rothenpieler (1): + Don't clear capability bounding set on capng_change_id + +corubba (2): + Fix IPv6 in port-share journal + Fix port-share journal doc + +orbea (1): + configure: disable engines if OPENSSL_NO_ENGINE is defined + +rein.vanbaaren (1): + Fix MBEDTLS_DEPRECATED_REMOVED build errors + +wellweek (1): + remove repetitive words in documentation and comments + +yatta (1): + fix(ssl): init peer_id when init tls_multi + + diff --git a/Changes.rst b/Changes.rst index e297334..3ffa2cb 100644 --- a/Changes.rst +++ b/Changes.rst @@ -2,25 +2,58 @@ ========================== New features ------------ -TLS alerts - OpenVPN 2.7 will send out TLS alerts to peers informing them if the TLS - session shuts down or when the TLS implementation informs the peer about - an error in the TLS session (e.g. mismatching TLS versions). This improves - the user experience as the client shows an error instead of running into - a timeout when the server just stops responding completely. +Multi-socket support for servers + OpenVPN servers now can listen on multiple sockets at the same time. + Multiple ``--local`` statements in the configuration can be used to + configure this. This way the same server can e.g. listen for UDP + and TCP connections at the same time, or listen on multiple addresses + and/or ports. -Support for tun/tap via unix domain socket and lwipovpn support - To allow better testing and emulating a full client with a full - network stack OpenVPN now allows a program executed to provide - a tun/tap device instead of opening a device. +Client implementations for DNS options sent by server for Linux/BSD + Linux and BSD versions of OpenVPN now ship with a default ``dns-updown`` + script that implements proper handling of DNS configuration sent + by the server. The scripts should work on systems that use + ``systemd`` or ``resolveconf`` to manage the DNS setup, as well as + raw ``/etc/resolv.conf`` files. However, the exact features supported + will depend on the configuration method. On Linux this should usually + mean that split-DNS configurations are supported out-of-the-box now. - The co-developed lwipovpn program based on lwIP stack allows to - simulate full IP stack and an OpenVPN client using - ``--dev-node unix:/path/to/lwipovpn`` can emulate a full client that - can be pinged, can serve a website and more without requiring any - elevated permission. This can make testing OpenVPN much easier. + Note that this new script will not be used by default if a ``--up`` + script is already in use to reduce problems with + backwards compatibility. - For more details see [lwipovpn on Gihtub](https://github.com/OpenVPN/lwipovpn). + See documentation for ``--dns-updown`` and ``--dns`` for more details. + +New client implementation for DNS options sent by server for Windows + The Windows client now uses NRPT (Name Resolution Policy Table) to + handle DNS configurations. This adds support for split-DNS and DNSSEC + and improves the compatbility with local DNS resolvers. Requires the + interactive service. + +On Windows the ``block-local`` flag is now enforced with WFP filters. + The ``block-local`` flag to ``--redirect-gateway`` and + ``--redirect-private`` is now also enforced via the Windows Firewall, + making sure packets can't be sent to the local network. + This provides stronger protection against TunnelCrack-style attacks. + +Windows network adapters are now generated on demand + This means that on systems that run multiple OpenVPN connections at + the same time the users don't need to manually create enough network + adapters anymore (in addition to the ones created by the installer). + +Windows automatic service now runs as an unpriviledged user + All tasks that need privileges are now delegated to the interactive + service. + +Support for new version of Linux DCO module + OpenVPN DCO module is moving upstream and being merged into the + main Linux kernel. For this process some API changes were required. + OpenVPN 2.7 will only support the new API. The new module is called + ``ovpn``. Out-of-tree builds for older kernels are available. Please + see the release announcements for futher information. + +Support for server mode in win-dco driver + On Windows the win-dco driver can now be used in server setups. Enforcement of AES-GCM usage limit OpenVPN will now enforce the usage limits on AES-GCM with the same @@ -30,11 +63,6 @@ https://datatracker.ietf.org/doc/draft-irtf-cfrg-aead-limits/ -Default ciphers in ``--data-ciphers`` - Ciphers in ``--data-ciphers`` can contain the string DEFAULT that is - replaced by the default ciphers used by OpenVPN, making it easier to - add an allowed cipher without having to spell out the default ciphers. - Epoch data keys and packet format This introduces the epoch data format for AEAD data channel ciphers in TLS mode ciphers. This new data format has a number of @@ -49,15 +77,46 @@ - IV constructed with XOR instead of concatenation to not have (parts) of the real IV on the wire +Default ciphers in ``--data-ciphers`` + Ciphers in ``--data-ciphers`` can contain the string DEFAULT that is + replaced by the default ciphers used by OpenVPN, making it easier to + add an allowed cipher without having to spell out the default ciphers. + +TLS alerts + OpenVPN 2.7 will send out TLS alerts to peers informing them if the TLS + session shuts down or when the TLS implementation informs the peer about + an error in the TLS session (e.g. mismatching TLS versions). This improves + the user experience as the client shows an error instead of running into + a timeout when the server just stops responding completely. + +Support for tun/tap via unix domain socket and lwipovpn support + To allow better testing and emulating a full client with a full + network stack OpenVPN now allows a program executed to provide + a tun/tap device instead of opening a device. + + The co-developed lwipovpn program based on lwIP stack allows to + simulate full IP stack. An OpenVPN client using + ``--dev-node unix:/path/to/lwipovpn`` can emulate a full client that + can be pinged, can serve a website and more without requiring any + elevated permission. This can make testing OpenVPN much easier. + + For more details see [lwipovpn on Gihtub](https://github.com/OpenVPN/lwipovpn). + Allow overriding username with ``--override-username`` This is intended to allow using auth-gen-token in scenarios where the clients use certificates and multi-factor authentication. This will also generate a 'push "auth-token-user newusername"' directives in push replies. +``--port-share`` now properly supports IPv6 + Issues with logging of IPv6 addresses were fixed. The feature now allows + IPv6 connections towards the proxy receiver. + +Support for Haiku OS + Deprecated features ------------------- -``secret`` support has been removed by default. +``secret`` support has been removed (by default). static key mode (non-TLS) is no longer considered "good and secure enough" for today's requirements. Use TLS mode instead. If deploying a PKI CA is considered "too complicated", using ``--peer-fingerprint`` makes @@ -67,6 +126,14 @@ ``--allow-deprecated-insecure-static-crypto`` but will be removed in OpenVPN 2.8. +Support for wintun Windows driver has been removed. + OpenVPN 2.6 added support for the new dco-win driver, so it supported + three different device drivers: dco-win, wintun, and tap-windows6. + OpenVPN 2.7 now drops the support for wintun driver. By default + all modern configs should be supported by dco-win driver. In all + other cases OpenVPN will fall back automatically to tap-windows6 + driver. + NTLMv1 authentication support for HTTP proxies has been removed. This is considered an insecure method of authentication that uses obsolete crypto algorithms. @@ -78,28 +145,34 @@ ``persist-key`` option has been enabled by default. All the keys will be kept in memory across restart. -Default for ``--topology`` changed to ``subnet`` for ``--mode server`` - Previous releases always used ``net30`` as default. This only affects - configs with ``--mode server`` or ``--server`` (the latter implies the - former), and ``--dev tun``, and only if IPv4 is enabled. - Note that this changes the semantics of ``--ifconfig``, so if you have - manual settings for that in your config but not set ``--topology`` - your config might fail to parse with the new version. Just adding - ``--topology net30`` to the config should fix the problem. - By default ``--topology`` is pushed from server to client. - -OpenSSL 1.0.2 support +OpenSSL 1.0.2 support has been removed. Support for building with OpenSSL 1.0.2 has been removed. The minimum supported OpenSSL version is now 1.1.0. -Compression on send +Support for mbedTLS older than 2.18.0 has been removed. + We now require all SSL libraries to have support for exporting + keying material. The only previously supported library versions + this affects are older mbedTLS releases. + +Compression on send has been