CVS commit: pkgsrc/net

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: pkgsrc/net
From: "Adam Ciarcinski" <adam%netbsd.org@localhost>
Date: Wed, 7 Oct 2026 16:12:13 +0000

Module Name:    pkgsrc
Committed By:   adam
Date:           Wed Oct  7 16:12:13 UTC 2026

Modified Files:
        pkgsrc/net/openvpn: Makefile.common distinfo
        pkgsrc/net/openvpn-acct-wtmpx: distinfo
        pkgsrc/net/openvpn-nagios: distinfo

Log Message:
openvpn: updated to 2.7.8

Overview of changes in 2.7.8

Security fixes
- Check for NULL-Bytes in certificate subjects - refuse all such certificates
  now as "invalid" (CVE-2026-84790).
- TLS handshake with tls-crypt-v2: do not try to add a wrapped client key
  if no key material is available (client bug in response to an ill-behaving
  server).
  (No CVE assigned as "a malicious server can stop the client from working
   properly" is not considered a CVE-worthy security issue according to the
   CRA guidelines)
- options: fix unsigned underflow when clearing domain_search_list
  (CVE-2026-88964)
- win32: stop cmd.exe from expanding variables in quoted arguments
  (CVE-2026-84256)

Bug fixes
- DCO: remove installed iroutes at client exit time, not at delayed
  multi instance cleanup time - otherwise there is a race with reconnecting
  clients, possibly ending up having "no iroutes installed in the system
  at all".  Bug reported by OpenVPN Inc Access Server team.
- DCO Linux: fix remaining races between synchronous netlink operations
  and incoming asynchronous notifications, by adding a second netlink socket
  and strictly separating sync/async operations.
- Client: refuse incoming pushed option combination of epoch data format
  with non-AEAD ciphers (restart session instead of aborting with a fatal
  error).
- DCO (Linux and Windows): on failures to set up a new peer or install
  key materials for a peer, do not exit OpenVPN with a fatal error.  Instead,
  signal the error up the call-chain and restart the (multi) instance.
  The handshake is inherently racy when a peer is removed kernel-side
  due to transport errors or timeouts, and userland does not yet know this
  and wants to, for example, install new keys.  This is fatal for the
  particular client instance, but must not end the whole server process.
- DCO: stop fetching peer stats during client disconnect
  The intention of the original code was to ensure reported counters
  are always correct, but it did not work (because at query time, the peer
  in kernel is already gone, so we only got an error message) - and very
  inefficiently so (because we queried all the peers all the time).
  End-of-session final counter values will be implemented properly by a
  followup patch leveraging counters piggybacked on the kernel's
  "DEL_PEER" notification message.
- p2mp server: improve handling of mbuf lists in the face of broadcast
  or multicast traffic, and fix a bug on client exit that could lead
  to a server queue deadlock in very particular scenarios.

User-visible Changes
- Certificate validation is now stricter regarding NULL bytes in strings
  (see above).  This might break existing installations if such certificates
  exist and OpenSSL builds are used.  mbedTLS builds always rejected this.
- On a certificate with duplicate fields (multiple CN, for example) OpenSSL
  builds would use the last one, mbedTLS builds use the first one - changed
  in the mbedTLS build so behaviour is identical.

Building/Testing improvements
- Github Action maintenance update (mostly: Ubuntu 26.04 and AWS-LC v5.9.0)
- work around mingw bug on Ubuntu 26.04 that would flag %zu as invalid
  printf() specifier, breaking -Werror builds
- GHA: explicitly set PKG_CONFIG_PATH for Android builds, build environment
  dependencies for lz4 are different from host system dependencies
- reliable: add unit tests for ACK and backoff DoS hardening

Code improvements/general hardening
- buffer: make buf_valid() and buf_defined() NULL-safe

Documentation improvements
- improve auth token related comments in the code
- improve documentation for client-kill management command


