CVS commit: pkgsrc/net

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Fri Nov  6 11:59:39 UTC 2026

Modified Files:
        pkgsrc/net/openvpn: Makefile.common PLIST distinfo
        pkgsrc/net/openvpn-acct-wtmpx: distinfo
        pkgsrc/net/openvpn-nagios: distinfo

Log Message:
openvpn: updated to 2.7.9

2.7.9

Security fixes

- win32: restrict loading plugin dependencies (DLLs) to plugin, app
  and system directories.

- win32: run openvpn.exe from the interactive service at "high integrity
  level", that is, process memory of openvpn.exe and all its threads are
  protected from tampering.  Signals/Events are still permitted.

- win32: openvpnserv: strictly filter user-defined environment variables
  before passing to openvpn.exe (CVE-2026-121720)

- win32: openvpnserv: make validation of openvpn command line more robust
  to invalid-quoting attacks (CVE-2026-115342)

- win32: openvpn.exe: change parsing of commandline to use the same
  function that the interactive service uses (CommandLineToArgvW())
  (CVE-2026-115342)

Bug fixes

- Username/Password parsing from --auth-user-pass file (or inline)
  left parts of overlong usernames in the password field.  Fix.

- win32: openvpnserv: fix memory leak for security descriptors

- win32: repair logging of errors in Windows tun_read_queue()

- win32: avoid accessing uninitialized structure data if GetInterfaceInfo()
  or GetPerAdapterInfo() fail

- win32: openvpnserv: avoid double free() if GetTokenInformation() fails

- win32: openvpnserv: avoid potential format-string issue on registry defaults

- win32: openvpnserv: repair error reporting on RegGetValueA() failures
  inside GetItfDnsServersV4()

- win32: openvpnserv: fix inet_ntop() return code check in
  GetItfDnsServersV6(), making it ignore DHCP-provided DNS servers.

- route: repair printing of ROUTE_GATEWAY/ROUTE6_GATEWAY info broken
  by commit 2777cdd3 - the actual gateway handling was correct, just not
  printing anything anymore.

- config: check_file_access: fix --extra-certs access check

- win32: tun: free gc arena in windows_set_mtu() (mem leak in error path)

- route: close socket in Haiku get_default_gateway() (FD leak)

- win32: openvpnserv: skip conversion of empty domain names

- win32: cmake+mingw: don't prefix the event message DLL with lib
  (it was building 'libopenvpnservmsg.dll' instead of 'openvpnservmsg.dll')

- win32: pass the buffer size in bytes to get_openvpn_reg_value()

- PUSH_UPDATE server: free temporary options after sending message (memleak)

User-visible Changes

- Linux: set IFF_BACKPRESSURE on Linux (if available)

  This helps the kernel tun/tap to apply proper prioritization (qdisc etc)
  to incoming packets if userspace is slow to process them.  Without the
  flag, the kernel would just drop everything.

- Management/GUI: Optionally indicate username in >PASSWORD '<UP_TYPE>' prompts

  If an openvpn config has a username set but no password, and OpenVPN
  wants to prompt for the password, the GUI could not see the username
  today and prompted for both.  With this change, OpenVPN sends a hint to
  the management interface, so a GUI can pre-fill the username field, or
  only prompt for the password.

  This is only done if the management interface client announces
  support for it (compatibility level >= 6).


To generate a diff of this commit:
cvs rdiff -u -r1.53 -r1.54 pkgsrc/net/openvpn/Makefile.common
cvs rdiff -u -r1.28 -r1.29 pkgsrc/net/openvpn/PLIST
cvs rdiff -u -r1.84 -r1.85 pkgsrc/net/openvpn/distinfo
cvs rdiff -u -r1.59 -r1.60 pkgsrc/net/openvpn-acct-wtmpx/distinfo
cvs rdiff -u -r1.56 -r1.57 pkgsrc/net/openvpn-nagios/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/openvpn/Makefile.common
diff -u pkgsrc/net/openvpn/Makefile.common:1.53 pkgsrc/net/openvpn/Makefile.common:1.54
--- pkgsrc/net/openvpn/Makefile.common:1.53     Wed Oct  7 16:12:13 2026
+++ pkgsrc/net/openvpn/Makefile.common  Fri Nov  6 11:59:39 2026
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile.common,v 1.53 2026/10/07 16:12:13 adam Exp $
+# $NetBSD: Makefile.common,v 1.54 2026/11/06 11:59:39 adam Exp $
 # used by net/openvpn/Makefile
 # used by net/openvpn-acct-wtmpx/Makefile
 # used by net/openvpn-nagios/Makefile
 