removed. OpenVPN 2.7 will never compress data before sending. Decompression of received data is still supported. ``--allow-compression yes`` is now an alias for ``--allow-compression asym``. + User-visible Changes -------------------- +- Default for ``--topology`` changed to ``subnet`` for ``--mode server``. + Previous releases always used ``net30`` as default. This only affects + configs with ``--mode server`` or ``--server`` (the latter implies the + former), and ``--dev tun``, and only if IPv4 is enabled. + Note that this changes the semantics of ``--ifconfig``, so if you have + manual settings for that in your config but not set ``--topology`` + your config might fail to parse with the new version. Just adding + ``--topology net30`` to the config should fix the problem. + By default ``--topology`` is pushed from server to client. + - ``--x509-username-field`` will no longer automatically convert fieldnames to uppercase. This is deprecated since OpenVPN 2.4, and has now been removed. @@ -108,6 +181,38 @@ And finite field Diffie Hellman is in the proces of being deprecated (see draft-ietf-tls-deprecate-obsolete-kex) +- ``--lport 0`` does not imply ``--bind`` anymore. + +- ``--redirect--gateway`` now works correctly if the VPN remote is not + reachable by the default gateway. + +- ``--show-gateway`` now supports querying the gateway for IPv4 addresses. + +- ``--static-challenge`` option now has a third parameter ``format`` that + can change how password and challenge response should be combined. + +- ``--key`` and ``--cert`` now accept URIs implemented in OpenSSL 3 as well as + optional OpenSSL 3 providers loaded using ``--providers`` option. + +- ``--cryptoapicert`` now supports issuer name as well as Windows CA template + name or OID as selector string. + +- TLS handshake debugging information contains much more details now when + using recent versions of OpenSSL. + +- The ``IV_PLAT_VER`` variable sent by Windows clients now contains the + full Windows build version to make it possible to determine the + Windows 10 or Windows 11 version used. + +- The ``--windows-driver`` option to select between various windows + drivers will no longer do anything - it's kept so existing configs + will not become invalid, but it is ignored with a warning. The default + is now ``ovpn-dco`` if all options used are compatible with DCO, with + a fallback to ``tap-windows6``. To force TAP (for example because a + server pushes DCO incompatible options), use the ``--disable-dco`` + option. + + Overview of changes in 2.6 ========================== diff --git a/tests/unit_tests/openvpn/Makefile.am b/tests/unit_tests/openvpn/Makefile.am index 471389b..fc47287 100644 --- a/tests/unit_tests/openvpn/Makefile.am +++ b/tests/unit_tests/openvpn/Makefile.am @@ -43,7 +43,7 @@ argv_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ argv_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -argv_testdriver_SOURCES = test_argv.c mock_msg.c mock_msg.h \ +argv_testdriver_SOURCES = test_argv.c mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/platform.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -52,7 +52,7 @@ buffer_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ buffer_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -buffer_testdriver_SOURCES = test_buffer.c mock_msg.c mock_msg.h \ +buffer_testdriver_SOURCES = test_buffer.c mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/win32-util.c \ $(top_srcdir)/src/openvpn/platform.c @@ -61,7 +61,7 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ crypto_testdriver_LDFLAGS = @TEST_LDFLAGS@ -crypto_testdriver_SOURCES = test_crypto.c mock_msg.c mock_msg.h \ +crypto_testdriver_SOURCES = test_crypto.c mock_msg.c mock_msg.h test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_mbedtls.c \ @@ -78,7 +78,7 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ ssl_testdriver_LDFLAGS = @TEST_LDFLAGS@ $(OPTIONAL_CRYPTO_LIBS) -ssl_testdriver_SOURCES = test_ssl.c mock_msg.c mock_msg.h \ +ssl_testdriver_SOURCES = test_ssl.c mock_msg.c mock_msg.h test_common.h \ mock_management.c mock_ssl_dependencies.c mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ @@ -114,7 +114,7 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ packet_id_testdriver_LDFLAGS = @TEST_LDFLAGS@ -packet_id_testdriver_SOURCES = test_packet_id.c mock_msg.c mock_msg.h \ +packet_id_testdriver_SOURCES = test_packet_id.c mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/otime.c \ @@ -128,7 +128,7 