<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="43">
<package pkgid="f616bf42075503c6a9fd0d78e39018fa434af7eadfcb002e29d94302bca54ac13d87c84fd9f78bbd6acb1a41a08d9fa34b8ad021607234cb1a6cd90234b816ab" name="cockpit-openvpn-connector" arch="noarch">
  <version epoch="0" ver="6" rel="9.2"/>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773662400">- Initial import of the Debian packaging</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773662401">- Initial import of the RHEL packaging</changelog>
</package>
<package pkgid="832f4aca27f82b3c9a836a2b3c39ef9d98bff8a75c1f0a24c462b18b6fd88ace22e1554b42be4dd940b380cfd26c0a0f64d625c24d73b701408d302a279c5fe9" name="gdbuspp" arch="src">
  <version epoch="0" ver="3" rel="9.8"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1739448000">- Initial package (version 3).</changelog>
</package>
<package pkgid="b7ad177929c7b479ed4fd43fe10afb7369e6ea4f2f976266b1a11ae167923bb1a2615fe507229afc23fba3ee59b5eecb19a3997d7ba5cdcd40cfb19813191742" name="gdbuspp-devel" arch="aarch64">
  <version epoch="0" ver="3" rel="9.8"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1739448000">- Initial package (version 3).</changelog>
</package>
<package pkgid="0c640c05f7c4374b5d58e16c051759e8a5cf0952c43cb6c8e87a9784d3377e8ed36a90d528dbb719381730e8b0eff18ff837ce2a37a0da3daaa6f4cee5b46e7e" name="libgdbuspp3" arch="aarch64">
  <version epoch="0" ver="3" rel="9.8"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1739448000">- Initial package (version 3).</changelog>
</package>
<package pkgid="a187042e1146abe5a6d22fb6b9c2e4c21809583fb07f9434d67e4a54aa429dc555ac431acb35af6869ed7417d5698c9af4f83ce8165ea36c087da1cc3dbd01b4" name="openvpn" arch="aarch64">
  <version epoch="0" ver="2.7.7" rel="542.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
  <changelog author="Yuriy Darnobyt &lt;yura.uddr@gmail.com&gt;" date="1788436800">- Update to 2.7.7</changelog>
</package>
<package pkgid="19a8dc9ae99edfcc9a48421698bd39ed1f9d8271952d8295451d236526c3eeddd22d318f704692e777aa942c3d74437f675896c892cf21428fc6f4381b9cc5b5" name="openvpn" arch="armv7hl">
  <version epoch="0" ver="2.7.7" rel="542.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
  <changelog author="Yuriy Darnobyt &lt;yura.uddr@gmail.com&gt;" date="1788436800">- Update to 2.7.7</changelog>
</package>
<package pkgid="61701a7e79c4f88fe7dceb307b74b9cb3026a3d8b94516ddd579ff39d94d16c116da5d917150343608998217ebc1b57e99cad9b60cdea54b379154fdc9c948ee" name="openvpn" arch="src">
  <version epoch="0" ver="2.7.7" rel="542.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
  <changelog author="Yuriy Darnobyt &lt;yura.uddr@gmail.com&gt;" date="1788436800">- Update to 2.7.7</changelog>
</package>
<package pkgid="cb38ce335f90fc19bd2c2187431a65a2aed2a29e9756cdc8402467cc17eec7e225bbb0ce18902f9633ed551600f45f3516755dde9d960151e27a30e4bcaa7468" name="openvpn-auth-pam-plugin" arch="aarch64">
  <version epoch="0" ver="2.7.7" rel="542.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
  <changelog author="Yuriy Darnobyt &lt;yura.uddr@gmail.com&gt;" date="1788436800">- Update to 2.7.7</changelog>
</package>
<package pkgid="fbf2133334ca0fd50b210d22797acd3e26bd08bee51aea3ddb874064a1368cafde1e73e236078f9f39dc6917c107992dd986cc84f7d2a6c2646ff221547b2897" name="openvpn-auth-pam-plugin" arch="armv7hl">
  <version epoch="0" ver="2.7.7" rel="542.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
  <changelog author="Yuriy Darnobyt &lt;yura.uddr@gmail.com&gt;" date="1788436800">- Update to 2.7.7</changelog>
</package>
<package pkgid="733bf46cc18ae73d6221170b18bda87dfe5e3cdbfe0af8c6585896010ccab974c1a3979b0d9918be93b792faba8d60739ab12b59ea0571ed7512c45219310d88" name="openvpn-auth-pam-plugin-debuginfo" arch="armv7hl">
  <version epoch="0" ver="2.7.7" rel="542.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
  <changelog author="Yuriy Darnobyt &lt;yura.uddr@gmail.com&gt;" date="1788436800">- Update to 2.7.7</changelog>
</package>
<package pkgid="2ddbe110262f23bf7e2e446d49e58813bf8edbbcb22d2b9594f12df15655d32e533647694f759b1d468d7e554afc0141ea3e94c877b1fd374a5a330cdadf6a88" name="openvpn-connector-setup" arch="src">
  <version epoch="0" ver="6" rel="9.2"/>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773662400">- Initial import of the Debian packaging</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773662401">- Initial import of the RHEL packaging</changelog>
</package>
<package pkgid="5210eeeba92518a582847566011f024fb822926241e0eb31248a941f485ce1f3cf50d710b75dad69b266f57a72390c28f20ec5bb2a17f8b9ba799695a695515c" name="openvpn-debuginfo" arch="armv7hl">
  <version epoch="0" ver="2.7.7" rel="542.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
  <changelog author="Yuriy Darnobyt &lt;yura.uddr@gmail.com&gt;" date="1788436800">- Update to 2.7.7</changelog>
</package>
<package pkgid="35e8bf31dbdf11c8dcdd340ee2fd609308526dc4d627211b16c01ab1d197b0b454d9f0556edb6f20b46b72fb65e73643807f58bd7213d399c5e65c333305c04a" name="openvpn-devel" arch="aarch64">
