Skip to content

Commit 6640a10

Browse files
cron2cron2
committed
preparing release 2.6.9
version.m4, ChangeLog, Changes.rst
1 parent d8faf56 commit 6640a10

File tree

3 files changed

+188
-3
lines changed

3 files changed

+188
-3
lines changed

‎ChangeLog

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,76 @@
11
OpenVPN ChangeLog
22
Copyright (C) 2002-2023 OpenVPN Inc <[email protected]>
33

4+
2024.02.11 -- Version 2.6.9
5+
6+
Arne Schwabe (15):
7+
Remove unused function prototype crypto_adjust_frame_parameters
8+
Log SSL alerts more prominently
9+
Document tls-exit option mainly as test option
10+
Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
11+
Fix check_session_buf_not_used using wrong index
12+
Add missing check for nl_socket_alloc failure
13+
Add check for nice in cmake config
14+
Remove compat versionhelpers.h and remove cmake/configure check for it
15+
Extend the error message when TLS 1.0 PRF fails
16+
Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
17+
Check PRF availability on initialisation and add --force-tls-key-material-export
18+
Make it more explicit and visible when pkg-config is not found
19+
Clarify that the tls-crypt-v2-verify has a very limited env set
20+
Implement the --tls-export-cert feature
21+
Remove conditional text for Apache2 linking exception
22+
23+
David Sommerseth (2):
24+
Remove --tls-export-cert
25+
Remove superfluous x509_write_pem()
26+
27+
Frank Lichtenheld (14):
28+
sample-keys: renew for the next 10 years
29+
GHA: clean up libressl builds with newer libressl
30+
configure.ac: Remove unused AC_TYPE_SIGNAL macro
31+
documentation: remove reference to removed option --show-proxy-settings
32+
unit_tests: remove includes for mock_msg.h
33+
documentation: improve documentation of --x509-track
34+
NTLM: add length check to add_security_buffer
35+
NTLM: increase size of phase 2 response we can handle
36+
proxy-options.rst: Add proper documentation for --http-proxy-user-pass
37+
buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
38+
--http-proxy-user-pass: allow to specify in either order with --http-proxy
39+
README.cmake.md: Document minimum required CMake version for --preset
40+
documentation: Update and fix documentation for --push-peer-info
41+
documentation: Fixes for previous fixes to --push-peer-info
42+
43+
Gert Doering (4):
44+
OpenBSD: repair --show-gateway
45+
get_default_gateway() HWADDR overhaul
46+
fix uncrustify complaints about previous patch
47+
preparing release 2.6.9
48+
49+
Kristof Provost (1):
50+
dco-freebsd: dynamically re-allocate buffer if it's too small
51+
52+
Lev Stipakov (1):
53+
tun.c: don't attempt to delete DNS and WINS servers if they're not set
54+
55+
Marc Becker (1):
56+
vcpkg-ports/pkcs11-helper: bump to version 1.30
57+
58+
Max Fillinger (4):
59+
Add support for mbedtls 3.X.Y
60+
Update README.mbedtls
61+
Disable TLS 1.3 support with mbed TLS
62+
Enable key export with mbed TLS 3.x.y
63+
64+
Reynir Bjoernsson (1):
65+
protocol_dump: tls-crypt support
66+
67+
Steffan Karger (1):
68+
Fix IPv6 route add/delete message log level
69+
70+
yatta (1):
71+
fix(ssl): init peer_id when init tls_multi
72+
73+
474
2023.11.17 -- Version 2.6.8
575