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ pkt_testdriver_LDFLAGS = @TEST_LDFLAGS@ -pkt_testdriver_SOURCES = test_pkt.c mock_msg.c mock_msg.h mock_win32_execve.c \ +pkt_testdriver_SOURCES = test_pkt.c mock_msg.c mock_msg.h mock_win32_execve.c test_common.h \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -156,7 +156,7 @@ -Wl,--wrap=buffer_write_file \ -Wl,--wrap=parse_line \ -Wl,--wrap=rand_bytes -tls_crypt_testdriver_SOURCES = test_tls_crypt.c mock_msg.c mock_msg.h \ +tls_crypt_testdriver_SOURCES = test_tls_crypt.c mock_msg.c mock_msg.h test_common.h \ mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ diff --git a/version.m4 b/version.m4 index 091cc5d..4c3b7c8 100644 --- a/version.m4 +++ b/version.m4 @@ -3,7 +3,7 @@ define([PRODUCT_TARNAME], [openvpn]) define([PRODUCT_VERSION_MAJOR], [2]) define([PRODUCT_VERSION_MINOR], [7]) -define([PRODUCT_VERSION_PATCH], [_git]) +define([PRODUCT_VERSION_PATCH], [_alpha1]) m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_MAJOR]) m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_MINOR], [[.]]) m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_PATCH], [[]]) -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1032?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I80a14b77fcc2fabf51af9f2d5ea0c36362cccb91 Gerrit-Change-Number: 1032 Gerrit-PatchSet: 7 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: cron2 <ge...@gr...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-CC: selvanair <sel...@gm...> Gerrit-CC: stipa <lst...@gm...> Gerrit-MessageType: newpatchset |
| From: plaisthos (C. Review) <ge...@op...> - 2025-05-28 16:29:41 |
Attention is currently required from: flichtenheld, plaisthos. Hello cron2, flichtenheld, I'd like you to reexamine a change. Please visit http://gerrit.openvpn.net/c/openvpn/+/1033?usp=email to look at the new patch set (#3). The change is no longer submittable: checks~ChecksSubmitRule is unsatisfied now. Change subject: Add missing header in unit tests Makefile.am ...................................................................... Add missing header in unit tests Makefile.am make distcheck fails since we are not listing all headers that are used by the unit tests. Change-Id: I674af04e1a6449544b7def0725337c3b353ea276 --- M tests/unit_tests/openvpn/Makefile.am 1 file changed, 24 insertions(+), 12 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/33/1033/3 diff --git a/tests/unit_tests/openvpn/Makefile.am b/tests/unit_tests/openvpn/Makefile.am index 471389b..c6c1699 100644 --- a/tests/unit_tests/openvpn/Makefile.am +++ b/tests/unit_tests/openvpn/Makefile.am @@ -43,7 +43,8 @@ argv_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ argv_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -argv_testdriver_SOURCES = test_argv.c mock_msg.c mock_msg.h \ +argv_testdriver_SOURCES = test_argv.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/platform.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -52,7 +53,8 @@ buffer_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ buffer_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -buffer_testdriver_SOURCES = test_buffer.c mock_msg.c mock_msg.h \ +buffer_testdriver_SOURCES = test_buffer.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/win32-util.c \ $(top_srcdir)/src/openvpn/platform.c @@ -61,7 +63,8 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ crypto_testdriver_LDFLAGS = @TEST_LDFLAGS@ -crypto_testdriver_SOURCES = test_crypto.c mock_msg.c mock_msg.h \ +crypto_testdriver_SOURCES = test_crypto.c \ + mock_msg.c mock_msg.h test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_mbedtls.c \ @@ -78,8 +81,10 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ ssl_testdriver_LDFLAGS = @TEST_LDFLAGS@ $(OPTIONAL_CRYPTO_LIBS) -ssl_testdriver_SOURCES = test_ssl.c mock_msg.c mock_msg.h \ - mock_management.c mock_ssl_dependencies.c mock_win32_execve.c \ +ssl_testdriver_SOURCES = test_ssl.c \ + mock_msg.c mock_msg.h test_common.h \ + mock_management.c \ + mock_ssl_dependencies.c mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -114,7 +119,8 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ packet_id_testdriver_LDFLAGS = @TEST_LDFLAGS@ -packet_id_testdriver_SOURCES = test_packet_id.c mock_msg.c mock_msg.h \ +packet_id_testdriver_SOURCES = test_packet_id.