Home A - Z
Page Index

An Otter Wiki

Commit b253da

2026-11-05 15:10:15 flichtenheld: -/-
Downloads.md ..
@@ 23,7 23,7 @@
to invalid-quoting attacks ([CVE-2026-115342](https://www.cve.org/CVERecord?id=CVE-2026-115342))
- win32: openvpn.exe: change parsing of commandline to use the same
- function that the interactive service uses (CommandLineToArgvW())
+ function that the interactive service uses (`CommandLineToArgvW()`)
([CVE-2026-115342](https://www.cve.org/CVERecord?id=CVE-2026-115342))
(Issues found by Heiko Hund, tracked in
@@ 31,56 31,55 @@
### Bug fixes
- - Username/Password parsing from --auth-user-pass file (or inline)
+ - Username/Password parsing from `--auth-user-pass` file (or inline)
left parts of overlong usernames in the password field. Fix.
(GH [OpenVPN/openvpn#1140](https://github.com/OpenVPN/openvpn/issues/1140))
- win32: openvpnserv: fix memory leak for security descriptors
- - win32: repair logging of errors in Windows tun_read_queue()
+ - win32: repair logging of errors in Windows `tun_read_queue()`
- - win32: avoid accessing uninitialized structure data if GetInterfaceInfo()
- or GetPerAdapterInfo() fail
+ - win32: avoid accessing uninitialized structure data if `GetInterfaceInfo()`
+ or `GetPerAdapterInfo()` fail
- - win32: openvpnserv: avoid double free() if GetTokenInformation() fails
+ - win32: openvpnserv: avoid double `free()` if `GetTokenInformation()` fails
- win32: openvpnserv: avoid potential format-string issue on registry defaults
- - win32: openvpnserv: repair error reporting on RegGetValueA() failures
- inside GetItfDnsServersV4()
+ - win32: openvpnserv: repair error reporting on `RegGetValueA()` failures
+ inside `GetItfDnsServersV4()`
- - win32: openvpnserv: fix inet_ntop() return code check in
- GetItfDnsServersV6(), making it ignore DHCP-provided DNS servers.
+ - win32: openvpnserv: fix `inet_ntop()` return code check in
+ `GetItfDnsServersV6()`, making it ignore DHCP-provided DNS servers.
- - route: repair printing of ROUTE_GATEWAY/ROUTE6_GATEWAY info broken
- by commit 2777cdd3 - the actual gateway handling was correct, just not
+ - route: repair printing of ROUTE_GATEWAY/ROUTE6_GATEWAY info - the actual gateway handling was correct, just not
printing anything anymore.
- - config: check_file_access: fix --extra-certs access check
+ - config: check_file_access: fix `--extra-certs` access check
- - win32: tun: free gc arena in windows_set_mtu() (mem leak in error path)
+ - win32: tun: free gc arena in `windows_set_mtu()` (mem leak in error path)
- - route: close socket in Haiku get_default_gateway() (FD leak)
+ - route: close socket in Haiku `get_default_gateway()` (FD leak)
- win32: openvpnserv: skip conversion of empty domain names
- win32: cmake+mingw: don't prefix the event message DLL with lib
(it was building 'libopenvpnservmsg.dll' instead of 'openvpnservmsg.dll')
- - win32: pass the buffer size in bytes to get_openvpn_reg_value()
+ - win32: pass the buffer size in bytes to `get_openvpn_reg_value()`
- PUSH_UPDATE server: free temporary options after sending message (memleak)
### User-visible Changes
- - Linux: set IFF_BACKPRESSURE on Linux (if available)
+ - Linux: set `IFF_BACKPRESSURE` on Linux (if available)
This helps the kernel tun/tap to apply proper prioritization (qdisc etc)
to incoming packets if userspace is slow to process them. Without the
flag, the kernel would just drop everything.
- - Management/GUI: Optionally indicate username in >PASSWORD '<UP_TYPE>' prompts
+ - Management/GUI: Optionally indicate username in `>PASSWORD '<UP_TYPE>'` prompts
If an openvpn config has a username set but no password, and OpenVPN
wants to prompt for the password, the GUI could not see the username
@@ 93,7 92,7 @@
### Code improvements/general hardening
- - crypto_epoch: wipe key material with secure_memzero()
+ - crypto_epoch: wipe key material with `secure_memzero()`
- do not look up "none" cipher in OpenSSL - this avoids leaving an "error"
on the OpenSSL error stack, which can then later lead to spurious
@@ 105,7 104,7 @@
- tls_crypt: fix handling of "cipher final output" (which is always empty
on today's SSL libraries, so no impact today, but might not be in future)
- - crypto: ASSERT() opt before first use in openvpn_decrypt_aead()
+ - crypto: `ASSERT()` opt before first use in `openvpn_decrypt_aead()`
- auth_token: wipe the server secret key after loading it
@@ 144,16 143,16 @@
### Long-term code maintenance
- - OpenSSL 4.1 compatibility: use ASN1_STRING_get_length() now, providing
- a fallback to ASN1_STRING_length() for older SSL libraries.
+ - OpenSSL 4.1 compatibility: use `ASN1_STRING_get_length()` now, providing
+ a fallback to `ASN1_STRING_length()` for older SSL libraries.
- - Linux: sitnl: use RTM_SETLINK for updating existing interfaces
- (instead of RTM_NEWLINK)
+ - Linux: sitnl: use `RTM_SETLINK` for updating existing interfaces
+ (instead of `RTM_NEWLINK`)
- gen-sample-keys.sh: Don't apply server extensions to CSRs
- - review all usages of strncpy()
- (change to strncpynt(), memcpy(), etc. where appropriate)
+ - review all usages of `strncpy()`
+ (change to `strncpynt()`, `memcpy()`, etc. where appropriate)
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9