sample/sample-config-files/server.conf | 8 4 + 4 - 0 !
1 file changed, 4 insertions(+), 4 deletions(-)

 set default logdir to /var/log/openvpn

src/plugins/auth-pam/auth-pam.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 fix libpam.so filename to /lib/libpam.so.0 in pam plugin

src/openvpn/options.c | 14 14 + 0 - 0 !
1 file changed, 14 insertions(+)

 warn users about deprecated pkcs11 options

distro/systemd/openvpn-client@.service.in | 2 1 + 1 - 0 !
distro/systemd/openvpn-server@.service.in | 2 1 + 1 - 0 !
2 files changed, 2 insertions(+), 2 deletions(-)

 remove syslog.target

src/openvpn/pkcs11_openssl.c | 2 1 + 1 - 0 !
1 file changed, 1 insertion(+), 1 deletion(-)

 [patch] bugfix: dangling pointer passed to pkcs11-helper

Github: Fixes OpenVPN/openvpn#323

Signed-off-by: Selva Nair <selva.nair@gmail.com>

src/openvpn/dco_linux.c | 5 4 + 1 - 0 !
1 file changed, 4 insertions(+), 1 deletion(-)

 [patch] dco: fix memory leak in dco_get_peer_stats_multi for linux

Leaks a small amount of memory every 15s.

Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>

src/openvpn/forward.c | 9 0 + 9 - 0 !
src/openvpn/init.c | 19 8 + 11 - 0 !
src/openvpn/openvpn.h | 3 0 + 3 - 0 !
3 files changed, 8 insertions(+), 23 deletions(-)

 [patch] remove saving initial frame code

This code was necessary before the frame/buffer refactoring as we
always did relative adjustment to the frame.

This also fixes also that previously initial_frame was initialised too
early before the fragment related options were initialised and contained
0 for the maximum frame size. This resulted in a DIV by 0 that caused an
abort on platforms that throw an exception for that.

CVE: 2023-46849

Only people with --fragment in their config are affected

src/openvpn/ssl.c | 8 7 + 1 - 0 !
1 file changed, 7 insertions(+), 1 deletion(-)

 [patch] fix using to_link buffer after freed

When I refactored the tls_state_change method in
9a7b95fda5 I accidentally changed a break into
a return true while it should return a false.

The code here is extremely fragile in the sense
that it assumes that settings a keystate to S_ERROR
cannot have any outgoing buffer or we will have a
use after free.  The previous break and now restored
return false ensure this by skipping any further
tls_process_state loops that might set to ks->S_ERROR
and ensure that the to_link is sent out and cleared
before having more loops in tls_state_change.

CVE: 2023-46850

This affects everyone, even with tls-auth/tls-crypt enabled.

src/openvpn/forward.c | 15 11 + 4 - 0 !
src/openvpn/forward.h | 2 1 + 1 - 0 !
src/openvpn/push.c | 12 7 + 5 - 0 !
3 files changed, 19 insertions(+), 10 deletions(-)

 [patch] only schedule_exit() once
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If an exit has already been scheduled we should not schedule it again.
Otherwise, the exit signal is never emitted if the peer reschedules the
exit before the timeout occurs.

schedule_exit() now only takes the context as argument. The signal is
hard coded to SIGTERM, and the interval is read directly from the
context options.

Furthermore, schedule_exit() now returns a bool signifying whether an
exit was scheduled; false if exit is already scheduled. The call sites

src/openvpn/buffer.c | 17 17 + 0 - 0 !
src/openvpn/buffer.h | 11 11 + 0 - 0 !
src/openvpn/forward.c | 121 78 + 43 - 0 !
tests/unit_tests/openvpn/test_buffer.c | 109 109 + 0 - 0 !
4 files changed, 215 insertions(+), 43 deletions(-)

 [patch] properly handle null bytes and invalid characters in control
 messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This makes OpenVPN more picky in accepting control message in two aspects:
- Characters are checked in the whole buffer and not until the first
  NUL byte
- if the message contains invalid characters, we no longer continue
  evaluating a fixed up version of the message but rather stop
  processing it completely.

Previously it was possible to get invalid characters to end up in log
files or on a terminal.

This also prepares the logic a bit in the direction of having a proper
framing of control messages separated by null bytes instead of relying
on the TLS framing for that. All OpenVPN implementations write the 0
bytes between control commands.

This patch also include several improvement suggestion from Reynir
(thanks!).

CVE: 2024-5594

Reported-By: Reynir Bjrnsson <reynir@reynir.dk>

sample/sample-config-files/loopback-client | 313 157 + 156 - 0 !
sample/sample-keys/ca.crt | 67 34 + 33 - 0 !
sample/sample-keys/ca.key | 100 50 + 50 - 0 !
sample/sample-keys/client-ec.crt | 129 65 + 64 - 0 !
sample/sample-keys/client-ec.key | 6 3 + 3 - 0 !
sample/sample-keys/client-pass.key | 60 30 + 30 - 0 !
sample/sample-keys/client.crt | 162 81 + 81 - 0 !
sample/sample-keys/client.key | 52 26 + 26 - 0 !
sample/sample-keys/client.p12 | 44 23 + 21 - 0 !
sample/sample-keys/dh2048.pem | 12 6 + 6 - 0 !
sample/sample-keys/gen-sample-keys.sh | 3 2 + 1 - 0 !
sample/sample-keys/server-ec.crt | 132 66 + 66 - 0 !
sample/sample-keys/server-ec.key | 6 3 + 3 - 0 !
sample/sample-keys/server.crt | 166 83 + 83 - 0 !
sample/sample-keys/server.key | 52 26 + 26 - 0 !
sample/sample-keys/ta.key | 32 16 + 16 - 0 !
16 files changed, 671 insertions(+), 665 deletions(-)

 [patch] sample-keys: renew for the next 10 years

Old expiration was October 2024, less than a year away.
Give everyone the chance to get the new keys before tests
start failing.

src/openvpn/ssl.c | 26 22 + 4 - 0 !
src/openvpn/ssl_common.h | 15 9 + 6 - 0 !
src/openvpn/ssl_pkt.c | 7 4 + 3 - 0 !
src/openvpn/ssl_pkt.h | 12 10 + 2 - 0 !
src/openvpn/tls_crypt.c | 24 23 + 1 - 0 !
src/openvpn/tls_crypt.h | 7 6 + 1 - 0 !
tests/unit_tests/openvpn/test_tls_crypt.c | 2 1 + 1 - 0 !
7 files changed, 75 insertions(+), 18 deletions(-)

 [patch] allow tls-crypt-v2 to be setup only on initial packet of a
 session

This fixes an internal server error condition that can be triggered by a
malicous authenticated client, a very unlucky corruption of packets in
transit or by an attacker that is able to inject a specially created
packet at the right time and is able to observe the traffic to construct
the packet.

The error condition results in an ASSERT statement being triggered,

NOTE: due to the security sensitive nature, this patch was prepared
under embargo on the security@openvpn.net mailing list, and thus has
no publically available "mailing list discussion before merge" URL.

CVE: 2025-2704