  <version epoch="0" ver="2.7.7" rel="542.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
  <changelog author="Yuriy Darnobyt &lt;yura.uddr@gmail.com&gt;" date="1788436800">- Update to 2.7.7</changelog>
</package>
<package pkgid="213c130bdbf83226b9d3bb169cb2c9c652b07f1be1ae02ff9a815c3dfd1681d787d175ee025bb82e90cba7abaa6452be36494743b53c246d103c7ee95b5f66c1" name="openvpn-devel" arch="armv7hl">
  <version epoch="0" ver="2.7.7" rel="542.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
  <changelog author="Yuriy Darnobyt &lt;yura.uddr@gmail.com&gt;" date="1788436800">- Update to 2.7.7</changelog>
</package>
<package pkgid="e60384f48db287875285b816227fb3e2de4e85b488ee5c76ecfc98766535131a14e37270bc7d4931a99c398f42f0300698066a915fdd1d8162528d3d6a8e3d60" name="openvpn-down-root-plugin" arch="aarch64">
  <version epoch="0" ver="2.7.7" rel="542.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
  <changelog author="Yuriy Darnobyt &lt;yura.uddr@gmail.com&gt;" date="1788436800">- Update to 2.7.7</changelog>
</package>
<package pkgid="5f5e7415792ab03c176c302b337904a244bb44774c92a77b4b724e63a8b24edba75e5209305c71a41f7f3a87cb29255f3ad60f451eab7e46dfa2b0f9e68460c5" name="openvpn-down-root-plugin" arch="armv7hl">
  <version epoch="0" ver="2.7.7" rel="542.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
  <changelog author="Yuriy Darnobyt &lt;yura.uddr@gmail.com&gt;" date="1788436800">- Update to 2.7.7</changelog>
</package>
<package pkgid="1e272ea8e08e2fe0e09dc39610affbb570d367818a93b441e5b497f57df9b930b6159ce98fe1325a6e28860d0786c00441da501c22ac84cff6642e844a1f9f66" name="openvpn-down-root-plugin-debuginfo" arch="armv7hl">
  <version epoch="0" ver="2.7.7" rel="542.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
  <changelog author="Yuriy Darnobyt &lt;yura.uddr@gmail.com&gt;" date="1788436800">- Update to 2.7.7</changelog>
</package>
<package pkgid="459eb06d8309d3424c72d02a1c6d8fec0692d664dc33ac53990527cff08f94f847f654c9a72cc28040884d9619aef023db874d5f3eff684020fd553046fce455" name="openvpn3" arch="aarch64">
  <version epoch="0" ver="27.1" rel="1.4"/>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 20-1" date="1679313600">- Package the openvpn3-linux-20 stable release</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 20-2" date="1682078400">- Packaging fix only - Recommend kmod-ovpn-dco &lt; 0.2
  - openvpn3 v20 is not ready for newer kmod-ovpn-dco versions yet
  - Improved descriptions</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-1" date="1695384000">- Package the openvpn3-linux-21 stable release</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-2" date="1696852800">- Build using devtoolset-11</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-3" date="1697457600">- Don't depend on tinyxml2-7.0.0 on RHEL-8; use tinyxml2-6 from CodeReady repos</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 22-1.dev1" date="1718625600">- Release of OpenVPN 3 Linux v22_dev</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 23-1" date="1724846400">- Release of OpenVPN 3 Linux v23</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24-1" date="1733227200">- Release of OpenVPN 3 Linux v24</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24-2" date="1742817600">- Update build for Fedora 42+ with GCC-15
- logmetadata.hpp needed to include cstdint
- Disabling unit-tests for Fedora 42+ due to cstdint missing in googletest framework</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24.1-1" date="1747656000">- Security: Fixes openvpn3-admin init-config symlink following {CVE-2025-3908}
- Bugfix: Fix openvpn3-service-sessionmgr crashing setting invalid log level
  for a running session
- Bugfix: Filter out ASCII control characters from user provided input
- Bugfix: Fix openvpn3-service-backendstart crash during shutdown
- Bugfix: Fix VPN sessions failing to start on systems without systemd-hostnamed
- Various build fixes, enabling GCC-15 builds (removing packaging patch)</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 25-1" date="1752494400">- Release of OpenVPN 3 Linux v25
- Added EPEL-10 SELinux policy packaging hack
- Disabling unit tests on RHEL-8, due to googletest framework compat issues</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; - 26-1" date="1758628800">- Release of OpenVPN 3 Linux v26
- Removing the EPEL-10 SELinux policy packaging hack; new Copr build chroots are available
- Requring GDBus++ v3 or newer; this change was forgotten in openvpn3-25-1.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; - 27-1" date="1772539200">- Release of OpenVPN 3 Linux v27
- Adds a new openvpn3-desktop-session-watcher notification tool</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; -  0-27.1.20260519gita136966" date="1779192000">- Develeopment snapshot of 27.1_qa1</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; -  0-27.1.20260630git511fc4e" date="1782820800">- Development snapshot of 27.1_qa3</changelog>