-OPENVPN_DISTNAME=      openvpn-2.7.8
+OPENVPN_DISTNAME=      openvpn-2.7.9
 OPENVPN_DISTFILE=      ${OPENVPN_DISTNAME}.tar.gz
 OPENVPN_MASTER_SITES=  https://swupdate.openvpn.org/community/releases/
 

Index: pkgsrc/net/openvpn/PLIST
diff -u pkgsrc/net/openvpn/PLIST:1.28 pkgsrc/net/openvpn/PLIST:1.29
--- pkgsrc/net/openvpn/PLIST:1.28       Sun Feb 15 12:50:42 2026
+++ pkgsrc/net/openvpn/PLIST    Fri Nov  6 11:59:39 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.28 2026/02/15 12:50:42 adam Exp $
+@comment $NetBSD: PLIST,v 1.29 2026/11/06 11:59:39 adam Exp $
 include/openvpn-msg.h
 include/openvpn-plugin.h
 ${PLIST.pam}lib/openvpn/plugins/openvpn-plugin-auth-pam.la
@@ -9,7 +9,7 @@ man/man8/openvpn.8
 sbin/openvpn
 share/doc/openvpn/COPYING
 share/doc/openvpn/COPYRIGHT.GPL
-share/doc/openvpn/Changes.rst
+share/doc/openvpn/Changes.md
 share/doc/openvpn/README
 ${PLIST.pam}share/doc/openvpn/README.auth-pam
 share/doc/openvpn/README.down-root

Index: pkgsrc/net/openvpn/distinfo
diff -u pkgsrc/net/openvpn/distinfo:1.84 pkgsrc/net/openvpn/distinfo:1.85
--- pkgsrc/net/openvpn/distinfo:1.84    Wed Oct  7 16:12:13 2026
+++ pkgsrc/net/openvpn/distinfo Fri Nov  6 11:59:39 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.84 2026/10/07 16:12:13 adam Exp $
+$NetBSD: distinfo,v 1.85 2026/11/06 11:59:39 adam Exp $
 
-BLAKE2s (openvpn-2.7.8.tar.gz) = c00f21af6f3a325b398702f9d0a8145933ac9bd083049f68b56f17b97745873c
-SHA512 (openvpn-2.7.8.tar.gz) = 1461dbe00e35219c06c0e8f5836877522a8d5db786a6f3a6049aebdbb0b326dd816a6fc3197ebd3a5c1019a54e703d52c28af77c747e266e31438d1a9f64b631
-Size (openvpn-2.7.8.tar.gz) = 2123466 bytes
+BLAKE2s (openvpn-2.7.9.tar.gz) = 1f7ae33a89642b1e7f27bf7173694b62197cb2e3a81d09517aeab760339da3e8
+SHA512 (openvpn-2.7.9.tar.gz) = 6069d24d945f9a1a22129d7bdcb360c5d578671b0293f616231de68959db21a09185078a536b926f062ba6b0f3e69b0a0db4bb7a5f7cbd70274d2fc962aba5fc
+Size (openvpn-2.7.9.tar.gz) = 2128894 bytes
 SHA1 (patch-src_compat_compat-basename.c) = c5cd48db40279a956ada044a81e6dfab015d70b6

Index: pkgsrc/net/openvpn-acct-wtmpx/distinfo
diff -u pkgsrc/net/openvpn-acct-wtmpx/distinfo:1.59 pkgsrc/net/openvpn-acct-wtmpx/distinfo:1.60
--- pkgsrc/net/openvpn-acct-wtmpx/distinfo:1.59 Wed Oct  7 16:12:13 2026
+++ pkgsrc/net/openvpn-acct-wtmpx/distinfo      Fri Nov  6 11:59:39 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.59 2026/10/07 16:12:13 adam Exp $
+$NetBSD: distinfo,v 1.60 2026/11/06 11:59:39 adam Exp $
 
