OpenVPN is een robuuste en gemakkelijk in te stellen opensource-vpn-daemon waarmee verschillende private networks aan elkaar geknoopt kunnen worden door een encrypted tunnel via internet. Voor de beveiliging wordt gebruikgemaakt van de OpenSSL-library, waarmee alle encryptie, authenticatie en certificatie kunnen worden afgehandeld. De ontwikkelaars hebben versie 2.5.6 uitgebracht en de belangrijkste veranderingen daarin zijn hieronder voor je op een rijtje gezet.
User-visible ChangesNew features
- Update copyright year to 2022
Bugfixes
- New plugin (sample-plugin/defer/multi-auth.c) to help testing with multiple parallel plugins that succeed/fail in direct/deferred mode
- Various build improvements (github actions etc)
- Upgrade pkcs11-helper to release 1.28.4
Documentation
- CVE-2022-0547, see here for more information. If openvpn is configured with multiple authentication plugins and more than one plugin tries to do deferred authentication, the result is not well-defined - creating a possible authentication bypass.
In this situation the server process will now abort itself with a clear log message. Only one plugin is allowed to do deferred authentication.- Fix "--mtu-disc maybe|yes" on Linux
Due to configure/syshead.h/#ifdef confusion, the code in question was not compiled-in since a long time. Fixed. Trac: #1452- Fix $common_name variable passed to scripts when username-as-common-name is in effect.
This was not consistently set - sometimes, OpenVPN exported the username, sometimes the common name from the client cert. Fixed. Trac: #1434- Fix potential memory leaks in add_route() and add_route_ipv6().
- Apply connect-retry backoff only to one side of the connection in p2p mode. Without that fix/enhancement, two sides could end up only sending packets when the other end is not ready. Trac: #1010, #1384
- Remove unused sitnl.h file
- Clean up msvc build files, remove unused MSVC build .bat files
- Repair "--inactive" handling with a 'bytes' parameter larger than 2 Gbytes
due to integer overflow, this ended up being "0" on Linux, but on Windows with MSVC it ends up being "always 2 Gbyte", both not doing what is requested. Trac: #1448- Repair handling of EC certificates on Windows with pkcs11-helper
(wrong compile-time defines for OpenSSL 1.1.1)
- Documentation improvements related to DynDNS. Trac: #1417
- Clean up documentation for --proto and related options
- Rebuild rst docs if input files change (proper dependency handling)
:fill(white):strip_exif()/i/2003549196.jpeg?f=thumbmedium)
:strip_icc():strip_exif()/u/317599/crop5d18b37261809_cropped.jpeg?f=community){kind=small}
:strip_icc():strip_exif()/u/147640/van_hitomi_small_1_noborder.jpg?f=community){kind=small}
/u/142848/crop631b73f49acc6_cropped.png?f=community){kind=small}
:strip_icc():strip_exif()/u/16170/crop5f3ee51d8d633.jpeg?f=community){kind=small}
:strip_icc():strip_exif()/u/179238/crop5641af1748ed7_cropped.jpeg?f=community){kind=small}