OpenVPN: baixar versions anteriors

Security fixes:
- reliability layer: avoid unbounded reliable TLS timeout, and ignore acks
for packets that cannot be outstanding (CVE-2026-84732)
Both reliability layer bugs found by Mark Bregman (Fox-IT)
- windows: fix CreateProcess() command line quoting for characters that
are special to cmd.exe, where a combination of validation script plus
rogue CA could lead to misbehavior (CVE-2026-84256)
Bug found by Clouditera Security
- windows: fix tapctl to always call netsh.exe with full path
(as we do elsewhere) (CVE-2026-84226)
Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2)
- windows: don't use NULL DACL with system objects, namely the --service
exit event and the netsh.exe guard semaphore.
The old approach was prone to a local DoS where one user could interfere
with other users' openvpn processes by blocking the netsh semaphore or
sending events. This only affects setups not using the iservice, or
using the automatic service to start/stop openvpn (CVE-2026-82312)
Bug found by DEBRAJ BASAK
- openvpnserv (windows): pass correct NRPT domains size - when IDN domains
with UTF8 encoding were involved, a buffer overread could be achieved
(CVE-2026-78221)
Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2)
- openvpnserv (windows): don't allow '/' in config paths.
The APIs windows uses for path validation do not handle '/' as path
separator, while the file open APIs do, so this could be used to
circumvent our config path validation, leading to openvpn.exe starting
a user-controlled config file even if administratively not allowed
(CVE-2026-78043)
Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2)
- dhcp (windows): fix off-by-one in write_dhcp_search_str() temp buffer
guard - suitable DHCP options could lead to a single-byte overflow of a
temp buffer (CVE-2026-81738)
Bug found by Andre Kropp (Nexory) and ChinhNguyen
- linux netlink: validate netlink replies against the request
Suggested by Joshua Rogers as a security improvement
- openvpnserv (windows): fix off-by-one on input validation
(discovered while fixing CVE-2026-78221)
- openvpnserv (windows): harden CheckConfigPath() a bit more
(another improvement while working on CVE-2026-78043)
User-visible Changes:
- when using EPOCH data channel format, reduce the number of future keys
from 16 to 4 - the previous calculation was wrong, and 4 spare keys are
sufficient for 100+ Gbit/s links. This means less log spam in userland
and fewer resources used in in-kernel implementations.
Bugfixes:
- work around a pubkey-handling bug in mbedTLS 4.1.0 and 4.2.0
(supposedly fixed in 4.3.0)
- multi: don't let stale-routes-check delete permanent routes -
--stale-routes-check did not only delete dynamic cached routes, but
also routes installed by --iroute and --ifconfig-push. Fixed by
introducing route flags and restraining the check on them
(Github: OpenVPN/openvpn#1063)
- ssl: do not queue control ciphertext while a packet is still queued
(fixes problems in TCP p2p handshake when both sides try to handshake
at the same time)
(Github: OpenVPN/openvpn#1089)
- reenable xmit_hold when using p2p tcp-server and tls-server - in TCP
server mode the server is not expected to initiate the TLS handshake.
This was introduced by the multisocket code checking the wrong variable
for socket protocol
(Github: OpenVPN/openvpn#1089)
- clinat: do not adjust UDP checksum if zero (as per RFC768)
(Github: OpenVPN/openvpn#1037)
- openssl: avoid resetting the HMAC key on every packet
(Github: OpenVPN/openvpn#1088)
- openvpnserv (windows): fix log lines format string - interface names with
international characters printed in some error messages need to be
converted from UTF8 to UCS16 first.
- fix format string specifier for size_t (%zu)
- fix test_misc compile issues with -Werror
Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.7.6...v2.7.7