  <changelog author="avid Sommerseth &lt;dazo@eurephia.org&gt; - 27.1-1~rc1" date="1783598400">- Development snapshot of 27.1_rc1</changelog>
</package>
<package pkgid="a12bedddc2fa24ee844c68e247751d5ea253ad7909cb62c97681898f5a5ff98b8222b62b5ba7d6c4e47a523a18f00200685c2359db7194b74c3a486a964e4be3" name="openvpn3" arch="src">
  <version epoch="0" ver="27.1" rel="1.4"/>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 16-1.beta1" date="1634644800">- Package openvpn3-linux-16_beta release
- Include packaging of the new openvpn3-systemd integration</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 17-2.beta1" date="1639396800">- Package the openvpn3-linux-17_beta release
- Build EPEL-7 using devtoolset-10</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 18-1.beta" date="1654603200">- Package the openvpn3-linux-18_beta release
- D-Bus policies has been relocated to %{_datarootdir}/dbus-1/system.d</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 19-1.beta" date="1666958400">- Package the openvpn3-linux-19_beta release</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 20-1" date="1679313600">- Package the openvpn3-linux-20 stable release</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 20-2" date="1682078400">- Packaging fix only - Recommend kmod-ovpn-dco &lt; 0.2
  - openvpn3 v20 is not ready for newer kmod-ovpn-dco versions yet
  - Improved descriptions</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-1" date="1695384000">- Package the openvpn3-linux-21 stable release</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-2" date="1696852800">- Build using devtoolset-11</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-3" date="1697457600">- Don't depend on tinyxml2-7.0.0 on RHEL-8; use tinyxml2-6 from CodeReady repos</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 22-1.dev1" date="1718625600">- Release of OpenVPN 3 Linux v22_dev</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 23-1" date="1724846400">- Release of OpenVPN 3 Linux v23</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24-1" date="1733227200">- Release of OpenVPN 3 Linux v24</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24-2" date="1742817600">- Update build for Fedora 42+ with GCC-15
- logmetadata.hpp needed to include cstdint
- Disabling unit-tests for Fedora 42+ due to cstdint missing in googletest framework</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24.1-1" date="1747656000">- Security: Fixes openvpn3-admin init-config symlink following {CVE-2025-3908}
- Bugfix: Fix openvpn3-service-sessionmgr crashing setting invalid log level
  for a running session
- Bugfix: Filter out ASCII control characters from user provided input
- Bugfix: Fix openvpn3-service-backendstart crash during shutdown
- Bugfix: Fix VPN sessions failing to start on systems without systemd-hostnamed
- Various build fixes, enabling GCC-15 builds (removing packaging patch)</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 25-1" date="1752494400">- Release of OpenVPN 3 Linux v25
- Added EPEL-10 SELinux policy packaging hack
- Disabling unit tests on RHEL-8, due to googletest framework compat issues</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; - 26-1" date="1758628800">- Release of OpenVPN 3 Linux v26
- Removing the EPEL-10 SELinux policy packaging hack; new Copr build chroots are available
- Requring GDBus++ v3 or newer; this change was forgotten in openvpn3-25-1.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; - 27-1" date="1772539200">- Release of OpenVPN 3 Linux v27
- Adds a new openvpn3-desktop-session-watcher notification tool</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; -  0-27.1.20260519gita136966" date="1779192000">- Develeopment snapshot of 27.1_qa1</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; -  0-27.1.20260630git511fc4e" date="1782820800">- Development snapshot of 27.1_qa3</changelog>
  <changelog author="avid Sommerseth &lt;dazo@eurephia.org&gt; - 27.1-1~rc1" date="1783598400">- Development snapshot of 27.1_rc1</changelog>
</package>
<package pkgid="79781f6847bd1481c2e27b77dc5c20287a187bb9e09bed66157f17142f160432ca201ed9be56a1e9c4c38cbdb90712761702b2729574efbb6bd5cdab65199d5d" name="openvpn3-addon-aws" arch="aarch64">
  <version epoch="0" ver="27.1" rel="1.4"/>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 20-1" date="1679313600">- Package the openvpn3-linux-20 stable release</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 20-2" date="1682078400">- Packaging fix only - Recommend kmod-ovpn-dco &lt; 0.2
  - openvpn3 v20 is not ready for newer kmod-ovpn-dco versions yet
