OpenVPN is a robust, scalable and highly configurable VPN (Virtual Private
Network) daemon which can be used to securely link two or more private networks
using an encrypted tunnel over the internet. It can operate over UDP or TCP,
can use SSL or a pre-shared secret to authenticate peers, and in SSL mode, one
server can handle many clients.
This development port is updated frequently and is much less well tested
than the formal releases, and functionality and APIs may change without
warning.
DO NOT USE IN PRODUCTION WITHOUT PRIOR TESTING FOR YOUR USE CASE.
===> The following configuration options are available for openvpn-devel-g20260907,2:
ASYNC_PUSH=off: Enable async-push support
DCO=on: Build with Data Channel Offload (ovpn(4)) support
DOCS=on: Build and/or install documentation
EASYRSA=on: Install security/easy-rsa RSA helper package
EXAMPLES=on: Build and/or install examples
LZ4=on: LZ4 compression support
PKCS11=off: Use security/pkcs11-helper
SMALL=off: Build a smaller executable with fewer features
TEST=on: Build and/or run tests
UNITTESTS=off: Enable unit tests
====> SSL protocol support: you have to select exactly one of them
MBEDTLS=off: SSL/TLS support via mbed TLS
OPENSSL=on: SSL/TLS support via OpenSSL
===> Use 'make config' to modify these settings
security/openvpn-devel: Update to commit 22a24132da
This brings in the upstream development work of the last two months,
including two CVE fixes relevant for all platforms.
One of the bundled patch files was adjusted to take into account
upstream formatting changes on tests/t_cltsrv.sh.
PR: 298286
Approved by: osa, vvd (Mentors, implicit)
MFH: 2026Q3
Security: CVE-2026-84790
Security: CVE-2026-84732
security/openvpn-devel: Update to latest commit
This brings in the upstream development work of the last three months,
including a number of CVE fixes.
The previous commit erroneously bumped the date string used as the
version number to "2027". Fix that, and upgrade EPOCH to make it work.
Some maintenance on the port Makefile itself to address "portlint"
complaints and upstream changes (--enable-strict configure argument has
been dropped because the flags are always on now).
- Remove unnecessary GNU_CONFIGURE_MANPREFIX.
- Improve post-install-EXAMPLES-on.
(Only the first 15 lines of the commit message are shown above )
*/*: Use C.UTF-8 locale
Ports 02f27a83b44d fixed the ports tree to the C locale so it would work
correctly in environments where users use a locale that isn't compatible
with the C locale, e.g. xx_YY.UTF-8 where [A-Z] includes more than just
upper case letters. USE_LOCALE was introduced to let ports use another
locale if they needed it. The C.UTF-8 locale was created later on to be
mostly compatible with the C locale.
Switch the ports tree locale to C.UTF-8 and remove USE_LOCALE. The
world has moved to Unicode so all ports either require it or know how to
build correctly in a Unicode environment.
PR: 295945
Exp-run by: antoine
all: drop support for FreeBSD 13, mips and risc64sf
Reviewed by: many (*)
Differential Revision: https://reviews.freebsd.org/D55624
Differential Revision: https://reviews.freebsd.org/D55642 (merged in from bofh)
many (*)
acm arrowd brooks cmt dch decke dinoex eduardo fluffy fuz gahr garga
jbeich joerg jrm kai kenrap martymac matthew mfechner michaelo mizhka
nobutaka pkubaj se tagattie thj
Anton Saietskii
GenericRikka
Gert Doering
Jan Bramkamp
Oleh Hushchenkov
Oleksandr Kryvulia
Ralf van der Enden
Yamagi
desktop kde python tcltk office
security/openvpn-devel: upgrade to commit 64fae9d829
this brings in the upstream development work that has happened over
the last two months, plus two CVE fixes:
- fix race condition in TLS handshake that could lead to leaking of
packet data from a previous handshake under specific circumstances
(CVE-2026-40215)
(Bug found by XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com))
- fix server ASSERT() on receiving a suitably malformed packet with
a valid tls-crypt-v2 key (CVE-2026-35058)
(Bug found by XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com)
(Only the first 15 lines of the commit message are shown above )
security/openvpn-devel: Update 2.7_rc6 -> post-2.7 commit 38243844
OpenVPN 2.7.0 has been released and will show up as "security/openvpn"
soon.
