Arne Schwabe (1):
      Ensure key state is authenticated before sending push reply

Gert Doering (3):
      clean up / rewrite sample-plugins/defer/simple.c
      Fix potential NULL ptr crash if compiled with DMALLOC
      Preparing release v2.4.11 (ChangeLog, version.m4, Changes.rst)

Greg Cox (5):
      Fix naming error in sample-plugins/defer/simple.c
      Documentation fixes around openvpn_plugin_func_v3 in openvpn-plugin.h.in
      Update openvpn_plugin_func_v2 to _v3 in sample-plugins/defer/simple.c
      More explicit versioning compatibility in sample-plugins/defer/simple.c
      Explain structver usage in sample defer plugin.

Antonio Quartulli (1):
      pool: prevent IPv6 pools to be larger than 2^16 addresses

Arne Schwabe (5):
      Fix tls_ctx_client/server_new leaving error on OpenSSL error stack
      Normalise ncp-ciphers option and restrict it to 127 bytes
      Also announce IV_CIPHERS as client in OpenVPN 2.4
      Fix auth-token not being updated if auth-nocache is set
      Remove auth_user_pass.wait_for_push variable

David Sommerseth (1):
      compat/lz4: Update to v1.9.2

Gert Doering (13):
      Fix stack overflow in OpenSolaris NEXTADDR()
      Document that --push-remove is generally more suitable than --push-reset
      Fix error detection / abort in --inetd corner case.
      Fix TUNSETGROUP compatibility with very old Linux systems.
      Fix handling of 'route remote_host' for IPv6 transport case.
      Fix description of --client-disconnect calling convention in manpage.
      Handle NULL returns from calloc() in sample plugins.
      Fix --show-gateway for IPv6 on NetBSD/i386.
      socks.c: fix alen for DOMAIN type addresses, bump up buffer sizes
      Fix redirecting of IPv4 default gateway if connecting over IPv6.
      Change travis build scripts to use https when fetching prerequisites.
      Fix line number reporting on config file errors after <inline> segments
      Preparing release v2.4.10 (ChangeLog, version.m4, Changes.rst)

Jeremy Evans (1):
      Switch assertion failure to returning false

Matthias Andree (1):
      Fix stack buffer overruns in NEXTADDR() macro:

Selva Nair (3):
      Parse static challenge response in auth-pam plugin
      Accept empty password and/or response in auth-pam plugin
      Persist management-query-remote and proxy prompts

Vladislav Grishenko (2):
      Log serial number of revoked certificate
      Fix fatal error at switching remotes (#629)

Antonio Quartulli (1):
      socks: use the right function when printing struct openvpn_sockaddr

Arne Schwabe (3):
      Fetch OpenSSL versions via source/old links
      Fix OpenSSL error stack handling of tls_ctx_add_extra_certs
      Fix OpenSSL 1.1.1 not using auto elliptic curve selection

Gert Doering (1):
      Preparing release v2.4.9 (ChangeLog, version.m4, Changes.rst)

Lev Stipakov (4):
      Fix broken fragmentation logic when using NCP
      Fix building with --enable-async-push in FreeBSD
      Fix broken async push with NCP is used
      Fix illegal client float (CVE-2020-11810)

Maxim Plotnikov (1):
      OpenSSL: Fix --crl-verify not loading multiple CRLs in one file

Santtu Lakkala (1):
      Fix OpenSSL private key passphrase notices

Selva Nair (7):
      Swap the order of checks for validating interactive service user
      Move querying username/password from management interface to a function
      When auth-user-pass file has no password query the management interface (if available).
      Fix possibly uninitialized return value in GetOpenvpnSettings()
      Fix possible access of uninitialized pipe handles
      Skip expired certificates in Windows certificate store
      Allow unicode search string in --cryptoapicert option

Tom van Leeuwen (1):
      mbedTLS: Make sure TLS session survives move

WGH (1):
      docs: Add reference to X509_LOOKUP_hash_dir(3)

Antonio Quartulli (1):
      mbedtls: fix segfault by calling mbedtls_cipher_free() in cipher_ctx_free()

