Softpedia >Windows >Internet >Secure Browsing / VPN >OpenVPN >  Changelog

OpenVPN Changelog

What's new in OpenVPN 2.6.10 I001

Mar 20, 2024
  • Security fixes:
  • CVE-2024-27459: Windows: fix a possible stack overflow in the
  • interactive service component which might lead to a local privilege escalation.
  • Reported-by: Vladimir Tokarev [email protected]
  • CVE-2024-24974: Windows: disallow access to the interactive service pipe from remote computers.
  • Reported-by: Vladimir Tokarev [email protected]
  • CVE-2024-27903: Windows: disallow loading of plugins from untrusted installation paths, which could be used to attack openvpn.exe via a malicious plugin. Plugins can now only be loaded from the OpenVPN install directory, the Windows system directory, and possibly from a directory specified by HKLMSOFTWAREOpenVPNplugin_dir.
  • Reported-by: Vladimir Tokarev [email protected]
  • CVE-2024-1305: Windows TAP driver: Fix potential integer overflow in !TapSharedSendPacket.
  • Reported-by: Vladimir Tokarev [email protected]
  • New features:
  • t_client.sh can now run pre-tests and skip a test block if needed
  • (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  • User visible changes:
  • Update copyright notices to 2024
  • Bug fixes:
  • Windows: if the win-dco driver is used (default) and the GUI requests use of a proxy server, the connection would fail. Disable DCO in this case. (#522)
  • Compression: minor bugfix in checking option consistency vs. compiled-in algorithm support
  • systemd unit files: remove obsolete syslog.target

New in OpenVPN 2.6.8 I001 (Nov 17, 2023)

  • User visible changes:
  • Windows: print warning if pushed options require DHCP (e.g. DOMAIN-SEARCH) and driver in use does not use DHCP (wintun, dco).
  • Bug fixes:
  • SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF state (Github ​#449) - the new sanity check function introduced in 2.6.7 sometimes tried to use a NULL pointer after an unsuccessful TLS handshake
  • Windows: --dns option did not work when tap-windows6 driver was used, because internal flag for "apply DNS option to DHCP server" wasn't set (Github ​#447)
  • Windows: fix status/log file permissions, caused by regression after changing to CMake build system (Github: ​#454, Trac: ​#1430)
  • Windows: fix --chdir failures, also caused by error in CMake build system (Github ​#448)

New in OpenVPN 2.6.6 I001 (Aug 17, 2023)

  • Antonio Quartulli (1):
  • configure.ac: fix typ0 in LIBCAPNG_CFALGS
  • Arne Schwabe (8):
  • Avoid unused function warning/error on FreeBSD (and potientially others)
  • fix warning with gcc 12.2.0 (compiler bug?)
  • Fix CR_RESPONSE mangaement message using wrong key_id
  • Print a more user-friendly error when tls-crypt-v2 client auth fails
  • Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  • Revert commit 423ced962d
  • Implement using --peer-fingerprint without CA certificates
  • show extra info for OpenSSL errors
  • David Sommerseth (1):
  • ntlm: Clarify details on NTLM phase 3 decoding
  • Frank Lichtenheld (8):
  • dist: add more missing files only used in the MSVC build
  • dist: Include all documentation in distribution
  • unit_tests: Add missing cert_data.h to source list for unit tests
  • test_tls_crypt: Improve mock() usage to be more portable
  • Remove old Travis CI related files
  • options: Do not hide variables from parent scope
  • pkcs11_openssl: Disable unused code
  • route: Fix overriding return value of add_route3
  • George Pchelkin (1):
  • fix typo: dhcp-options to dhcp-option in vpn-network-options.rst
  • Gert Doering (2):
  • Make received OCC exit messages more visible in log.
  • preparing release 2.6.6
  • Heiko Hund (1):
  • work around false positive warning with mingw 12
  • Lev Stipakov (3):
  • tun.c: enclose DNS domain in single quotes in WMIC call
  • manage.c: document missing KID parameter
  • Set WINS servers via interactice service
  • Sergey Korolev (1):
  • dco-linux: fix counter print format

New in OpenVPN 2.6.5 I001 (Jun 14, 2023)

  • Dynamic TLS Crypt: When both peers are OpenVPN 2.6.1+, OpenVPN will dynamically create a tls-crypt key that is used for renegotiation. This ensure that only the previously authenticated peer can do trigger renegotiation and complete renegotiations.
  • CryptoAPI (Windows): support issuer name as a selector. Certificate selection string can now specify a partial issuer name string as
  • „–cryptoapicert ISSUER:<string>“ where <string> is matched as a substring of the issuer (CA) name in the certificate.

New in OpenVPN 2.6.4 I001 (May 11, 2023)

  • Arne Schwabe (3):
  • Remove unused variable line
  • Add Apache2 linking with for new commits
  • Fix compile error on TARGET_ANDROID
  • Frank Lichtenheld (2):
  • man page: Remove cruft from --topology documentation
  • tests: do not include t_client.sh in dist
  • Kristof Provost (1):
  • DCO: support key rotation notifications
  • Michael Nix (1):
  • fix typo in help text: --ignore-unknown-option
  • Selva Nair (2):
  • Format Windows error message in Unicode
  • Bugfix: dangling pointer passed to pkcs11-helper

New in OpenVPN 2.6.3 I001 (Apr 14, 2023)

  • Feature changes:
  • Windows: support setting DNS domain in configurations without GUI and DHCP (typically wintun or windco drivers), see GH ​openvpn#306.
  • Windows MSI changes:
  • Several Windows-specific issues fixed:
  • ensure interactive service stays enabled after silent reinstall, see GH ​openvpn-build#348, ​openvpn-build#349 and ​openvpn-build#351
  • repair querying install path info for easyrsa-start.bat on some Windows language versions, see GH ​openvpn-build#352.
  • MSIs are now built against OpenSSL 3.1.0.
  • Update included openvpn-gui to 11.41.0.0
  • This update removes the ability to change the password of a private key from the GUI. This was a niche feature which caused a direct dependency of GUI on OpenSSL. Use openssl.exe directly if you need to edit a private key.

New in OpenVPN 2.6.1 I001 (Mar 9, 2023)

  • Feature changes:
  • Dynamic TLS Crypt: When both peers are OpenVPN 2.6.1+, OpenVPN will dynamically create a tls-crypt key that is used for renegotiation. This ensure that only the previously authenticated peer can do trigger renegotiation and complete renegotiations.
  • CryptoAPI (Windows): support issuer name as a selector. Certificate selection string can now specify a partial issuer name string as
  • "--cryptoapicert ISSUER:<string>" where <string> is matched as a substring of the issuer (CA) name in the certificate.
  • Note: configure now enables DCO build by default on FreeBSD and Linux. On Linux this brings in a new default dependency for libnl-genl (for Linux distributions that are too old to have a suitable version of the library, use "configure --disable-dco")
  • Windows MSI changes since 2.6.1:
  • Update included ovpn-dco-win driver to 0.9.2

New in OpenVPN 2.6.0 I003 (Jan 26, 2023)

  • Data Channel Offload (DCO) kernel acceleration support for Windows, Linux, and FreeBSD.
  • OpenSSL 3 support.
  • Improved handling of tunnel MTU, including support for pushable MTU.
  • Outdated cryptographic algorithms disabled by default, but there are options to override if necessary.
  • Reworked TLS handshake, making OpenVPN immune to replay-packet state exhaustion attacks.
  • Added --peer-fingerprint mode for a more simplistic certificate setup and verification.
  • Added Pre-Logon Access Provider support to OpenVPN GUI for Windows.
  • Improved protocol negotiation, leading to faster connection setup.
  • Included openvpn-gui updated to 11.36.0.0. See CHANGES.rst.
  • Updated easy-rsa3 bundled with the installer on Windows.
  • Various bug fixes.

New in OpenVPN 2.5.8 I601 (Nov 3, 2022)

  • There were several enhancements of the Windows GUI component:
  • OpenVPN 3 support -- the GUI can also work as a user interface for the OpenVPN 3 client.
  • pkcs11-id-management -- the GUI can list available pkcs11-ids and allows the user to select one.
  • Persistent connections -- the GUI lists connections started at boot by the automatic service and lets the user control them. Interactive inputs such as username/password with such connections are possible.

New in OpenVPN 2.5.7 I602 (Jun 1, 2022)

  • The OpenVPN community project team is proud to release OpenVPN 2.5.7. This is mostly a bugfix release, but adds limited support for OpenSSL 3.0. Full support will arrive in OpenVPN 2.6.

New in OpenVPN 2.5.6 I601 (Mar 16, 2022)

  • This is mostly a bugfix release including one security fix ("Disallow multiple deferred authentication plug-ins.", CVE: 2022-0547).