Security fixes:
- openvpnserv (windows): better scrutinize command line passed in
from the control socket to openvpn. This would lead to circumventing
admin restrictions on allowed openvpn config directories (but never
to "read files the user has no permissions for") (CVE-2026-63649)
Bug found by 章鱼哥 (www.aipyaipy.com)
- dco: make key state desync recoverable
This was reported as a "with suitable timing, a key-update de-sync between
OpenVPN and the kernel could trigger an ASSERT()", and was initially
handled as security report. It turned out to be not exploitable, but the
state machine was not very robust and so the opportunity was used to
improve the code.
Bug found by 章鱼哥 (www.aipyaipy.com)
- make --x509-username-field work with mbedTLS.
In very particular setups, together with a CA creating matching certificates,
this could lead to unintentionally permitting a certificate that should
not have. This is why this was considered a (low-prio) security bug and a
CVE ID was assigned (CVE-2026-63650)
Bug found by 章鱼哥 (www.aipyaipy.com)
User-visible Changes:
- if --dev is not specified, default to --dev tun - so for the
tun case, this option can now be left out of the openvpn config.
- --ping and --keepalive settings are now limited to 24 hours
maximum - the primary reason for that is to avoid lots of extra code
in the DCO kernel to handle arbitrarily large values without overflowing
32 bit integers. 24h is considered much higher than any reasonable use.
- The TCP_NODELAY socket flag is now "always on". The --tcp-nodelay
option is kept, because setting it on a p2mp server also enables pushing
of socket-flags TCP_NODELAY to clients, which might not have this
code change yet.
- Remove --providers from --help output on mbedTLS builds.
Bugfixes:
- refuse incoming HARD RESET packets with a sequence ID != 0
(this is basically making an OpenVPN server ignore and log a
"should never happen" client-side misbehaviour, which could lead to
TLS handshake establishment failures in p2p TLS setups)
- correctly calculate packet id size if epoch packet format is in use -
this was off by 4, for connections openvpn 2.7+ to openvpn 2.7+,
exceeding "mssfix mtu" headroom by those 4 bytes
(Github: OpenVPN/openvpn#1074)
- correct minimum packet length check for 802.1q tagged packets
(Github: OpenVPN/openvpn#1044).
This was also reported (twice) as a security bug, as technically
OpenVPN with --client-nat would read and write up to 4 bytes
"after the end of the packet" - but due to the OpenVPN packet buffer
layouts, which are always full-frame-sized this is fully safe and has
no adverse consequences.
Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.7.5...v2.7.6

Security fixes:
- openvpnserv (windows): fix DNS SearchList state pollution on (dis)connect.
specific combinations of --dns config entries plus local DNS config
could lead to corruption of pre-openvpn DNS config (CVE-2026-13379)
Bug found by 章鱼哥 (www.aipyaipy.com).
- Fix use-after-free bug in ack_write_buf(), triggerable by a well-timed
sequence of control channel + authentication packets (CVE-2026-12996)
Bug found by multiple researchers:
- 章鱼哥 (www.aipyaipy.com)
- Haiyang Huang
- Haruki Oyama (Waseda University)
- Fix use-after-free bug in tls_wrap_reneg(), triggerable by suitable
sequence of dynamic tls-crypt control-channel packets (CVE-2026-13117)
Bug found by multiple researchers:
- Trace37 Labs (github.com/trace37labs)
- Haiyang Huang
- Fix server crash on reception of suitably malformed auth-token, if
--auth-gen-token external-auth is active (CVE-2026-13122)
Bug found by Haiyang Huang.
- Fix memory-leak in tls-crypt-v2 client key handling that could lead
to out-of-memory situations and subsequent server crashes (CVE-2026-12932)
Bug found by Valton Tahiri.
- Fix possible 1-byte buffer overrun on NTLMv2 proxy responses.
(CVE-2026-11771)
Bug found by Tristan Madani (@TristanInSec).
- Fix another memory leak on reception of suitable tls-crypt-v2 packets
that could lead to an out of memory situation and server crash
(CVE-2026-13698)
Bug found by Max Fillinger. Overlaps with a report
from Valton Tahiri that we believe to
be fixed by this bugfix as well.
Bugfixes:
- Windows: fix plugin trusted-dir check prefix bypass
(this fixes a bug in the path checking logic we do on Windows for
"is loading a plugin from this path allowed?", but since we could
not find a way to exploit this unless starting with admin privs or
a social engineering attack, not classified as a security fix)
- Windows: openvpnserv: rework ConvertItfDnsDomains and tests
(this fixes a buffer overread that is not exploitable and as such
not classified as security fix)
- options: fix use-after-free of DNS options on client connect
(using suitable --dns or --dhcp-option DNS options in a server
config - not pushed, but applying to the server itself - triggers a
double free() and use-after-free condition, possibly crashing the
server) (Github: OpenVPN/openvpn#1060)
- dns: Fix memory leak in dns_server_addr_parse, if too many server
addresses are configured (Github: OpenVPN/openvpn#1055)
- improve multi-socket event handling further - multiple open UDP sockets
with concurrent traffic could lead to inefficient processing, and the
old code was also very hard to follow.
(This was initially triggered by a report from Joshua Rogers using ZeroPath,
but turned out to be "just bad code" not a security vulnerability)
- Null-terminate tls-crypt client keys when testing - non-exploitable
strlen() on a buffer that is not null-terminated
- mudp: send HMAC reset reply synchronously
this fixes a bug where multiple incoming tls-crypt-v2 RESET packets
on different sockets could end up overwriting each other's control
structures, leading to initial handshake packets (HMAC reset reply)
being sent to the wrong client IP, or on a non-suitable socket
("v4 packet on a v6 socket"). Since the overall flow here is stateless
by nature, do not artificially create state by creating elaborate
queues, just send-or-drop.
- fix port-share and multi-socket interaction - port-share needs TCP
listeners, but the check was wrong. So "as long as any of the listening
sockets is TCP, port-share can be used" (Github: OpenVPN/openvpn#1027)
- Ensure pushed tun-mtu is no lower than TUN_MTU_MIN - this fixes a bug
where a server can push a suitable combination of options and make the
client ASSERT().
(Reported as security issue by Haiyang Huang,
but it was decided that the server always has means to make the client
"not function properly", and it can not be exploited beyond that)
- Windows: socket: assert buffer length before reading prepended sockaddr
family - a misbehaviour in the windows DCO driver could trigge

