<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="26">
<package pkgid="c8adcbd1715f6a0693a8fdce1c55bcd7a13c1b9779e99c04c187c37e689e279608e09e740fae833670844f804a3407e59d6b1ed153e45e75ccfe893ef76b7f72" name="cockpit-openvpn-connector" arch="noarch">
  <version epoch="0" ver="6" rel="8.1"/>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773662400">- Initial import of the Debian packaging</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773662401">- Initial import of the RHEL packaging</changelog>
</package>
<package pkgid="ba16344b2d9875b6241f4c5a16b9fd86746a472427cc71b82061fa66f31d065311c214b2dc48f507eb5f993cef7a6f1857d3df7fca7fc1304ecd33ef34895ccd" name="gdbuspp" arch="src">
  <version epoch="0" ver="3" rel="4.8"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1739448000">- Initial package (version 3).</changelog>
</package>
<package pkgid="dc0e619861e4e532f58c1b59588da6ba62f1624cebaae37556962a991ff83b266cda3bed55489d957dcf68a5a78f581403ce16f9609370bbdf689a2626e98555" name="gdbuspp-devel" arch="x86_64">
  <version epoch="0" ver="3" rel="4.8"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1739448000">- Initial package (version 3).</changelog>
</package>
<package pkgid="f30928cba75abd50da68dbda6395f6642f5771ab9c7eb471c8b597df43dc0e8c55545c6f502e34cb671b8be1cdc8faf1378074e47a0f9934ea97c15375bfaa7d" name="libgdbuspp3" arch="x86_64">
  <version epoch="0" ver="3" rel="4.8"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1739448000">- Initial package (version 3).</changelog>
</package>
<package pkgid="7f961e22625f70731082c1d209d4a248a9b934dc2e4d2b00c1f94751a4547a6226402974923fbfa32c4535bb073637f23b1ccf1c542cc4eafc75a557d0fee069" name="openvpn" arch="i586">
  <version epoch="0" ver="2.7.6" rel="524.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
</package>
<package pkgid="4e2982838bd0843a6f174ae1478fb4227d5b1b5b11447033af07ab6c91a1b9cf569e0219cbd63fc44b2463fc83619a943b85fbc1f0d598d5f2f5ca138cbc44c1" name="openvpn" arch="src">
  <version epoch="0" ver="2.7.6" rel="524.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
</package>
<package pkgid="83f69a578b23074e78c4e5e54ff575fa012b9ce057fe6ff2a96ffc12bfdcfc8cd5b23de88dc2d403eeba658b813d925c147c71616977483e0669a1f2ee33d468" name="openvpn" arch="x86_64">
  <version epoch="0" ver="2.7.6" rel="524.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
</package>
<package pkgid="cdb2852c6e194700c7a532812d22d89f1cde0f3110552b0d5f4749b25b18040f5f3464064d36bfa42eaff46b0f42c2f8b9ee2125ce9d85f5a6e179345130359f" name="openvpn-auth-pam-plugin" arch="i586">
  <version epoch="0" ver="2.7.6" rel="524.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
</package>
<package pkgid="432ce9b077131fa4c00fb417829f141b36dedd23f93542cae77fd6456aeb5eb7d64bab74e999d0f01041452965e79c74c7af5a14adacf798bac000cced4b2365" name="openvpn-auth-pam-plugin" arch="x86_64">
  <version epoch="0" ver="2.7.6" rel="524.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
</package>
<package pkgid="0e14dd94e2b696cf7cb0dae169035a8221df6a7735b6fb997db8c932c4b75d7790d354fc5bc5930b70ad0dba38183547005717822b83026a49bd9ae948b8cbfa" name="openvpn-connector-setup" arch="src">
  <version epoch="0" ver="6" rel="8.1"/>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773662400">- Initial import of the Debian packaging</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773662401">- Initial import of the RHEL packaging</changelog>
</package>
<package pkgid="cbb8a39dc668c1ae65a057becabe99384378589d6a9ac3d33314dbfb01a9e05e3e2242e7d2ecf887217f5a1c6bac95a4719e31bfc2eed72006bc9dea5501da1e" name="openvpn-devel" arch="i586">
  <version epoch="0" ver="2.7.6" rel="524.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
</package>
<package pkgid="4e3d86cd43b548c31c5f34f7731e17b5a70f5a3f1fbb2012c09d6abaaa84f69e91c5eabfc1251315567c5c43331c3f03cb791b8df987eb389ebfc4a84f72739f" name="openvpn-devel" arch="x86_64">
  <version epoch="0" ver="2.7.6" rel="524.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
</package>
<package pkgid="d2f651807edbbe9b996ad1e734107a819f5cd71f927942168e6269f01338b7b0dd6e63b11ffa9a93eb5f4c054d626a83f091a675c47071c5fe8be61899f29c8f" name="openvpn-down-root-plugin" arch="i586">
  <version epoch="0" ver="2.7.6" rel="524.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
</package>
<package pkgid="a552dab9d4b2f6045da250392897c55bdd07653fb254a1c9fb325083929d945dd9817ce1de390905f46d7bda49b1f89fc1a70dd622651f160a883fe9392bfdc3" name="openvpn-down-root-plugin" arch="x86_64">
  <version epoch="0" ver="2.7.6" rel="524.1"/>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1692187200">- update to 2.6.6:
  * configure.ac: fix typ0 in LIBCAPNG_CFALGS
  * Avoid unused function warning/error on FreeBSD (and potientially others)
  * fix warning with gcc 12.2.0 (compiler bug?)