New in OpenVPN 2.5.4 I604 (Oct 21, 2021)

  • Installer I604 fixes some small Windows issues.

New in OpenVPN 2.5.4 (Oct 5, 2021)

  • Bugfixes:
  • Fix prompting for password on windows console if stderr redirection is in use - this breaks 2.5.x on Win11/ARM, and might also break on Win11/adm64 when released.
  • Fix setting MAC address on TAP adapters (--lladdr) to use sitnl (was overlooked, and still used "ifconfig" calls)
  • Various improvements for man page building (rst2man/rst2html etc)
  • Minor bugfix with IN6_IS_ADDR_UNSPECIFIED() use (breaks build on at least one platform strictly checking this)
  • Fix minor memory leak under certain conditions in add_route() and add_route_ipv6()

New in OpenVPN 2.5.2 (Apr 21, 2021)

  • Arne Schwabe (10):
  • Avoid generating unecessary mbed debug messages
  • Restore also ping related options on a reconnect
  • Cleanup print_details and add signature/ED certificate print
  • Always disable TLS renegotiations
  • Also restore/save route-gateway options on SIGUSR1 reconnects
  • Move context_auth from context_2 to tls_multi and name it multi_state
  • Fix condition to generate session keys
  • Move auth_token_state from multi to key_state
  • Ensure auth-token is only sent on a fully authenticated session
  • Ensure key state is authenticated before sending push reply
  • Gert Doering (2):
  • Fix potential NULL ptr crash if compiled with DMALLOC
  • Preparing release 2.5.2
  • Max Fillinger (2):
  • In init_ssl, open the correct CRL path pre-chroot
  • Abort if CRL file can't be stat-ed in ssl_init
  • Richard Bonhomme (1):
  • Do not print Diffie Hellman parameters file to log file
  • Simon Rozman (1):
  • openvpnserv: Cache last error before it is overridden
  • Vladislav Grishenko (1):
  • Fix IPv4 default gateway with multiple route tables

New in OpenVPN 2.5.1 (Feb 24, 2021)

  • Arne Schwabe (5):
  • Fix auth-token not being updated if auth-nocache is set
  • Remove auth_user_pass.wait_for_push variable
  • Fix port-share option with TLS-Crypt v2
  • Zero initialise msghdr prior to calling sendmesg
  • Fix tls-auth mismatch OCC message when tls-cryptv2 is used.
  • David Sommerseth (1):
  • build: Fix missing install of man page in certain environments
  • Domagoj Pensa (3):
  • Fix too early argv freeing when registering DNS
  • Remove 1 second delay before running netsh
  • Skip DHCP renew with Wintun adapter
  • Gert Doering (7):
  • Change travis build scripts to use https when fetching prerequisites.
  • Fix line number reporting on config file errors after <inline> segments
  • Clarify --block-ipv6 intent and direction.
  • Document common uses of 'echo' directive, re-enable logging for 'echo'.
  • Make OPENVPN_PLUGIN_ENABLE_PF failures FATAL
  • clean up / rewrite sample-plugins/defer/simple.c
  • Preparing release 2.5.1
  • Greg Cox (5):
  • Fix naming error in sample-plugins/defer/simple.c
  • Documentation fixes around openvpn_plugin_func_v3 in openvpn-plugin.h.in
  • Update openvpn_plugin_func_v2 to _v3 in sample-plugins/defer/simple.c
  • More explicit versioning compatibility in sample-plugins/defer/simple.c
  • Explain structver usage in sample defer plugin.
  • Richard Bonhomme (1):
  • Man page sections corrections
  • Selva Nair (1):
  • Quote the domain name argument passed to the wmic command
  • Steffan Karger (2):
  • tls-crypt-v2: fix server memory leak
  • tls-crypt-v2: also preload tls-crypt-v2 keys (if --persist-key)

New in OpenVPN 2.5.0 (Oct 28, 2020)

  • Faster connections:
  • Connections setup is now much faster
  • Crypto specific changes:
  • ChaCha20-Poly1305 cipher in the OpenVPN data channel (Requires OpenSSL 1.1.0 or newer)
  • Improved TLS 1.3 support when using OpenSSL 1.1.1 or newer
  • Client-specific tls-crypt keys (–tls-crypt-v2)
  • Improved Data channel cipher negotiation
  • Removal of BF-CBC support in default configuration (see below for possible incompatibilities)
  • Server-side improvements:
  • HMAC based auth-token support for seamless reconnects to standalone servers or a group of servers.
  • Asynchronous (deferred) authentication support for auth-pam plugin
  • Asynchronous (deferred) support for client-connect scripts and plugins
  • Network-related changes:
  • Support IPv4 configs with /31 netmasks now
  • 802.1q VLAN support on TAP servers
  • IPv6-only tunnels
  • New option –block-ipv6 to reject all IPv6 packets (ICMPv6)
  • Windows-specific features:
  • Wintun driver support, a faster alternative to tap-windows6
  • Setting tun/tap interface MTU
  • Setting DHCP search domain
  • Allow unicode search string in –cryptoapicert option
  • EasyRSA3, a modern take on OpenVPN CA management
  • MSI installer

New in OpenVPN 2.5 RC 2 (Sep 30, 2020)

  • Gert Doering (1):
  • Preparing release 2.5_rc2
  • Lev Stipakov (1):
  • Alias ADAPTER_DOMAIN_SUFFIX to DOMAIN
  • Selva Nair (2):
  • Set DNS Domain using iservice
  • Improve documentation of --username-as-common-name
  • Simon Rozman via Openvpn-devel (4):
  • netsh: Specify interfaces by index rather than name
  • netsh: Clear existing IPv6 DNS servers before configuring new ones
  • netsh: Delete WINS servers on TUN close
  • openvpnmsica: Simplify find_adapters() to void return
  • Vladislav Grishenko (1):
  • Fix update_time() and openvpn_gettimeofday() coexistence

New in OpenVPN 2.5 RC 1 (Sep 22, 2020)

  • David Sommerseth (4):
  • man: Add missing --server-ipv6
  • man: Improve --remote entry
  • sample-plugins: Partially autotoolize the sample-plugins build
  • build: Fix make distclean/distcheck
  • Gert Doering (11):
  • Fix handling of 'route remote_host' for IPv6 transport case.
  • Replace 'echo -n' with 'printf' in tests/t_lpback.sh
  • Fix description of --client-disconnect calling convention in manpage.
  • Handle NULL returns from calloc() in sample plugins.
  • Fix --show-gateway for IPv6 on NetBSD/i386.
  • socks.c: fix alen for DOMAIN type addresses, bump up buffer sizes
  • Fix netbits setting (in TAP mode) for IPv6 on Windows.
  • If IPv6 pool specification sets pool start to ::0 address, increment.
  • Add demo plugin that excercises "CLIENT_CONNECT" and "CLIENT_CONNECT_V2" paths
  • Fix combination of --dev tap and --topology subnet across multiple platforms.
  • Preparing release 2.5_rc1
  • Lev Stipakov (1):
  • msvc: better support for 32bit architecture
  • Selva Nair (2):
  • Add a remark on dropping privileges when --mlock is used
  • Allow --dhcp-option in config file when windows-driver is wintun
  • Vladislav Grishenko (1):
  • Fix fatal error at switching remotes (#629)

New in OpenVPN 2.5 Beta 1 (Aug 14, 2020)

  • This is a new major release (14th August 2020) with a large number of new features including, but not limited to:
  • Client-specific tls-crypt keys (–tls-crypt-v2)
  • Netlink support
  • Wintun support
  • Linux VRF support
  • TLS 1.3 support
  • HMAC based auth-token support
  • VLAN support
  • MSI installer support (Windows)

New in OpenVPN 2.4.9 (Apr 17, 2020)

  • New features:
  • Allow unicode search string in --cryptoapicert option (Windows)
  • User visible changes:
  • Skip expired certificates in Windows certificate store (Windows) (trac #966)
  • OpenSSL: Fix --crl-verify not loading multiple CRLs in one file (trac #623)
  • When using "--auth-user-pass file" with just a username and no password in the file, OpenVPN now queries the management interface (if active) for the credentials. Previously it would query the console for the password, and fail if no console available (normal case on Windows) (trac #757)
  • Swap the order of checks for validating interactive service user (Windows: check config location before querying domain controller for group membership, which can be slow)
  • Bug fixes:
  • fix condition where a client's session could "float" to a new IP address that is not authorized ("fix illegal client float")
  • This can be used to disrupt service to a freshly connected client (no session keys negotiated yet). It can not be used to inject or steal VPN traffic. CVE-2020-11810, trac #1272)
  • fix combination of async push (deferred auth) and NCP (trac #1259)
  • Fix OpenSSL 1.1.1 not using auto elliptic curve selection (trac #1228)
  • Fix OpenSSL error stack handling of tls_ctx_add_extra_certs
  • mbedTLS: Make sure TLS session survives move (trac #880)
  • Fix OpenSSL private key passphrase notices
  • Fix building with --enable-async-push in FreeBSD (trac #1256)
  • Fix broken fragmentation logic when using NCP (trac #1140)