Bugfixes:
- using --dns server ... style configs on Windows with win-dco would
lead to erroneously enabling "DnsSecValidationRequired : True", possibly
breaking VPN DNS resolution. Pushing --dns server ... dnssec no
can be used as a workaround until clients can be updated.
(Github: openvpn#1024)
- correct comments in the --dns-up-down platform scripts relating to
dns_server_..._dnssec values.
- fix release-only build of pkcs11-helper vcpkg port, do not try to
install files from debug build.
- mbedTLS builds will now provide a proper error message if a
tls-group statement with no valid groups is encountered
(used to run into SSL handshake failure later on).
- --enable-strict and --enable-strict-options configure flags have
been removed (because they did not actually do anything anymore)
For details see Changes.rst
Windows Client: Community MSI installer for Windows client can be found at Community Downloads.
Linux Packages: Instructions for installing community-maintained Linux packages can be found in the Community Wiki.
Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.7.3...v2.7.4

Bugfixes:
- using --dns server ... style configs on Windows with win-dco would
lead to erroneously enabling "DnsSecValidationRequired : True", possibly
breaking VPN DNS resolution. Pushing --dns server ... dnssec no
can be used as a workaround until clients can be updated.
(Github: openvpn#1024)
- correct comments in the --dns-up-down platform scripts relating to
dns_server_..._dnssec values.
- fix release-only build of pkcs11-helper vcpkg port, do not try to
install files from debug build.
- mbedTLS builds will now provide a proper error message if a
tls-group statement with no valid groups is encountered
(used to run into SSL handshake failure later on).
- --enable-strict and --enable-strict-options configure flags have
been removed (because they did not actually do anything anymore)
For details see Changes.rst
Windows Client: Community MSI installer for Windows client can be found at Community Downloads.
Linux Packages: Instructions for installing community-maintained Linux packages can be found in the Community Wiki.
Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.7.3...v2.7.4

Bugfixes:
- in combination with --management-query-passwords, setups using
--auth-user-pass file or inline auth-user-pass would no longer
use the configured passwords and prompt on the management interface
instead (OpenVPN GUI would then provide an empty user/password prompt)
(Github: openpvn#1021).
For details see Changes.rst
Windows Client: Community MSI installer for Windows client can be found at Community Downloads.
Linux Packages: Instructions for installing community-maintained Linux packages can be found in the Community Wiki.
Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.7.2...v2.7.3

Security fixes:
- CVE-2026-40215: fix race condition in TLS handshake that could lead to leaking of
packet data from a previous handshake under specific circumstances
- CVE-2026-35058: fix server ASSERT() on receiving a suitably malformed packet with
a valid tls-crypt-v2 key
New features:
- management interface: permit input of very long passwords in
base64-encoded multiline format. Signal support to management
clients via "management version 6".
User-visible Changes:
- improve error messages on --verify-x509-name failures
- improve error logging when overlong username or passwords can not
be written to TLS buffer
Bugfixes:
- when using a config file with inlined username and no password,
fix prompting for the password from management interface.
- Windows: fix DNSSEC flag handling - this got never applied due to
a bad comparison being always false.
- Windows: fix deinstallation progress bar on adapter deletion.
For details see Changes.rst
Windows Client: Community MSI installer for Windows client can be found at Community Downloads.
Linux Packages: Instructions for installing community-maintained Linux packages can be found in the Community Wiki.
Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.7.1...v2.7.2

