mirror of
https://github.com/OpenVPN/openvpn.git
synced 2026-05-28 04:03:29 -04:00
preparing release 2.6.9
version.m4, ChangeLog, Changes.rst
This commit is contained in:
Gert Doering
parent
d8faf568d2
commit
6640a10bf6
3 changed files with 188 additions and 3 deletions
70
ChangeLog
70
ChangeLog
|
|
@ -1,6 +1,76 @@
|
|||
OpenVPN ChangeLog
|
||||
Copyright (C) 2002-2023 OpenVPN Inc <sales@openvpn.net>
|
||||
|
||||
2024.02.11 -- Version 2.6.9
|
||||
|
||||
Arne Schwabe (15):
|
||||
Remove unused function prototype crypto_adjust_frame_parameters
|
||||
Log SSL alerts more prominently
|
||||
Document tls-exit option mainly as test option
|
||||
Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
|
||||
Fix check_session_buf_not_used using wrong index
|
||||
Add missing check for nl_socket_alloc failure
|
||||
Add check for nice in cmake config
|
||||
Remove compat versionhelpers.h and remove cmake/configure check for it
|
||||
Extend the error message when TLS 1.0 PRF fails
|
||||
Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
|
||||
Check PRF availability on initialisation and add --force-tls-key-material-export
|
||||
Make it more explicit and visible when pkg-config is not found
|
||||
Clarify that the tls-crypt-v2-verify has a very limited env set
|
||||
Implement the --tls-export-cert feature
|
||||
Remove conditional text for Apache2 linking exception
|
||||
|
||||
David Sommerseth (2):
|
||||
Remove --tls-export-cert
|
||||
Remove superfluous x509_write_pem()
|
||||
|
||||
Frank Lichtenheld (14):
|
||||
sample-keys: renew for the next 10 years
|
||||
GHA: clean up libressl builds with newer libressl
|
||||
configure.ac: Remove unused AC_TYPE_SIGNAL macro
|
||||
documentation: remove reference to removed option --show-proxy-settings
|
||||
unit_tests: remove includes for mock_msg.h
|
||||
documentation: improve documentation of --x509-track
|
||||
NTLM: add length check to add_security_buffer
|
||||
NTLM: increase size of phase 2 response we can handle
|
||||
proxy-options.rst: Add proper documentation for --http-proxy-user-pass
|
||||
buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
|
||||
--http-proxy-user-pass: allow to specify in either order with --http-proxy
|
||||
README.cmake.md: Document minimum required CMake version for --preset
|
||||
documentation: Update and fix documentation for --push-peer-info
|
||||
documentation: Fixes for previous fixes to --push-peer-info
|
||||
|
||||
Gert Doering (4):
|
||||
OpenBSD: repair --show-gateway
|
||||
get_default_gateway() HWADDR overhaul
|
||||
fix uncrustify complaints about previous patch
|
||||
preparing release 2.6.9
|
||||
|
||||
Kristof Provost (1):
|
||||
dco-freebsd: dynamically re-allocate buffer if it's too small
|
||||
|
||||
Lev Stipakov (1):
|
||||
tun.c: don't attempt to delete DNS and WINS servers if they're not set
|
||||
|
||||
Marc Becker (1):
|
||||
vcpkg-ports/pkcs11-helper: bump to version 1.30
|
||||
|
||||
Max Fillinger (4):
|
||||
Add support for mbedtls 3.X.Y
|
||||
Update README.mbedtls
|
||||
Disable TLS 1.3 support with mbed TLS
|
||||
Enable key export with mbed TLS 3.x.y
|
||||
|
||||
Reynir Bjoernsson (1):
|
||||
protocol_dump: tls-crypt support
|
||||
|
||||
Steffan Karger (1):
|
||||
Fix IPv6 route add/delete message log level
|
||||
|
||||
yatta (1):
|
||||
fix(ssl): init peer_id when init tls_multi
|
||||
|
||||
|
||||
2023.11.17 -- Version 2.6.8
|
||||
|
||||
Aquila Macedo (1):
|
||||
|
|
|
|||
117
Changes.rst
117
Changes.rst
|
|
@ -1,3 +1,118 @@
|
|||
Overview of changes in 2.6.9
|
||||
============================
|
||||
|
||||
Security fixes
|
||||
--------------
|
||||
- Windows Installer: fix CVE 2023-7235 where installing to a non-default
|
||||
directory could lead to a local privilege escalation.
|
||||
Reported by Will Dormann <will.dormann@analygence.com>.
|
||||
|
||||
New features
|
||||
------------
|
||||
- add support for building with mbedTLS 3.x.x
|
||||
|
||||
- new option "--force-tls-key-material-export" to only accept clients
|
||||
that can do TLS keying material export to generate session keys
|
||||
(mostly an internal option to better deal with TLS 1.0 PRF failures).
|
||||
|
||||
- Windows: bump vcpkg-ports/pkcs11-helper to 1.30
|
||||
|
||||
- Log incoming SSL alerts in easier to understand form and move logging
|
||||
from "--verb 8" to "--verb 3".
|
||||
|
||||
- protocol_dump(): add support for printing "--tls-crypt" packets
|
||||
|
||||
|
||||
User visible changes
|
||||
--------------------
|
||||
- license change is now complete, and all code has been re-licensed
|
||||
under the new license (still GPLv2, but with new linking exception
|
||||
for Apache2 licensed code). See COPYING for details.
|
||||
|
||||
Code that could not be re-licensed has been removed or rewritten.