New in OpenVPN 2.4.8 (Oct 31, 2019)

  • Antonio Quartulli (1):
  • mbedtls: fix segfault by calling mbedtls_cipher_free() in cipher_ctx_free()
  • Arne Schwabe (1):
  • Remove -no-cpp-precomp flag from Darwin builds
  • David Sommerseth (3):
  • cleanup: Remove RPM openvpn.spec build approach
  • docs: Update INSTALL
  • build: Package missing mock_msg.h
  • Gert Doering (5):
  • repair windows builds (2.4)
  • Increase listen() backlog queue to 32
  • Force combinationation of --socks-proxy and --proto UDP to use IPv4.
  • Fix IPv6 routes on tap interfaces on OpenSolaris/OpenIndiana
  • preparing release v2.4.8 (ChangeLog, version.m4, Changes.rst)
  • Gisle Vanem (1):
  • Wrong FILETYPE in .rc files
  • Hilko Bengen (1):
  • Do not set pkcs11-helper 'safe fork mode'
  • Ilya Shipitsin (2):
  • travis-ci: add "linux-ppc64le" to build matrix, change trusty image to xenial, update osx to xcode9.4 and modernize brew management
  • travis-ci: fix osx builds
  • Kyle Evans (1):
  • tests/t_lpback.sh: Switch sed(1) to POSIX-compatible regex.
  • Lev Stipakov (1):
  • Fix various compiler warnings
  • Matthias Andree (1):
  • Fix regression, reinstate LibreSSL support.
  • Michal Soltys (1):
  • man: correct the description of --capath and --crl-verify regarding CRLs
  • Mykola Baibuz (1):
  • Fix typo in NTLM proxy debug message
  • Richard Bonhomme (1):
  • Ignore --pull-filter for --mode server
  • Rosen Penev (1):
  • openssl: Fix compilation without deprecated OpenSSL 1.1 APIs
  • Selva Nair (3):
  • Better error message when script fails due to script-security setting
  • Correct the return value of cryptoapi RSA signature callbacks
  • Handle PSS padding in cryptoapicert
  • Steffan Karger (1):
  • cmocka: use relative paths
  • Thomas Quinot (1):
  • Fix documentation of tls-verify script argument

New in OpenVPN 2.4.7 (Feb 21, 2019)

  • Adam Ciarciński (1):
  • Fix subnet topology on NetBSD (2.4).
  • Antonio Quartulli (3):
  • add support for %lu in argv_printf and prevent ASSERT
  • buffer_list: add functions documentation
  • ifconfig-ipv6(-push): allow using hostnames
  • Arne Schwabe (7):
  • Properly free tuntap struct on android when emulating persist-tun
  • Add OpenSSL compat definition for RSA_meth_set_sign
  • Add support for tls-ciphersuites for TLS 1.3
  • Add better support for showing TLS 1.3 ciphersuites in --show-tls
  • Use right function to set TLS1.3 restrictions in show-tls
  • Add message explaining early TLS client hello failure
  • Fallback to password authentication when auth-token fails
  • Christian Ehrhardt (1):
  • systemd: extend CapabilityBoundingSet for auth_pam
  • David Sommerseth (1):
  • plugin: Export base64 encode and decode functions
  • Gert Doering (4):
  • Add %d, %u and %lu tests to test_argv unit tests.
  • Fix combination of --dev tap and --topology subnet across multiple platforms.
  • Add 'printing of port number' to mroute_addr_print_ex() for v4-mapped v6.
  • preparing release v2.4.7 (ChangeLog, version.m4, Changes.rst)
  • Gert van Dijk (1):
  • Minor reliability layer documentation fixes
  • James Bekkema (1):
  • Resolves small IV_GUI_VER typo in the documentation.
  • Jonathan K. Bullard (1):
  • Clarify and expand management interface documentation
  • Lev Stipakov (5):
  • Refactor NCP-negotiable options handling
  • init.c: refine functions names and description
  • interactive.c: fix usage of potentially uninitialized variable
  • options.c: fix broken unary minus usage
  • Remove extra token after #endif
  • Richard van den Berg via Openvpn-devel (1):
  • Fix error message when using RHEL init script
  • Samy Mahmoudi (1):
  • man: correct a --redirection-gateway option flag
  • Selva Nair (7):
  • Replace M_DEBUG with D_LOW as the former is too verbose
  • Correct the declaration of handle in 'struct openvpn_plugin_args_open_return'
  • Bump version of openvpn plugin argument structs to 5
  • Move get system directory to a separate function
  • Enable dhcp on tap adapter using interactive service
  • Pass the hash without the DigestInfo header to NCryptSignHash()
  • White-list pull-filter and script-security in interactive service
  • Simon Rozman (2):
  • Add Interactive Service developer documentation
  • Detect TAP interfaces with root-enumerated hardware ID
  • Steffan Karger (7):
  • man: add security considerations to --compress section
  • mbedtls: print warning if random personalisation fails
  • Fix memory leak after sighup
  • travis: add OpenSSL 1.1 Windows build
  • Fix --disable-crypto build
  • Don't print OCC warnings about 'key-method', 'keydir' and 'tls-auth'
  • buffer_list_aggregate_separator(): simplify code

New in OpenVPN 2.4.6 (Apr 24, 2018)

  • David Sommerseth (1):
  • Management: Warn if TCP port is used without password
  • Gert Doering (3):
  • Correct version in ChangeLog - should be 2.4.5, was mistyped as 2.4.4
  • Fix potential double-free() in Interactive Service (CVE-2018-9336)
  • Preparing release v2.4.6 (ChangeLog, version.m4, Changes.rst)
  • Gert van Dijk (1):
  • Manpage: improve description of --status and --status-version
  • Joost Rijneveld (1):
  • Make return code external tls key match docs
  • Selva Nair (3):
  • Delete the IPv6 route to the "connected" network on tun close
  • Management: warn about password only when the option is in use
  • Avoid overflow in wakeup time computation
  • Simon Matter (1):
  • Add missing #ifdef SSL_OP_NO_TLSv1_1/2
  • Steffan Karger (1):
  • Check for more data in control channel

New in OpenVPN 2.4.5-I601 (Mar 1, 2018)

  • Antonio Quartulli (4):
  • reload HTTP proxy credentials when moving to the next connection profile
  • Allow learning iroutes with network made up of all 0s (only if netbits < 8)
  • mbedtls: fix typ0 in comment
  • manpage: fix simple typ0
  • Arne Schwabe (2):
  • Treat dhcp-option DNS6 and DNS identical
  • show the right string for key-direction
  • Bertrand Bonnefoy-Claudet (1):
  • Fix typo in error message: "optione" -> "option"
  • David Sommerseth (8):
  • lz4: Fix confused version check
  • lz4: Fix broken builds when pkg-config is not present but system library is
  • Remove references to keychain-mcd in Changes.rst
  • lz4: Rebase compat-lz4 against upstream v1.7.5
  • systemd: Add and ship README.systemd
  • Update copyright to include 2018 plus company name change
  • man: Add .TQ groff support macro
  • man: Reword --management to prefer unix sockets over TCP
  • Emmanuel Deloget (1):
  • OpenSSL: check EVP_PKEY key types before returning the pkey
  • Gert Doering (3):
  • Remove warning on pushed tun-ipv6 option.
  • Fix removal of on-link prefix on windows with netsh
  • Preparing for release v2.4.5 (ChangeLog, version.m4, Changes.rst)
  • Ilya Shipitsin (2):
  • travis-ci: add brew cache, remove ccache
  • travis-ci: modify openssl build script to support openssl-1.1.0
  • James Bottomley (1):
  • autoconf: Fix engine checks for openssl 1.1
  • Jeremie Courreges-Anglas (2):
  • Cast time_t to long long in order to print it.
  • Fix build with LibreSSL
  • Selva Nair (14):
  • Check whether in pull_mode before warning about previous connection blocks
  • Avoid illegal memory access when malformed data is read from the pipe
  • Fix missing check for return value of malloc'd buffer
  • Return NULL if GetAdaptersInfo fails
  • Use RSA_meth_free instead of free
  • Bring cryptoapi.c upto speed with openssl 1.1
  • Add SSL_CTX_get_max_proto_version() not in openssl 1.0
  • TLS v1.2 support for cryptoapicert -- RSA only
  • Refactor get_interface_metric to return metric and auto flag separately
  • Ensure strings read from registry are null-terminated
  • Make most registry values optional
  • Use lowest metric interface when multiple interfaces match a route
  • Adapt to RegGetValue brokenness in Windows 7
  • Fix format spec errors in Windows builds
  • Simon Rozman (11):
  • Local functions are not supported in MSVC. Bummer.
  • Mixing wide and regular strings in concatenations is not allowed in MSVC.
  • RtlIpv6AddressToStringW() and RtlIpv4AddressToStringW() require mstcpip.h
  • Simplify iphlpapi.dll API calls
  • Fix local #include to use quoted form
  • Document ">PASSWORD:Auth-Token" real-time message
  • Fix typo in "verb" command examples
  • Uniform swprintf() across MinGW and MSVC compilers
  • MSVC meta files added to .gitignore list
  • openvpnserv: Add support for multi-instances
  • Document missing OpenVPN states
  • Steffan Karger (21):
  • make struct key * argument of init_key_ctx const
  • buffer_list_aggregate_separator(): add unit tests
  • Add --tls-cert-profile option.
  • Use P_DATA_V2 for server->client packets too
  • Fix memory leak in buffer unit tests
  • buffer_list_aggregate_separator(): update list size after aggregating
  • buffer_list_aggregate_separator(): don't exceed max_len
  • buffer_list_aggregate_separator(): prevent 0-byte malloc
  • Fix types around buffer_list_push(_data)
  • ssl_openssl: fix compiler warning by removing getbio() wrapper
  • travis: use clang's -fsanitize=address to catch more bugs
  • Fix --tls-version-min and --tls-version-max for OpenSSL 1.1+
  • Add support for TLS 1.3 in --tls-version-{min, max}
  • Plug memory leak if push is interrupted
  • Fix format errors when cross-compiling for Windows
  • Log pre-handshake packet drops using D_MULTI_DROPPED
  • Enable stricter compiler warnings by default
  • Get rid of ax_check_compile_flag.m4
  • mbedtls: don't use API deprecated in mbed 2.7
  • Warn if tls-version-max < tls-version-min
  • Don't throw fatal errors from create_temp_file()
  • hashiz (1):
  • Fix '--bind ipv6only'