  - Improved descriptions</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-1" date="1695384000">- Package the openvpn3-linux-21 stable release</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-2" date="1696852800">- Build using devtoolset-11</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-3" date="1697457600">- Don't depend on tinyxml2-7.0.0 on RHEL-8; use tinyxml2-6 from CodeReady repos</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 22-1.dev1" date="1718625600">- Release of OpenVPN 3 Linux v22_dev</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 23-1" date="1724846400">- Release of OpenVPN 3 Linux v23</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24-1" date="1733227200">- Release of OpenVPN 3 Linux v24</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24-2" date="1742817600">- Update build for Fedora 42+ with GCC-15
- logmetadata.hpp needed to include cstdint
- Disabling unit-tests for Fedora 42+ due to cstdint missing in googletest framework</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24.1-1" date="1747656000">- Security: Fixes openvpn3-admin init-config symlink following {CVE-2025-3908}
- Bugfix: Fix openvpn3-service-sessionmgr crashing setting invalid log level
  for a running session
- Bugfix: Filter out ASCII control characters from user provided input
- Bugfix: Fix openvpn3-service-backendstart crash during shutdown
- Bugfix: Fix VPN sessions failing to start on systems without systemd-hostnamed
- Various build fixes, enabling GCC-15 builds (removing packaging patch)</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 25-1" date="1752494400">- Release of OpenVPN 3 Linux v25
- Added EPEL-10 SELinux policy packaging hack
- Disabling unit tests on RHEL-8, due to googletest framework compat issues</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; - 26-1" date="1758628800">- Release of OpenVPN 3 Linux v26
- Removing the EPEL-10 SELinux policy packaging hack; new Copr build chroots are available
- Requring GDBus++ v3 or newer; this change was forgotten in openvpn3-25-1.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; - 27-1" date="1772539200">- Release of OpenVPN 3 Linux v27
- Adds a new openvpn3-desktop-session-watcher notification tool</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; -  0-27.1.20260519gita136966" date="1779192000">- Develeopment snapshot of 27.1_qa1</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; -  0-27.1.20260630git511fc4e" date="1782820800">- Development snapshot of 27.1_qa3</changelog>
  <changelog author="avid Sommerseth &lt;dazo@eurephia.org&gt; - 27.1-1~rc1" date="1783598400">- Development snapshot of 27.1_rc1</changelog>
</package>
<package pkgid="297f86c09a8d63ab0cacdfcae36010d1e91d082aa7a6dc209df6116b992a799eab84c54c472d4dc95f3ee04921d1fe38399bfb15e1ff3119b1080a172ca07489" name="openvpn3-addon-devposture" arch="aarch64">
  <version epoch="0" ver="27.1" rel="1.4"/>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 20-1" date="1679313600">- Package the openvpn3-linux-20 stable release</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 20-2" date="1682078400">- Packaging fix only - Recommend kmod-ovpn-dco &lt; 0.2
  - openvpn3 v20 is not ready for newer kmod-ovpn-dco versions yet
  - Improved descriptions</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-1" date="1695384000">- Package the openvpn3-linux-21 stable release</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-2" date="1696852800">- Build using devtoolset-11</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-3" date="1697457600">- Don't depend on tinyxml2-7.0.0 on RHEL-8; use tinyxml2-6 from CodeReady repos</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 22-1.dev1" date="1718625600">- Release of OpenVPN 3 Linux v22_dev</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 23-1" date="1724846400">- Release of OpenVPN 3 Linux v23</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24-1" date="1733227200">- Release of OpenVPN 3 Linux v24</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24-2" date="1742817600">- Update build for Fedora 42+ with GCC-15
- logmetadata.hpp needed to include cstdint
- Disabling unit-tests for Fedora 42+ due to cstdint missing in googletest framework</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24.1-1" date="1747656000">- Security: Fixes openvpn3-admin init-config symlink following {CVE-2025-3908}
- Bugfix: Fix openvpn3-service-sessionmgr crashing setting invalid log level
  for a running session
- Bugfix: Filter out ASCII control characters from user provided input
- Bugfix: Fix openvpn3-service-backendstart crash during shutdown
- Bugfix: Fix VPN sessions failing to start on systems without systemd-hostnamed
- Various build fixes, enabling GCC-15 builds (removing packaging patch)</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 25-1" date="1752494400">- Release of OpenVPN 3 Linux v25
- Added EPEL-10 SELinux policy packaging hack
- Disabling unit tests on RHEL-8, due to googletest framework compat issues</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; - 26-1" date="1758628800">- Release of OpenVPN 3 Linux v26
- Removing the EPEL-10 SELinux policy packaging hack; new Copr build chroots are available