  * Fix CR_RESPONSE mangaement message using wrong key_id
  * Print a more user-friendly error when tls-crypt-v2 client auth fails
  * Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
  * Revert commit 423ced962d
  * Implement using --peer-fingerprint without CA certificates
  * show extra info for OpenSSL errors
  * dist: add more missing files only used in the MSVC build
  * dist: Include all documentation in distribution
  * unit_tests: Add missing cert_data.h to source list for unit tests
  * test_tls_crypt: Improve mock() usage to be more portable
  * Remove old Travis CI related files
  * options: Do not hide variables from parent scope
  * pkcs11_openssl: Disable unused code
  * route: Fix overriding return value of add_route3</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1700481600">- update to 2.6.8:
  * SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF
    state - the new sanity check function introduced in 2.6.7 sometimes
    tried to use a NULL pointer after an unsuccessful TLS handshake
  * CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    use a send buffer after it has been free()d in some circumstances,
    causing some free()d memory to be sent to the peer. All configurations
    using TLS (e.g. not using --secret) are affected by this issue.
  * CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
    restore --fragment configuration in some circumstances, leading to a
    division by zero when --fragment is used. On platforms where division
    by zero is fatal, this will cause an OpenVPN crash.
  * DCO: warn if DATA_V1 packets are sent by the other side - this a hard
    incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4
    server, and the only fix is to use --disable-dco.
  * Remove OpenSSL Engine method for loading a key. This had to be removed
    because the original author did not agree to relicensing the code with
    the new linking exception added. This was a somewhat obsolete feature
    anyway as it only worked with OpenSSL 1.x, which is end-of-support.
  * add warning if p2p NCP client connects to a p2mp server - this is a
    combination that used to work without cipher negotiation (pre 2.6 on
    both ends), but would fail in non-obvious ways with 2.6 to 2.6.
  * add warning to --show-groups that not all supported groups are listed
    (this is due the internal enumeration in OpenSSL being a bit weird,
    omitting X448 and X25519 curves).
  * --dns: remove support for exclude-domains argument (this was a new 2.6
    option, with no backend support implemented yet on any platform, and it
    turns out that no platform supported it at all - so remove option again)
  * warn user if INFO control message too long, do not forward to management
    client (safeguard against protocol-violating server implementations)
  * DCO-WIN: get and log driver version (for easier debugging).