This port skips 2.7.0 release and continues to track development versions,
which will focus on code cleanup / refactoring for the next few months.
Use this opportunity to bring option and dependency handling more in
line with main port
- X509ALTUSERNAME is gone (always-on now in upstream source)
- ASYNC_PUSH added, with freebsd-version dependent handling of
libinotify dependency (see PR 293176)
- UNITTEST added, with libcmocka dependency if unit tests are desired
security/openvpn-devel: Update 2.7_rc5 => 2.7_rc6
FreeBSD - notable changes for rc5 => rc6 update:
- bugfix on restarting a p2mp server instance with SIGUSR1
(inadvertedly closing fd 0, causing a crash on the next restart),
- prevent NULL pointer crash on suitable combination of --dns-updown
statements in openvpn config file (not pushable),
- prevent inappropriate management interface activity if a password is
set and --management-forget-disconnect or --management-signal are active,
- more conversion warnings fixed,
- remove #ifdefs around socket sendbuf/receive buf handling,
assuming that all platforms that have POSIX sockets have this,
- add mbedTLS 4 support,
- fix check for failed fork() in port-share code.
PR: 292829
Requested by: maintainer
security/openvpn-devel: Update 2.7_rc3 => 2.7_rc5
Some important changes for FreeBSD users rc3 -> rc5:
- CVE 2025-15497 in epoch key handling
- repair interaction between DCO and persist-tun after reconnection
- require "script-security 2" when using --dev unix:<program>
- improve documentation and error messages for a number of
deprecated options
- tun.c: unify read_tun()/write_tun() functions for all BSD
platforms
- more type conversion related cleanups
- add check for auth none / cipher none on FreeBSD DCO
- drop mbedtls 2.x support
PR: 292492
Sponsored by: Subcarpathian BSD User Group
-----
committer annotations by Matthias Andree
Approved by: Gert Doering (maintainer)
MFH: 2026Q1
security/openvpn-devel: Update 2.7_rc2 => 2.7_rc3
Relevant changes for FreeBSD users:
- more type conversion related warnings have been fixed
- --multihome behaviour regarding egress interface selection has been
changed. See Changes.rst and manpage for details.
- cleanup dead code in event handling code (leftover of the multisocket
patch set)
- add new feature, --tls-crypt-v2-max-age n. See Changes.rst and manpage
for details.
- improve documentation to point out the pitfalls of case-insensitive
filesystems and --client-config-dir
- split default gateway query logic in two:
- for --redirect-gateway functionality, query for the gateway
towards the actual IP address of the VPN server connecting to
(Only the first 15 lines of the commit message are shown above )
security/openvpn-devel: upgrade port to git commit d6ee27b4ff (2.7_rc2,
2025-11-17)
This commit brings the port to "openvpn 2.7_rc2"
Changes of interest for FreeBSD:
- IPv6 address parsing: fix buffer overread on invalid input
(CVE-2025-12106)
- HMAC verification check: fix incorrect memcmp() call
(CVE-2025-13086)
- even more type conversion related warnings have been fixed
- DCO FreeBSD improvements:
improving debug messages (verb 6)
implement client-side counter handling
repair --inactive (and document shortcomings)
(Only the first 15 lines of the commit message are shown above )
security/openvpn-devel: upgrade port to git commit 4281449ba4 (2.7_rc1,
2025-10-31)
This commit brings the port to "openvpn 2.7_rc1".
Changes of interest for FreeBSD:
- even more type conversion related warnings have been fixed
- more bugfixes related to BYTECOUNT display on the management
interface and byte counters on DCO platforms in general
- numerous minibugs reported by ZeroPath AI have been fixed
(small memleaks, possible file descriptor leaks, improved
sanity checks, add ASSERT() on function contracts, etc.)
- add warning for unsupported combination of --push and --tls-server
- add warning for unsupported combination of --reneg-bytes or
--reneg-pkts with DCO
(Only the first 15 lines of the commit message are shown above )
security/openvpn-devel: upgrade port to git commit 0fb5a00549 (2.7_beta2,
2025-09-25)
This commit brings the port to "openvpn 2.7_beta2".