- Requring GDBus++ v3 or newer; this change was forgotten in openvpn3-25-1.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; - 27-1" date="1772539200">- Release of OpenVPN 3 Linux v27
- Adds a new openvpn3-desktop-session-watcher notification tool</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; -  0-27.1.20260519gita136966" date="1779192000">- Develeopment snapshot of 27.1_qa1</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; -  0-27.1.20260630git511fc4e" date="1782820800">- Development snapshot of 27.1_qa3</changelog>
  <changelog author="avid Sommerseth &lt;dazo@eurephia.org&gt; - 27.1-1~rc1" date="1783598400">- Development snapshot of 27.1_rc1</changelog>
</package>
<package pkgid="b66c5a0f20c9dc8131052db4db1e791076f991bd27e29a1b1dffb3b1358d145a086398f485870f6fea9c6e323876db8617de169b765e5c81591091e80e682b36" name="openvpn3-client" arch="aarch64">
  <version epoch="0" ver="27.1" rel="1.4"/>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 20-1" date="1679313600">- Package the openvpn3-linux-20 stable release</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 20-2" date="1682078400">- Packaging fix only - Recommend kmod-ovpn-dco &lt; 0.2
  - openvpn3 v20 is not ready for newer kmod-ovpn-dco versions yet
  - Improved descriptions</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-1" date="1695384000">- Package the openvpn3-linux-21 stable release</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-2" date="1696852800">- Build using devtoolset-11</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-3" date="1697457600">- Don't depend on tinyxml2-7.0.0 on RHEL-8; use tinyxml2-6 from CodeReady repos</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 22-1.dev1" date="1718625600">- Release of OpenVPN 3 Linux v22_dev</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 23-1" date="1724846400">- Release of OpenVPN 3 Linux v23</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24-1" date="1733227200">- Release of OpenVPN 3 Linux v24</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24-2" date="1742817600">- Update build for Fedora 42+ with GCC-15
- logmetadata.hpp needed to include cstdint
- Disabling unit-tests for Fedora 42+ due to cstdint missing in googletest framework</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24.1-1" date="1747656000">- Security: Fixes openvpn3-admin init-config symlink following {CVE-2025-3908}
- Bugfix: Fix openvpn3-service-sessionmgr crashing setting invalid log level
  for a running session
- Bugfix: Filter out ASCII control characters from user provided input
- Bugfix: Fix openvpn3-service-backendstart crash during shutdown
- Bugfix: Fix VPN sessions failing to start on systems without systemd-hostnamed
- Various build fixes, enabling GCC-15 builds (removing packaging patch)</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 25-1" date="1752494400">- Release of OpenVPN 3 Linux v25
- Added EPEL-10 SELinux policy packaging hack
- Disabling unit tests on RHEL-8, due to googletest framework compat issues</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; - 26-1" date="1758628800">- Release of OpenVPN 3 Linux v26
- Removing the EPEL-10 SELinux policy packaging hack; new Copr build chroots are available
- Requring GDBus++ v3 or newer; this change was forgotten in openvpn3-25-1.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; - 27-1" date="1772539200">- Release of OpenVPN 3 Linux v27
- Adds a new openvpn3-desktop-session-watcher notification tool</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; -  0-27.1.20260519gita136966" date="1779192000">- Develeopment snapshot of 27.1_qa1</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; -  0-27.1.20260630git511fc4e" date="1782820800">- Development snapshot of 27.1_qa3</changelog>
  <changelog author="avid Sommerseth &lt;dazo@eurephia.org&gt; - 27.1-1~rc1" date="1783598400">- Development snapshot of 27.1_rc1</changelog>
</package>
<package pkgid="c15430c2672d4504bbb15c44b14e9f6531bd99219b08b2e7275c8f0d2f2a9904a7174231f49020c394c6511c32d96a8135c0d6763e1e97ff4d4941a8b771516c" name="openvpn3-devel" arch="noarch">
  <version epoch="0" ver="27.1" rel="1.4"/>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 20-1" date="1679313600">- Package the openvpn3-linux-20 stable release</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 20-2" date="1682078400">- Packaging fix only - Recommend kmod-ovpn-dco &lt; 0.2
  - openvpn3 v20 is not ready for newer kmod-ovpn-dco versions yet
