sample/sample-config-files/server.conf | 8 4 + 4 - 0 !
1 file changed, 4 insertions(+), 4 deletions(-)

 set default logdir to /var/log/openvpn

src/plugins/auth-pam/auth-pam.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 fix libpam.so filename to /lib/libpam.so.0 in pam plugin

sample/sample-config-files/client.conf | 2 1 + 1 - 0 !
sample/sample-config-files/server.conf | 2 1 + 1 - 0 !
sample/sample-config-files/static-home.conf | 2 1 + 1 - 0 !
sample/sample-config-files/static-office.conf | 2 1 + 1 - 0 !
sample/sample-config-files/tls-home.conf | 2 1 + 1 - 0 !
sample/sample-config-files/tls-office.conf | 2 1 + 1 - 0 !
6 files changed, 6 insertions(+), 6 deletions(-)

 unpriviledged group in debian is called nogroup instead of nobody

src/openvpn/options.c | 14 14 + 0 - 0 !
1 file changed, 14 insertions(+)

 warn users about deprecated pkcs11 options

src/openvpn/lladdr.c | 2 1 + 1 - 0 !
src/openvpn/route.c | 15 8 + 7 - 0 !
src/openvpn/ssl.c | 2 1 + 1 - 0 !
src/openvpn/syshead.h | 2 1 + 1 - 0 !
src/openvpn/tun.c | 6 3 + 3 - 0 !
5 files changed, 14 insertions(+), 13 deletions(-)

 improve kfreebsd support

src/openvpn/options.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 [patch] change command help to match man page and implementation

doc/openvpn.8 | 4 2 + 2 - 0 !
src/openvpn/buffer.c | 2 1 + 1 - 0 !
src/openvpn/options.c | 2 1 + 1 - 0 !
3 files changed, 4 insertions(+), 4 deletions(-)

 correct tspelling errors

distro/systemd/openvpn-client@.service.in | 2 1 + 1 - 0 !
distro/systemd/openvpn-server@.service.in | 2 1 + 1 - 0 !
2 files changed, 2 insertions(+), 2 deletions(-)

 remove syslog.target

src/openvpn/pkcs11.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

---

src/openvpn/multi.c | 3 2 + 1 - 0 !
1 file changed, 2 insertions(+), 1 deletion(-)

 [patch] fix illegal client float (cve-2020-11810)

There is a time frame between allocating peer-id and initializing data
channel key (which is performed on receiving push request or on async
push-reply) in which the existing peer-id float checks do not work right.

If a "rogue" data channel packet arrives during that time frame from
another address and  with same peer-id, this would cause client to float
to that new address. This is because:

 - tls_pre_decrypt() sets packet length to zero if
   data channel key has not been initialized, which leads to

 - openvpn_decrypt() returns true if packet length is zero,
   which leads to

 - process_incoming_link_part1() returns true, which
   calls multi_process_float(), which commits float

Note that problem doesn't happen when data channel key is initialized,
since in this case openvpn_decrypt() returns false.

The net effect of this behaviour is that the VPN session for the
"victim client" is broken.  Since the "attacker client" does not have
suitable keys, it can not inject or steal VPN traffic from the other
session.  The time window is small and it can not be used to attack
a specific client's session, unless some other way is found to make it
disconnect and reconnect first.

CVE-2020-11810 has been assigned to acknowledge this risk.

Fix illegal float by adding buffer length check ("is this packet still
considered valid") before calling multi_process_float().

Trac: #1272
CVE: 2020-11810

Signed-off-by: Lev Stipakov <lev@openvpn.net>

src/openvpn/push.c | 8 7 + 1 - 0 !
1 file changed, 7 insertions(+), 1 deletion(-)

 [patch] ensure key state is authenticated before sending push reply

This ensures that the key state is authenticated when sending
a push reply.

src/openvpn/socket.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 [patch] increase listen() backlog queue to 32

For reasons historically unknown, OpenVPN sets the listen() backlog
queue to "1", which signals the kernel "while there is one TCP connect
waiting for OpenVPN to handle it, refuse all others" - which, on
restarting a busy TCP server, will create connection issues.

The exact "best" value of the backlog queue is subject of discussion,
but for a server that is not extremely busy with many connections