|
||||
|
||||
- the original code for the "--tls-export-cert" feature has been removed
|
||||
(due to the re-licensing effort) and rewritten without looking at the
|
||||
original code. Feature-compatibility has been tested by other developers,
|
||||
looking at both old and new code and documentation, so there *should*
|
||||
not be a user-visible change here.
|
||||
|
||||
- IPv6 route addition/deletion are now logged on the same level (3) as
|
||||
for IPv4. Previously IPv6 was always logged at "--verb 1".
|
||||
|
||||
- better handling of TLS 1.0 PRF failures in the underlying SSL library
|
||||
(e.g. on some FIPS builds) - this is now reported on startup, and
|
||||
clients before 2.6.0 that can not use TLS EKM to generate key material
|
||||
are rejected by the server. Also, error messages are improved to see
|
||||
what exactly failed.
|
||||
|
||||
- packaged sample-keys renewed (old keys due to expire in October 2024)
|
||||
|
||||
|
||||
Bug fixes / Code cleanup
|
||||
------------------------
|
||||
- Windows GUI: always update tray icon on state change (Github: #669)
|
||||
(for persistent connection profiles, "connecting" state would not show)
|
||||
|
||||
- FreeBSD: for servers with multiple clients, reporting of peer traffic
|
||||
statistics would fail due to insufficient buffer space (Github: #487)
|
||||
|
||||
- make interaction between "--http-proxy-user-pass" and "--http-proxy"
|
||||
more consistent
|
||||
|
||||
- doc: improve documentation on "--http-proxy-user-pass"
|
||||
|
||||
- doc: improve documentation for IV_ variables and IV_PROTO bits
|
||||
|
||||
- doc: improve documentation on CMake requirements
|
||||
|
||||
- fix various coverity-reported complains (signed/unsigned comparison etc),
|
||||
none of them actual bugs
|
||||
|
||||
- NTLMv2: increase phase 2 buffers so things actually work
|
||||
|
||||
- NTLM: add extra buffer size verification checks
|
||||
|
||||
- doc: improve documentation on "--tls-crypt-v2-verify"
|
||||
|
||||
- autoconf on Linux: improve error reporting for missing libraries - in
|
||||
case the problem came due to missing "pkg-config" the previous error
|
||||
was misleading. Now clearly report that Linux builds require "pkg-config"
|
||||
and abort if not found.
|
||||
|
||||
- MacOS X: fix "undefined behaviour" found by UBSAN in get_default_gateway()
|
||||
(IV_HWADDR), using getifaddrs(3) instead of old and convoluted
|
||||
SIOCGIFCONF API.
|
||||
|
||||
- OpenSolaris: correctly implement get_default_gateway() (IV_HWADDR), using
|
||||
SIOCGIFHWADDR instead of SIOCGIFCONF API.
|
||||
|
||||
- OpenBSD: work around route socket issue in get_default_gateway()
|
||||
("--show-gateway") where RA_IFP must not be set on the query message,
|
||||
otherwise kernel will return EINVAL.
|
||||
|
||||
- doc: improve documentation of --x509-track
|
||||
|
||||
- bugfix: in UDP mode when exceeding "--max-clients", OpenVPN would
|
||||
incorrectly close the connection to "peer-id 0". Fix by correctly
|
||||
initializing peer_id with MAX_PEER_ID.
|
||||
|
||||
- Windows: do not attempt to delete DNS or WINS servers if they are not set
|
||||
|
||||
- configure: get rid of AC_TYPE_SIGNAL macro (unused)
|
||||
|
||||
- Linux DCO: add missing check for nl_socket_alloc() failure
|
||||
|
||||
- bugfix: check_session_buf_not_used() was not working as planned
|
||||
|
||||
- remove dead test code for TEST_GET_DEFAULT_GATEWAY (use "--show-gateway")
|
||||
|
||||
- doc: better document "--tls-exit" option
|
||||
|
||||
- Github Actions: clean up LibreSSL builds
|
||||
|
||||
|
||||
|
||||
Overview of changes in 2.6.8
|
||||
============================
|
||||
|
||||
|
|
@ -526,7 +641,7 @@ Improve DCO-related logging in many places.
|
|||
DCO/Linux robustness fixes.
|
||||
|
||||
DCO/Linux TCP crashbug (recvfrom(-1) endless loop) worked around - root
|
||||
cause has not been found, but the condition is detected and the
|
||||
cause has not been found, but the condition is detected and the
|
||||
offending client is removed, instead of crashing the server.
|
||||
|
||||
Rename internal TLS state TM_UNTRUSTED to TM_INITIAL, always start new
|
||||
|
|
|
|||
|
|
@ -3,12 +3,12 @@ define([PRODUCT_NAME], [OpenVPN])
|
|||
define([PRODUCT_TARNAME], [openvpn])
|
||||
define([PRODUCT_VERSION_MAJOR], [2])
|
||||
define([PRODUCT_VERSION_MINOR], [6])
|
||||
define([PRODUCT_VERSION_PATCH], [.8])
|
||||
define([PRODUCT_VERSION_PATCH], [.9])
|
||||
m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_MAJOR])
|
||||
m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_MINOR], [[.]])
|
||||
m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_PATCH], [[]])
|
||||
define([PRODUCT_BUGREPORT], [openvpn-users@lists.sourceforge.net])
|
||||
define([PRODUCT_VERSION_RESOURCE], [2,6,8,0])
|
||||
define([PRODUCT_VERSION_RESOURCE], [2,6,9,0])
|
||||
dnl define the TAP version
|
||||
define([PRODUCT_TAP_WIN_COMPONENT_ID], [tap0901])
|
||||
define([PRODUCT_TAP_WIN_MIN_MAJOR], [9])
|
||||
|
|
|
|||
Loading…
Reference in a new issue