CVS commit: pkgsrc/net

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Sep  3 19:02:46 UTC 2026

Modified Files:
        pkgsrc/net/openvpn: Makefile.common distinfo
        pkgsrc/net/openvpn-acct-wtmpx: distinfo
        pkgsrc/net/openvpn-nagios: distinfo

Log Message:
openvpn: updated to 2.7.7

Overview of changes in 2.7.7

Security fixes

- reliability layer: Avoid unbounded reliable TLS timeout (CVE-2026-84732)

- reliability layer: Ignore acks for packets that cannot be outstanding
  (CVE-2026-84732)

- Windows: fix ``CreateProcess()`` command line quoting for characters that
  are special to ``cmd.exe`` and where a combination of validation script
  plus rogue CA could lead to misbehavior (CVE-2026-84256)

- Windows: fix ``tapctl`` to always call ``netsh.exe`` with full path
  (as we do elsewhere) (CVE-2026-84226)

- Windows: don't use NULL DACL with system objects, namely the
  ``--service`` exit event and the ``netsh.exe`` guard semaphore.  The
  old approach was prone to a local DoS where one user could interfere
  with other users' openvpn processes by blocking the netsh semaphore
  or sending events.  This only affects setups not using the iservice,
  or using the automatic service to start/stop openvpn (CVE-2026-82312).

- Linux Netlink: validate netlink replies against the request

- Windows: fix off-by-one on input validation in openvpnserv
  (discovered while fixing CVE-2026-78221)

- Windows: openvpnserv: pass correct NRPT domains size - when IDN domains
  with UTF8 encoding were involved, a buffer overread could be achieved
  (CVE-2026-78221).

- Windows: harden CheckConfigPath() a bit more
  (another improvement while working on CVE-2026-78043)

- Windows: openvpnserv: don't allow '/' in config paths
  (the APIs windows uses for path validation do not handle '/' as path
   separator, while the file open APIs do, so this could be used to
   circumvent our config path validation, leading to openvpn.exe
   starting a user-controlled config file even if administatively not
   allowed.  CVE-2026-78043)

- Windows: dhcp: Fix off-by-one in write_dhcp_search_str() temp buffer guard
  (suitable DHCP options could lead to a single-byte overflow of a temp
   buffer, CVE-2026-81738)

Bugfixes

- work around a pubkey-handling bug in mbedTLS 4.1.0 and 4.2.0
  (supposedly fixed in 4.3.0)

- multi: don't let stale-routes-check delete permanent routes
  (the ``--stale-routes-check`` did not delete dynamic cached routes,
   but also routes installed by ``--iroute`` and ``--ifconfig-push``
   - fix by introducing route flags and restraining the check on them)

- Windows: openvpnserv: fix log lines format string
  interface names with international characters printed in some error
  messages need to be converted from UTF8 to UCS16 first.

- clinat: do not adjust UDP checksum if zero (as per RFC768)

- OpenSSL: avoid resetting the HMAC key on every packet

- fix format string specifier for size_t (%zu)

- ssl: Do not queue control ciphertext while a packet is still queued
  (fixes problems in TCP p2p handshake when both sides try to handshake
   at the same time)

- Reenable xmit_hold when using p2p tcp-server and tls-server
  (in TCP server mode, the server is not expected to initiate the TLS
   handshake - bug introduced by the multisocket code, checking the
   wrong variable for socket protocol)

- fix test_misc compile issues with -Werror

User-visible Changes

- when using EPOCH data channel format, reduce number of future keys
  from 16 to 4 (calculation was wrong, 4 spare keys are sufficient
  for 100+ Gbit/s links, less log spam in userland and less resources
  used in in-kernel implementations)

Building/Testing improvements

- clang-format: Convert deprecated setting KeepEmptyLinesAtTheStartOfBlocks

- t_client.sh: various improvements

Documentation improvements
--------------------------
- doc: Update doxygen references to removed tunnel_server_{udp, tcp}()
  (those functions do not exist in 2.7+ anymore)