New in OpenVPN 2.4.4-I601 (Sep 27, 2017)

  • crypto: correct typ0 in error message
  • use M_ERRNO instead of explicitly printing errno
  • don't print errno twice
  • ntlm: avoid useless cast
  • ntlm: unwrap multiple function calls
  • route: improve error message
  • management: preserve wait_for_push field when asking for user/pass
  • tls-crypt: avoid warnings when --disable-crypto is used
  • ntlm: convert binary buffers to uint8_t *
  • ntlm: restyle compressed multiple function calls
  • ntlm: improve code style and readability
  • OpenSSL: remove unreachable call to SSL_CTX_get0_privatekey()
  • make function declarations C99 compliant
  • remove unused functions
  • use NULL instead of 0 when assigning pointers
  • add missing static attribute to functions
  • ntlm: avoid breaking anti-aliasing rules
  • remove the --disable-multi config switch
  • rename mroute_extract_addr_ipv4 to mroute_extract_addr_ip
  • route: avoid definition of unused variables in certain configurations
  • fix a couple of typ0s in comments and strings
  • fragment.c: simplify boolean expression
  • tcp-server: ensure AF family is propagated to child context
  • Set tls-cipher restriction before loading certificates
  • Print ec bit details, refuse management-external-key if key is not RSA
  • Use provided env vars in up/down script.
  • Document down-root plugin usage in client.down
  • doc: The CRL processing is not a deprecated feature
  • cleanup: Move write_pid() to where it is being used
  • contrib: Remove keychain-mcd code
  • cleanup: Move init_random_seed() to where it is being used
  • sample-plugins: fix ASN1_STRING_to_UTF8 return value checks
  • Highlight deprecated features
  • Use consistent version references
  • docs: Replace all PolarSSL references to mbed TLS
  • systemd: Ensure systemd shuts down OpenVPN in a proper way
  • systemd: Enable systemd's auto-restart feature for server profiles
  • lz4: Move towards a newer LZ4 API
  • Prepare the release of OpenVPN 2.4.
  • OpenSSL: remove pre-1.1 function from the OpenSSL compat interface
  • OpenSSL: remove EVP_CIPHER_CTX_new() from the compat layer
  • OpenSSL: remove EVP_CIPHER_CTX_free() from the compat layer
  • Warn that DH config option is only meaningful in a tls-server context
  • travis-ci: add 3 missing patches from master to release/2.4
  • travis-ci: update openssl to 1.0.2l, update mbedtls to 2.5.1
  • travis-ci: update pkcs11-helper to 1.22
  • man: Corrections to doc/openvpn.8
  • Fix typo in extract_x509_extension() debug message
  • Move adjust_power_of_2() to integer.h
  • Undo cipher push in client options state if cipher is rejected
  • Remove strerror_ts()
  • Move openvpn_sleep() to manage.c
  • fixup: also change missed openvpn_sleep() occurrences
  • Always use default keysize for NCP'd ciphers
  • Move create_temp_file() out of #ifdef ENABLE_CRYPTO
  • Deprecate --keysize
  • Deprecate --no-replay
  • Move run_up_down() to init.c
  • tls-crypt: introduce tls_crypt_kt()
  • crypto: create function to initialize encrypt and decrypt key
  • Add coverity static analysis to Travis CI config
  • tls-crypt: don't leak memory for incorrect tls-crypt messages
  • travis: reorder matrix to speed up build
  • Fix bounds check in read_key()
  • OpenSSL: Always set SSL_OP_CIPHER_SERVER_PREFERENCE flag
  • Fix socks_proxy_port pointing to invalid data

New in OpenVPN 2.4.3-I601 (Jun 22, 2017)

  • Antonio Quartulli (1):
  • Ignore auth-nocache for auth-user-pass if auth-token is pushed
  • David Sommerseth (3):
  • crypto: Enable SHA256 fingerprint checking in --verify-hash
  • copyright: Update GPLv2 license texts
  • auth-token with auth-nocache fix broke --disable-crypto builds
  • Emmanuel Deloget (8):
  • OpenSSL: don't use direct access to the internal of X509
  • OpenSSL: don't use direct access to the internal of EVP_PKEY
  • OpenSSL: don't use direct access to the internal of RSA
  • OpenSSL: don't use direct access to the internal of DSA
  • OpenSSL: force meth->name as non-const when we free() it
  • OpenSSL: don't use direct access to the internal of EVP_MD_CTX
  • OpenSSL: don't use direct access to the internal of EVP_CIPHER_CTX
  • OpenSSL: don't use direct access to the internal of HMAC_CTX
  • Gert Doering (6):
  • Fix NCP behaviour on TLS reconnect.
  • Remove erroneous limitation on max number of args for --plugin
  • Fix edge case with clients failing to set up cipher on empty PUSH_REPLY.
  • Fix potential 1-byte overread in TCP option parsing.
  • Fix remotely-triggerable ASSERT() on malformed IPv6 packet.
  • Preparing for release v2.4.3 (ChangeLog, version.m4, Changes.rst)
  • Guido Vranken (6):
  • refactor my_strupr
  • Fix 2 memory leaks in proxy authentication routine
  • Fix memory leak in add_option() for option 'connection'
  • Ensure option array p[] is always NULL-terminated
  • Fix a null-pointer dereference in establish_http_proxy_passthru()
  • Prevent two kinds of stack buffer OOB reads and a crash for invalid input data
  • Jérémie Courrèges-Anglas (2):
  • Fix an unaligned access on OpenBSD/sparc64
  • Missing include for socket-flags TCP_NODELAY on OpenBSD
  • Matthias Andree (1):
  • Make openvpn-plugin.h self-contained again.
  • Selva Nair (1):
  • Pass correct buffer size to GetModuleFileNameW()
  • Steffan Karger (11):
  • Log the negotiated (NCP) cipher
  • Avoid a 1 byte overcopy in x509_get_subject (ssl_verify_openssl.c)
  • Skip tls-crypt unit tests if required crypto mode not supported
  • openssl: fix overflow check for long --tls-cipher option
  • Add a DSA test key/cert pair to sample-keys
  • Fix mbedtls fingerprint calculation
  • mbedtls: fix --x509-track post-authentication remote DoS (CVE-2017-7522)
  • mbedtls: require C-string compatible types for --x509-username-field
  • Fix remote-triggerable memory leaks (CVE-2017-7521)
  • Restrict --x509-alt-username extension types
  • Fix potential double-free in --x509-alt-username (CVE-2017-7521)
  • Steven McDonald (1):
  • Fix gateway detection with OpenBSD routing domains

New in OpenVPN 2.4.1-I601 (Mar 23, 2017)