  * print "peer temporary key details" in TLS handshake
  * log OpenSSL errors on failure to set certificate, for example if the
    algorithms used are in acceptable to OpenSSL (misleading message would be
    printed in cryptoapi / pkcs11 scenarios)
  * add CMake build system for MinGW and MSVC builds
  * remove old MSVC build system
  * improve cmocka unit test building for Windows</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1707739200">- update to 2.6.9:
  * Remove unused function prototype crypto_adjust_frame_parameters
  * Log SSL alerts more prominently
  * Document tls-exit option mainly as test option
  * Remove TEST_GET_DEFAULT_GATEWAY as it duplicates --show-gateway
  * Fix check_session_buf_not_used using wrong index
  * Add missing check for nl_socket_alloc failure
  * Add check for nice in cmake config
  * Remove compat versionhelpers.h and remove cmake/configure check for it
  * Extend the error message when TLS 1.0 PRF fails
  * Fix unaligned access in macOS, FreeBSD, Solaris hwaddr
  * Check PRF availability on initialisation and add --force-tls-key-material-export
  * Make it more explicit and visible when pkg-config is not found
  * Clarify that the tls-crypt-v2-verify has a very limited env set
  * Implement the --tls-export-cert feature
  * Remove conditional text for Apache2 linking exception
  * Remove --tls-export-cert
  * Remove superfluous x509_write_pem()
  * sample-keys: renew for the next 10 years
  * GHA: clean up libressl builds with newer libressl
  * configure.ac: Remove unused AC_TYPE_SIGNAL macro
  * documentation: remove reference to removed option --show-proxy-settings
  * unit_tests: remove includes for mock_msg.h
  * documentation: improve documentation of --x509-track
  * NTLM: add length check to add_security_buffer
  * NTLM: increase size of phase 2 response we can handle
  * proxy-options.rst: Add proper documentation for --http-proxy-user-pass
  * buf_string_match_head_str: Fix Coverity issue 'Unsigned compared against 0'
  * --http-proxy-user-pass: allow to specify in either order with --http-proxy
  * README.cmake.md: Document minimum required CMake version for --preset
  * documentation: Update and fix documentation for --push-peer-info
  * documentation: Fixes for previous fixes to --push-peer-info
  * OpenBSD: repair --show-gateway
  * get_default_gateway() HWADDR overhaul
  * fix uncrustify complaints about previous patch
  * preparing release 2.6.9
  * dco-freebsd: dynamically re-allocate buffer if it's too small
  * tun.c: don't attempt to delete DNS and WINS servers if they're not set
  * vcpkg-ports/pkcs11-helper: bump to version 1.30
  * Add support for mbedtls 3.X.Y
  * Update README.mbedtls
  * Disable TLS 1.3 support with mbed TLS
  * Enable key export with mbed TLS 3.x.y
  * protocol_dump: tls-crypt support
  * Fix IPv6 route add/delete message log level
  * fix(ssl): init peer_id when init tls_multi</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Mohd Saquib &lt;mohd.saquib@suse.com&gt;" date="1711022400">- update to 2.6.10:
  * t_client.sh can now run pre-tests and skip a test block if needed
    (e.g. skip NTLM proxy tests if SSL library does not support MD4)
  * Compression: minor bugfix in checking option consistency vs.
    compiled-in algorithm support
  * systemd unit files: remove obsolete syslog.target</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1715860800">- Enable Data-Channel-Offloading (DCO) for better performance (jsc#PED-8305)
  if libnl &gt;= 3.4 is available</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1728561600">- Fix multiple exit notifications from authenticated clients will
  extend the validity of a closing session (bsc#1227546 CVE-2024-28882)
  Patchname:openvpn-CVE-2024-28882.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1734696000">- Set %_buildshell because of bashisms in build recipe
- Replace over-the-top `find -exec rm` by just -delete</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1737547200">- FIX:VUL-0 CVE-2024-5594: openvpn: properly handle null bytes and
  invalid characters in control messages(bsc#1235147 CVE-2024-5594)
  Patchname:openvpn-CVE-2024-5594.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547201">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1743768000">- update to 2.6.14:
  * CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
  * Linux DCO: repair source IP selection for --multihome
- update to 2.6.13:
  * on non-windows clients (MacOS, Linux, Unix) send "release" string from
    uname() call as IV_PLAT_VER to server
  * Linux: pass --timeout=0 argument to systemd-ask-password, to avoid default
    timeout of 90 seconds
  * improve server-side handling of clients sending usernames or passwords
    longer than USER_PASS_LEN
  * purge proxy authentication credentials from memory after use
- update to 2.6.12:
  * the fix for CVE-2024-5594 (refuse control channel messages with
    nonprintable characters) was too strict, breaking user configurations
  * Http-proxy: fix bug preventing proxy credentials caching
- update to 2.6.11:
  * CVE-2024-5594: control channel: refuse control channel messages with
    nonprintable characters in them. Security scope: a malicious openvpn
    peer can send garbage to openvpn log, or cause high CPU load.
  * CVE-2024-28882: only call schedule_exit() once (on a given peer).