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/otime.c \ @@ -156,7 +162,8 @@ -Wl,--wrap=buffer_write_file \ -Wl,--wrap=parse_line \ -Wl,--wrap=rand_bytes -tls_crypt_testdriver_SOURCES = test_tls_crypt.c mock_msg.c mock_msg.h \ +tls_crypt_testdriver_SOURCES = test_tls_crypt.c \ + mock_msg.c mock_msg.h test_common.h \ mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ @@ -229,7 +236,8 @@ @TEST_CFLAGS@ $(OPTIONAL_CRYPTO_CFLAGS) pkcs11_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -pkcs11_testdriver_SOURCES = test_pkcs11.c mock_msg.c \ +pkcs11_testdriver_SOURCES = test_pkcs11.c \ + mock_msg.c test_common.h \ pkey_test_utils.c cert_data.h mock_get_random.c \ $(top_srcdir)/src/openvpn/xkey_helper.c \ $(top_srcdir)/src/openvpn/xkey_provider.c \ @@ -251,7 +259,8 @@ auth_token_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -auth_token_testdriver_SOURCES = test_auth_token.c mock_msg.c \ +auth_token_testdriver_SOURCES = test_auth_token.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_epoch.c \ @@ -269,7 +278,8 @@ @TEST_CFLAGS@ user_pass_testdriver_LDFLAGS = @TEST_LDFLAGS@ -user_pass_testdriver_SOURCES = test_user_pass.c mock_msg.c \ +user_pass_testdriver_SOURCES = test_user_pass.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/console.c \ $(top_srcdir)/src/openvpn/env_set.c \ @@ -287,7 +297,8 @@ ncp_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -ncp_testdriver_SOURCES = test_ncp.c mock_msg.c \ +ncp_testdriver_SOURCES = test_ncp.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_epoch.c \ @@ -306,7 +317,8 @@ misc_testdriver_LDFLAGS = @TEST_LDFLAGS@ -misc_testdriver_SOURCES = test_misc.c mock_msg.c \ +misc_testdriver_SOURCES = test_misc.c \ + mock_msg.c test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/options_util.c \ -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1033?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I674af04e1a6449544b7def0725337c3b353ea276 Gerrit-Change-Number: 1033 Gerrit-PatchSet: 3 Gerrit-Owner: plaisthos <arn...@rf...> Gerrit-Reviewer: cron2 <ge...@gr...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-MessageType: newpatchset |
| From: Gert D. <ge...@gr...> - 2025-05-28 15:04:24 |
From: Arne Schwabe <ar...@rf...> make distcheck fails since we are not listing all headers that are used by the unit tests. Change-Id: I674af04e1a6449544b7def0725337c3b353ea276 Signed-off-by: Arne Schwabe <arn...@rf...> Acked-by: Gert Doering <ge...@gr...> --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1033 This mail reflects revision 3 of this Change. Signed-off-by line for the author was added as per our policy. Acked-by according to Gerrit (reflected above): Gert Doering <ge...@gr...> diff --git a/tests/unit_tests/openvpn/Makefile.am b/tests/unit_tests/openvpn/Makefile.am index 471389b..c6c1699 100644 --- a/tests/unit_tests/openvpn/Makefile.am +++ b/tests/unit_tests/openvpn/Makefile.am @@ -43,7 +43,8 @@ argv_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ argv_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -argv_testdriver_SOURCES = test_argv.c mock_msg.c mock_msg.h \ +argv_testdriver_SOURCES = test_argv.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/platform.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -52,7 +53,8 @@ buffer_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ buffer_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -buffer_testdriver_SOURCES = test_buffer.c mock_msg.c mock_msg.h \ +buffer_testdriver_SOURCES = test_buffer.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/win32-util.c \ $(top_srcdir)/src/openvpn/platform.c @@ -61,7 +63,8 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ crypto_testdriver_LDFLAGS = @TEST_LDFLAGS@ -crypto_testdriver_SOURCES = test_crypto.c mock_msg.c mock_msg.h \ +crypto_testdriver_SOURCES = test_crypto.c \ + mock_msg.c mock_msg.h test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_mbedtls.c \ @@ -78,8 +81,10 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ ssl_testdriver_LDFLAGS = @TEST_LDFLAGS@ $(OPTIONAL_CRYPTO_LIBS) -ssl_testdriver_SOURCES = test_ssl.c mock_msg.c mock_msg.h \ - mock_management.c mock_ssl_dependencies.c mock_win32_execve.c \ +ssl_testdriver_SOURCES = test_ssl.c \ + mock_msg.c mock_msg.h test_common.h \ + mock_management.c \ + mock_ssl_dependencies.c mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -114,7 +119,8 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ packet_id_testdriver_LDFLAGS = @TEST_LDFLAGS@ -packet_id_testdriver_SOURCES = test_packet_id.c mock_msg.c mock_msg.h \ +packet_id_testdriver_SOURCES = test_packet_id.