From patchwork Fri Nov 6 13:08:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10698 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4jLfdK1nX0z3wb2 for ; Fri, 06 Nov 2026 13:08:53 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jLfdJ5ssSz6b6 for ; Fri, 06 Nov 2026 13:08:52 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jLfdJ57NCz32M3 for ; Fri, 06 Nov 2026 13:08:52 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jLfdG0JJsz2xJq for ; Fri, 06 Nov 2026 13:08:50 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4jLfdD6F4Mz4ZC; Fri, 06 Nov 2026 13:08:48 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1793970529; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=FzFR3ogNtrafnrU3gOiXOipcDCljTDVZnkKErRW6PEw=; b=huEYSFqeWkIv4BfJOaq7AJ+ZTzPROh0GRWKLHtu8O5+UOREQXGl7mhrLqSFq6d06VXTHzY 5BH+u3ze9mjSBQCw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1793970529; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=FzFR3ogNtrafnrU3gOiXOipcDCljTDVZnkKErRW6PEw=; b=jCQOoHpVXC8VdMudjQ935X8ns9nR9N5OBg6e6qJvLhr0y3ip990LJ517YuyY0HceyahiSE 7SsosGtTp7bAZ+1KonS6iCDaEYx4kuBs+OSKNHrJHEoolztRDdHBw5ncmNVTy6okIs8r6V bGG7iiJ+TaweNDYUXQTBKj1oTRV6U3R+llMkDSCFx1/gpC6DMkwD0kFBy6LdQiKsqBe/+g SXyPTo30HL39AvWVef8GVCXTOYzpQXsxJG4WkUeWFKol/QTf8Wdyuml1DpRr5ElI8nB2Pv 7QByedBhjC4g9hZTktXQRnLGkJudDfDBfZuWGL1+uY2U7gVdyKPxrg5bs8uUNg== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] openvpn: Update to version 2.7.9 Date: Fri, 6 Nov 2026 14:08:46 +0100 Message-ID: <20261106130846.3094481-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 2.7.8 to 2.7.9 - Update of rootfile - There are 3 CVE Fixes but these are for win32 as are all the security fixes. The majority of bug fixes are also for win32 but there are 4 bug fixes that are general ones. There are also several general hardening improvements. - Changelog 2.7.9 Security fixes - win32: restrict loading plugin dependencies (DLLs) to plugin, app and system directories. - win32: run openvpn.exe from the interactive service at "high integrity level", that is, process memory of openvpn.exe and all its threads are protected from tampering. Signals/Events are still permitted. - win32: openvpnserv: strictly filter user-defined environment variables before passing to openvpn.exe (CVE-2026-121720) (Issue found by Heiko Hund, , tracked in Github: OpenVPN/openvpn-private-issues#186) - win32: openvpnserv: make validation of openvpn command line more robust to invalid-quoting attacks (CVE-2026-115342) - win32: openvpn.exe: change parsing of commandline to use the same function that the interactive service uses (CommandLineToArgvW()) (CVE-2026-115342) (Issue found by Heiko Hund, , tracked in Github: OpenVPN/openvpn-private-issues#184) Bug fixes - Username/Password parsing from --auth-user-pass file (or inline) left parts of overlong usernames in the password field. Fix. (GH OpenVPN/openvpn#1140) - win32: openvpnserv: fix memory leak for security descriptors - win32: repair logging of errors in Windows tun_read_queue() - win32: avoid accessing uninitialized structure data if GetInterfaceInfo() or GetPerAdapterInfo() fail - win32: openvpnserv: avoid double free() if GetTokenInformation() fails - win32: openvpnserv: avoid potential format-string issue on registry defaults - win32: openvpnserv: repair error reporting on RegGetValueA() failures inside GetItfDnsServersV4() - win32: openvpnserv: fix inet_ntop() return code check in GetItfDnsServersV6(), making it ignore DHCP-provided DNS servers. - route: repair printing of ROUTE_GATEWAY/ROUTE6_GATEWAY info broken by commit 2777cdd3 - the actual gateway handling was correct, just not printing anything anymore. - config: check_file_access: fix --extra-certs access check - win32: tun: free gc arena in windows_set_mtu() (mem leak in error path) - route: close socket in Haiku get_default_gateway() (FD leak) - win32: openvpnserv: skip conversion of empty domain names - win32: cmake+mingw: don't prefix the event message DLL with lib (it was building 'libopenvpnservmsg.dll' instead of 'openvpnservmsg.dll') - win32: pass the buffer size in bytes to get_openvpn_reg_value() - PUSH_UPDATE server: free temporary options after sending message (memleak) User-visible Changes - Linux: set IFF_BACKPRESSURE on Linux (if available) This