  • attempt to add IPv6 route even when no IPv6 address was configured
  • fix redirect-gateway behaviour when an IPv4 default route does not exist
  • CRL: use time_t instead of struct timespec to store last mtime
  • ignore remote-random-hostname if a numeric host is provided
  • man: fix formatting for alternative option
  • systemd: Use automake tools to install unit files
  • systemd: Do not race on RuntimeDirectory
  • systemd: Add more security feature for systemd units
  • Clean up plugin path handling
  • plugin: Remove GNUism in openvpn-plugin.h generation
  • fix typo in notification message
  • management: >REMOTE operation would overwrite ce change indicator
  • management: Remove a redundant #ifdef block
  • git: Merge .gitignore files into a single file
  • systemd: Move the READY=1 signalling to an earlier point
  • plugin: Improve the handling of default plug-in directory
  • cleanup: Remove faulty env processing functions
  • OpenSSL: check for the SSL reason, not the full error
  • OpenSSL: don't use direct access to the internal of X509_STORE_CTX
  • OpenSSL: don't use direct access to the internal of SSL_CTX
  • OpenSSL: don't use direct access to the internal of X509_STORE
  • OpenSSL: don't use direct access to the internal of X509_OBJECT
  • OpenSSL: don't use direct access to the internal of RSA_METHOD
  • OpenSSL: SSLeay symbols are no longer available in OpenSSL 1.1
  • OpenSSL: use EVP_CipherInit_ex() instead of EVP_CipherInit()
  • Fix Building Using MSVC
  • Add openssl_compat.h to openvpn_SOURCES
  • Fix '--dev null'
  • Fix installation of IPv6 host route to VPN server when using iservice.
  • Make ENABLE_OCC no longer depend on !ENABLE_SMALL
  • Preparing for release v2.4.1 (ChangeLog, version.m4)
  • Crash in options.c
  • Resolve several travis-ci issues
  • travis-ci: remove unused files
  • Fix building with LibreSSL 2.5.1 by cleaning a hack.
  • Fix push options digest update
  • Always release dhcp address in close_tun() on Windows.
  • Add a check for -Wl, --wrap support in linker
  • Fix user's group membership check in interactive service to work with domains
  • Fix segfault when using crypto lib without AES-256-CTR or SHA256
  • More broadly enforce Allman style and braces-around-conditionals
  • Use SHA256 for the internal digest, instead of MD5
  • OpenSSL: 1.1 fallout - fix configure on old autoconf
  • Fix types in WIN32 socket_listen_accept()
  • Remove duplicate X509 env variables
  • Fix non-C99-compliant builds: don't use const size_t as array length
  • Deprecate --ns-cert-type
  • Be less picky about keyUsage extensions

New in OpenVPN 2.4.0-I601 (Dec 28, 2016)

  • Update build parameters to match openvpn-install-2.4_rc2
  • Merge pull request #63 from selvanair/less-choice-v2
  • Update build parameters to match openvpn-install-2.4.0
  • Simplifiy user choices and always install openvpn, dlls and services
  • Add missing /o to Section SecService

New in OpenVPN 2.3.14-I601 (Dec 7, 2016)

  • update year in copyright message
  • man: Improve the --keepalive section
  • Document the --auth-token option
  • Repair topology subnet on FreeBSD 11
  • Repair topology subnet on OpenBSD
  • Preparing release of v2.3.14
  • Drop recursively routed packets
  • Support --block-outside-dns on multiple tunnels
  • When parsing '--setenv opt xx ..' make sure a third parameter is present
  • Map restart signals from event loop to SIGTERM during exit-notification wait
  • Correctly state the default dhcp server address in man page
  • Clean up format_hex_ex()

New in OpenVPN 2.4 RC 1 (Dec 2, 2016)

  • reload CRL only if file was modified
  • update year in copyright message
  • Use systemd service manager notification
  • Refuse to daemonize when running from systemd
  • Preparing OpenVPN v2.4_rc1 release
  • Fix windows path in Changes.rst
  • Mention that OpenVPN 2.4 requires Windows Vista or higher
  • Map restart signals from event loop to SIGTERM during exit-notification wait
  • When parsing '--setenv opt xx ..' make sure a third parameter is present
  • Force 'def1' method when --redirect-gateway is done through service
  • Do not restart dns client service as a part of --register-dns processing
  • tls_process: don't set variable that's never read
  • Unconditionally enable TLS_AGGREGATE_ACK
  • Clean up format_hex_ex()
  • Introduce and use secure_memzero() to erase secrets

New in OpenVPN 2.4 Beta 2 (Nov 25, 2016)

  • Document that tls-crypt also supports inline
  • Fix warning that RAND_bytes is undeclared
  • Remove compat-stdbool.h.
  • Fix various compiler warnings
  • Handle DNS6 option on Android
  • Changes.rst: Fixing wrong formatting
  • Document the --auth-token option
  • Remove remaining traces of compat-stdbool.h
  • Stub implementation of "--dhcp-option DNS6 "
  • Do not set ipv6 address if '--ip-win32 manual' is used
  • Handle --dhcp-option DNS6 on Windows using netsh
  • Set IPv6 DNS servers using interactive service
  • multi_process_float: revert part of c14c4a9e
  • tls-crypt fixes
  • Change cmocka remote to use https in stead of git protocol
  • generate_key_expansion: make assumption explicit, use C99 features
  • Poor man's NCP for non-NCP peers
  • Refactor data channel key generation API

New in OpenVPN 2.3.13-I601 (Nov 3, 2016)

  • Use AES ciphers in our sample configuration files and add a few modern 2.4 examples
  • Incorporate the Debian typo fixes where appropriate and make show_opt default message clearer
  • t_client.sh: Make OpenVPN write PID file to avoid various sudo issues
  • t_client.sh: Add support for Kerberos/ksu
  • t_client.sh: Improve detection if the OpenVPN process did start during tests
  • t_client.sh: Add prepare/cleanup possibilties for each test case
  • Preparing release of v2.3.13
  • Do not abort t_client run if OpenVPN instance does not start.
  • Fix t_client runs on OpenSolaris
  • make t_client robust against sudoers misconfiguration
  • add POSTINIT_CMD_suf to t_client.sh and sample config
  • Fix --multihome for IPv6 on 64bit BSD systems.
  • skip t_lpback.sh and t_cltsrv.sh if openvpn configured --disable-crypto
  • Exclude peer-id from pulled options digest
  • Fix compilation in pedantic mode
  • Automatically cache expected IPs for t_client.sh on the first run
  • Fix unittests for out-of-source builds
  • Make gnu89 support explicit
  • cleanup: remove code duplication in msg_test()
  • Update cipher-related man page text
  • Limit --reneg-bytes to 64MB when using small block ciphers
  • Add a revoked cert to the sample keys

New in OpenVPN 2.3.12-I601 (Aug 24, 2016)

  • Complete push-peer-info documentation and allow IV_PLAT_VER for other platforms than Windows if the client UI supplies it.
  • Move ASSERT so external-key with OpenSSL works again
  • Only build and run cmocka unit tests if its submodule is initialized
  • Another fix related to unit test framework
  • Remove NOP function and callers
  • Revert "Drop recursively routed packets"
  • Preparing release of v2.3.12
  • Add CHACHA20-POLY1305 ciphersuite IANA name translations.
  • Plug memory leak in mbedTLS backend
  • Update contrib/pull-resolv-conf/client.up for no DOMAIN
  • Add unit testing support via cmocka
  • Add a test for auth-pam searchandreplace
  • Push an IPv6 CIDR mask used by the server, not the pool's size
  • Add link to bug tracker
  • Drop recursively routed packets
  • Update CONTRIBUTING.rst to allow GitHub PRs for code review purposes
  • Clarify the fact that build instructions in README are for release tarballs
  • Make error non-fatal while deleting address using netsh
  • Make block-outside-dns work with persist-tun
  • Ignore SIGUSR1/SIGHUP during exit notification
  • Promptly close the netcmd_semaphore handle after use
  • Fix polarssl / mbedtls builds
  • Don't limit max incoming message size based on c2->frame
  • Fix '--cipher none --cipher' crash
  • Discourage using 64-bit block ciphers

New in OpenVPN 2.3.11-I601 (May 10, 2016)

  • Fixed port-share bug with DoS potential
  • Make intent of utun device name validation clear
  • Fix buffer overflow by user supplied data
  • Correctly report TCP connection timeout on windows
  • Report Windows bitness
  • Fix undefined signed shift overflow
  • Fix build with libressl
  • Improve LZO, PAM and OpenSSL documentation
  • Ensure input read using systemd-ask-password is null terminated
  • Support reading the challenge-response from console
  • openssl: improve logging
  • polarssl: improve logging
  • Update manpage: OpenSSL might also need /dev/urandom inside chroot
  • socks.c: fix check on get_user_pass() return value(s)
  • Fix OCSP_check.sh
  • hardening: add safe FD_SET() wrapper openvpn_fd_set()
  • Fix memory leak in argv_extract_cmd_name()
  • Replace MSG_TEST() macro for static inline msg_test()
  • Restrict default TLS cipher list
  • Various Changes.rst fixes
  • Clarify mssfix documentation
  • Clarify --block-outside-dns documentation
  • Update --block-outside-dns to work on Windows Vista