    Security scope: an authenticated client can make the server "keep the
    session" even when the server has been told to disconnect this client
  * Fix connect timeout when using SOCKS proxies
  * Add bracket in fingerprint message and do not warn about missing
    verification
  * Remove "experimental" denotation for --fast-io
  * Correctly document ifconfig_* variables passed to scripts
  * Documentation: make section levels consistent
  * Samples: Update sample configurations (remove compression &amp; old cipher
    settings, add more informative comments)
- update keyring, as the old one doesn't verify anymore (and attach an url)
- remove openvpn-CVE-2024-28882.patch and openvpn-CVE-2024-5594.patch, as
  the latest version include fixes for the CVEs</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748606400">- Don't recommend ovpn-dco-kmp if it is in the kernel already (newer and
  safer version):
  https://build.opensuse.org/requests/1255536
- add (bsc#1239783)
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1754481600">- add (bsc#1239783) -- fix build against 6.16
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1765454400">- Update to 2.6.17
- Revert to vanilla code, dropping the ovpn.ko support backport.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1774958400">- Update to 2.7.1</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1776945600">- Update to 2.7.2</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1777550400">- Update to 2.7.4</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1782907200">- Update to 2.7.5</changelog>
  <changelog author="Rahul Jain &lt;rahul.jain@suse.com&gt;" date="1784635200">- Update to version 2.7.5
  * Multiple security fixes (CVE-2026-13379, CVE-2026-12996, CVE-2026-13117,
    CVE-2026-13122, CVE-2026-12932, CVE-2026-11771, CVE-2026-13698)
  * Improved DCO (Data Channel Offload) support built-in
  * Better multi-socket event handling
  * Enhanced DNS configuration handling
  * Windows openvpnserv improvements and fixes
- Add debian packaging files (debian.control, debian.rules,
  debian.tar.xz, *.dsc) as Source entries
- Remove all DCO patches (integrated or superseded in 2.7.5):
  * 0001-dco-better-naming-for-function-parameters.patch
  * 0001-dco_linux-extend-netlink-error-cb-with-extra-info.patch
  * 0001-Handle-missing-DCO-peer-by-restarting-the-session.patch
  * 0001-dco_linux-Introduce-new-uAPIs.patch
  * 0001-Implement-ovpn-version-detection.patch
  * 0001-dco_linux-fix-peer-stats-parsing-with-new-ovpn-kerne.patch
  * 0001-dco_linux-avoid-bogus-text-when-netlink-message-is-n.patch
  * 0001-dco-linux-avoid-redefining-ovpn-enums.patch
- Change Recommends to ovpn-kmp (simplified)</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 2.7.6</changelog>
</package>
<package pkgid="cf01b7a9a38ef90ec98b7a35cae2bb478931450f1d3ccd7ffe6891c3490ecb0e21d07ecca36f5631e0a9f59906d39d1b4cb34bdd9dabceee8c66d6e00c41b008" name="openvpn3" arch="src">
  <version epoch="0" ver="27.1" rel="5.4"/>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1772712000">- Fix change in user ownership in Debian packages. User changed from
  "openvpn" to "_openvpn".</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1772798400">- Fix config init during Debian postinst. Needs to run after
  systemd-sysusers.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773144000">- Re-add .pkla policy needed by older Ubuntu releases</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773230400">- Re-add python3-dbus, python3-gi and python3-systemd dependencies.
  These packages are missing in the default installation of some minimal
  images and breaks the systemd integration to start/stop VPN sessions.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773316800">- Re-add openvpn-dco-dkms as a recommended package</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1783944000">- Update to v27.1</changelog>
</package>
<package pkgid="6e0b8602054bc10ea08308817929178bcb1b7093a53a12144b07bcfba97e9cba253b6d11249d2aaec4fd7498067fa3fcad70ea6cad7de91b4f25ae988ac5b428" name="openvpn3" arch="x86_64">
  <version epoch="0" ver="27.1" rel="5.4"/>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1772712000">- Fix change in user ownership in Debian packages. User changed from
  "openvpn" to "_openvpn".</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1772798400">- Fix config init during Debian postinst. Needs to run after
  systemd-sysusers.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773144000">- Re-add .pkla policy needed by older Ubuntu releases</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773230400">- Re-add python3-dbus, python3-gi and python3-systemd dependencies.
  These packages are missing in the default installation of some minimal
  images and breaks the systemd integration to start/stop VPN sessions.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773316800">- Re-add openvpn-dco-dkms as a recommended package</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1783944000">- Update to v27.1</changelog>
</package>
<package pkgid="c0cdf347039b0c1914cb440c2068c690f53d92f9af21306b2e6ed926c78c2dfe21b61223752b668c87054c7c75eda88cc547eec49b4db367ff5622e2488431de" name="openvpn3-addon-aws" arch="x86_64">
  <version epoch="0" ver="27.1" rel="5.4"/>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1772712000">- Fix change in user ownership in Debian packages. User changed from
  "openvpn" to "_openvpn".</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1772798400">- Fix config init during Debian postinst. Needs to run after
  systemd-sysusers.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773144000">- Re-add .pkla policy needed by older Ubuntu releases</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773230400">- Re-add python3-dbus, python3-gi and python3-systemd dependencies.