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/otime.c \ @@ -156,7 +162,8 @@ -Wl,--wrap=buffer_write_file \ -Wl,--wrap=parse_line \ -Wl,--wrap=rand_bytes -tls_crypt_testdriver_SOURCES = test_tls_crypt.c mock_msg.c mock_msg.h \ +tls_crypt_testdriver_SOURCES = test_tls_crypt.c \ + mock_msg.c mock_msg.h test_common.h \ mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ @@ -229,7 +236,8 @@ @TEST_CFLAGS@ $(OPTIONAL_CRYPTO_CFLAGS) pkcs11_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -pkcs11_testdriver_SOURCES = test_pkcs11.c mock_msg.c \ +pkcs11_testdriver_SOURCES = test_pkcs11.c \ + mock_msg.c test_common.h \ pkey_test_utils.c cert_data.h mock_get_random.c \ $(top_srcdir)/src/openvpn/xkey_helper.c \ $(top_srcdir)/src/openvpn/xkey_provider.c \ @@ -251,7 +259,8 @@ auth_token_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -auth_token_testdriver_SOURCES = test_auth_token.c mock_msg.c \ +auth_token_testdriver_SOURCES = test_auth_token.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_epoch.c \ @@ -269,7 +278,8 @@ @TEST_CFLAGS@ user_pass_testdriver_LDFLAGS = @TEST_LDFLAGS@ -user_pass_testdriver_SOURCES = test_user_pass.c mock_msg.c \ +user_pass_testdriver_SOURCES = test_user_pass.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/console.c \ $(top_srcdir)/src/openvpn/env_set.c \ @@ -287,7 +297,8 @@ ncp_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -ncp_testdriver_SOURCES = test_ncp.c mock_msg.c \ +ncp_testdriver_SOURCES = test_ncp.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_epoch.c \ @@ -306,7 +317,8 @@ misc_testdriver_LDFLAGS = @TEST_LDFLAGS@ -misc_testdriver_SOURCES = test_misc.c mock_msg.c \ +misc_testdriver_SOURCES = test_misc.c \ + mock_msg.c test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/options_util.c \ |
| From: flichtenheld (C. Review) <ge...@op...> - 2025-05-28 15:02:33 |
Attention is currently required from: plaisthos. Hello plaisthos, I'd like you to do a code review. Please visit http://gerrit.openvpn.net/c/openvpn/+/1034?usp=email to review the following change. Change subject: Remove contrib/pull-resolv-conf ...................................................................... Remove contrib/pull-resolv-conf We have an official solution for this now. Change-Id: Ic30f8514b50f561e7ea8f1ce12d740ac53f202e5 Signed-off-by: Frank Lichtenheld <fr...@li...> --- D contrib/pull-resolv-conf/client.down D contrib/pull-resolv-conf/client.up 2 files changed, 0 insertions(+), 155 deletions(-) git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/34/1034/1 diff --git a/contrib/pull-resolv-conf/client.down b/contrib/pull-resolv-conf/client.down deleted file mode 100644 index 0cbb476..0000000 --- a/contrib/pull-resolv-conf/client.down +++ /dev/null @@ -1,51 +0,0 @@ -#!/bin/sh - -# Copyright (c) 2005-2018 OpenVPN Inc -# Licensed under the GPL version 2 - -# First version by Jesse Adelman -# someone at boldandbusted dink com -# http://www.boldandbusted.com/ - -# PURPOSE: This script automatically removes the /etc/resolv.conf entries previously -# set by the companion script "client.up". - -# INSTALL NOTES: -# Place this in /etc/openvpn/client.down -# Then, add the following to your /etc/openvpn/<clientconfig>.conf: -# client -# up /etc/openvpn/client.up -# down /etc/openvpn/client.down -# Next, "chmod a+x /etc/openvpn/client.down" - -# USAGE NOTES: -# Note that this script is best served with the companion "client.up" -# script. - -# Tested under Debian lenny with OpenVPN 2.1_rc11 -# It should work with any UNIX with a POSIX sh, /etc/resolv.conf or resolvconf - -# This runs with the context of the OpenVPN UID/GID -# at the time of execution. This generally means that -# the client "up" script will run fine, but the "down" script -# will require the use of the OpenVPN "down-root" plugin -# which is in the plugins/ directory of the OpenVPN source tree -# The config example above would have to be changed to: -# client -# up /etc/openvpn/client.up -# plugin openvpn-plugin-down-root.so "/etc/openvpn/client.down" - -# A horrid work around, from a security perspective, -# is to run OpenVPN as root. THIS IS NOT RECOMMENDED. You have -# been WARNED. -PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin - -if type resolvconf >/dev/null 2>&1; then - resolvconf -d "${dev}" -f -elif [ -e /etc/resolv.conf.ovpnsave ] ; then - # cp + rm rather than mv in case it's a symlink - cp /etc/resolv.conf.ovpnsave /etc/resolv.conf - rm -f /etc/resolv.conf.ovpnsave -fi - -exit 0 diff --git a/contrib/pull-resolv-conf/client.up b/contrib/pull-resolv-conf/client.up deleted file mode 100644 index 220aeb7..0000000 --- a/contrib/pull-resolv-conf/client.up +++ /dev/null @@ -1,104 +0,0 @@ -#!