New features:
- Add a new username-only flag argument to --auth-user-pass which
will now make OpenVPN only query for username and send a dummy password
to the server. This is only useful if auth schemes are used on the
server side that will do some sort of external challenge base on username,
and not password authentication. See discussion in
GH OpenVPN/openvpn#501
(starting Jan 30, 2024).
- Increase default sizing of internal hash maps to 4 * --max-clients.
The default used to be 256 with a --max-clients default of
1024 - this is bad for performance, while the memory savings are
minimal. On a very memory constrained system, reduce --max-clients.
User-visible Changes:
- When compiled with the AWS-LC SSL library, using --tls-cert-profile
will now print a run-time warning - the library does not support it,
so it would silently do nothing.
- Systemd unit files: change LimitNPROC to TasksMax and increase limit
(GH: OpenVPN/openvpn#929)
- Documentation improvements.
- port-share: log incoming connections at verb 3, not on error
level anymore (GH: OpenVPN/openvpn#976).
Bugfixes:
- Fix usage of --lport inside a <connection> block - this got
broken with the multi-socket patchset (GH: OpenVPN/openvpn#995)
- Do not try to run auto-pam unit test when cross-compiling.
- Do not break private-key passphrases of length >= 64
(GH: OpenVPN/openvpn#993)
- Fix obscure ASSERT() crash on TCP connects with TAP and no ip config.
- Make DCO work on FreeBSD systems that have no IPv4 support in kernel
(FreeBSD PR 286263)
- Make DCO work on Linux on big endian systems (namely, MIPS and PowerPC)
(GH: OpenVPN/ovpn-dco#96)
- Fixup responses to management interface version command (for >= 4)
- Make --enable-async-push work on FreeBSD 15 (which has native
inotify support, and consequently no libinotify.pc anymore)
- Adjust some code parts to new "const" handling on string function
returns (ISO C23, as implemented by glibc 2.43 and newer).
For details see Changes.rst
Windows Client: Community MSI installer for Windows client can be found at Community Downloads.
Linux Packages: Instructions for installing community-maintained Linux packages can be found in the Community Wiki.
Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.7.0...v2.7.1

Highlights of 2.7
- Multi-socket support for servers -- Handle multiple addresses/ports/protocols within one server
- Improved Client support for DNS options
- Client implementations for Linux/BSD/macOS, included with the default install
- New client implementation for Windows, adding support for features like split DNS and DNSSEC
- Architectural improvements on Windows
- The block-local flag is now enforced with WFP filters
- Windows network adapters are now generated on demand
- Windows automatic service now runs as an unpriviledged user
- Support for server mode in win-dco driver
- Note: Support for the wintun driver has been removed. win-dco is now the default, tap-windows6 is the fallback solution for use-cases not covered by win-dco.
- Improved data channel
- Enforcement of AES-GCM usage limit
- Epoch data keys and packet format
- Support for new upstream DCO Linux kernel module
- This release supports the new ovpn DCO Linux kernel module which will be available in future upstream Linux kernel releases. Backports of the new module to current kernels are available via the ovpn-backports project.
- Client-side support for new PUSH_UPDATE control-channel message
- This allows servers to send updates to options like routing and DNS config without triggering a reconnect.
- PUSH_UPDATE server support (minimal)
- New management interface commands push-update-broad and push-update-cid to send PUSH_UPDATE option updates.
- TLS 1.3 support with bleeding-edge mbedTLS versions
- Support for mbedTLS version 4
- Two new environment variables have been introduced to communicate desired default gateway redirection to plugins like Network Manager.
- Support for Epoch data channel on Windows, using the win-dco driver (2.8.0+)
- "Recursive Routing" check is now more granular, and will only drop packets-in-tunnel if destination IP, protocol and port matches with those needed to reach the VPN server.
- COPYING: license details only relevant to our Windows installers have been updated and moved to the openvpn-build repo
For details see Changes.rst
Windows Client: Community MSI installer for Windows client can be found at Community Downloads.
Linux Packages: Instructions for installing community-maintained Linux packages can be found in the Community Wiki.
Changes since last release candidate: https://github.com/OpenVPN/openvpn/compare/v2.7_rc6...v2.7.0

Highlights of 2.7
- Multi-socket support for servers -- Handle multiple addresses/ports/protocols within one server
- Improved Client support for DNS options
- Client implementations for Linux/BSD/macOS, included with the default install
- New client implementation for Windows, adding support for features like split DNS and DNSSEC
- Architectural improvements on Windows
- The block-local flag is now enforced with WFP filters
- Windows network adapters are now generated on demand
- Windows automatic service now runs as an unpriviledged user
- Support for server mode in win-dco driver
- Note: Support for the wintun driver has been removed. win-dco is now the default, tap-windows6 is the fallback solution for use-cases not covered by win-dco.
- Improved data channel
- Enforcement of AES-GCM usage limit
- Epoch data keys and packet format
- Support for new upstream DCO Linux kernel module
- This release supports the new ovpn DCO Linux kernel module which will be available in future upstream Linux kernel releases. Backports of the new module to current kernels are available via the ovpn-backports project.
- Client-side support for new PUSH_UPDATE control-channel message
- This allows servers to send updates to options like routing and DNS config without triggering a reconnect.
- PUSH_UPDATE server support (minimal)
- New management interface commands push-update-broad and push-update-cid to send PUSH_UPDATE option updates.
- TLS 1.3 support with bleeding-edge mbedTLS versions
- Support for mbedTLS version 4
- Two new environment variables have been introduced to communicate desired default gateway redirection to plugins like Network Manager.
- Support for Epoch data channel on Windows, using the win-dco driver (2.8.0+)
- "Recursive Routing" check is now more granular, and will only drop packets-in-tunnel if destination IP, protocol and port matches with those needed to reach the VPN server.
- COPYING: license details only relevant to our Windows installers have been updated and moved to the openvpn-build repo
For details see Changes.rst
Windows Client: Community MSI installer for Windows client can be found at Community Downloads.
Linux Packages: Instructions for installing community-maintained Linux packages can be found in the Community Wiki.
Changes since last release candidate: https://github.com/OpenVPN/openvpn/compare/v2.7_rc6...v2.7.0

Security fixes:
- CVE-2025-13751: Windows/interactive service: fix erroneous exit on error that could be
used by a local Windows users to achieve a local denial-of-service
Bug fixes:
- Windows/interactive service: improve service pipe robustness against
file access races (uuid) and access by unauthorized processes (ACL).
- upgrade bundled build instruction (vcpkg and patch) for pkcs11-helper
to 1.31, fixing a parser bug
Windows Client: Community MSI installer for Windows client can be found at Community Downloads.
Linux Packages: Instructions for installing community-maintained Linux packages can be found in the Community Wiki.
Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.6.16...v2.6.17

Security fixes:
- CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
Security scope: OpenVPN servers between 2.6.1 and 2.6.13 using
--tls-crypt-v2 can be made to abort with an ASSERT() message by
sending a particular combination of authenticated and malformed packets.
To trigger the bug, a valid tls-crypt-v2 client key is needed, or
network observation of a handshake with a valid tls-crypt-v2 client key.
No crypto integrity is violated, no data is leaked, and no remote
code execution is possible.
This bug does not affect OpenVPN clients.
(Bug found by internal QA at OpenVPN Inc)
Bug fixes:
- Linux DCO: repair source IP selection for --multihome (Qingfang Deng)
Windows Client: Community MSI installer for Windows client can be found at Community Downloads.
Linux Packages: Instructions for installing community-maintained Linux packages can be found in the Community Wiki.
Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.6.13...v2.6.14

Security fixes:
- CVE-2025-2704: fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
Security scope: OpenVPN servers between 2.6.1 and 2.6.13 using
--tls-crypt-v2 can be made to abort with an ASSERT() message by
sending a particular combination of authenticated and malformed packets.
To trigger the bug, a valid tls-crypt-v2 client key is needed, or
network observation of a handshake with a valid tls-crypt-v2 client key.
No crypto integrity is violated, no data is leaked, and no remote
code execution is possible.
This bug does not affect OpenVPN clients.
(Bug found by internal QA at OpenVPN Inc)
Bug fixes:
- Linux DCO: repair source IP selection for --multihome (Qingfang Deng)
Windows Client: Community MSI installer for Windows client can be found at Community Downloads.
Linux Packages: Instructions for installing community-maintained Linux packages can be found in the Community Wiki.
Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.6.13...v2.6.14

Bug fixes / Code cleanup
------------------------
- SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF state
(Github #449) - the new sanity check function introduced in 2.6.7
sometimes tried to use a NULL pointer after an unsuccessful TLS handshake

- Windows: --dns option did not work when tap-windows6 driver was used,
because internal flag for "apply DNS option to DHCP server" wasn't set
(Github #447)

- Windows: fix status/log file permissions, caused by regression after
changing to CMake build system (Github: #454, Trac: #1430)

- Windows: fix --chdir failures, also caused by error in CMake build system
(Github #448)

- doc: fix typos in documentation

User visible changes
--------------------
- Windows: print warning if pushed options require DHCP (e.g. DOMAIN-SEARCH)
and driver in use does not use DHCP (wintun, dco).