  These packages are missing in the default installation of some minimal
  images and breaks the systemd integration to start/stop VPN sessions.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773316800">- Re-add openvpn-dco-dkms as a recommended package</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1783944000">- Update to v27.1</changelog>
</package>
<package pkgid="8e9640e2bd623ebb0ee7931ea7a84a562c3b3ba62885a1b8e8a6f36565809d1a750936f8feff884346b8ddd818e6ea582b7f07d7a1b9ac72badd1028e637ae22" name="openvpn3-addon-devposture" arch="x86_64">
  <version epoch="0" ver="27.1" rel="5.4"/>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1772712000">- Fix change in user ownership in Debian packages. User changed from
  "openvpn" to "_openvpn".</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1772798400">- Fix config init during Debian postinst. Needs to run after
  systemd-sysusers.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773144000">- Re-add .pkla policy needed by older Ubuntu releases</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773230400">- Re-add python3-dbus, python3-gi and python3-systemd dependencies.
  These packages are missing in the default installation of some minimal
  images and breaks the systemd integration to start/stop VPN sessions.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773316800">- Re-add openvpn-dco-dkms as a recommended package</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1783944000">- Update to v27.1</changelog>
</package>
<package pkgid="d292d09366cbb4164065af79c30dfb798f0c790edec06ca7f750e372fd02887cb2aa46cfa71adc6180916686810babb6e93eb6f3b1d5b3cce30bcaef935e8422" name="openvpn3-client" arch="x86_64">
  <version epoch="0" ver="27.1" rel="5.4"/>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1772712000">- Fix change in user ownership in Debian packages. User changed from
  "openvpn" to "_openvpn".</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1772798400">- Fix config init during Debian postinst. Needs to run after
  systemd-sysusers.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773144000">- Re-add .pkla policy needed by older Ubuntu releases</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773230400">- Re-add python3-dbus, python3-gi and python3-systemd dependencies.
  These packages are missing in the default installation of some minimal
  images and breaks the systemd integration to start/stop VPN sessions.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773316800">- Re-add openvpn-dco-dkms as a recommended package</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1783944000">- Update to v27.1</changelog>
</package>
<package pkgid="4ab4f98288edb8364e787380f4e7e278f25c0117a9a443e32fdcd15e42ee584d188e695232becc2cca0a880a53d421918ee1a1f148655e79249f025e67504467" name="openvpn3-devel" arch="noarch">
  <version epoch="0" ver="27.1" rel="5.4"/>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1772712000">- Fix change in user ownership in Debian packages. User changed from
  "openvpn" to "_openvpn".</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1772798400">- Fix config init during Debian postinst. Needs to run after
  systemd-sysusers.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773144000">- Re-add .pkla policy needed by older Ubuntu releases</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773230400">- Re-add python3-dbus, python3-gi and python3-systemd dependencies.
  These packages are missing in the default installation of some minimal
  images and breaks the systemd integration to start/stop VPN sessions.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773316800">- Re-add openvpn-dco-dkms as a recommended package</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1783944000">- Update to v27.1</changelog>
</package>
<package pkgid="bcf6dc93b921670ac407fc2aca761be3ecd2591a9c95a689eefcb567d844816e61a3307e5815e1a550a8346fd43a15d1595b1830278afa03740aa91b0b821676" name="openvpn3-dpc-openvpninc" arch="noarch">
  <version epoch="0" ver="27.1" rel="5.4"/>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1772712000">- Fix change in user ownership in Debian packages. User changed from
  "openvpn" to "_openvpn".</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1772798400">- Fix config init during Debian postinst. Needs to run after
  systemd-sysusers.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773144000">- Re-add .pkla policy needed by older Ubuntu releases</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773230400">- Re-add python3-dbus, python3-gi and python3-systemd dependencies.