/bin/sh - -# Copyright (c) 2005-2018 OpenVPN Inc -# Licensed under the GPL version 2 - -# First version by Jesse Adelman -# someone at boldandbusted dink com -# http://www.boldandbusted.com/ - -# PURPOSE: This script automatically sets the proper /etc/resolv.conf entries -# as pulled down from an OpenVPN server. - -# INSTALL NOTES: -# Place this in /etc/openvpn/client.up -# Then, add the following to your /etc/openvpn/<clientconfig>.conf: -# client -# up /etc/openvpn/client.up -# Next, "chmod a+x /etc/openvpn/client.up" - -# USAGE NOTES: -# Note that this script is best served with the companion "client.down" -# script. - -# Tested under Debian lenny with OpenVPN 2.1_rc11 -# It should work with any UNIX with a POSIX sh, /etc/resolv.conf or resolvconf - -# This runs with the context of the OpenVPN UID/GID -# at the time of execution. This generally means that -# the client "up" script will run fine, but the "down" script -# will require the use of the OpenVPN "down-root" plugin -# which is in the plugins/ directory of the OpenVPN source tree - -# A horrid work around, from a security perspective, -# is to run OpenVPN as root. THIS IS NOT RECOMMENDED. You have -# been WARNED. -PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin - -# init variables - -i=1 -domains= -fopt= -ndoms=0 -nns=0 -nl=' -' - -# $foreign_option_<n> is something like -# "dhcp-option DOMAIN example.com" (multiple allowed) -# or -# "dhcp-option DNS 10.10.10.10" (multiple allowed) - -# each DNS option becomes a "nameserver" option in resolv.conf -# if we get one DOMAIN, that becomes "domain" in resolv.conf -# if we get multiple DOMAINS, those become "search" lines in resolv.conf -# if we get no DOMAINS, then don't use either domain or search. - -while true; do - eval fopt=\$foreign_option_${i} - [ -z "${fopt}" ] && break - - case ${fopt} in - dhcp-option\ DOMAIN\ *) - ndoms=$((ndoms + 1)) - domains="${domains} ${fopt#dhcp-option DOMAIN }" - ;; - dhcp-option\ DNS\ *) - nns=$((nns + 1)) - if [ $nns -le 3 ]; then - dns="${dns}${dns:+$nl}nameserver ${fopt#dhcp-option DNS }" - else - printf "%s\n" "Too many nameservers - ignoring after third" >&2 - fi - ;; - *) - printf "%s\n" "Unknown option \"${fopt}\" - ignored" >&2 - ;; - esac - i=$((i + 1)) -done - -ds="" -if [ $ndoms -eq 1 ]; then - ds="${nl}domain" -elif [ $ndoms -gt 1 ]; then - ds="${nl}search" -fi - -# This is the complete file - "$domains" has a leading space already -out="# resolv.conf autogenerated by ${0} (${dev})${nl}${dns}${ds}${domains}" - -# use resolvconf if it's available -if type resolvconf >/dev/null 2>&1; then - printf "%s\n" "${out}" | resolvconf -a "${dev}" -else - # Preserve the existing resolv.conf - if [ -e /etc/resolv.conf ] ; then - cp /etc/resolv.conf /etc/resolv.conf.ovpnsave - fi - printf "%s\n" "${out}" > /etc/resolv.conf - chmod 644 /etc/resolv.conf -fi - -exit 0 -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1034?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: Ic30f8514b50f561e7ea8f1ce12d740ac53f202e5 Gerrit-Change-Number: 1034 Gerrit-PatchSet: 1 Gerrit-Owner: flichtenheld <fr...@li...> Gerrit-Reviewer: plaisthos <arn...@rf...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-MessageType: newchange |
| From: Gert D. <ge...@gr...> - 2025-05-28 12:00:00 |
From: Max Fillinger <max...@fo...> make distcheck fails since we are not listing all headers that are used by the unit tests. Change-Id: I674af04e1a6449544b7def0725337c3b353ea276 Signed-off-by: Arne Schwabe <arn...@rf...> Acked-by: Gert Doering <ge...@gr...> --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1033 This mail reflects revision 2 of this Change. Signed-off-by line for the author was added as per our policy. Acked-by according to Gerrit (reflected above): Gert Doering <ge...@gr...> diff --git a/tests/unit_tests/openvpn/Makefile.am b/tests/unit_tests/openvpn/Makefile.am index 471389b..c6c1699 100644 --- a/tests/unit_tests/openvpn/Makefile.am +++ b/tests/unit_tests/openvpn/Makefile.am @@ -43,7 +43,8 @@ argv_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ argv_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -argv_testdriver_SOURCES = test_argv.c mock_msg.c mock_msg.h \ +argv_testdriver_SOURCES = test_argv.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/platform.