New in OpenVPN 2.3.10-I601 (Jan 4, 2016)

  • Prepare for v2.3.10 release, list PolarSSL 1.2 to 1.3 upgrade
  • Preparing for release v2.3.10 (ChangeLog, version.m4)
  • Make certificate expiry warning patch (091edd8e299686) work on OpenSSL 1.0.1 and earlier.
  • Repair IPv6 netsh calls if Win XP is detected
  • Use bob.example.com and alice.example.com to improve clarity of documentation
  • Remove unused variables from ssl_verify_polarssl.c's x509_get_serial()
  • Upgrade OpenVPN 2.3 to PolarSSL 1.3
  • Warn user if their certificate has expired
  • Make assert_failed() print the failed condition
  • cleanup: get rid of httpdigest.c type warnings
  • Fix regression in setups without a client certificate
  • polarssl: fix unreachable code

New in OpenVPN 2.3.9-I601 (Dec 17, 2015)

  • Show extra-certs in current parameters.
  • Fix commit a3160fc1bd7368395745b9cee6e40fb819f5564c
  • Do not set the buffer size by default but rely on the operation system default.
  • Remove --enable-password-save option
  • Reflect enable-password-save change in documentation
  • Also remove second instance of enable-password-save in the man page
  • Detect config lines that are too long and give a warning/error
  • Log serial number of revoked certificate
  • Adjust server-ipv6 documentation
  • Avoid partial authentication state when using --disabled in CCD configs
  • Make "block-outside-dns" option platform agnostic
  • Un-break --auth-user-pass on windows
  • Replace unaligned 16bit access to TCP MSS value with bytewise access
  • Repair test_local_addr() on WIN32
  • Fix possible heap overflow on read accessing getaddrinfo() result.
  • Fix FreeBSD-specific mishandling of gc arena pointer in create_arbitrary_remote()
  • remove unused gc_arena in FreeBSD close_tun()
  • Fix isatty() check for good.
  • Preparing for release v2.3.9 (ChangeLog, version.m4)
  • put virtual IPv6 addresses into env
  • Use adapter index instead of name for windows IPv6 interface config
  • Client-side part for server restart notification
  • Use adapter index for add/delete_route_ipv6
  • Pass adapter index to up/down scripts
  • Fix VS2013 compilation
  • Fix privilege drop if first connection attempt fails
  • Support for username-only auth file.
  • Add CONTRIBUTING.rst
  • Updates to Changes.rst
  • Fix termination when windows suspends/sleeps
  • Do not hard-code windows systemroot in env_block
  • Handle ctrl-C and ctrl-break events on Windows
  • Unbreak read username password from management
  • Replace strdup() calls for string_alloc() calls
  • Check return value of ms_error_text()
  • Increase control channel packet size for faster handshakes
  • hardening: add insurance to exit on a failed ASSERT()
  • Fix memory leak in auth-pam plugin
  • Fix (potential) memory leak in init_route_list()
  • Fix unintialized variable in plugin_vlog()
  • Add macro to ensure we exit on fatal errors
  • Fix memory leak in add_option() by simplifying get_ipv6_addr
  • openssl: properly check return value of RAND_bytes()
  • Fix rand_bytes return value checking
  • Add Windows DNS Leak fix using WFP ('block-outside-dns')
  • Fix "White space before end tags can break the config parser"

New in OpenVPN 2.3.8-I601 (Aug 5, 2015)

  • Contains the following changes:
  • Report missing endtags of inline files as warnings
  • Fix commit e473b7c if an inline file happens to have a line break exactly at buffer limit
  • Produce a meaningful error message if --daemon gets in the way of asking for passwords.
  • Document --daemon changes and consequences (--askpass, --auth-nocache).
  • Del ipv6 addr on close of linux tun interface
  • Fix --askpass not allowing for password input via stdin
  • write pid file immediately after daemonizing
  • Make __func__ work with Visual Studio too
  • fix regression: query password before becoming daemon
  • Fix using management interface to get passwords.
  • Fix overflow check in openvpn_decrypt()
  • Un-break --auth-user-pass on windows

New in OpenVPN 2.3.7-I603 (Jul 25, 2015)

  • Bundles OpenSSL 1.0.1p, which fixes a security vulnerability of high severity.

New in OpenVPN 2.3.7-I601 (Jun 10, 2015)

  • Default gateway can't be determined on illumos/Solaris platforms
  • Warn that tls-auth with free form files is going to be removed from OpenVPN 2.4
  • autotools: Fix wrong ./configure help screen default values
  • down-root plugin: Replaced system() calls with execve()
  • down-root: Improve error messages
  • plugin, down-root: Fix compiler warnings
  • sockets: Remove the limitation of --tcp-nodelay to be server-only
  • plugins, down-root: Code style clean-up
  • pkcs11: Load p11-kit-proxy.so module by default
  • Make 'provider' option to --show-pkcs11-ids optional where p11-kit is present
  • Use OPENVPN_ETH_P_* so that is unecessary
  • New approach to handle peer-id related changes to link-mtu (2.3 version)
  • Fix incorrect use of get_ipv6_addr() for iroute options.
  • Print helpful error message on --mktun/--rmtun if not available.
  • explain effect of --topology subnet on --ifconfig
  • Add note about file permissions and --crl-verify to manpage.
  • repair --dev null breakage caused by db950be85d37
  • assume res_init() is always there.
  • Correct note about DNS randomization in openvpn.8
  • Disallow usage of --server-poll-timeout in --secret key mode.
  • slightly enhance documentation about --cipher
  • Enforce "serial-tests" behaviour for tests/Makefile
  • Revert "Enforce "serial-tests" behaviour for tests/Makefile"
  • On signal reception, return EAI_SYSTEM from openvpn_getaddrinfo().
  • Use configure.ac hack to apply serial_test AM option only if supported.
  • Use EAI_AGAIN instead of EAI_SYSTEM for openvpn_getaddrinfo().
  • Move res_init() call to inner openvpn_getaddrinfo() loop
  • Fix FreeBSD ifconfig for topology subnet tunnels.
  • Preparing for release v2.3.7 (ChangeLog, version.m4)
  • Fix --redirect-private in --dev tap mode.
  • include ifconfig_ environment variables in --up-restart env set
  • Fix null pointer dereference in options.c
  • Fix mssfix default value in connection_list context
  • Manual page update for Re-enabled TLS version negotiation.
  • Include systemd units in the source tarball (make dist)
  • Updated manpage for --rport and --lport
  • Properly escape dashes on the man-page
  • Improve documentation in --script-security section of the man-page
  • Really fix '--cipher none' regression
  • Update doxygen (a bit)
  • Set tls-version-max to 1.1 if cryptoapicert is used
  • Account for peer-id in frame size calculation
  • Disable SSL compression
  • Fix frame size calculation for non-CBC modes.
  • Allow for CN/username of 64 characters (fixes off-by-one)
  • Remove unneeded parameter 'first_time' from possibly_become_daemon()
  • Re-enable TLS version negotiation by default
  • Remove size limit for files inlined in config
  • Improve --tls-cipher and --show-tls man page description
  • Re-read auth-user-pass file on (re)connect if required
  • Clarify --capath option in manpage
  • Call daemon() before initializing crypto library

New in OpenVPN 2.3.6-I601 (Dec 2, 2014)

  • This release fixes a critical denial of service vulnerability in OpenVPN servers (CVE-2014-8104). The vulnerability only be exploited by authenticated clients only. Also note that confidentiality and authenticity of traffic are not affected.