Antonio Quartulli (1):
dco: fix crash when --multihome is used with --proto tcp

Arne Schwabe (8):
Mock openvpn_exece on win32 also for test_tls_crypt
Add warning for the --show-groups command that some groups are missing
Print peer temporary key details
Add warning if a p2p NCP client connects to a p2mp server
Remove openssl engine method for loading the key
Remove saving initial frame code
Double check that we do not use a freed buffer when freeing a session
Fix using to_link buffer after freed

Frank Lichtenheld (7):
GHA: do not trigger builds in openvpn-build anymore
GHA: new workflow to submit scan to Coverity Scan service
buffer: use memcpy in buf_catrunc
vcpkg-ports/pkcs11-helper: Backport MinGW series from master to release/2.6
CMake: backport CMake buildsystem from master to release/2.6
Remove all traces of the previous MSVC build system
doc: fix argument name in --route-delay documentation

Heiko Hund (1):
dns option: remove support for exclude-domains

Lev Stipakov (3):
Warn user if INFO control command is too long
dco-win: get driver version
dco: warn if DATA_V1 packets are sent to userspace

Selva Nair (2):
Make cert_data.h and test_cryptoapi/pkcs11.c MSVC compliant
Log OpenSSL errors on failure to set certificate

orbea (1):
configure: disable engines if OPENSSL_NO_ENGINE is defined

Antonio Quartulli (1):
configure.ac: fix typ0 in LIBCAPNG_CFALGS

Arne Schwabe (8):
Avoid unused function warning/error on FreeBSD (and potientially others)
fix warning with gcc 12.2.0 (compiler bug?)
Fix CR_RESPONSE mangaement message using wrong key_id
Print a more user-friendly error when tls-crypt-v2 client auth fails
Ignore Ipv6 route delete request on Android and set ipv4 verbosity to 7
Revert commit 423ced962d
Implement using --peer-fingerprint without CA certificates
show extra info for OpenSSL errors

David Sommerseth (1):
ntlm: Clarify details on NTLM phase 3 decoding

Frank Lichtenheld (8):
dist: add more missing files only used in the MSVC build
dist: Include all documentation in distribution
unit_tests: Add missing cert_data.h to source list for unit tests
test_tls_crypt: Improve mock() usage to be more portable
Remove old Travis CI related files
options: Do not hide variables from parent scope
pkcs11_openssl: Disable unused code
route: Fix overriding return value of add_route3

George Pchelkin (1):
fix typo: dhcp-options to dhcp-option in vpn-network-options.rst

Gert Doering (1):
Make received OCC exit messages more visible in log.

Heiko Hund (1):
work around false positive warning with mingw 12

Lev Stipakov (3):
tun.c: enclose DNS domain in single quotes in WMIC call
manage.c: document missing KID parameter
Set WINS servers via interactice service

Sergey Korolev (1):
dco-linux: fix counter print format

Arne Schwabe (1):
Fix use-after-free with EVP_CIPHER_free

Frank Lichtenheld (6):
dco_linux: properly close dco version file
DCO: fix memory leak in dco_get_peer_stats_multi for Linux
Fix two unused assignments
sample-plugins: Fix memleak in client-connect example plugin
options: remove --key-method from usage message
msvc-generate: include version.m4.in in tarball

Ilya Shipitsin (1):
src/openvpn/dco_freebsd.c: handle malloc failure

Lev Stipakov (2):
dco-win: support for --dev-node
tapctl: generate driver-specific adapter names

Selva Nair (2):
Correctly handle Unicode names for exit event
Interactive service: do not force a target desktop for openvpn.exe

Arne Schwabe (3):
Remove unused variable line
Add Apache2 linking with for new commits
Fix compile error on TARGET_ANDROID

Frank Lichtenheld (2):
man page: Remove cruft from --topology documentation
tests: do not include t_client.sh in dist

Kristof Provost (1):
DCO: support key rotation notifications

Michael Nix (1):
fix typo in help text: --ignore-unknown-option

Selva Nair (2):
Format Windows error message in Unicode
Bugfix: dangling pointer passed to pkcs11-helper