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -52,7 +53,8 @@ buffer_testdriver_CFLAGS = -I$(top_srcdir)/src/openvpn -I$(top_srcdir)/src/compat @TEST_CFLAGS@ buffer_testdriver_LDFLAGS = @TEST_LDFLAGS@ -L$(top_srcdir)/src/openvpn -Wl,--wrap=parse_line -buffer_testdriver_SOURCES = test_buffer.c mock_msg.c mock_msg.h \ +buffer_testdriver_SOURCES = test_buffer.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/win32-util.c \ $(top_srcdir)/src/openvpn/platform.c @@ -61,7 +63,8 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ crypto_testdriver_LDFLAGS = @TEST_LDFLAGS@ -crypto_testdriver_SOURCES = test_crypto.c mock_msg.c mock_msg.h \ +crypto_testdriver_SOURCES = test_crypto.c \ + mock_msg.c mock_msg.h test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_mbedtls.c \ @@ -78,8 +81,10 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ ssl_testdriver_LDFLAGS = @TEST_LDFLAGS@ $(OPTIONAL_CRYPTO_LIBS) -ssl_testdriver_SOURCES = test_ssl.c mock_msg.c mock_msg.h \ - mock_management.c mock_ssl_dependencies.c mock_win32_execve.c \ +ssl_testdriver_SOURCES = test_ssl.c \ + mock_msg.c mock_msg.h test_common.h \ + mock_management.c \ + mock_ssl_dependencies.c mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ $(top_srcdir)/src/openvpn/buffer.c \ @@ -114,7 +119,8 @@ -I$(top_srcdir)/include -I$(top_srcdir)/src/compat -I$(top_srcdir)/src/openvpn \ @TEST_CFLAGS@ packet_id_testdriver_LDFLAGS = @TEST_LDFLAGS@ -packet_id_testdriver_SOURCES = test_packet_id.c mock_msg.c mock_msg.h \ +packet_id_testdriver_SOURCES = test_packet_id.c \ + mock_msg.c mock_msg.h test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/otime.c \ @@ -156,7 +162,8 @@ -Wl,--wrap=buffer_write_file \ -Wl,--wrap=parse_line \ -Wl,--wrap=rand_bytes -tls_crypt_testdriver_SOURCES = test_tls_crypt.c mock_msg.c mock_msg.h \ +tls_crypt_testdriver_SOURCES = test_tls_crypt.c \ + mock_msg.c mock_msg.h test_common.h \ mock_win32_execve.c \ $(top_srcdir)/src/openvpn/argv.c \ $(top_srcdir)/src/openvpn/base64.c \ @@ -229,7 +236,8 @@ @TEST_CFLAGS@ $(OPTIONAL_CRYPTO_CFLAGS) pkcs11_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -pkcs11_testdriver_SOURCES = test_pkcs11.c mock_msg.c \ +pkcs11_testdriver_SOURCES = test_pkcs11.c \ + mock_msg.c test_common.h \ pkey_test_utils.c cert_data.h mock_get_random.c \ $(top_srcdir)/src/openvpn/xkey_helper.c \ $(top_srcdir)/src/openvpn/xkey_provider.c \ @@ -251,7 +259,8 @@ auth_token_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -auth_token_testdriver_SOURCES = test_auth_token.c mock_msg.c \ +auth_token_testdriver_SOURCES = test_auth_token.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_epoch.c \ @@ -269,7 +278,8 @@ @TEST_CFLAGS@ user_pass_testdriver_LDFLAGS = @TEST_LDFLAGS@ -user_pass_testdriver_SOURCES = test_user_pass.c mock_msg.c \ +user_pass_testdriver_SOURCES = test_user_pass.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/console.c \ $(top_srcdir)/src/openvpn/env_set.c \ @@ -287,7 +297,8 @@ ncp_testdriver_LDFLAGS = @TEST_LDFLAGS@ \ $(OPTIONAL_CRYPTO_LIBS) -ncp_testdriver_SOURCES = test_ncp.c mock_msg.c \ +ncp_testdriver_SOURCES = test_ncp.c \ + mock_msg.c test_common.h \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/crypto.c \ $(top_srcdir)/src/openvpn/crypto_epoch.c \ @@ -306,7 +317,8 @@ misc_testdriver_LDFLAGS = @TEST_LDFLAGS@ -misc_testdriver_SOURCES = test_misc.c mock_msg.c \ +misc_testdriver_SOURCES = test_misc.c \ + mock_msg.c test_common.h \ mock_get_random.c \ $(top_srcdir)/src/openvpn/buffer.c \ $(top_srcdir)/src/openvpn/options_util.c \ |
| From: cron2 (C. Review) <ge...@op...> - 2025-05-28 11:59:38 |
Attention is currently required from: flichtenheld, plaisthos. cron2 has posted comments on this change. ( http://gerrit.openvpn.net/c/openvpn/+/1033?usp=email ) Change subject: Add missing header in unit tests Makefile.am ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit http://gerrit.openvpn.net/c/openvpn/+/1033?usp=email To unsubscribe, or for help writing mail filters, visit http://gerrit.openvpn.net/settings Gerrit-Project: openvpn Gerrit-Branch: master Gerrit-Change-Id: I674af04e1a6449544b7def0725337c3b353ea276 Gerrit-Change-Number: 1033 Gerrit-PatchSet: 2 Gerrit-Owner: plaisthos <arn...@rf...> Gerrit-Reviewer: cron2 <ge...@gr...> Gerrit-Reviewer: flichtenheld <fr...@li...> Gerrit-CC: openvpn-devel <ope...@li...> Gerrit-Attention: plaisthos <arn...@rf...> Gerrit-Attention: flichtenheld <fr...@li...> Gerrit-Comment-Date: Wed, 28 May 2025 11:59:24 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment |
