OpenVPN is a robust, scalable and highly configurable VPN (Virtual Private
Network) daemon which can be used to securely link two or more private networks
using an encrypted tunnel over the internet. It can operate over UDP or TCP,
can use SSL or a pre-shared secret to authenticate peers, and in SSL mode, one
server can handle many clients.
===> The following configuration options are available for openvpn-2.7.8:
ASYNC_PUSH=off: Enable async-push support
DCO=on: Data Channel Offload/ovpn(4) support->README.dco.md
DOCS=on: Build and/or install documentation
EASYRSA=on: Install security/easy-rsa RSA helper package
EXAMPLES=on: Build and/or install examples
LZ4=on: LZ4 compression support
LZO=on: LZO compression (incompatible with LibreSSL)
PKCS11=on: Use security/pkcs11-helper, needs same SSL lib!
SMALL=off: Build a smaller executable with fewer features
TEST=on: Build and/or run tests
UNITTESTS=off: Enable unit tests
X509ALTUSERNAME=off: Enable --x509-username-field
===> Use 'make config' to modify these settings
Reason:
The openvpn 2.7 port update no longer installs the openvpn-client.up
and openvpn-client.down scripts into libexec/, but instead a
dns-updown script into libexec/openvpn/.
Review your configuration, and the openvpn man page for --dns-updown.
Reason:
OpenVPN has been updated to the new upstream release v2.6.0, which
is quite compatible with v2.5 versions.
A copy of the latest v2.5.8 port is being kept as security/openvpn25 (or
openvpn25 package) until end of March 2023.
security/openvpn: bugfix update to 2.7.6
This is not security-relevant on FreeBSD, one security fix affects
Windows, the other one only affects builds against mbedTLS (which is not
currently supported by the port), and a third one (second bullet point)
turned out to not be exploitable.
Note that the --dev option defaults to "tun" (if not specified).
Note that --ping and --keepalive settings are now capped at 24 h.
TCP-based configurations now always enable TCP_NODELAY.
Changelog: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.6
MFH: 2026Q3
Pull Request: https://github.com/freebsd/freebsd-ports/pull/584
*/*: Use C.UTF-8 locale
Ports 02f27a83b44d fixed the ports tree to the C locale so it would work
correctly in environments where users use a locale that isn't compatible
with the C locale, e.g. xx_YY.UTF-8 where [A-Z] includes more than just
upper case letters. USE_LOCALE was introduced to let ports use another
locale if they needed it. The C.UTF-8 locale was created later on to be
mostly compatible with the C locale.
Switch the ports tree locale to C.UTF-8 and remove USE_LOCALE. The
world has moved to Unicode so all ports either require it or know how to
build correctly in a Unicode environment.
PR: 295945
Exp-run by: antoine
all: drop support for FreeBSD 13, mips and risc64sf
Reviewed by: many (*)
Differential Revision: https://reviews.freebsd.org/D55624
Differential Revision: https://reviews.freebsd.org/D55642 (merged in from bofh)
many (*)
acm arrowd brooks cmt dch decke dinoex eduardo fluffy fuz gahr garga
jbeich joerg jrm kai kenrap martymac matthew mfechner michaelo mizhka
nobutaka pkubaj se tagattie thj
Anton Saietskii
GenericRikka
Gert Doering
Jan Bramkamp
Oleh Hushchenkov
Oleksandr Kryvulia
Ralf van der Enden
Yamagi
desktop kde python tcltk office
security/openvpn: Update to 2.7.1
This changes installed scripts, openvpn-client.up and .down scripts
are no longer installed into libexec/, but instead a dns-updown script
is placed into libexec/openvpn/ (all under $PREFIX).
Based on a patch provided by Marek Zarychta.
Changelog: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.1
PR: 293138, 286263
security/openvpn: update to v2.6.15
ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.6.15/Changes.rst#overview-of-changes-in-2615
FreeBSD relevant changes:
(note the DCO float notifications had previously been backported
for the FreeBSD port already in 2.6.14_3, and we're not currently
building with mbedTLS support for 2.6.x)
New features / User visible changes
-----------------------------------
- Apply more checks to incoming TLS handshake packets before creating
new state - namely, verify message ID / acked ID for "valid range for
an initial packet". This fixes a problem with clients that float
very early but send control channel packet from the pre-float IP
(Only the first 15 lines of the commit message are shown above )
security/openvpn: assert()->ASSERT() cleanup
This reverts my prior assert -> if...return(false) change
to Ralf Lici's backport, and replaces all assert() by ASSERT().
Gert Doering writes:
| OpenVPN's ASSERT() macro will do a bit more than the standard-libc
| assert() call, namely print out which function and what expression
| failed, before calling _exit(1). Also, it can not be accidentially
| compiled-away (-DNDEBUG).
|
| Use of ASSERT() generally only advised in cases of "this must not happen,
| but if it does, it's a programming or state corruption error that we
| must know about". Use of assert() is lacking the extra debug info, and as
| such, not advised at all.
This is a backport of OpenVPN master changes...
Obtained from: Gert Doering <gert@greenie.muc.de>
Obtained from: <https://gerrit.openvpn.net/c/openvpn/+/1171>
PR: 289303
MFH: 2025Q3 (suggestion after 10 days)
security/openvpn: support DCO float notifications
The FreeBSD kernel added "if_ovpn: support floating clients"
on main on 2025-07-28, and merged it to 14/stable on 2025-08-13.
https://reviews.freebsd.org/D51468https://cgit.freebsd.org/src/commit/?id=9c52600a5a150117b4396df3b868cf2516e1674c&h=mainhttps://cgit.freebsd.org/src/commit/?h=stable/14&id=fc387ed68f3c7b0b8da9bab13492b7bbafecb5bf
This adds a new notification from the kernel module to user space
named OVPN_NOTIF_FLOAT, which OpenVPN 2.6.14 does not support.
Backport support into OpenVPN 2.6.
Reported by: Marek Zarychta <zarychtam@plan-b.pwste.edu.pl>
Obtained from: Kristof Provost <kp@FreeBSD.org>
Obtained from: Ralf Lici <ralf@mandelbit.com>
- modified to avoid assert() in nvlist_to_sockaddr()
in src/openvpn/dco_freebsd.c
Obtained from: Gert Doering <gert@greenie.muc.de>
Tested by: Marek Zarychta <zarychtam@plan-b.pwste.edu.pl>
PR: 289303
MFH: 2025Q3 (suggestion after 10 days)
security/openvpn: remove 2048-bit legacy Diffie Hellman
I received a fallout complaint from i386 FreeBSD 15-PRERELEASE
builders that, as of now, has no other explanation than a tightened
(if intermediately) SECLEVEL on that machine, and that's due to
Diffie-Hellman 2048 bit parameters, and self-tests are failing
with stereotypical "ee key too small" and "dh key too small".
While it's not clear what the exact cause of the failure is and
if we had a glitch in the OpenSSL 3.5.1 import (Enji updated
the main branch to 3.5.2 shortly after), let's modernize the
setup a bit.
Fallout and Builder logs (I take it the 2nd URL states
that the FreeBSD src branch was at commit c6778f3a442):
(Only the first 15 lines of the commit message are shown above )
security/openvpn: security update to 2.6.14
"Fix possible ASSERT() on OpenVPN servers using --tls-crypt-v2
Security scope: OpenVPN servers between 2.6.1 and 2.6.13 using
--tls-crypt-v2 can be made to abort with an ASSERT() message by sending
a particular combination of authenticated and malformed packets.
To trigger the bug, a valid tls-crypt-v2 client key is needed, or
network observation of a handshake with a valid tls-crypt-v2 client key
No crypto integrity is violated, no data is leaked, and no remote code
execution is possible.
This bug does not affect OpenVPN clients."
ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.6.14/Changes.rst#overview-of-changes-in-2614
Security: 2cad4541-0f5b-11f0-89f8-411aefea0df9
Security: CVE-2025-2704
MFH: 2025Q2
security/openvpn: critical update to 2.6.13
ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.6.13/Changes.rst#overview-of-changes-in-2613
Notably: Security fixes
improve server-side handling of clients sending usernames or
passwords longer than USER_PASS_LEN - this would not result in a crash,
buffer overflow or other security issues, but the server would then
misparse incoming IV_* variables and produce misleading error messages.
Security: 47bc292a-d472-11ef-aaab-7d43732cb6f5
MFH: 2025Q1
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree
- Remove all references to defunct ARCH arm
- Remove all references to defunct ARCH sparc64
- Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64
ARCH
- Remove sysutils/afbinit requires defunct sparc64 ARCH
- Remove all references to bktr driver
- Remove all references to defunct FreeBSD_12
- Remove all references to OSVERSION/OSREL corresponding to 12
- Remove conditionals in Mk/Uses/cabal.mk
- Remove sparc reference from Mk/Uses/qt-dist.mk
- Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64
- Remove BROKEN_FreeBSD_12* from:
- Remove OpenSSL patches from:
- Remove conditional flags for OSVERSION >= 1300000 to fixed flags.
Also move conditional flags for non sparc64/arm ARCH to fixed flags.
Reviewed by: brooks, jbeich, rene, salvadore
Differential Revision: https://reviews.freebsd.org/D42068
security/openvpn: add missing 2.6.x documentation,
...for instance, README.dco.md but also others.
Update DCO help text to refer to this .md file.
Found while debugging
PR: 275206
MFH: 2023Q4
security/openvpn: remove header file that now ships with 2.6.1 tarball
Since this is identical to what's in the tarball, no PORTREVISION
bump is required.
security/openvpn: default-enable DCO
(on FreeBSD but not 12 and 13, because the relevant if_ovpn module
is to appear in FreeBSD 14.)
Reported by: Kristof Provost (kp@)
security/openvpn*: update to 2.6.0, keep openvpn25
- copy openvpn to openvpn25, mark as deprecated and to expire March 31
- update openvpn to openvpn 2.6.0, highlights from Frank Lichtenheld's
release announcement e-mail, slightly edited:
* Data Channel Offload (DCO) kernel acceleration support for Windows,
Linux, and FreeBSD [14].
* OpenSSL 3 support
* Improved handling of tunnel MTU, including support for pushable MTU.
* Outdated cryptographic algorithms disabled by default, but there are
options to override if necessary.
* Reworked TLS handshake, making OpenVPN immune to replay-packet state
exhaustion attacks.
* Added --peer-fingerprint mode for a more simplistic certificate setup
and verification.
* Improved protocol negotiation, leading to faster connection setup.
ChangeLog: https://github.com/OpenVPN/openvpn/blob/v2.6.0/Changes.rst
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* <ports@c0decafe.net>
* Aaron Dalton <aaron@FreeBSD.org>
* Adam Weinberger <adamw@FreeBSD.org>
* Ade Lovett <ade@FreeBSD.org>
* Aldis Berjoza <aldis@bsdroot.lv>
* Alex Dupre <ale@FreeBSD.org>
* Alex Kapranoff <kappa@rambler-co.ru>
* Alex Samorukov <samm@freebsd.org>
* Alexander Botero-Lowry <alex@foxybanana.com>
* Alexander Kriventsov <avk@vl.ru>
* Alexander Leidinger <netchild@FreeBSD.org>
(Only the first 15 lines of the commit message are shown above )
security/openvpn: Bump PORTREVISION to be newer than on quarterly.
This is to make sure that with 2022Q3 branching off of this
version, the package will look newer and flush out the old
package, with MBEDTLS and TUNNELBLICK options now removed.
security/openvpn: update to v2.5.7
FreeBSD-related changes from Changes.rst:
- Limited OpenSSL 3.0 support
OpenSSL 3.0 support has been added. OpenSSL 3.0 support in 2.5 relies
on the compatiblity layer and full OpenSSL 3.0 support is coming with
OpenVPN 2.6. Only features that impact usage directly have been
backported:
``--tls-cert-profile insecure`` has been added to allow selecting the
lowest OpenSSL security level (not recommended, use only if you must).
OpenSSL 3.0 no longer supports the Blowfish (and other deprecated)
algorithm by default and the new option ``--providers`` allows loading
(Only the first 15 lines of the commit message are shown above )
security/openvpn: drop man source patch
There has been a report of sporadic man-page rebuilds on OpenZFS.
While the patch order is correct, we do not intend to rebuild the
manpage (after a nobody -> openvpn change, for instance), and
we also patch the output files. So just remove the source patch.
This should go without any functional changes, so ships without
bumping PORTREVISION.
There is an upstream ticket reporting a missing source file
in the tarball. https://community.openvpn.net/openvpn/ticket/1461
Reported by: Jan Martin Mikkelsen
PR: 263116
security/openvpn: bugfix update to 2.5.5
Bugfixes (FreeBSD-specific):
* improve "make check" to notice if "openvpn --show-cipher" crashes
* improve argv unit tests
* ensure unit tests work with mbedTLS builds without BF-CBC ciphers
* include "--push-remove" in the output of "openvpn --help"
* fix "resolvconf -p" invocation in example "up" script
* fix "common_name" environment for script calls when
"--username-as-common-name" is in effect (Trac #1434)
Documentation:
* move "push-peer-info" documentation from "server options" to "client"
(where it belongs)
* correct "foreign_option_{n}" typo in manpage
* update IRC information in CONTRIBUTING.rst (libera.chat)
* README.down-root: fix plugin module name
security/openvpn: re-enable mbedTLS build
...now that mbedTLS metadata was fixed to show the actual situation
for mbedTLS 2.x.y, that it's either Apache License 2.0, or
GNU General Public License 2.0 or any later version.
While here, also mark the main port with mbedTLS option enabled to
record it's going to lose the mbedTLS option end of March 2022.
security/openvpn: license incompat mbedTLS, LZO+LibreSSL
After reviewing licenses again,
- mark mbedTLS broken for now, since it uses the Apache License 2.0,
which is incompatible with the GPLv2 (OpenVPN does not employ the
"or any later version" escape hatch). This will be handed to the
OpenVPN-devel mailing list for review.
- block out the combination of LZO with LibreSSL, since OpenVPN
only has a linking exception for OpenSSL itself. Remedy is
to either forgo LibreSSL, or to disable the LZO option, which
requires proper configuration on either end. The maintainer's
recommendation is to compile with OpenSSL instead.
Bump PORTREVISION in spite of unchanged contents to flush out old
packages.
MFH: 2021Q4
security/openvpn-mbedtls: sunset port.
mbedTLS is obsolete through its lack of TLS v1.3 support
OpenVPN-mbedtls does not work on 14-CURRENT.
=> remove this port and the MBEDTLS option end 2022Q1.
*/*: Remove redundant '-[0-9]*' from CONFLICTS_INSTALL
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Approved by: portmgr (blanket)
security/openvpn: fix missing include for PATH_MAX
While here, add a warning banner about libressl support status,
and clean up a leftover INSTALL_DATA workaround no longer needed.
Patch suggested and
Reported by: Franco Fichtner <franco@opnsense.org>
PR: 256744
security/openvpn: do not package .orig leftovers from patch
Bump PORTREVISION as we change the pkg-plist.
(Includes -mbedtls port variant.)
PR: 255946
Based on a patch by and
Reported by: Mikael Urankar (mikael@)
security/openvpn: run ldd -a when multi-link of "same" library found
The build runs a sanity to check that libssl and libcrypto are linked
only once, to catch mismatches in SSL providers to libpkcs11-helper
and openvpn itself. In order to assist the operator to find out
which libraries pull in differing versions of libcrypto or libssl,
run ldd -a in the error path. (Not run normally, not PORTREVISION bump.)
PR: 254323 (related)
security/openvpn: fix test suite when ifconfig emits ::1/128 address format
Some systems apparently format output of ifconfig lo0 similar to
"inet6 ::1/128" instead of 12.1's "inet6 ::1 prefixlen 128". This
confuses the test script, so strip the slash and trailing prefixlen
off.
Since that bug affects the build-time test suite and its occurrence
breaks the build, no PORTREVISION bump needed.
Reported by: des@
security/openvpn: future proofing, PLUGINDIR now ...
...configured the official way, not hacky (which failed in openvpn-devel
because it broke some configure tests).
security/openvpn: update to 2.4.9 (also for -mbedtls slave port)
At the same time, remove ASYNC_PUSH_LIBS workaround from [1].
Changelog (high-level):
https://github.com/OpenVPN/openvpn/blob/release/2.4/Changes.rst#version-249
Git changelog, marking the three fixes that were already in 2.4.8_3
as cherry-picks with a 1, 2, or 3 instead of "*" to correspond
with the PORTREVISION, and those with "-" that are specific to other systems,
say, Windows.