Arne Schwabe (1):
      Remove -no-cpp-precomp flag from Darwin builds

David Sommerseth (3):
      cleanup: Remove RPM openvpn.spec build approach
      docs: Update INSTALL
      build: Package missing mock_msg.h

Gert Doering (5):
      repair windows builds (2.4)
      Increase listen() backlog queue to 32
      Force combinationation of --socks-proxy and --proto UDP to use IPv4.
      Fix IPv6 routes on tap interfaces on OpenSolaris/OpenIndiana
      preparing release v2.4.8 (ChangeLog, version.m4, Changes.rst)

Gisle Vanem (1):
      Wrong FILETYPE in .rc files

Hilko Bengen (1):
      Do not set pkcs11-helper 'safe fork mode'

Ilya Shipitsin (2):
      travis-ci: add "linux-ppc64le" to build matrix, change trusty image to xenial, update osx to xcode9.4 and modernize brew management
      travis-ci: fix osx builds

Kyle Evans (1):
      tests/t_lpback.sh: Switch sed(1) to POSIX-compatible regex.

Lev Stipakov (1):
      Fix various compiler warnings

Matthias Andree (1):
      Fix regression, reinstate LibreSSL support.

Michal Soltys (1):
      man: correct the description of --capath and --crl-verify regarding CRLs

Mykola Baibuz (1):
      Fix typo in NTLM proxy debug message

Richard Bonhomme (1):
      Ignore --pull-filter for --mode server

Rosen Penev (1):
      openssl: Fix compilation without deprecated OpenSSL 1.1 APIs

Selva Nair (3):
      Better error message when script fails due to script-security setting
      Correct the return value of cryptoapi RSA signature callbacks
      Handle PSS padding in cryptoapicert

Steffan Karger (1):
      cmocka: use relative paths

Thomas Quinot (1):
      Fix documentation of tls-verify script argument

Adam Ciarciński (1):
      Fix subnet topology on NetBSD (2.4).

Antonio Quartulli (3):
      add support for %lu in argv_printf and prevent ASSERT
      buffer_list: add functions documentation
      ifconfig-ipv6(-push): allow using hostnames

Arne Schwabe (7):
      Properly free tuntap struct on android when emulating persist-tun
      Add OpenSSL compat definition for RSA_meth_set_sign
      Add support for tls-ciphersuites for TLS 1.3
      Add better support for showing TLS 1.3 ciphersuites in --show-tls
      Use right function to set TLS1.3 restrictions in show-tls
      Add message explaining early TLS client hello failure
      Fallback to password authentication when auth-token fails

Christian Ehrhardt (1):
      systemd: extend CapabilityBoundingSet for auth_pam

David Sommerseth (1):
      plugin: Export base64 encode and decode functions

Gert Doering (4):
      Add %d, %u and %lu tests to test_argv unit tests.
      Fix combination of --dev tap and --topology subnet across multiple platforms.
      Add 'printing of port number' to mroute_addr_print_ex() for v4-mapped v6.
      preparing release v2.4.7 (ChangeLog, version.m4, Changes.rst)

Gert van Dijk (1):
      Minor reliability layer documentation fixes

James Bekkema (1):
      Resolves small IV_GUI_VER typo in the documentation.

Jonathan K. Bullard (1):
      Clarify and expand management interface documentation

Lev Stipakov (5):
      Refactor NCP-negotiable options handling
      init.c: refine functions names and description
      interactive.c: fix usage of potentially uninitialized variable
      options.c: fix broken unary minus usage
      Remove extra token after #endif

Richard van den Berg via Openvpn-devel (1):
      Fix error message when using RHEL init script

Samy Mahmoudi (1):
      man: correct a --redirection-gateway option flag

Selva Nair (7):
      Replace M_DEBUG with D_LOW as the former is too verbose
      Correct the declaration of handle in 'struct openvpn_plugin_args_open_return'
      Bump version of openvpn plugin argument structs to 5
      Move get system directory to a separate function
      Enable dhcp on tap adapter using interactive service
      Pass the hash without the DigestInfo header to NCryptSignHash()
      White-list pull-filter and script-security in interactive service

Simon Rozman (2):
      Add Interactive Service developer documentation
      Detect TAP interfaces with root-enumerated hardware ID