  These packages are missing in the default installation of some minimal
  images and breaks the systemd integration to start/stop VPN sessions.</changelog>
  <changelog author="David Sommerseth &lt;dazo@eurephia.org&gt;" date="1773316800">- Re-add openvpn-dco-dkms as a recommended package</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1783944000">- Update to v27.1</changelog>
</package>
<package pkgid="285424a69bc3861038b182f210e6d4c83a71da2be980ad6ca7d382e47a2bcf63f895bec9e3084796abc90b6bf19cef63616219984c2704d44453ca97986a75ca" name="ovpn-backports" arch="src">
  <version epoch="0" ver="7.1.0.2026080300" rel="27.10"/>
</package>
<package pkgid="21d3ccf919957273cb1981ea8a46d922474be565a8ad831cda31dabd22707143053c3803ccae834c15689a12c6ba0b0a1049940331135f5637c2e861e7375681" name="ovpn-dco" arch="src">
  <version epoch="0" ver="0.2.20260804" rel="27.9"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773230400">- Debian: Change to use the full version number. We prefer this for
  Support reasons.
- Debian: This also fixes package build on Ubuntu 22.04. dh_dkms
  didn't automatically fall back to the version number and just
  left #MODULE_VERSION# in place.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 0.2.20260804</changelog>
</package>
<package pkgid="16b8066c5e129a182fbd186fabd2b3d7ba950ead1888f4ea83ff071508998c35639ac7d9a64d25e16efdaecd0706669f517db4e98c51606ac84115bafa8359dd" name="ovpn-dco-kmp-default" arch="x86_64">
  <version epoch="0" ver="0.2.20260804_k7.1.8_1" rel="27.9"/>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750400">- Initial packaging.
- Patched for SLE/openSUSE Leap compatibility.
- Added file:
  - 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt; - 0.2.20240320~git0.2aa7f93" date="1712750401">- Disable builds on releases prior to SLE15 SP2 / Leap 15.2.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1712923200">- Added ovpn-dco-preamble as a Source file.
- Fix spec file whitespace.</changelog>
  <changelog author="jeffm@suse.com" date="1726228800">- Update to version 0.2.20240712~git0.d22d04e:
  * ovpn-dco: drop ending year from copyright lines
  * ovpn-dco: add missing include for MODULE_ALIAS_GENL_FAMILY
  * ovpn-dco: fix gso.h compat code for RHEL 9.4
  * ovpn-dco: add net/gso.h existance check for RedHat 9.4
  * ovpn-dco: add compatibility for SUSE Linux Enterprise and openSUSE Leap
- Removed: 0001-ovpn-dco-add-compatibility-for-SUSE-Linux-Enterprise.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1734696000">- Update to version 0.2.20241216~git0.a08b2fd:
  * linux-compat: fix typ0 in comment
  * ovpn-dco: port to 6.12 and add related compat hacks
  * linux-compat: move UDP_ENCAP_OVPNINUDP to compat file
  * linux-compat: NLA_POLICY_MAX_LEN will be released in 6.13</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1742472000">- add: do-not-redefine-symbols-when-they-are-upstream.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1748433600">- add patches for 6.15
  * use-new-timer-api.patch
  * 6.15-newlink-proto.patch</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1753876800">- add patch for 6.16
  * timer_container_of.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1753963200">- Use existing pkg_vcmp macro instead of re-implementing this.</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1756123200">- Do not build on Tumbleweed, not needed anymore</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773230400">- Debian: Change to use the full version number. We prefer this for
  Support reasons.
- Debian: This also fixes package build on Ubuntu 22.04. dh_dkms
  didn't automatically fall back to the version number and just
  left #MODULE_VERSION# in place.</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1785931200">- Update to 0.2.20260804</changelog>
</package>
<package pkgid="c5bbcf065c54d3902db8d6fdc32fb411176250418e27fdd12db1da1cdbd0b4024eaca97a2d4052f271e0574fc95c8aff96cf24d8ffdc208f3ff4c076d8eba48c" name="ovpn-kmp-default" arch="x86_64">
  <version epoch="0" ver="7.1.0.2026080300_k7.1.8_1" rel="27.10"/>
</package>
<package pkgid="953d57b61130b9d728c3cc8f03c1390cb48f33f95e47623f7a6f96875a8c6206d1aab27cbd702f062c5917470b734fde75fec6ed5e817ee7e0f29e197eaff70d" name="python3-openvpn-connector-setup" arch="noarch">
  <version epoch="0" ver="6" rel="8.1"/>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773662400">- Initial import of the Debian packaging</changelog>
  <changelog author="Frank Lichtenheld &lt;frank@lichtenheld.com&gt;" date="1773662401">- Initial import of the RHEL packaging</changelog>
</package>
</otherdata>