Notable changes beta1 -> beta2 (relevant for FreeBSD) are:
- even more of signed/unsigned related warnings have been fixed
- #pragmas have been added to all to-be-fixed source files, so we can
now always enable -Wconversion to see if new code brings new warnings
(and the CI infra builds with -Werror)
- add proper input sanitation to DNS strings to prevent an attack
coming from a trusted-but-malicous OpenVPN server (CVE: 2025-10680,
affects unixoid systems with --dns-updown scripts and windows using
the built-in powershell call)
- Switch test_ssl certificate from RSA 2048 to secp384r1
(so "make check" runs with OpenSSL set to @SECLEVEL=3)
- clean up MI prefix handling
- replace all assert() calls with OpenVPN ASSERT()
PR: 289838
Security: e5cf9f44-9a64-11f0-8241-93c889bb8de1
Security: CVE-2025-10680
MFH: 2025Q3
security/openvpn-devel: fix mbedTLS3 bootstrapping
and switch to depend on the net/mbedtls3 port,
as we no longer carry mbedtls2 in ports.
Also, mbedTLS 3 supports TLSv1.3, so drop our local MBEDTLS_DESC
and go with the official description instead.
Approved by: Gert Doering (maintainer, via IRC)
Related to:
PR: 289315
security/openvpn-devel: Revert "disable ssl_testdriver test"
The cause wasn't OpenSSL 3.5 but a local tightening of the
settings, see https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289315#c6
This reverts commit e75cace158f73d560cb09b91f4915ea9e5689115.
PR: 289315
security/openvpn-devel: disable ssl_testdriver test
which embeds inline certificates that are inacceptable
for our openssl35 port, and possibly for FreeBSD 15.
PR: 289315
security/openvpn-devel: upgrade port to git commit 1e7b9a0fb0 (2.7_beta1,
2025-09-03)
This commit brings the port to "openvpn 2.7_beta1".
New features alpha3 -> beta1 are
- a large number of signed/unsigned related warnings have been fixed
- bugfixes in --dns-updown script for linux systems using resolvconf
- rewrite of the management interface "bytecount" infastructure to better
interact with DCO
- PUSH_UPDATE server support (via management interface)
- introduction of route_redirect_gateway_ipv4 and _ipv6 env variables
- speeding up t_client tests by reducing per-test startup delay 3s -> 1s
The biggest noticeable difference in beta1 is the reformatting using
clang-format, leaving uncrustify as that wasn't stable across versions.
PR: 289315
security/openvpn-devel: upgrade port to git commit 7b1b283478 (2.7_alpha3,
2025-07-31)
This commit brings the port to "openvpn 2.7_alpha3".
For FreeBSD, the most significant change is that "floating clients with
DCO" are supported, if the kernel has support for it (-current).
Platform-independent the "big new feature" is client side support
for PUSH_UPDATE (send new configuration data while a client-server
connection is established).
security/openvpn-devel: upgrade port to git commit df4863aa0e (2025-06-27)
This commit brings the port to "openvpn 2.7_alpha2" with a few extra
bugfixes.
There is one significant change here: the "old way" to update DNS
config via "--up contrib/pull-resolv-conf/client.up" and plugin-down-root.sh
has been replaced by a built-in mechanism (--dns-updown $script),
which is no loger "contributed" but maintained upstream, and brings
its own privilege separation / down-root mechanism. The old
contrib/pull-resolv-conf scripts have been removed from the upstream
distribution.
The port-specific "openvpn-client" script has been adjusted to do
the same thing ("run a client config with DNS setup") with the new
mechanism.
Besides this, this update has a number of minor bugfixes and improvements
to documentation, logging and testing infrastructure.
PR: 287892
security/openvpn-devel: upgrade port to git commit b75849ba36 (2025-04-02)
Fixes CVE-2025-2704 (servers using --tls-crypt-v2 can be made to ASSERT()
by sending a particular sequence of authenticated and malformed packets).
New feature: Multisocket support (listening to multiple sockets, UDP and
TCP, in one server) - with a number of minor bug fixes to that.
New feature: --override-username (see manpage for details)
Other minor features, polishing and bugfixes.