Steffan Karger (7):
      man: add security considerations to --compress section
      mbedtls: print warning if random personalisation fails
      Fix memory leak after sighup
      travis: add OpenSSL 1.1 Windows build
      Fix --disable-crypto build
      Don't print OCC warnings about 'key-method', 'keydir' and 'tls-auth'
      buffer_list_aggregate_separator(): simplify code

David Sommerseth (1):
      management: Warn if TCP port is used without password

Gert Doering (3):
      Correct version in ChangeLog - should be 2.4.5, was mistyped as 2.4.4
      Fix potential double-free() in Interactive Service (CVE-2018-9336)
      preparing release v2.4.6 (ChangeLog, version.m4, Changes.rst)

Gert van Dijk (1):
      manpage: improve description of --status and --status-version

Joost Rijneveld (1):
      Make return code external tls key match docs

Selva Nair (3):
      Delete the IPv6 route to the "connected" network on tun close
      Management: warn about password only when the option is in use
      Avoid overflow in wakeup time computation

Simon Matter (1):
      Add missing #ifdef SSL_OP_NO_TLSv1_1/2

Steffan Karger (1):
      Check for more data in control channel

Antonio Quartulli (4):
      reload HTTP proxy credentials when moving to the next connection profile
      Allow learning iroutes with network made up of all 0s (only if netbits < 8)
      mbedtls: fix typ0 in comment
      manpage: fix simple typ0

Arne Schwabe (2):
      Treat dhcp-option DNS6 and DNS identical
      show the right string for key-direction

Bertrand Bonnefoy-Claudet (1):
      Fix typo in error message: "optione" -> "option"

David Sommerseth (8):
      lz4: Fix confused version check
      lz4: Fix broken builds when pkg-config is not present but system library is
      Remove references to keychain-mcd in Changes.rst
      lz4: Rebase compat-lz4 against upstream v1.7.5
      systemd: Add and ship README.systemd
      Update copyright to include 2018 plus company name change
      man: Add .TQ groff support macro
      man: Reword --management to prefer unix sockets over TCP

Emmanuel Deloget (1):
      OpenSSL: check EVP_PKEY key types before returning the pkey

Gert Doering (3):
      Remove warning on pushed tun-ipv6 option.
      Fix removal of on-link prefix on windows with netsh
      Preparing for release v2.4.5 (ChangeLog, version.m4, Changes.rst)

Ilya Shipitsin (2):
      travis-ci: add brew cache, remove ccache
      travis-ci: modify openssl build script to support openssl-1.1.0

James Bottomley (1):
      autoconf: Fix engine checks for openssl 1.1

Jeremie Courreges-Anglas (2):
      Cast time_t to long long in order to print it.
      Fix build with LibreSSL

Selva Nair (14):
      Check whether in pull_mode before warning about previous connection blocks
      Avoid illegal memory access when malformed data is read from the pipe
      Fix missing check for return value of malloc'd buffer
      Return NULL if GetAdaptersInfo fails
      Use RSA_meth_free instead of free
      Bring cryptoapi.c upto speed with openssl 1.1
      Add SSL_CTX_get_max_proto_version() not in openssl 1.0
      TLS v1.2 support for cryptoapicert -- RSA only
      Refactor get_interface_metric to return metric and auto flag separately
      Ensure strings read from registry are null-terminated
      Make most registry values optional
      Use lowest metric interface when multiple interfaces match a route
      Adapt to RegGetValue brokenness in Windows 7
      Fix format spec errors in Windows builds

Simon Rozman (11):
      Local functions are not supported in MSVC. Bummer.
      Mixing wide and regular strings in concatenations is not allowed in MSVC.
      RtlIpv6AddressToStringW() and RtlIpv4AddressToStringW() require mstcpip.h
      Simplify iphlpapi.dll API calls
      Fix local #include to use quoted form
      Document ">PASSWORD:Auth-Token" real-time message
      Fix typo in "verb" command examples
      Uniform swprintf() across MinGW and MSVC compilers
      MSVC meta files added to .gitignore list
      openvpnserv: Add support for multi-instances
      Document missing OpenVPN states