To generate a diff of this commit:
cvs rdiff -u -r1.51 -r1.52 pkgsrc/net/openvpn/Makefile.common
cvs rdiff -u -r1.82 -r1.83 pkgsrc/net/openvpn/distinfo
cvs rdiff -u -r1.57 -r1.58 pkgsrc/net/openvpn-acct-wtmpx/distinfo
cvs rdiff -u -r1.54 -r1.55 pkgsrc/net/openvpn-nagios/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/openvpn/Makefile.common
diff -u pkgsrc/net/openvpn/Makefile.common:1.51 pkgsrc/net/openvpn/Makefile.common:1.52
--- pkgsrc/net/openvpn/Makefile.common:1.51     Thu Aug  6 19:13:40 2026
+++ pkgsrc/net/openvpn/Makefile.common  Thu Sep  3 19:02:45 2026
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile.common,v 1.51 2026/08/06 19:13:40 adam Exp $
+# $NetBSD: Makefile.common,v 1.52 2026/09/03 19:02:45 adam Exp $
 # used by net/openvpn/Makefile
 # used by net/openvpn-acct-wtmpx/Makefile
 # used by net/openvpn-nagios/Makefile
 
-OPENVPN_DISTNAME=      openvpn-2.7.6
+OPENVPN_DISTNAME=      openvpn-2.7.7
 OPENVPN_DISTFILE=      ${OPENVPN_DISTNAME}.tar.gz
 OPENVPN_MASTER_SITES=  https://swupdate.openvpn.org/community/releases/
 

Index: pkgsrc/net/openvpn/distinfo
diff -u pkgsrc/net/openvpn/distinfo:1.82 pkgsrc/net/openvpn/distinfo:1.83
--- pkgsrc/net/openvpn/distinfo:1.82    Thu Aug  6 19:13:40 2026
+++ pkgsrc/net/openvpn/distinfo Thu Sep  3 19:02:45 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.82 2026/08/06 19:13:40 adam Exp $
+$NetBSD: distinfo,v 1.83 2026/09/03 19:02:45 adam Exp $
 
-BLAKE2s (openvpn-2.7.6.tar.gz) = 428ead434e134d5126f50aef890a792b74b3268d3f4e8ad6e1b206e59c9bc5ae
-SHA512 (openvpn-2.7.6.tar.gz) = 2e45d147f0983b6f343b6772c20b17e67bff0143e7bcf3c2a10551b77d9929c64c86e53b4ade5493023517f3ccd92b0c1011d03cb3543321d0f9faea408e6020
-Size (openvpn-2.7.6.tar.gz) = 2105678 bytes
+BLAKE2s (openvpn-2.7.7.tar.gz) = e55ef9eaefa0c1451d51d5b3dd14e80b5c7f9615ab63b2a381bc0ea807b36218
+SHA512 (openvpn-2.7.7.tar.gz) = 27c12b94569c21fb09a081607bca8d959f70039d72335b6bf4a39d4fe02ddd1b60d8787594e0b878b1237892fd4372cf9888373609fde1469f9636eeb6ecb541
+Size (openvpn-2.7.7.tar.gz) = 2128305 bytes
 SHA1 (patch-src_compat_compat-basename.c) = c5cd48db40279a956ada044a81e6dfab015d70b6

Index: pkgsrc/net/openvpn-acct-wtmpx/distinfo
diff -u pkgsrc/net/openvpn-acct-wtmpx/distinfo:1.57 pkgsrc/net/openvpn-acct-wtmpx/distinfo:1.58
--- pkgsrc/net/openvpn-acct-wtmpx/distinfo:1.57 Thu Aug  6 19:13:40 2026
+++ pkgsrc/net/openvpn-acct-wtmpx/distinfo      Thu Sep  3 19:02:45 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.57 2026/08/06 19:13:40 adam Exp $
+$NetBSD: distinfo,v 1.58 2026/09/03 19:02:45 adam Exp $
 