-BLAKE2s (openvpn-2.7.8.tar.gz) = c00f21af6f3a325b398702f9d0a8145933ac9bd083049f68b56f17b97745873c
-SHA512 (openvpn-2.7.8.tar.gz) = 1461dbe00e35219c06c0e8f5836877522a8d5db786a6f3a6049aebdbb0b326dd816a6fc3197ebd3a5c1019a54e703d52c28af77c747e266e31438d1a9f64b631
-Size (openvpn-2.7.8.tar.gz) = 2123466 bytes
+BLAKE2s (openvpn-2.7.9.tar.gz) = 1f7ae33a89642b1e7f27bf7173694b62197cb2e3a81d09517aeab760339da3e8
+SHA512 (openvpn-2.7.9.tar.gz) = 6069d24d945f9a1a22129d7bdcb360c5d578671b0293f616231de68959db21a09185078a536b926f062ba6b0f3e69b0a0db4bb7a5f7cbd70274d2fc962aba5fc
+Size (openvpn-2.7.9.tar.gz) = 2128894 bytes
 BLAKE2s (openvpn-acct-wtmpx-20130210.tgz) = 2bb02a4e6adb7ce1d189271a6fbb6cbffd6a37d7b5e75cccebfc8dfac6dbaddd
 SHA512 (openvpn-acct-wtmpx-20130210.tgz) = 7b8fd4929e65d8d84158f62e5a17ff3adb3b4a6cff63b29038acfb368750719f2f593786ed9b02402824c19d872b188d2a46740a5c5f853e8873a71481b13aaf
 Size (openvpn-acct-wtmpx-20130210.tgz) = 2778 bytes

Index: pkgsrc/net/openvpn-nagios/distinfo
diff -u pkgsrc/net/openvpn-nagios/distinfo:1.56 pkgsrc/net/openvpn-nagios/distinfo:1.57
--- pkgsrc/net/openvpn-nagios/distinfo:1.56     Wed Oct  7 16:12:13 2026
+++ pkgsrc/net/openvpn-nagios/distinfo  Fri Nov  6 11:59:39 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.56 2026/10/07 16:12:13 adam Exp $
+$NetBSD: distinfo,v 1.57 2026/11/06 11:59:39 adam Exp $
 
-BLAKE2s (openvpn-2.7.8.tar.gz) = c00f21af6f3a325b398702f9d0a8145933ac9bd083049f68b56f17b97745873c
-SHA512 (openvpn-2.7.8.tar.gz) = 1461dbe00e35219c06c0e8f5836877522a8d5db786a6f3a6049aebdbb0b326dd816a6fc3197ebd3a5c1019a54e703d52c28af77c747e266e31438d1a9f64b631
-Size (openvpn-2.7.8.tar.gz) = 2123466 bytes
+BLAKE2s (openvpn-2.7.9.tar.gz) = 1f7ae33a89642b1e7f27bf7173694b62197cb2e3a81d09517aeab760339da3e8
+SHA512 (openvpn-2.7.9.tar.gz) = 6069d24d945f9a1a22129d7bdcb360c5d578671b0293f616231de68959db21a09185078a536b926f062ba6b0f3e69b0a0db4bb7a5f7cbd70274d2fc962aba5fc
+Size (openvpn-2.7.9.tar.gz) = 2128894 bytes
 BLAKE2s (openvpn-nagios-20130210.tgz) = 713b55e865350c44a314aa3b48694695f4d82b50883d1fae919f01e9545c7c34
 SHA512 (openvpn-nagios-20130210.tgz) = 80e565f32379c39eb6c7f3b4744af221ae882ff07dce9dae5bd7feb73b0edcfc7c7ac7f70d23fdcd4f492b66f095f09833deb122449840b36ea606ce91900358
 Size (openvpn-nagios-20130210.tgz) = 3034 bytes