Steffan Karger (21):
      make struct key * argument of init_key_ctx const
      buffer_list_aggregate_separator(): add unit tests
      Add --tls-cert-profile option.
      Use P_DATA_V2 for server->client packets too
      Fix memory leak in buffer unit tests
      buffer_list_aggregate_separator(): update list size after aggregating
      buffer_list_aggregate_separator(): don't exceed max_len
      buffer_list_aggregate_separator(): prevent 0-byte malloc
      Fix types around buffer_list_push(_data)
      ssl_openssl: fix compiler warning by removing getbio() wrapper
      travis: use clang's -fsanitize=address to catch more bugs
      Fix --tls-version-min and --tls-version-max for OpenSSL 1.1+
      Add support for TLS 1.3 in --tls-version-{min, max}
      Plug memory leak if push is interrupted
      Fix format errors when cross-compiling for Windows
      Log pre-handshake packet drops using D_MULTI_DROPPED
      Enable stricter compiler warnings by default
      Get rid of ax_check_compile_flag.m4
      mbedtls: don't use API deprecated in mbed 2.7
      Warn if tls-version-max < tls-version-min
      Don't throw fatal errors from create_temp_file()

hashiz (1):
      Fix '--bind ipv6only'

Antonio Quartulli (23):
      crypto: correct typ0 in error message
      use M_ERRNO instead of explicitly printing errno
      don't print errno twice
      ntlm: avoid useless cast
      ntlm: unwrap multiple function calls
      route: improve error message
      management: preserve wait_for_push field when asking for user/pass
      tls-crypt: avoid warnings when --disable-crypto is used
      ntlm: convert binary buffers to uint8_t *
      ntlm: restyle compressed multiple function calls
      ntlm: improve code style and readability
      OpenSSL: remove unreachable call to SSL_CTX_get0_privatekey()
      make function declarations C99 compliant
      remove unused functions
      use NULL instead of 0 when assigning pointers
      add missing static attribute to functions
      ntlm: avoid breaking anti-aliasing rules
      remove the --disable-multi config switch
      rename mroute_extract_addr_ipv4 to mroute_extract_addr_ip
      route: avoid definition of unused variables in certain configurations
      fix a couple of typ0s in comments and strings
      fragment.c: simplify boolean expression
      tcp-server: ensure AF family is propagated to child context

Arne Schwabe (2):
      Set tls-cipher restriction before loading certificates
      Print ec bit details, refuse management-external-key if key is not RSA

Conrad Hoffmann (2):
      Use provided env vars in up/down script.
      Document down-root plugin usage in client.down

David Sommerseth (12):
      doc: The CRL processing is not a deprecated feature
      cleanup: Move write_pid() to where it is being used
      contrib: Remove keychain-mcd code
      cleanup: Move init_random_seed() to where it is being used
      sample-plugins: fix ASN1_STRING_to_UTF8 return value checks
      Highlight deprecated features
      Use consistent version references
      docs: Replace all PolarSSL references to mbed TLS
      systemd: Ensure systemd shuts down OpenVPN in a proper way
      systemd: Enable systemd's auto-restart feature for server profiles
      lz4: Move towards a newer LZ4 API
      Prepare the release of OpenVPN 2.4.4

Emmanuel Deloget (3):
      OpenSSL: remove pre-1.1 function from the OpenSSL compat interface
      OpenSSL: remove EVP_CIPHER_CTX_new() from the compat layer
      OpenSSL: remove EVP_CIPHER_CTX_free() from the compat layer

Gert van Dijk (1):
      Warn that DH config option is only meaningful in a tls-server context

Ilya Shipitsin (3):
      travis-ci: add 3 missing patches from master to release/2.4
      travis-ci: update openssl to 1.0.2l, update mbedtls to 2.5.1
      travis-ci: update pkcs11-helper to 1.22