-BLAKE2s (openvpn-2.7.6.tar.gz) = 428ead434e134d5126f50aef890a792b74b3268d3f4e8ad6e1b206e59c9bc5ae
-SHA512 (openvpn-2.7.6.tar.gz) = 2e45d147f0983b6f343b6772c20b17e67bff0143e7bcf3c2a10551b77d9929c64c86e53b4ade5493023517f3ccd92b0c1011d03cb3543321d0f9faea408e6020
-Size (openvpn-2.7.6.tar.gz) = 2105678 bytes
+BLAKE2s (openvpn-2.7.7.tar.gz) = e55ef9eaefa0c1451d51d5b3dd14e80b5c7f9615ab63b2a381bc0ea807b36218
+SHA512 (openvpn-2.7.7.tar.gz) = 27c12b94569c21fb09a081607bca8d959f70039d72335b6bf4a39d4fe02ddd1b60d8787594e0b878b1237892fd4372cf9888373609fde1469f9636eeb6ecb541
+Size (openvpn-2.7.7.tar.gz) = 2128305 bytes
 BLAKE2s (openvpn-acct-wtmpx-20130210.tgz) = 2bb02a4e6adb7ce1d189271a6fbb6cbffd6a37d7b5e75cccebfc8dfac6dbaddd
 SHA512 (openvpn-acct-wtmpx-20130210.tgz) = 7b8fd4929e65d8d84158f62e5a17ff3adb3b4a6cff63b29038acfb368750719f2f593786ed9b02402824c19d872b188d2a46740a5c5f853e8873a71481b13aaf
 Size (openvpn-acct-wtmpx-20130210.tgz) = 2778 bytes

Index: pkgsrc/net/openvpn-nagios/distinfo
diff -u pkgsrc/net/openvpn-nagios/distinfo:1.54 pkgsrc/net/openvpn-nagios/distinfo:1.55
--- pkgsrc/net/openvpn-nagios/distinfo:1.54     Thu Aug  6 19:13:40 2026
+++ pkgsrc/net/openvpn-nagios/distinfo  Thu Sep  3 19:02:45 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.54 2026/08/06 19:13:40 adam Exp $
+$NetBSD: distinfo,v 1.55 2026/09/03 19:02:45 adam Exp $
 
-BLAKE2s (openvpn-2.7.6.tar.gz) = 428ead434e134d5126f50aef890a792b74b3268d3f4e8ad6e1b206e59c9bc5ae
-SHA512 (openvpn-2.7.6.tar.gz) = 2e45d147f0983b6f343b6772c20b17e67bff0143e7bcf3c2a10551b77d9929c64c86e53b4ade5493023517f3ccd92b0c1011d03cb3543321d0f9faea408e6020
-Size (openvpn-2.7.6.tar.gz) = 2105678 bytes
+BLAKE2s (openvpn-2.7.7.tar.gz) = e55ef9eaefa0c1451d51d5b3dd14e80b5c7f9615ab63b2a381bc0ea807b36218
+SHA512 (openvpn-2.7.7.tar.gz) = 27c12b94569c21fb09a081607bca8d959f70039d72335b6bf4a39d4fe02ddd1b60d8787594e0b878b1237892fd4372cf9888373609fde1469f9636eeb6ecb541
+Size (openvpn-2.7.7.tar.gz) = 2128305 bytes
 BLAKE2s (openvpn-nagios-20130210.tgz) = 713b55e865350c44a314aa3b48694695f4d82b50883d1fae919f01e9545c7c34
 SHA512 (openvpn-nagios-20130210.tgz) = 80e565f32379c39eb6c7f3b4744af221ae882ff07dce9dae5bd7feb73b0edcfc7c7ac7f70d23fdcd4f492b66f095f09833deb122449840b36ea606ce91900358
 Size (openvpn-nagios-20130210.tgz) = 3034 bytes