New in OpenVPN 2.3.5-I601 (Oct 29, 2014)

  • Fix some typos in the man page
  • Do not upcase x509-username-field for mixed-case arguments
  • Fix server routes not working in topology subnet with --server [v3]
  • Improve error reporting on file access to --client-config-dir and --ccd-exclusive
  • Don't let openvpn_popen() keep zombies around
  • Add systemd unit file for OpenVPN
  • systemd: Use systemd functions to consider systemd availability
  • Drop incoming fe80:: packets silently now.
  • Fix t_lpback.sh platform-dependent failures
  • Call init script helpers with explicit path (./)
  • Preparing for release v2.3.5 (ChangeLog, version.m4)
  • refine assertion to allow other modes than CBC
  • ocsp_check - signature verification and cert staus results are separate
  • ocsp_check - double check if ocsp didn't report any errors in execution
  • Fixed several instances of declarations after statements.
  • In socket.c, fixed issue where uninitialized value (err) is being passed to to gai_strerror.
  • Explicitly cast the third parameter of setsockopt to const void * to avoid warning.
  • MSVC 2008 doesn't support dimensioning an array with a const var nor using %z as a printf format specifier.
  • Define PATH_SEPARATOR for MSVC builds.
  • Fixed some compile issues with show_library_versions()
  • Remove quadratic complexity from openvpn_base64_decode()
  • Add configure check for the path to systemd-ask-password
  • Add topology in sample server configuration file
  • Implement on-link route adding for iproute2
  • Ensure that client-connect files are always deleted
  • Remove function without effect (cipher_ok() always returned true).
  • Remove unneeded wrapper functions in crypto_openssl.c
  • Fix bug that incorrectly refuses oid representation eku's in polar builds
  • Update README.polarssl
  • Rename ALLOW_NON_CBC_CIPHERS to ENABLE_OFB_CFB_MODE, and add to configure.
  • Add proper check for crypto modes (CBC or OFB/CFB)
  • Improve --show-ciphers to show if a cipher can be used in static key mode
  • Extend t_lpback tests to test all ciphers reported by --show-ciphers
  • Don't exit daemon if opening or parsing the CRL fails.
  • Fix typo in cipher_kt_mode_{cbc, ofb_cfb}() doxygen.
  • Fix regression with password protected private keys (polarssl)
  • ssl_polarssl.c: fix includes and make casts explicit
  • Remove unused variables from ssl_verify_openssl.c extract_x509_extension()
  • Fix "code=995" bug with windows NDIS6 tap driver.

New in OpenVPN 2.3.4-I001 (May 2, 2014)

  • Fix man page and OSCP script: tls_serial_{n} is decimal
  • Fix is_ipv6 in case of tap interface.
  • IPv6 address/route delete fix for Win8
  • Add SSL library version reporting.
  • Minor t_client.sh cleanups
  • Repair --multihome on FreeBSD for IPv4 sockets.
  • Rewrite manpage section about --multihome
  • More IPv6-related updates to the openvpn man page.
  • Conditionalize calls to print_default_gateway on !ENABLE_SMALL
  • Use native strtoull() with MSVC 2013.
  • When tls-version-min is unspecified, revert to original versioning approach.
  • Change signedness of hash in x509_get_sha1_hash(), fixes compiler warning.
  • Fix OCSP_check.sh to also use decimal for stdout verification.
  • Fix build system to accept non-system crypto library locations for plugins.
  • Make serial env exporting consistent amongst OpenSSL and PolarSSL builds.
  • Fix SOCKSv5 method selection
  • Fix typo in sample build script to use LDFLAGS

New in OpenVPN 2.3.3-I001 (Apr 9, 2014)

  • pkcs11: use generic evp key instead of rsa
  • Add support of utun devices under Mac OS X
  • Add support to ignore specific options.
  • Add a note what setenv opt does for OpenVPN < 2.3.3
  • Add reporting of UI version to basic push-peer-info set.
  • Fix compile error in ssl_openssl introduced by polar external-management patch
  • Fix assertion when SIGUSR1 is received while getaddrinfo is successful
  • Add warning for using connection block variables after connection blocks
  • Introduce safety check for http proxy options
  • man page: Update man page about the tls_digest_{n} environment variable
  • Remove the --disable-eurephia configure option
  • plugin: Extend the plug-in v3 API to identify the SSL implementation used
  • autoconf: Fix typo
  • Fix file checks when --chroot is being used
  • Document authfile for socks server
  • Fix IPv6 examples in t_client.rc-sample
  • Fix slow memory drain on each client renegotiation.
  • t_client.sh: ignore fields from "ip -6 route show" output that distort results.
  • Make code and documentation for --remote-random-hostname consistent.
  • Reduce IV_OPENVPN_GUI_VERSION= to IV_GUI_VER=
  • Document issue with --chroot, /dev/urandom and PolarSSL.
  • Rename 'struct route' to 'struct route_ipv4'
  • Replace copied structure elements with including
  • Workaround missing SSL_OP_NO_TICKET in earlier OpenSSL versions
  • Always load intermediate certificates from a PKCS#12 file
  • Support non-ASCII TAP adapter names on Windows
  • Support non-ASCII characters in Windows tmp path
  • TLS version negotiation
  • Added "setenv opt" directive prefix.
  • Set SSL_OP_NO_TICKET flag in SSL context for OpenSSL builds, to disable TLS stateless session resumption.
  • Fix spurious ignoring of pushed config options (trac#349).
  • Refactor tls_ctx_use_external_private_key()
  • --management-external-key for PolarSSL
  • external_pkcs1_sign: Support non-RSA_SIG_RAW hash_ids
  • Correct error text when no Windows TAP device is present
  • Require a 1.2.x PolarSSL version
  • tls_ctx_load_ca: Improve certificate error messages
  • Remove duplicate cipher entries from TLS translation table.
  • Fix configure interaction with static OpenSSL libraries
  • Do not pass struct tls_session* as void* in key_state_ssl_init().
  • Require polarssl >= 1.2.10 for polarssl-builds, which fixes CVE-2013-5915.
  • Use RSA_generate_key_ex() instead of deprecated, RSA_generate_key()
  • Also update TLSv1_method() calls in support code to SSLv23_method() calls.
  • Update TLSv1 error messages to SSLv23 to reflect changes from commit 4b67f98
  • If --tls-cipher is supplied, make --show-tls parse the list.
  • Add openssl-specific common cipher list names to ssl.c.
  • Add support for client-cert-not-required for PolarSSL.
  • Fix "." in description of utun.

New in OpenVPN 2.3.2-I001 (Jun 3, 2013)

  • Only print script warnings when a script is used. Remove stray mention of script-security system.
  • Move settings of user script into set_user_script function
  • Move checking of script file access into set_user_script
  • Provide more accurate warning message
  • Fix NULL-pointer crash in route_list_add_vpn_gateway().
  • Fix problem with UDP tunneling due to mishandled pktinfo structures.
  • Preparing for v2.3.2 (ChangeLog, version.m4)
  • Always push basic set of peer info values to server.
  • make 'explicit-exit-notify' pullable again
  • Fix proto tcp6 for server & non-P2MP modes
  • Fix Windows script execution when called from script hooks
  • Fixed tls-cipher translation bug in openssl-build
  • Fixed usage of stale define USE_SSL to ENABLE_SSL
  • Fix segfault when enabling pf plug-ins

New in OpenVPN 2.3.1-I001 (Mar 30, 2013)

  • Remove dead code path and putenv functionality
  • Remove unused function xor
  • Move static prototype definition from header into c file
  • Remove unused function no_tap_ifconfig
  • fix build with automake 1.13(.1)
  • Fix corner case in NTLM authentication (trac #172)
  • Update README.IPv6 to match what is in 2.3.0
  • Repair "tcp server queue overflow" brokenness, more fallout.
  • Permit pool size of /64.../112 for ifconfig-ipv6-pool
  • Add MIN() compatibility macro
  • Fix directly connected routes for "topology subnet" on Solaris.
  • close more file descriptors on exec
  • Ignore UTF-8 byte order mark
  • reintroduce --no-name-remapping option
  • make --tls-remote compatible with pre 2.3 configs
  • add new option for X.509 name verification
  • man page patch for missing options
  • Fix parameter listing in non-debug builds at verb 4
  • updated) [PATCH] Warn when using verb levels >=7 without debug
  • Enable TCP_NODELAY configuration on FreeBSD.
  • Removed ChangeLog.IPv6
  • Added cross-compilation information INSTALL-win32.txt
  • Updated README
  • Cleaned up and updated INSTALL
  • PolarSSL-1.2 support
  • Improve PolarSSL key_state_read_{cipher, plain}text messages
  • Improve verify_callback messages
  • Config compatibility patch. Added translate_cipher_name.
  • Switch to IANA names for TLS ciphers.
  • Fixed autoconf script to properly detect missing pkcs11 with polarssl.
  • Use constant time memcmp when comparing HMACs in openvpn_decrypt.