Security: 2cad4541-0f5b-11f0-89f8-411aefea0df9
Security: CVE-2025-2704
MFH: 2025Q2
security/openvpn-devel: upgrade port to git commit 9f4670fc71 (2025-02-12)
Contains a number of bugfixes and minor improvements, especially adding
more unit tests and cleaning up code all over the place.
The most important new feature in here is the "epoch data format",
which is a suitable data channel format & rekeying strategy for 10G+
links where regular AES rekeying starts to become a limiting factor.
When using FreeBSD DCO, epoch data format is not yet being used, because
this needs kernel changes in ovpn(4). This is on the roadmap.
-- Additional edits by mandree@: --
reset PORTREVISION
PR: 284766
security/mbedtls: Move to security/mbedtls2
The port has expired but isn't removed yet because there are still too
many consumers. Rename it because the name "security/mbedtls" makes it
look like it's the default version.
PR: 283792
security/openvpn-devel: upgrade port to git commit 91b057a2b5 (2024-02-11)
contains a number of bugfixes and minor improvements, especially adding
more unit tests.
There is one FreeBSD relevant bugfix for servers with DCO, where reporting
of kernel peer statistics to userland failed due to static buffers sized
too small (ENOSPC). Buffer handling here has been made dynamic.
PR: 276973
security/openvpn-devel: upgrade port to git commit efad93d049 (2023-11-17)
contains a number of bugfixes and minor improvements, plus fixes
for two bugs that have been assigned CVEs:
- CVE-2023-46850 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly use
a send buffer after it has been free()d in some circumstances, causing
some free()d memory to be sent to the peer. All configurations using TLS
(e.g. not using --secret) are affected by this issue.
(found while tracking down CVE-2023-46849 / Github #400, #417)
- CVE-2023-46849 OpenVPN versions between 2.6.0 and 2.6.6 incorrectly
restore "--fragment" configuration in some circumstances, leading to
a division by zero when "--fragment" is used. On platforms where
division by zero is fatal, this will cause an OpenVPN crash.
see also https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements
Also adjust files/patch-tests__t_cltsrv.sh because upstream commit
d623aa6c29 conflicts with this patch.
Security: 2fe004f5-83fd-11ee-9f5d-31909fb2f495
Security: CVE-2023-46849
Security: CVE-2023-46850
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree
- Remove all references to defunct ARCH arm
- Remove all references to defunct ARCH sparc64
- Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64
ARCH
- Remove sysutils/afbinit requires defunct sparc64 ARCH
- Remove all references to bktr driver
- Remove all references to defunct FreeBSD_12
- Remove all references to OSVERSION/OSREL corresponding to 12
- Remove conditionals in Mk/Uses/cabal.mk
- Remove sparc reference from Mk/Uses/qt-dist.mk
- Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64
- Remove BROKEN_FreeBSD_12* from:
- Remove OpenSSL patches from:
- Remove conditional flags for OSVERSION >= 1300000 to fixed flags.
Also move conditional flags for non sparc64/arm ARCH to fixed flags.
Reviewed by: brooks, jbeich, rene, salvadore
Differential Revision: https://reviews.freebsd.org/D42068
bsd.sites.mk: Update all ports using USE_GITLAB
Replace GL_COMMIT by GL_TAGNAME in all ports. The new GL_TAGNAME is
backwards-compatible (accepting any commit hash as before), but also
understands an actual tag name. Moving to tag names where appropriate is
left to individual ports' maintainers.
Approved by: portmgr (tcberner, mentor)
Differential Revision: https://reviews.freebsd.org/D37077
security/openvpn-devel: upgrade port to git commit fafb05f6f3 (2023-03-31)
This brings openvpn-devel to the current HEAD of the development tree,
which is still very close to OpenVPN 2.6.3.
Adjust config handling of option "DCO" to match upstream changes - that
is, DCO is enabled by default, so we pass "--disable-dco" to configure
now if the option is unchecked.
security/openvpn-devel: upgrade port to git commit 480ad2a84e (2023-01-13)
this commit is also 2.6_rc2 (+ a freebsd/linux build fix).
contains a number of bugfixes and minor improvements, see
https://github.com/OpenVPN/openvpn/blob/v2.6_rc2/Changes.rst
Most notable improvement: this contains a default-enabled ratelimiter
for initial TLS handshake packets (100 per 10s), significantly reducing
the usefulness of abusing an OpenVPN server as a DDoS reflection engine.