Frank Lichtenheld (3):
GHA: remove Ubuntu 18.04 builds
vcpkg: request "tools" feature of openssl for MSVC build
doc: run rst2* with --strict to catch warnings

Lev Stipakov (1):
Support of DNS domain for DHCP-less drivers

Selva Nair (1):
Bug-fix: segfault in dco_get_peer_stats()

Frank Lichtenheld (3):
GHA: remove Ubuntu 18.04 builds
vcpkg: request "tools" feature of openssl for MSVC build
doc: run rst2* with --strict to catch warnings

Lev Stipakov (1):
Support of DNS domain for DHCP-less drivers

Selva Nair (1):
Bug-fix: segfault in dco_get_peer_stats()

Antonio Quartulli (6):
dco: don't use NetLink to exchange control packets
dco: print version to log if available
dco-linux: remove M_ERRNO flag when printing netlink error message
multi: don't call DCO APIs if DCO is disabled
dco-freebsd: use m->instances[] instead of m->hash
dco-linux: implement dco_get_peer_stats{, multi} API

Arne Schwabe (12):
Set netlink socket to be non-blocking
Ensure n = 2 is set in key2 struct in tls_crypt_v2_unwrap_client_key
Fix memory leaks in open_tun_dco()
Fix memory leaks in HMAC initial packet generation
Use key_state instead of multi for tls_send_payload parameter
Make sending plain text control message session aware
Only update frame calculation if we have a valid link sockets
Improve description of compat-mode
Simplify --compress parsing in options.c
Refuse connection if server pushes an option contradicting allow-compress
Add 'allow-compression stub-only' internally for DCO
Parse compression options and bail out when compression is disabled

Frank Lichtenheld (1):
tests/unit_tests: Fix 'make distcheck' with subdir-objects enabled

Gert Doering (1):
preparing release 2.6.2

Heiko Hund (1):
dns option: allow up to eight addresses per server

Kristof Provost (1):
dco: print FreeBSD version

Lev Stipakov (4):
Support --inactive option for DCO
Fix '--inactive <time> 0' behavior for DCO
Print DCO client stats on SIGUSR2
Don't overwrite socket flags when using DCO on Windows

Michael Baentsch (1):
using OpenSSL3 API for EVP PKEY type name reporting

Selva Nair (8):
Bugfix: Convert ECDSA signature form pkcs11-helper to DER encoded form
Import some sample certificates into Windows store for testing
Add tests for finding certificates in Windows cert store
Refactor SSL_CTX_use_CryptoAPI_certificate()
Add a test for signing with certificates in Windows store
Unit tests: add test for SSL_CTX_use_Cryptoapi_certificate()
Improve error message on short read from socks proxy
Make error in setting metric for IPv6 interface non-fatal

Arne Schwabe (13):
Fix unaligned access in auth-token
Update LibreSSL to 3.7.0 in Github actions
Add printing USAN stack trace on github actions
Fix LibreSSL not building in Github Actions
Add missing stdint.h includes in unit tests files
Combine extra_tun/frame parameter of frame_calculate_payload_overhead
Update the last sections in the man page to a be a bit less outdated
Add building unit tests with mingw to github actions
Revise the cipher negotiation info about OpenVPN3 in the man page
Exit if a proper message instead of segfault on Android without management
Use proper print format/casting when converting msg_channel handle
Reduce initialisation spam from verb <= 3 and print summary instead
Dynamic tls-crypt for secure soft_reset/session renegotiation

Frank Lichtenheld (8):
Changes.rst: document removal of --keysize
Windows: fix unused function setenv_foreign_option
Windows: fix unused variables in delete_route_ipv6
Windows: fix wrong printf format in x_check_status
Windows: fix unused variable in win32_get_arch
configure: enable DCO by default on FreeBSD/Linux
Windows: fix signedness errors with recv/send
configure: fix formatting of --disable-lz4 and --enable-comp-stub

Gert Doering (2):
Get rid of unused 'bool tuntap_buffer' arguments.
FreeBSD 12.x workaround for IPv6 ifconfig is needed on 12.4 as well

Kristof Provost (3):
options.c: enforce a minimal fragment size
configure: improve FreeBSD DCO check
dco: define OVPN_DEL_PEER_REASON_TRANSPORT_DISCONNECT on FreeBSD