New in OpenVPN 2.3.0-I005 (Mar 11, 2013)

  • Fix OpenVPN-GUI crash on 64 bit Windows

New in OpenVPN 2.3.0 (Jan 8, 2013)

  • Fix parameter type for IP_TOS setsockopt on non-Linux systems
  • Fix client crash on double PUSH_REPLY

New in OpenVPN 2.3 RC 2 (Dec 19, 2012)

  • Fix --show-pkcs11-ids
  • Error message if max-routes used incorrectly
  • Properly require --key even if defined(MANAGMENT_EXTERNAL_KEY)
  • Remove dnsflags_to_socktype, it is not used anywhere
  • Fix the proto is used inconsistently warning
  • Fix double-free issue in pf_destroy_context()
  • The get_default_gateway() function uses warn() instead of msg()
  • Avoid recursion in virtual_output_callback_func()
  • Implement --mssfix handling for IPv6 packets.
  • Fix option inconsistency warnings about "proto" and "tun-ipv6"
  • doc/management-notes.txt: fix typo
  • Fix typo in ./configure message

New in OpenVPN 2.3 RC 1 (Nov 1, 2012)

  • Fixed a bug where PolarSSL gave an error when using an inline file tag.
  • Document man agent-external-key
  • Options parsing demands unnecessary configuration if PKCS11 is used
  • Make git ignore some more files
  • Remove the support for using system() when executing external programs or scripts
  • Preparing for v2.3_rc1
  • Fix display of plugin hook types
  • Support UTF-8 --client-config-dir
  • Fix v3 plugins to support returning values back to OpenVPN.

New in OpenVPN 2.3 Beta 1 (Sep 14, 2012)

  • Fixes error: --key fails with EXTERNAL_PRIVATE_KEY: No such file or directory if --management-external-key is used
  • Merge almost identical create_socket_tcp and create_socket_tcp6
  • Document the inlining of files in openvpn and document key-direction
  • Merge getaddr_multi and getaddr6 into one function
  • Document --management-client and --management-signal a bit better
  • Document that keep alive will double the second value in server mode and give a short explanation why the value is chosen.
  • Add checks for external-key-managements
  • Fix reconnect issues when --push and UDP is used on the server
  • Reduce --version string detail about IPv6 to just "[IPv6]".
  • Put actual OpenVPN command line on top of corresponding log file.
  • Keep pre-existing tun/tap devices around on *BSD
  • make "ipv6 ifconfig" on linux compatible with busybox ifconfig
  • fix regression with --http-proxy[-*] options
  • add x_msg_va() log function
  • add API for plug-ins to write to openvpn log
  • remove stale _openssl_get_subject() prototype
  • remove unused flag SSLF_NO_NAME_REMAPPING
  • Add --compat-names option

New in OpenVPN 2.2.1 (Dec 22, 2011)

  • Fixed several build issues
  • Updated easy-rsa for OpenSSL 1.0.0

New in OpenVPN 2.2.0 (Jul 1, 2011)

  • Several man-page updates
  • Several buildsystem fixes
  • Fixed a bug with GUI icon deletion on upgrade from 2.2-RC or earlier
  • Change the default --tmp-dir path to a more suitable path
  • Improve the mysprintf() issue in openvpnserv.c
  • Fixed bug in port-share that could cause port share process to crash
  • Fix the --client-cert-not-required feature

New in OpenVPN 2.2 RC (Mar 10, 2011)

  • Make the --x509-username-field feature an opt-in feature
  • Fix compiler warning when compiling against OpenSSL 1.0.0
  • Fix packaging of config-win32.h and service-win32/msvc.mak
  • Minor addition of logging info before and after execution of Windows net commands.
  • Change variadic macros to C99 style.
  • Added ENABLE_PASSWORD_SAVE to config-win32.h
  • Added a nmake makefile for openvpnserv.exe building
  • Moved TAP-driver version info to version.m4.
  • Cleaned up win/settings.in.
  • Added helper functionality to win/wb.py
  • Added support for viewing config-win32.h paramters to win/show.py
  • Added comments and made small modifications to win/msvc.mak.in
  • Added command-line switch to win/build_all.py to skip TAP driver building
  • Added configure.h and version.m4 variable parsing to win/config.py
  • Added openvpnserv.exe building to win/build.py
  • Added comments to win/build_ddk.py
  • Several modifications to win/make_dist.py to allow building the NSI installer
  • Copied install-win32/setpath.nsi to win/setpath.nsi
  • Added first version of NSI installer script to win/openvpn.nsi
  • Changes to buildsystem patchset
  • Temporary snprintf-related fix to service-win32/openvpnserv.c

New in OpenVPN 2.2 Beta 5 (Dec 6, 2010)

  • Fixed an issue causing a build failure with MS Visual Studio 2008.

New in OpenVPN 2.1.4 (Nov 10, 2010)

  • Fixed problem with special case route targets ('remote_host'), which could cause filling of the routing table with random garbage.

New in OpenVPN 2.1.3 (Sep 2, 2010)

  • OpenVPN GUI is now packaged in the Windows installer.
  • Extensions to Management Interface to allow greater programmatic control of OpenVPN client and server.
  • topology subnet option, allowing intuitive tun-based VPN subnets having 1 IP address per client.
  • DHCP proxy support for Windows clients using the route-gateway dhcp option.
  • TAP-Win32 adapter can now be opened from non-administrator mode.
  • PKCS #11 features for usage of cryptographic tokens ("smart cards").
  • multihome option to enable UDP-based multihoming of the server on multiple interfaces.
  • port-share option to allow OpenVPN and an HTTPS server to share TCP port 443.
  • Users upgrading from 2.x should note that the new script-security option must be set to enable OpenVPN to run scripts.

New in OpenVPN 2.1 RC15 / 2.0.9 (Nov 28, 2008)

  • Windows Vista-ready on both x86 and x64.
  • OpenVPN GUI is now packaged in the Windows installer.
  • topology subnet feature, allowing intuitive tun-based VPN subnets having 1 IP address per client.
  • TAP-Win32 adapter can now be opened from non-administrator mode.
  • PKCS #11 features for usage of cryptographic tokens ("smart cards").
  • multihome feature to enable UDP-based multihoming of the server on multiple interfaces.
  • port-share feature to allow OpenVPN and an HTTPS server to share TCP port 443.

New in OpenVPN 2.1 RC14 (Nov 18, 2008)

  • Added AC_GNU_SOURCE to configure.ac to enable structucred, with the goal of fixing a build issue on Fedora 9 that was introduced in 2.1_rc13.
  • Added additional method parameter to --script-security to preserve backward compatibility with system() call semantics used in OpenVPN 2.1_rc8 and earlier. To preserve backward compatibility use: script-security 3 system
  • Added additional warning messages about --script-security 2 or higher being required to execute user-defined scripts or executables.
  • Windows build system changes:
  • Modified Windows domake-win build system to write all openvpn.nsi input files to gen, so that gen can be disconnected from the rest of the source tree and makensis openvpn.nsi will still function correctly.
  • Added additional SAMPCONF_(CA|CRT|KEY) macros to settings.in(commented out by default).
  • Added optional files SAMPCONF_CONF2 (second sample configuration file) and SAMPCONF_DH (Diffie-Helman parameters) to Windows build system, and may be defined in settings.in.
  • Extended Management Interface "bytecount" command to work when OpenVPN is running as a server.
  • Documented Management Interface "bytecount" command in management/management-notes.txt.
  • Fixed informational message in ssl.c to properly indicate deferred authentication.
  • Added server-side --auth-user-pass-optional directive, to allow connections by clients that do not specify a username/password, when a user-defined authentication script/module is in place (via --auth-user-pass-verify, --management-client-auth, or a plugin module).
  • Changes to easy-rsa/2.0/pkitool and related openssl.cnf:
  • Calling scripts can set the KEY_NAME environmental variable to set the "name" X509 subject field in generated certificates.
  • Modified pkitool to allow flexibility in separating the Common Name convention from the cert/key filename convention.
  • For example: KEY_CN="James's Laptop" KEY_NAME="james" ./pkitool james will create a client certificate/key pair of james.crt/james.key having a Common Name of "James's Laptop" and a Name of "james".
  • Added --no-name-remapping option to allow Common Name, X509 Subject, and username strings to include any printable character including space, but excluding control characters such as tab, newline, and carriage-return (this is important for compatibility with external authentication systems).
  • As a related change, added --status-version 3 format (and "status 3" in the management interface) which uses the version 2 format except that tabs are used as delimiters instead of commas so that there is no ambiguity when parsing a Common Name that contains a comma.
  • Also, save X509 Subject fields to environment, using the naming convention:
  • X509_{cert_depth}_{name}={value}
  • This is to avoid ambiguities when parsing out the X509 subject string since "/" characters could potentially be used in the common name.
  • Fixed some ifconfig-pool issues that precluded it from being combined with --server directive.
  • Now, for example, we can configure thusly:
  • server 10.8.0.0 255.255.255.0 nopool
  • ifconfig-pool 10.8.0.2 10.8.0.99 255.255.255.0
  • to have ifconfig-pool manage only a subset of the VPN subnet.
  • Added config file option "setenv FORWARD_COMPATIBLE 1" to relax config file syntax checking to allow directives for future OpenVPN versions to be ignored.

New in OpenVPN 2.1 RC7 (Feb 9, 2008)

  • Added a few extra files that exist in the svn repo but were not being copied into the tarball by make dist.
  • Fixup null interface on close, don't use ip addr flush (Alon Bar-Lev).