Use '--connect-freq-initial' to tune parameters if needed.
security/openvpn-devel: upgrade port to git commit 566c0791ca (2022-12-15)
this commit is also 2.6_beta2.
contains a number of bugfixes and minor improvements
user visible changes since last port upgrade
- freebsd + DCO now has working byte counters in DCO mode
- server no longer accepts new inbound client connections
while in "explicit-exit-notify" shutdown phase
- logging improvements for DCO key handling
security/openvpn-devel: upgrade port to git commit e778a6fd26d (2022-12-01)
this commit is also 2.6_beta1.
contains a good number of bugfixes and minor improvements
user visible changes since last port upgrade
- binary identifies itself as "2.6_beta1"
- client reconnect in p2p TLS mode works now with DCO enabled (on FreeBSD 14)
- more robust handling of cipher negotiation issues in p2p TLS mode
- supports server-pushable "tun-mtu" now
- support DCO with AES-192-GCM on sufficiently-new FreeBSD 14 kernels
security/openvpn-devel: fix up shebang of totpauth.py script
...and we also need to add USES+=python:build to fix
stage-qa complaints of the following kind:
Error: '/usr/local/bin/python' is an invalid shebang you need
USES=shebangfix for 'share/examples/openvpn/sample-scripts/totpauth.py'
ALTHOUGH the shebangfix has worked and replaced /usr/bin/python3
by /usr/local/bin/python (with /usr/local from LOCALBASE apparently).
security/openvpn-devel: upgrade port to git commit ecad4839ca (2022-10-27)
contains a good number of bugfixes and minor improvements, no new features.
user visible changes:
- "topology subnet" tun interfaces will now use IFF_POINTOPOINT
- DCO option on FreeBSD 14 will default to "on" now
- DCO on FreeBSD now requires a FreeBSD kernel after
commit 2e797555f701c38d9d to get kernel-side ovpn(4)
improvements, necessary for proper subnet + iroute support
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/openvpn-devel: options cleanup
- Drop TUNNELBLICK option and patch, which fails PATCH and if your force
it, build. security/openvpn removed the option earlier this year.
Drop pkg-help along with it
- Exclude DCO-option on FreeBSD 12 and 13. It requires FreeBSD 14
kernel features, and FreeBSD 11 and older are no longer supported.
Approved by: portmgr (blanket)
security/openvpn-devel: Upgrade to current git revision, add DCO option
commits up to 734de8f9aa2df bring a number new developments, especially
inclusion of the "Data Channel Offload" (OpenVPN in kernel space)
feature.
Since this is still considered not very well tested and needs a
very recent FreeBSD 14 kernel, this is off by default, and a new option
[ ] DCO
has been added to enable it.
security: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* <ports@c0decafe.net>
* Aaron Dalton <aaron@FreeBSD.org>
* Adam Weinberger <adamw@FreeBSD.org>
* Ade Lovett <ade@FreeBSD.org>
* Aldis Berjoza <aldis@bsdroot.lv>
* Alex Dupre <ale@FreeBSD.org>
* Alex Kapranoff <kappa@rambler-co.ru>
* Alex Samorukov <samm@freebsd.org>
* Alexander Botero-Lowry <alex@foxybanana.com>
* Alexander Kriventsov <avk@vl.ru>
* Alexander Leidinger <netchild@FreeBSD.org>
(Only the first 15 lines of the commit message are shown above )
security/openvpn-devel: Upgrade to current git revision
commits up to 413877f522e bring a number new developments, especially
hardening the server against TLS state exhaustion and being abused
for reflection/amplification attacks, a full MTU/MSS handling rehaul,
and proper OpenSSL 3.0.x support.
PR: 263818
*/*: Remove redundant '-[0-9]*' from CONFLICTS_INSTALL
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Approved by: portmgr (blanket)
security/openvpn-devel: switch to Gitlab and new maintainer
The previous maintainer asked that the port be removed, but
we seem to have found a better solution. Gert Doering volunteered
to take over the port and reference Git directly.
Import security/openvpn fix for leftover .orig files.