* 9b0dafca 2020-04-16 | Preparing release v2.4.9 (ChangeLog, version.m4,
Changes.rst) (tag: v2.4.9) [Gert Doering]
3 f7b318f8 2020-04-15 | Fix illegal client float (CVE-2020-11810) [Lev Stipakov]
* 9bb285e3 2020-03-13 | Fix broken async push with NCP is used [Lev Stipakov]
(Only the first 15 lines of the commit message are shown above )
security/openvpn: Fix illegal client float (CVE-2020-11810)
There is a time frame between allocating peer-id and initializing data
channel key (which is performed on receiving push request or on async
push-reply) in which the existing peer-id float checks do not work right.
If a "rogue" data channel packet arrives during that time frame from another
address and with same peer-id, this would cause client to float to that new
address.
The net effect of this behaviour is that the VPN session for the "victim
client" is broken. Since the "attacker client" does not have suitable keys,
it can not inject or steal VPN traffic from the other session. The time
window is small and it can not be used to attack a specific client's session,
unless some other way is found to make it disconnect and reconnect first.
This fix is inherited by the openvpn-mbedtls slave port.
Obtained from: Lev Stipakov (OpenVPN)
MFH: 2020Q2 (blanket security patch)
Security: CVE-2020-11810
Security: 8604121c-7fc2-11ea-bcac-7781e90b0c8f
openvpn: Add default-off ASYNC_PUSH option.
When enabled, pulls in devel/libinotify, and
adds --enable-async-push to configure.
In contrast to garga@'s proposal, uses
ASYNC_PUSH_LIBS instead of a patch file.
PR: 244286
Submitted by: garga@
Allow build without compression libs.
In that situation, add ./configure --enable-compression-stub.
While here, rearrange Makefile and use _ENABLE rather than _OFF
tags for the options.
Submitted by: Daniel Engberg
Differential Revision: https://reviews.freebsd.org/D23190
security/openvpn[-mbedtls] upstream update to OpenVPN 2.4.8
This upstream release integrated two FreeBSD patches by Kyle Evans and me,
which are herewith dropped from the port.
Upstream release banner
"This is primarily a maintenance release with minor bugfixes and improvements."
High-level changes:
<https://github.com/OpenVPN/openvpn/blob/release/2.4/Changes.rst#version-248>
Manually filtered FreeBSD-related excerpt from Git log: v2.4.7..v2.4.8:
- mbedtls: fix segfault by calling mbedtls_cipher_free() in cipher_ctx_free()
[Antonio Quartulli]
- openssl: Fix compilation without deprecated OpenSSL 1.1 APIs [Rosen Penev]
- Force combinationation of --socks-proxy and --proto UDP to use IPv4. [Gert
Doering]
(Only the first 15 lines of the commit message are shown above )
security/openvpn: regression fix, support LibreSSL again.
(I use a different patch than what was submitted by pizzamig@,
and have sent our patch upstream.)
Remove IGNORE_SSL.
While here, remove USE_LDCONFIG to fix a portlint complaint,
and fix a typo in a Makefile comment.
PR: 238382
Reported by: pizzamig@
OpenVPN won't compile with LibreSSL, mark IGNORE.
Upstream maintainers are massively pushing back against patches
offered so far with valid and concrete technical reasons and unsuitability
of the LibreSSL version API that will create a maintenance nightmare.
(And LibreSSL abusing the OpenSSL API.)
PR: 238382
Submitted by: pizzamig
security/openvpn[-mbedtls] update to OpenVPN 2.4.7
Upstream release announcement:
"This is primarily a maintenance release with bugfixes and improvements.
One of the big things is enhanced TLS 1.3 support
Please note that LibreSSL is not a supported crypto backend. We accept
patches and we do test on OpenBSD 6.0 which comes with LibreSSL, but if
newer versions of LibreSSL break API compatibility we do not take
responsibility to fix that."
Move USES up to please portlint.
Change summary:
<https://github.com/OpenVPN/openvpn/blob/release/2.4/Changes.rst#version-247>
Detailed change list:
<https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24#OpenVPN2.4.7>
Update to new upstream bugfix release 2.4.6.
While here, warn and sleep for 10 s when building against LibreSSL.
Remove some cruft.
Change summary:
<https://github.com/OpenVPN/openvpn/blob/release/2.4/Changes.rst#version-246>
Changelog:
<https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24#OpenVPN2.4.6>
Reported by: portscout
Number of commits found: 236 (showing only 100 on this page)