676
Aquila Macedo (1):

‎Changes.rst

Lines changed: 116 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,118 @@
1+
Overview of changes in 2.6.9
2+
============================
3+
4+
Security fixes
5+
--------------
6+
- Windows Installer: fix CVE 2023-7235 where installing to a non-default
7+
directory could lead to a local privilege escalation.
8+
Reported by Will Dormann <[email protected]>.
9+
10+
New features
11+
------------
12+
- add support for building with mbedTLS 3.x.x
13+
14+
- new option "--force-tls-key-material-export" to only accept clients
15+
that can do TLS keying material export to generate session keys
16+
(mostly an internal option to better deal with TLS 1.0 PRF failures).
17+
18+
- Windows: bump vcpkg-ports/pkcs11-helper to 1.30
19+
20+
- Log incoming SSL alerts in easier to understand form and move logging
21+
from "--verb 8" to "--verb 3".
22+
23+
- protocol_dump(): add support for printing "--tls-crypt" packets
24+
25+
26+
User visible changes
27+
--------------------
28+
- license change is now complete, and all code has been re-licensed
29+
under the new license (still GPLv2, but with new linking exception
30+
for Apache2 licensed code). See COPYING for details.
31+
32+
Code that could not be re-licensed has been removed or rewritten.
33+
34+
- the original code for the "--tls-export-cert" feature has been removed
35+
(due to the re-licensing effort) and rewritten without looking at the
36+
original code. Feature-compatibility has been tested by other developers,
37+
looking at both old and new code and documentation, so there *should*
38+
not be a user-visible change here.
39+
40+
- IPv6 route addition/deletion are now logged on the same level (3) as
41+
for IPv4. Previously IPv6 was always logged at "--verb 1".
42+
43+
- better handling of TLS 1.0 PRF failures in the underlying SSL library
44+
(e.g. on some FIPS builds) - this is now reported on startup, and
45+
clients before 2.6.0 that can not use TLS EKM to generate key material
46+
are rejected by the server. Also, error messages are improved to see
47+
what exactly failed.
48+
49+
- packaged sample-keys renewed (old keys due to expire in October 2024)
50+
51+
52+
Bug fixes / Code cleanup
53+
------------------------
54+
- Windows GUI: always update tray icon on state change (Github: #669)
55+
(for persistent connection profiles, "connecting" state would not show)
56+
57+
- FreeBSD: for servers with multiple clients, reporting of peer traffic
58+
statistics would fail due to insufficient buffer space (Github: #487)
59+
60+
- make interaction between "--http-proxy-user-pass" and "--http-proxy"
61+
more consistent
62+
63+
- doc: improve documentation on "--http-proxy-user-pass"
64+
65+
- doc: improve documentation for IV_ variables and IV_PROTO bits
66+
67+
- doc: improve documentation on CMake requirements
68+
69+
- fix various coverity-reported complains (signed/unsigned comparison etc),
70+
none of them actual bugs
71+
72+
- NTLMv2: increase phase 2 buffers so things actually work
73+
74+
- NTLM: add extra buffer size verification checks
75+
76+
- doc: improve documentation on "--tls-crypt-v2-verify"
77+
78+
- autoconf on Linux: improve error reporting for missing libraries - in
79+
case the problem came due to missing "pkg-config" the previous error
80+
was misleading. Now clearly report that Linux builds require "pkg-config"
81+
and abort if not found.
82+
83+
- MacOS X: fix "undefined behaviour" found by UBSAN in get_default_gateway()
84+
(IV_HWADDR), using getifaddrs(3) instead of old and convoluted
85+
SIOCGIFCONF API.
86+
87+
- OpenSolaris: correctly implement get_default_gateway() (IV_HWADDR), using
88+
SIOCGIFHWADDR instead of SIOCGIFCONF API.
89+
90+
- OpenBSD: work around route socket issue in get_default_gateway()
91+
("--show-gateway") where RA_IFP must not be set on the query message,
92+
otherwise kernel will return EINVAL.
93+
94+
- doc: improve documentation of --x509-track
95+
96+
- bugfix: in UDP mode when exceeding "--max-clients", OpenVPN would
97+
incorrectly close the connection to "peer-id 0". Fix by correctly
98+
initializing peer_id with MAX_PEER_ID.
99+
100+
- Windows: do not attempt to delete DNS or WINS servers if they are not set
101+
102+
- configure: get rid of AC_TYPE_SIGNAL macro (unused)
103+
104+
- Linux DCO: add missing check for nl_socket_alloc() failure
105+
106+
- bugfix: check_session_buf_not_used() was not working as planned
107+
108+
- remove dead test code for TEST_GET_DEFAULT_GATEWAY (use "--show-gateway")
109+
110+
- doc: better document "--tls-exit" option
111+
112+
- Github Actions: clean up LibreSSL builds
113+
114+
115+
1116
Overview of changes in 2.6.8
2117
============================
3118

@@ -526,7 +641,7 @@ Improve DCO-related logging in many places.
526641
DCO/Linux robustness fixes.
527642

528643
DCO/Linux TCP crashbug (recvfrom(-1) endless loop) worked around - root
529-
cause has not been found, but the condition is detected and the
644+
cause has not been found, but the condition is detected and the
530645
offending client is removed, instead of crashing the server.
531646

532647
Rename internal TLS state TM_UNTRUSTED to TM_INITIAL, always start new

‎version.m4

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@ define([PRODUCT_NAME], [OpenVPN])
33
define([PRODUCT_TARNAME], [openvpn])
44
define([PRODUCT_VERSION_MAJOR], [2])
55
define([PRODUCT_VERSION_MINOR], [6])
6-
define([PRODUCT_VERSION_PATCH], [.8])
6+
define([PRODUCT_VERSION_PATCH], [.9])
77
m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_MAJOR])
88
m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_MINOR], [[.]])
99
m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_PATCH], [[]])
1010
define([PRODUCT_BUGREPORT], [[email protected]])
11-
define([PRODUCT_VERSION_RESOURCE], [2,6,8,0])
11+
define([PRODUCT_VERSION_RESOURCE], [2,6,9,0])
1212
dnl define the TAP version
1313
define([PRODUCT_TAP_WIN_COMPONENT_ID], [tap0901])
1414
define([PRODUCT_TAP_WIN_MIN_MAJOR], [9])

0 commit comments

Comments
 (0)