  - Improved descriptions</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-1" date="1695384000">- Package the openvpn3-linux-21 stable release</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-2" date="1696852800">- Build using devtoolset-11</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-3" date="1697457600">- Don't depend on tinyxml2-7.0.0 on RHEL-8; use tinyxml2-6 from CodeReady repos</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 22-1.dev1" date="1718625600">- Release of OpenVPN 3 Linux v22_dev</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 23-1" date="1724846400">- Release of OpenVPN 3 Linux v23</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24-1" date="1733227200">- Release of OpenVPN 3 Linux v24</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24-2" date="1742817600">- Update build for Fedora 42+ with GCC-15
- logmetadata.hpp needed to include cstdint
- Disabling unit-tests for Fedora 42+ due to cstdint missing in googletest framework</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24.1-1" date="1747656000">- Security: Fixes openvpn3-admin init-config symlink following {CVE-2025-3908}
- Bugfix: Fix openvpn3-service-sessionmgr crashing setting invalid log level
  for a running session
- Bugfix: Filter out ASCII control characters from user provided input
- Bugfix: Fix openvpn3-service-backendstart crash during shutdown
- Bugfix: Fix VPN sessions failing to start on systems without systemd-hostnamed
- Various build fixes, enabling GCC-15 builds (removing packaging patch)</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 25-1" date="1752494400">- Release of OpenVPN 3 Linux v25
- Added EPEL-10 SELinux policy packaging hack
- Disabling unit tests on RHEL-8, due to googletest framework compat issues</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; - 26-1" date="1758628800">- Release of OpenVPN 3 Linux v26
- Removing the EPEL-10 SELinux policy packaging hack; new Copr build chroots are available
- Requring GDBus++ v3 or newer; this change was forgotten in openvpn3-25-1.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; - 27-1" date="1772539200">- Release of OpenVPN 3 Linux v27
- Adds a new openvpn3-desktop-session-watcher notification tool</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; -  0-27.1.20260519gita136966" date="1779192000">- Develeopment snapshot of 27.1_qa1</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; -  0-27.1.20260630git511fc4e" date="1782820800">- Development snapshot of 27.1_qa3</changelog>
  <changelog author="avid Sommerseth &lt;dazo@eurephia.org&gt; - 27.1-1~rc1" date="1783598400">- Development snapshot of 27.1_rc1</changelog>
</package>
<package pkgid="b34b8ba17adb650068a5a4883240462732e40eee0c5545aefdd630779e8bbb351d4a2ef7a4bdc45caaa1b4333b9d0a38d9f9b5a1e0392468676df41f68858b8f" name="openvpn3-dpc-openvpninc" arch="noarch">
  <version epoch="0" ver="27.1" rel="1.4"/>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 20-1" date="1679313600">- Package the openvpn3-linux-20 stable release</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 20-2" date="1682078400">- Packaging fix only - Recommend kmod-ovpn-dco &lt; 0.2
  - openvpn3 v20 is not ready for newer kmod-ovpn-dco versions yet
  - Improved descriptions</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-1" date="1695384000">- Package the openvpn3-linux-21 stable release</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-2" date="1696852800">- Build using devtoolset-11</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 21-3" date="1697457600">- Don't depend on tinyxml2-7.0.0 on RHEL-8; use tinyxml2-6 from CodeReady repos</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 22-1.dev1" date="1718625600">- Release of OpenVPN 3 Linux v22_dev</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 23-1" date="1724846400">- Release of OpenVPN 3 Linux v23</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24-1" date="1733227200">- Release of OpenVPN 3 Linux v24</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24-2" date="1742817600">- Update build for Fedora 42+ with GCC-15
- logmetadata.hpp needed to include cstdint
- Disabling unit-tests for Fedora 42+ due to cstdint missing in googletest framework</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 24.1-1" date="1747656000">- Security: Fixes openvpn3-admin init-config symlink following {CVE-2025-3908}
- Bugfix: Fix openvpn3-service-sessionmgr crashing setting invalid log level
  for a running session
- Bugfix: Filter out ASCII control characters from user provided input
- Bugfix: Fix openvpn3-service-backendstart crash during shutdown
- Bugfix: Fix VPN sessions failing to start on systems without systemd-hostnamed
- Various build fixes, enabling GCC-15 builds (removing packaging patch)</changelog>
  <changelog author="David Sommerseth &lt;davids@openvpn.net&gt; - 25-1" date="1752494400">- Release of OpenVPN 3 Linux v25
- Added EPEL-10 SELinux policy packaging hack
- Disabling unit tests on RHEL-8, due to googletest framework compat issues</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; - 26-1" date="1758628800">- Release of OpenVPN 3 Linux v26
- Removing the EPEL-10 SELinux policy packaging hack; new Copr build chroots are available
- Requring GDBus++ v3 or newer; this change was forgotten in openvpn3-25-1.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; - 27-1" date="1772539200">- Release of OpenVPN 3 Linux v27