PR: 256209
Maintainer change implicitly
Approved by: ecrist@secure-computing.net (removal request)
New contents reviewed and
Approved by: gert@greenie.muc.de (new maintainer, by IRC/mail)
security/openvpn-devel: Update to 2021-W13 development snapshot
Commit history from 202049 to 202113:
5ac8c3c7 Fix async push broken after auth deferred refactor
8ccce69d log file descriptor in more socket related error messages
c5fec838 Move auth deferred related members into its own struct
6ea62d50 Remove deprecated option '--keysize'
60f5889a Deprecate non TLS mode in OpenVPN
79ff3f79 Allow running a default configuration with TLS libraries without BF-CBC
9e702a5d Always disable TLS renegotiations
203afbe9 reliable: retransmit if 3 follow-up ACKs are received
343b6119 Remove do_init_socket_2 and do_init_socket_1 wrapper function
9fe0b2c2 Extract multi_assign_peer_id into its own function
18b4a838 Remove thread_mode field of multi_context
(Only the first 15 lines of the commit message are shown above )
security/openvpn-devel: Update to 2020-W49 snapshot
Update port to 2020-W49 development snapshot.
1387f526 Fix port-share option with TLS-Crypt v2
4d307ed4 tls-crypt-v2: also preload tls-crypt-v2 keys (if --persist-key)
fb169c3b tls-crypt-v2: fix server memory leak
dfd624b5 Remove auth_user_pass.wait_for_push variable
fb789947 Fix auth-token not being updated if auth-nocache is set
88dc4276 Make any auth failure tls_authentication_status return auth failed
55d5eaa3 Send AUTH_FAILED message to clients on renegotiation failures
3ac8e592 Rename DECRYPT_KEY_ENABLED to TLS_AUTHENTICATED
f9d3fbf9 Clean up tls_authentication_status and document it
f1f0f074 Improve keys out of sync message
8292102b Add more documentation about our internal TLS functions
cc5a7163 Replace key_scan array of static pointers with inline function
fc25ca3a build: Fix missing install of man page in certain environments
0d4069e4 Change travis build scripts to use https when fetching prerequisites.
PR: 251761
Submitted by: Eric F. Crist (maintainer)
openvpn-devel Update to post 2.5 release development snapshot.
=== Commit Notes ===
99d217b2 Remove --disable-def-auth configure argument
0d4ca79d Remove explicit setting of peer_id to false
cb70cf51 Remove NULL checks before calling free
2c8a9877 Align reliable_free with other free methods to accept NULL
0d5aab88 Inline function tls_get_peer_info
bbcada8a Avoid passing NULL to argv_printf_cat() in temp_file error case.
a4eeef17 Add function for common env setting of verify user/pass calls
a480eaae Ignore deprecation warning for daemon on macOS
14bd92b7 Fix compilation on pre-EKM mbedTLS libraries.
f0734e49 Simplify key material exporter backend API
6dc09d0d Implement generating data channel keys via EKM/RFC 5705
1e6e083e networking_iproute2: fix memory leak in net_iface_mtu_set()
(Only the first 15 lines of the commit message are shown above )
security/openvpn-devel: Update to 2020-W35 snapshot (take 2 + 1/2)
This also adds a fix to the optional TUNNELBLICK extra-patch that removes
context now gone from the upstream code.
Here are the changes in the W35 snapshot:
136c5f01 Fix compilation with older mbed TLS versions (mbedtls_tls_prf_types
undefined)
5e19cc2c Workaround FreeBSD 12+ race condition on tun/tap open with IPv6.
10abd656 Refactor key_state_export_keying_material functions
62560e2a Fixes a bug in management_callback_send_cc_message, should be strlen
instead of sizeof
2ab0a924 Fix client's poor man NCP fallback
ed47c097 tun.c: enable using wintun driver under SYSTEM
2da29362 Improve the documentation for --dhcp-option
bf911882 Changes.rst: fix mistyped option names
(Only the first 15 lines of the commit message are shown above )
security/openvpn-devel: Update to 2020-W33 snapshot
Update to Week 33 snapshot:
e02616d8 Document comp-lzo no and compress being incompatible
c13d20fa Remove S_OP_NORMAL key state.
4b4f5fe2 Move parsing IV_PROTO to separate function
4edcf571 Skip existing interfaces on opening the first available utun on macOS
42b39e98 Merge check_coarse_timers and check_coarse_timers_dowork
cd88d947 Eliminate check_tls wrapper function
eed645b3 Eliminate check_incoming_control_channel wrapper function
b7aebba2 Eliminate check_fragment function
76ea0859 Rename check_ping_restart_dowork to trigger_ping_timeout_signal
ce7ddaaf Split pf_check_reload check and check timer in process_coarse_timers
feacd01c travis: don't run t_net.sh test
(Only the first 15 lines of the commit message are shown above )
security/openvpn-devel: update to 2020-W30 snapshot
This is from the PR, with the addition of
BUILD_DEPENDS+=rst2man:textproc/py-docutils
such that the manpage gets built (it doesn't ship with
snapshots - which are from Git - any longer).
changes:
08469ca1 Remove --client-cert-not-required
2d5facaa Remove --ifconfig-pool-linear
94edc7c5 Require AEAD support in the crypto library
ec7d0e8e Drop support for OpenSSL 1.0.1
df85950a travis: Fix make distcheck failure
aad16b6c client-connect: Implement deferred connect support for plugin API v2
(Only the first 15 lines of the commit message are shown above )
security/openvpn-devel: Update to 202028 (2020-W28 snapshot)
ChangeLog:
<https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=247974#c0>
While here:
* add cmocka as build-time requisite to include the engine test.
* use PLUGINDIR rather than hacking CPPFLAGS for PLUGIN_LIBDIR,
the latter breaks -fPIC detection by configure (breaking the
shared lib build for the engine unit tests)
PR: 247974
Submitted by: Eric F. Crist (maintainer)
security/openvpn-devel: Maintainer update to 201935
This commit updates the port to the latest development snapshot.
Additional changes over PR:
- leave CATEGORIES alone (leaving net-vpn in)
- move IGNORE_SSL upwards and remove USE_LDCONFIG to please portlint -CA
PR: 240376
Submitted by: ecrist@secure-computing.net (maintainer)
Patch sed(1) regexp in self-test script from GNU to POSIX syntax.
PR: 240307
Submitted by: kevans@
Approved by: ecrist@secure-computing.net (maintainer)
Update to new snapshot.
Note I didn't take the original patch because it needed to NOT conflict
with itself, and I had to fix indentation - be sure to use TAB, not
blanks, after the VARIABLE= part.
PR: 219305
Submitted by: ecrist@secure-computing.net (maintainer)
Update openvpn-devel to 2016-52 snapshot.
Align with security/openvpn for RC script improvements, dropping the
TUNNELBLICK patch (integrated upstream) and pkg-help file (no longer
required).
Note that pkcs11* and mbedTLS currently do not mix (I randomly checked
different option sets), an issue this port shares with security/openvpn.
"checking mbedtls pkcs11 support...
configure: error: mbedtls has no pkcs11 wrapper compiled in"
PR: 215734
Submitted by: Eric F. Crist (maintainer)
security/openvpn-devel: 201607 -> 201623
Port Changes:
- password-save option is always on now, no longer optional
- LibreSSL has been renamed mbed TLS
Upstream Changes:
- Implement --push-remove option to remove options pushed by server
- Use mbedTLS 2.x now, instead of PolarSSL 1.x
PR: 210259
Submitted by: ecrist@secure-computing.net (maintainer)
By default libtool replaces -export-symbols <file> with -retain-symbols-file
<file> on ELF systems, but this doesn't really do what -export-symbols is
meant to do. On GNU ELF systems it converts <file> to a simple version
script first and then uses -version-script instead of -retain-symbols-file.
Let USES=libtool patch libtool scripts to do this on all systems with GNU
ld(1).
Bump PORTREVISION on all ports where the build log contains -export-symbols.
audio/calf: This port builds a module that now exports only one function,
but it also builds a number of executables that link to this module and
expect to see other functions. Because it's already a bit dodgy to link to
a module (libtool warns about this) let the module continue to export only
one function and instead build an ordinary library from the same source that
the executables can link to. Fix a number of other issues in the same
(Only the first 15 lines of the commit message are shown above )
- Update security/polarssl13 to 1.3.11
- Patch a Makefile so regular make install works
- Replace a patch with MAKE_ENV
- Bump dependent ports
PR: 200816