helps the kernel tun/tap to apply proper prioritization (qdisc etc) to incoming packets if userspace is slow to process them. Without the flag, the kernel would just drop everything. - Management/GUI: Optionally indicate username in >PASSWORD '' prompts If an openvpn config has a username set but no password, and OpenVPN wants to prompt for the password, the GUI could not see the username today and prompted for both. With this change, OpenVPN sends a hint to the management interface, so a GUI can pre-fill the username field, or only prompt for the password. This is only done if the management interface client announces support for it (compatibility level >= 6). Building/Testing improvements - test_provider: Fix compiler warning with clang 23 - configure: Call AC_PROG_CC before AC_USE_SYSTEM_EXTENSIONS - configure: Output compiler version - automake: Add build-tests recursive target - configure: Require automake 1.16 - clang-format: Enable InsertNewlineAtEOF - t_client.sh.in: Check whether addresses are in "tentative" state - config.h.cmake.in: Fix issues with string functions - Add missing includes for C files and their own headers Code improvements/general hardening - crypto_epoch: wipe key material with secure_memzero() - do not look up "none" cipher in OpenSSL - this avoids leaving an "error" on the OpenSSL error stack, which can then later lead to spurious SSL error prints on CRL loading. - Make CRL reload EOF detection independent of stale error queue entries (GH: OpenVPN/openvpn#1104) - tls_crypt: fix handling of "cipher final output" (which is always empty on today's SSL libraries, so no impact today, but might not be in future) - crypto: ASSERT() opt before first use in openvpn_decrypt_aead() - auth_token: wipe the server secret key after loading it - port-share: do not write journal file through symlinks or hardlinks (and also document how port-share directory should be set up) (GH OpenVPN/openvpn#1124) - dns-updown: close first pipe if creating the second one fails (avoid leaking file descriptors on error) - init: check parameters for NULL before strlen() in send_cc_message (not triggerable today) - crypto_openssl: Clear PEM decoded key data before freeing it - Increase the buffer size for alert-message in management user-pass query (so long usernames can be hinted towards the GUI) - win32: openvpnserv: validate message size for dns/nrpt/wins handlers (GH: OpenVPN/openvpn#1129) - win32: plugin: detect too long plugin paths on Windows - win32: openvpnserv: null-terminate iface.name in address and route handlers (GH: OpenVPN/openvpn#1130) Documentation improvements - Fix numbering of examples in management-notes.txt - Document "notify" as auth pending method - Convert Changes.rst to Markdown (2.7) Long-term code maintenance - OpenSSL 4.1 compatibility: use ASN1_STRING_get_length() now, providing a fallback to ASN1_STRING_length() for older SSL libraries. - Linux: sitnl: use RTM_SETLINK for updating existing interfaces (instead of RTM_NEWLINK) - gen-sample-keys.sh: Don't apply server extensions to CSRs - review all usages of strncpy() (change to strncpynt(), memcpy(), etc. where appropriate) Signed-off-by: Adolf Belka --- config/rootfiles/common/openvpn | 2 +- lfs/openvpn | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/openvpn index 46c242d10..1b8a3517f 100644 --- a/config/rootfiles/common/openvpn +++ b/config/rootfiles/common/openvpn @@ -15,7 +15,7 @@ usr/sbin/openvpn-authenticator #usr/share/doc/openvpn #usr/share/doc/openvpn/COPYING #usr/share/doc/openvpn/COPYRIGHT.GPL -#usr/share/doc/openvpn/Changes.rst +#usr/share/doc/openvpn/Changes.md #usr/share/doc/openvpn/README #usr/share/doc/openvpn/README.auth-pam #usr/share/doc/openvpn/README.down-root diff --git a/lfs/openvpn b/lfs/openvpn index b705fdd6c..a511fc281 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -24,7 +24,7 @@ include Config -VER = 2.7.8 +VER = 2.7.9 THISAPP = openvpn-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = dfe77dc1c066cc03540b7249963db2030fabe62c52d3e460aab571f11c2ae304204793ca348964308f8713b282244cbe043a7c4546649d4f2fb923ae38e26591 +$(DL_FILE)_BLAKE2 = 543946533cac5805698f9397d066fe99c8d35e3aadc530c8239b2a586cff7ccbc0b0f60cb061c95a8934e2cfd12b3ebfef887ed76f51906ce4378882a0f418c2 install : $(TARGET)