- Adds a new openvpn3-desktop-session-watcher notification tool</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; -  0-27.1.20260519gita136966" date="1779192000">- Develeopment snapshot of 27.1_qa1</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt; -  0-27.1.20260630git511fc4e" date="1782820800">- Development snapshot of 27.1_qa3</changelog>
  <changelog author="avid Sommerseth &lt;dazo@eurephia.org&gt; - 27.1-1~rc1" date="1783598400">- Development snapshot of 27.1_rc1</changelog>
</package>
<package pkgid="16b14e0d0f8c96d6de7107d5ccc918dd9c464b4722f056f0bb22b4daf7631725f43b970ba2dbb189cfaf48097311b65f3a015524e3c563159a682a26ca655cf9" name="ovpn-backports" arch="src">
  <version epoch="0" ver="7.1.0.2026080300" rel="35.13"/>
</package>
<package pkgid="1250b045e2488a180094f9d21ec2086430e9eb01ad38e402e356d7c3225a34311cf085ad779c407fe0aaa8ca67d8418bd22629c096bb3526a6bc1aacb53c26a7" name="ovpn-backports" arch="src">
  <version epoch="0" ver="7.2.0.2026082800" rel="36.2"/>
</package>
<package pkgid="d00036fe453b9af805f2af8905f65cca24aaee1382690eec566240c47371218bbcf9abf98b9283e71221aea8d5628e2baf35d1c6a834c7fd268c068d64e05348" name="ovpn-backports-debugsource" arch="armv7hl">
  <version epoch="0" ver="7.1.0.2026080300" rel="35.13"/>
</package>
<package pkgid="3a52607a2d4cb07ba706555150bb99c673e4c52a305a1ce563d18642514df1e3374990fc38b2dff1fd53aaa0c4728f265617a71d12740cfb60346e5c42eb59c2" name="ovpn-dco" arch="src">
  <version epoch="0" ver="0.2.20260804" rel="33.12"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773230400">- Debian: Change to use the full version number. We prefer this for
  Support reasons.
- Debian: This also fixes package build on Ubuntu 22.04. dh_dkms
  didn't automatically fall back to the version number and just
  left #MODULE_VERSION# in place.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 0.2.20260804</changelog>
</package>
<package pkgid="1579d8bae26ab38198c94d1475f3e48bfb2d01a78d320930f8fe9c5ce683685b55d7af1a334c2aca432cf55034eb3b99764f4030e368cb84db27f24088bc14a8" name="ovpn-dco" arch="src">
  <version epoch="0" ver="0.2.20260804" rel="33.21"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773230400">- Debian: Change to use the full version number. We prefer this for
  Support reasons.
- Debian: This also fixes package build on Ubuntu 22.04. dh_dkms
  didn't automatically fall back to the version number and just
  left #MODULE_VERSION# in place.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 0.2.20260804</changelog>
</package>
<package pkgid="3421e98a9a0886266fea9e0482a0151d41ffd6b4d2538bfeb380537be48ba5be408c6a9697fdf19345ab8bedbac503061b75ff3b310030923aca3ed9bb3cca98" name="ovpn-dco-debugsource" arch="armv7hl">
  <version epoch="0" ver="0.2.20260804" rel="33.12"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773230400">- Debian: Change to use the full version number. We prefer this for
  Support reasons.
- Debian: This also fixes package build on Ubuntu 22.04. dh_dkms
  didn't automatically fall back to the version number and just
  left #MODULE_VERSION# in place.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 0.2.20260804</changelog>
</package>
<package pkgid="a0ae38fe0a5114cde2aeecbaf249b4a076e5c0104fff775ee3ebd5b0e1a689ac2248972d95e114feadb8b8e6272b73ade55c57729183217472a60ea49075062b" name="ovpn-dco-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="0.2.20260804_k7.2.2_1" rel="33.21"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773230400">- Debian: Change to use the full version number. We prefer this for
  Support reasons.
- Debian: This also fixes package build on Ubuntu 22.04. dh_dkms
  didn't automatically fall back to the version number and just
  left #MODULE_VERSION# in place.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 0.2.20260804</changelog>
</package>
<package pkgid="534da7384313dd585e57bb1cb63aa7bc9efa585d1257559e151a576d03142eb08dbb0b9e7555d3d856ef9ad83eedbb519d2142651112171ecfdbeb30cbb7f9a9" name="ovpn-dco-kmp-default" arch="armv7hl">
  <version epoch="0" ver="0.2.20260804_k7.1.8_1" rel="33.12"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773230400">- Debian: Change to use the full version number. We prefer this for
  Support reasons.
- Debian: This also fixes package build on Ubuntu 22.04. dh_dkms
  didn't automatically fall back to the version number and just
  left #MODULE_VERSION# in place.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 0.2.20260804</changelog>
</package>
<package pkgid="3cc31481f8f7b60615fa7c576c6ce35fc92b72e00a295131fe301c9fde64ecce0fdd038626b578294e393466a5d2dcd57220c05044799d5318b65ef4bdf52e4e" name="ovpn-dco-kmp-default" arch="aarch64">
  <version epoch="0" ver="0.2.20260804_k7.2.2_1" rel="33.21"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773230400">- Debian: Change to use the full version number. We prefer this for
  Support reasons.