Lev Stipakov (6):
Allow certain DHCP options to be used without DHCP server
dco-win: use proper calling convention on x86
Improve format specifier for socket handle in Windows
Disable DCO if proxy is set via management
Add logging for windows driver selection process
Avoid management log loop with verb >= 6

Matthias Andree (1):
make dist: Ship ovpn_dco_freebsd.h, too

Selva Nair (9):
block-dns using iservice: fix a potential double free
Conditionally add subdir-objects option to automake
Build unit tests in mingw Windows build
cyryptapi.c: log the selected certificate's name
cryptoapi.c: remove pre OpenSSL-3.01 support
cryptoapi.c: simplify parsing of thumbprint hex string
Option --cryptoapicert: support issuer name as a selector
Add a unit test for functions in cryptoapi.c
Do not save pointer to 'struct passwd' returned by getpwnam etc.

Antonio Quartulli (1):
dco_linux: update license for ovpn_dco_linux.h

Arne Schwabe (1):
Workaround: make ovpn-dco more reliable

Gert Doering (3):
Fix OVPN_DEL_PEER_REASON_TRANSPORT_DISCONNECT breakage on FreeBSD+DCO
Repair special-casing of EEXIST for Linux/SITNL route install
preparing release 2.6.0

Lev Stipakov (3):
openvpnmsica: remove dco installer custom actions
openvpnmsica: remove unused declarations
openvpnmsica: fix adapters discovery logic for DCO

Selva Nair (4):
Define and use macros for route addition status code
Warn when pkcs11-id or pkcs11-id-management options are ignored
Cleanup route error and debug logging on Windows
Fix one more 'existing route may get deleted' case

Timo Rothenpieler (1):
Don't clear capability bounding set on capng_change_id

OpenVPN Data Channel Offload for Windows
Move WSK initialization into OVPN_IOCTL_NEW_PEER ioctl
Use "nolower" binding to avoid filter driver incompatibilities
https://github.com/OpenVPN/ovpn-dco-win/issues/31
Fix BSOD after resume from Legacy Standby (S3)
https://github.com/OpenVPN/ovpn-dco-win/issues/36

Antonio Quartulli (1):
dco_linux: update license for ovpn_dco_linux.h

Arne Schwabe (1):
Workaround: make ovpn-dco more reliable

Gert Doering (3):
Fix OVPN_DEL_PEER_REASON_TRANSPORT_DISCONNECT breakage on FreeBSD+DCO
Repair special-casing of EEXIST for Linux/SITNL route install
preparing release 2.6.0

Lev Stipakov (3):
openvpnmsica: remove dco installer custom actions
openvpnmsica: remove unused declarations
openvpnmsica: fix adapters discovery logic for DCO

Selva Nair (4):
Define and use macros for route addition status code
Warn when pkcs11-id or pkcs11-id-management options are ignored
Cleanup route error and debug logging on Windows
Fix one more 'existing route may get deleted' case

Timo Rothenpieler (1):
Don't clear capability bounding set on capng_change_id

OpenVPN Data Channel Offload for Windows
Move WSK initialization into OVPN_IOCTL_NEW_PEER ioctl

Antonio Quartulli (4):
networking: use OPENVPN_ETH_ALEN instead of ETH_ALEN
networking_iproute2: don't pass M_WARN to openvpn_execve_check()
t_net.sh: delete dummy iface using iproute command
auth-pam.c: add missing include limits.h

Arne Schwabe (11):
Add insecure tls-cert-profile options
Refactor early initialisation and uninitialisation into methods
Allow loading of non default providers
Add ubuntu 22.04 to Github Actions
Add macos OpenSSL 3.0 and ASAN builds
Add --with-openssl-engine autoconf option (auto|yes|no)
Fix allowing/showing unsupported ciphers and digests
Remove dependency on BF-CBC existance from test_ncp
Add message when decoding PKCS12 file fails.
Translate OpenSSL 3.0 digest names to OpenSSL 1.1 digest names
Fix client-pending-auth error message to say ERROR instead of SUCCESS

Gert Doering (1):
Preparing release 2.5.7

Jan Mikkelsen (1):
cipher-negotiation.rst missing from doc/Makefile.am

Lev Stipakov (5):
vcpkg-ports\pkcs11-helper: shorten patch filename
msvc: adjust build options to harden binaries
vcpkg-ports: remove openssl port
vcpkg: switch to manifest
Fix M_ERRNO behavior on Windows

Marc Becker (1):
vcpkg-ports/pkcs11-helper: bump to release 1.29

Simon Rozman (1):
tapctl: Resolve MSVC C4996 warnings