To generate a diff of this commit:
cvs rdiff -u -r1.52 -r1.53 pkgsrc/net/openvpn/Makefile.common
cvs rdiff -u -r1.83 -r1.84 pkgsrc/net/openvpn/distinfo
cvs rdiff -u -r1.58 -r1.59 pkgsrc/net/openvpn-acct-wtmpx/distinfo
cvs rdiff -u -r1.55 -r1.56 pkgsrc/net/openvpn-nagios/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/openvpn/Makefile.common
diff -u pkgsrc/net/openvpn/Makefile.common:1.52 pkgsrc/net/openvpn/Makefile.common:1.53
--- pkgsrc/net/openvpn/Makefile.common:1.52     Thu Sep  3 19:02:45 2026
+++ pkgsrc/net/openvpn/Makefile.common  Wed Oct  7 16:12:13 2026
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile.common,v 1.52 2026/09/03 19:02:45 adam Exp $
+# $NetBSD: Makefile.common,v 1.53 2026/10/07 16:12:13 adam Exp $
 # used by net/openvpn/Makefile
 # used by net/openvpn-acct-wtmpx/Makefile
 # used by net/openvpn-nagios/Makefile
 
-OPENVPN_DISTNAME=      openvpn-2.7.7
+OPENVPN_DISTNAME=      openvpn-2.7.8
 OPENVPN_DISTFILE=      ${OPENVPN_DISTNAME}.tar.gz
 OPENVPN_MASTER_SITES=  https://swupdate.openvpn.org/community/releases/
 

Index: pkgsrc/net/openvpn/distinfo
diff -u pkgsrc/net/openvpn/distinfo:1.83 pkgsrc/net/openvpn/distinfo:1.84
--- pkgsrc/net/openvpn/distinfo:1.83    Thu Sep  3 19:02:45 2026
+++ pkgsrc/net/openvpn/distinfo Wed Oct  7 16:12:13 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.83 2026/09/03 19:02:45 adam Exp $
+$NetBSD: distinfo,v 1.84 2026/10/07 16:12:13 adam Exp $
 
-BLAKE2s (openvpn-2.7.7.tar.gz) = e55ef9eaefa0c1451d51d5b3dd14e80b5c7f9615ab63b2a381bc0ea807b36218
-SHA512 (openvpn-2.7.7.tar.gz) = 27c12b94569c21fb09a081607bca8d959f70039d72335b6bf4a39d4fe02ddd1b60d8787594e0b878b1237892fd4372cf9888373609fde1469f9636eeb6ecb541
-Size (openvpn-2.7.7.tar.gz) = 2128305 bytes
+BLAKE2s (openvpn-2.7.8.tar.gz) = c00f21af6f3a325b398702f9d0a8145933ac9bd083049f68b56f17b97745873c
+SHA512 (openvpn-2.7.8.tar.gz) = 1461dbe00e35219c06c0e8f5836877522a8d5db786a6f3a6049aebdbb0b326dd816a6fc3197ebd3a5c1019a54e703d52c28af77c747e266e31438d1a9f64b631
+Size (openvpn-2.7.8.tar.gz) = 2123466 bytes
 SHA1 (patch-src_compat_compat-basename.c) = c5cd48db40279a956ada044a81e6dfab015d70b6

Index: pkgsrc/net/openvpn-acct-wtmpx/distinfo
diff -u pkgsrc/net/openvpn-acct-wtmpx/distinfo:1.58 pkgsrc/net/openvpn-acct-wtmpx/distinfo:1.59
--- pkgsrc/net/openvpn-acct-wtmpx/distinfo:1.58 Thu Sep  3 19:02:45 2026
+++ pkgsrc/net/openvpn-acct-wtmpx/distinfo      Wed Oct  7 16:12:13 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.58 2026/09/03 19:02:45 adam Exp $
+$NetBSD: distinfo,v 1.59 2026/10/07 16:12:13 adam Exp $
 