- Debian: This also fixes package build on Ubuntu 22.04. dh_dkms
  didn't automatically fall back to the version number and just
  left #MODULE_VERSION# in place.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 0.2.20260804</changelog>
</package>
<package pkgid="038afb1555c28d7ed9b08576e854684a1bfc2e02c77fbf05803dd673afe7fb558747a80a1240c471cc700e1961a19461de011481030f3678370ad25672e1842e" name="ovpn-dco-kmp-default-debuginfo" arch="armv7hl">
  <version epoch="0" ver="0.2.20260804_k7.1.8_1" rel="33.12"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773230400">- Debian: Change to use the full version number. We prefer this for
  Support reasons.
- Debian: This also fixes package build on Ubuntu 22.04. dh_dkms
  didn't automatically fall back to the version number and just
  left #MODULE_VERSION# in place.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 0.2.20260804</changelog>
</package>
<package pkgid="5eeb6243259e85a22b454128b877e7a7d8d4fe2c0ec66f33cb77aa2a377ebfddde9f265941aeeb7cb595228aa18e1755b33196eecca548fc49c05b96715e177f" name="ovpn-dco-kmp-lpae" arch="armv7hl">
  <version epoch="0" ver="0.2.20260804_k7.1.8_1" rel="33.12"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773230400">- Debian: Change to use the full version number. We prefer this for
  Support reasons.
- Debian: This also fixes package build on Ubuntu 22.04. dh_dkms
  didn't automatically fall back to the version number and just
  left #MODULE_VERSION# in place.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 0.2.20260804</changelog>
</package>
<package pkgid="18946cbfe0b301fc190ef538065c02364c7b427402f49ccc0e51db7d564eea54af6aa5dc32a2ff6e83f621ae0f2f8016b00b78754e1e88d5a7ff5d75547570e4" name="ovpn-dco-kmp-lpae-debuginfo" arch="armv7hl">
  <version epoch="0" ver="0.2.20260804_k7.1.8_1" rel="33.12"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773230400">- Debian: Change to use the full version number. We prefer this for
  Support reasons.
- Debian: This also fixes package build on Ubuntu 22.04. dh_dkms
  didn't automatically fall back to the version number and just
  left #MODULE_VERSION# in place.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 0.2.20260804</changelog>
</package>
<package pkgid="af3d3f6a7a915a1f39a6cd839b5ced26b5ed655f7c80b47f3a39837865552f1d0d281779a5245fdc4ba55c626f83136ac6abdd062a690e875a40f496d96c44d6" name="ovpn-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="7.2.0.2026082800_k7.2.2_1" rel="36.2"/>
</package>
<package pkgid="4f9c727282ca57da8d277f054b1904b0872ecb78ca0abb0164c5aaf928d9b4c7675235a0b51c406ec4ff5e9cc4f47b82531f3be09baa86fb9d7c7ed63ef03c36" name="ovpn-kmp-default" arch="armv7hl">
  <version epoch="0" ver="7.1.0.2026080300_k7.1.8_1" rel="35.13"/>
</package>
<package pkgid="c4ac712a89a1106d361786b809d9c6c8c42b10fab9c5b01b8a52a8d79b21fce9868682205ed383420d5a44e1ee164c244e51df05eb5ccdba132792ba171bd966" name="ovpn-kmp-default" arch="aarch64">
  <version epoch="0" ver="7.2.0.2026082800_k7.2.2_1" rel="36.2"/>
</package>
<package pkgid="35273405c1333066057c146f2fc314d76f4f6ae87ce2c81d025dfe027a700d0f0045aa8e12725cd19084aa31205a4ed961c9235735aa9acca1e107aa26881c50" name="ovpn-kmp-default-debuginfo" arch="armv7hl">
  <version epoch="0" ver="7.1.0.2026080300_k7.1.8_1" rel="35.13"/>
</package>
<package pkgid="0416b625f240c1e7a6d142f3b298557aebdd6013b5b0db2b14d1710aba6d0a1340fdc9c48f1eb1aaee395a8e976f5e1ae49895d3f6998cb465455347c4f98051" name="ovpn-kmp-lpae" arch="armv7hl">
  <version epoch="0" ver="7.1.0.2026080300_k7.1.8_1" rel="35.13"/>
</package>
<package pkgid="848f81380e766089d8f74954e0175ba6213f821dd23103cc89c94503d02ad3aac83469afd54057d16d65d8f7f875d2ea5853250665de3dcc45f798a2866c9726" name="ovpn-kmp-lpae-debuginfo" arch="armv7hl">
  <version epoch="0" ver="7.1.0.2026080300_k7.1.8_1" rel="35.13"/>
</package>
<package pkgid="b5b9d52831caf05b6c1b9c016c742f1aeea7b144f3d0e13c71a6962706531026719dcf846ca56b6d8488f18d0055e799b9663d02ab83f01764eef5cd767af2c0" name="python3-openvpn-connector-setup" arch="noarch">
  <version epoch="0" ver="6" rel="9.2"/>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773662400">- Initial import of the Debian packaging</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773662401">- Initial import of the RHEL packaging</changelog>
</package>
</otherdata>