-BLAKE2s (openvpn-2.7.7.tar.gz) = e55ef9eaefa0c1451d51d5b3dd14e80b5c7f9615ab63b2a381bc0ea807b36218
-SHA512 (openvpn-2.7.7.tar.gz) = 27c12b94569c21fb09a081607bca8d959f70039d72335b6bf4a39d4fe02ddd1b60d8787594e0b878b1237892fd4372cf9888373609fde1469f9636eeb6ecb541
-Size (openvpn-2.7.7.tar.gz) = 2128305 bytes
+BLAKE2s (openvpn-2.7.8.tar.gz) = c00f21af6f3a325b398702f9d0a8145933ac9bd083049f68b56f17b97745873c
+SHA512 (openvpn-2.7.8.tar.gz) = 1461dbe00e35219c06c0e8f5836877522a8d5db786a6f3a6049aebdbb0b326dd816a6fc3197ebd3a5c1019a54e703d52c28af77c747e266e31438d1a9f64b631
+Size (openvpn-2.7.8.tar.gz) = 2123466 bytes
 BLAKE2s (openvpn-acct-wtmpx-20130210.tgz) = 2bb02a4e6adb7ce1d189271a6fbb6cbffd6a37d7b5e75cccebfc8dfac6dbaddd
 SHA512 (openvpn-acct-wtmpx-20130210.tgz) = 7b8fd4929e65d8d84158f62e5a17ff3adb3b4a6cff63b29038acfb368750719f2f593786ed9b02402824c19d872b188d2a46740a5c5f853e8873a71481b13aaf
 Size (openvpn-acct-wtmpx-20130210.tgz) = 2778 bytes

Index: pkgsrc/net/openvpn-nagios/distinfo
diff -u pkgsrc/net/openvpn-nagios/distinfo:1.55 pkgsrc/net/openvpn-nagios/distinfo:1.56
--- pkgsrc/net/openvpn-nagios/distinfo:1.55     Thu Sep  3 19:02:45 2026
+++ pkgsrc/net/openvpn-nagios/distinfo  Wed Oct  7 16:12:13 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.55 2026/09/03 19:02:45 adam Exp $
+$NetBSD: distinfo,v 1.56 2026/10/07 16:12:13 adam Exp $
 
-BLAKE2s (openvpn-2.7.7.tar.gz) = e55ef9eaefa0c1451d51d5b3dd14e80b5c7f9615ab63b2a381bc0ea807b36218
-SHA512 (openvpn-2.7.7.tar.gz) = 27c12b94569c21fb09a081607bca8d959f70039d72335b6bf4a39d4fe02ddd1b60d8787594e0b878b1237892fd4372cf9888373609fde1469f9636eeb6ecb541
-Size (openvpn-2.7.7.tar.gz) = 2128305 bytes
+BLAKE2s (openvpn-2.7.8.tar.gz) = c00f21af6f3a325b398702f9d0a8145933ac9bd083049f68b56f17b97745873c
+SHA512 (openvpn-2.7.8.tar.gz) = 1461dbe00e35219c06c0e8f5836877522a8d5db786a6f3a6049aebdbb0b326dd816a6fc3197ebd3a5c1019a54e703d52c28af77c747e266e31438d1a9f64b631
+Size (openvpn-2.7.8.tar.gz) = 2123466 bytes
 BLAKE2s (openvpn-nagios-20130210.tgz) = 713b55e865350c44a314aa3b48694695f4d82b50883d1fae919f01e9545c7c34
 SHA512 (openvpn-nagios-20130210.tgz) = 80e565f32379c39eb6c7f3b4744af221ae882ff07dce9dae5bd7feb73b0edcfc7c7ac7f70d23fdcd4f492b66f095f09833deb122449840b36ea606ce91900358
 Size (openvpn-nagios-20130210.tgz) = 3034 bytes

Prev by Date: CVS commit: pkgsrc/doc
Next by Date: CVS commit: pkgsrc/databases/py-peewee
Previous by Thread: CVS commit: pkgsrc/doc
Next by Thread: CVS commit: pkgsrc/databases/py-peewee
Indexes:

Home | Main Index | Thread Index | Old Index