Richard Bonhomme (1):
      man: Corrections to doc/openvpn.8

Steffan Karger (17):
      Fix typo in extract_x509_extension() debug message
      Move adjust_power_of_2() to integer.h
      Undo cipher push in client options state if cipher is rejected
      Remove strerror_ts()
      Move openvpn_sleep() to manage.c
      fixup: also change missed openvpn_sleep() occurrences
      Always use default keysize for NCP'd ciphers
      Move create_temp_file() out of #ifdef ENABLE_CRYPTO
      Deprecate --keysize
      Deprecate --no-replay
      Move run_up_down() to init.c
      tls-crypt: introduce tls_crypt_kt()
      crypto: create function to initialize encrypt and decrypt key
      Add coverity static analysis to Travis CI config
      tls-crypt: don't leak memory for incorrect tls-crypt messages
      travis: reorder matrix to speed up build
      Fix bounds check in read_key()

Szilárd Pfeiffer (1):
      OpenSSL: Always set SSL_OP_CIPHER_SERVER_PREFERENCE flag

Thomas Veerman via Openvpn-devel (1):
      Fix socks_proxy_port pointing to invalid data

Antonio Quartulli (1):
      Ignore auth-nocache for auth-user-pass if auth-token is pushed

David Sommerseth (3):
      crypto: Enable SHA256 fingerprint checking in --verify-hash
      copyright: Update GPLv2 license texts
      auth-token with auth-nocache fix broke --disable-crypto builds

Emmanuel Deloget (8):
      OpenSSL: don't use direct access to the internal of X509
      OpenSSL: don't use direct access to the internal of EVP_PKEY
      OpenSSL: don't use direct access to the internal of RSA
      OpenSSL: don't use direct access to the internal of DSA
      OpenSSL: force meth->name as non-const when we free() it
      OpenSSL: don't use direct access to the internal of EVP_MD_CTX
      OpenSSL: don't use direct access to the internal of EVP_CIPHER_CTX
      OpenSSL: don't use direct access to the internal of HMAC_CTX

Gert Doering (6):
      Fix NCP behaviour on TLS reconnect.
      Remove erroneous limitation on max number of args for --plugin
      Fix edge case with clients failing to set up cipher on empty PUSH_REPLY.
      Fix potential 1-byte overread in TCP option parsing.
      Fix remotely-triggerable ASSERT() on malformed IPv6 packet.
      Preparing for release v2.4.3 (ChangeLog, version.m4, Changes.rst)

Guido Vranken (6):
      refactor my_strupr
      Fix 2 memory leaks in proxy authentication routine
      Fix memory leak in add_option() for option 'connection'
      Ensure option array p[] is always NULL-terminated
      Fix a null-pointer dereference in establish_http_proxy_passthru()
      Prevent two kinds of stack buffer OOB reads and a crash for invalid input data

Jérémie Courrèges-Anglas (2):
      Fix an unaligned access on OpenBSD/sparc64
      Missing include for socket-flags TCP_NODELAY on OpenBSD

Matthias Andree (1):
      Make openvpn-plugin.h self-contained again.

Selva Nair (1):
      Pass correct buffer size to GetModuleFileNameW()

Steffan Karger (11):
      Log the negotiated (NCP) cipher
      Avoid a 1 byte overcopy in x509_get_subject (ssl_verify_openssl.c)
      Skip tls-crypt unit tests if required crypto mode not supported
      openssl: fix overflow check for long --tls-cipher option
      Add a DSA test key/cert pair to sample-keys
      Fix mbedtls fingerprint calculation
      mbedtls: fix --x509-track post-authentication remote DoS (CVE-2017-7522)
      mbedtls: require C-string compatible types for --x509-username-field
      Fix remote-triggerable memory leaks (CVE-2017-7521)
      Restrict --x509-alt-username extension types
      Fix potential double-free in --x509-alt-username (CVE-2017-7521)

Steven McDonald (1):
      Fix gateway detection with OpenBSD routing domains

David Sommerseth (6):
      auth-token: Ensure tokens are always wiped on de-auth
      docs: Fixed man-page warnings discoverd by rpmlint
      Make --cipher/--auth none more explicit on the risks
      plugin: Fix documentation typo for type_mask
      plugin: Export secure_memzero() to plug-ins
      Preparing v2.4.2 release

Hristo Venev (1):
      Fix extract_x509_field_ssl for external objects, v2

Selva Nair (1):
      In auth-pam plugin clear the password after use

Steffan Karger (10):
      cleanup: merge packet_id_alloc_outgoing() into packet_id_write()
      Don't run packet_id unit tests for --disable-crypto builds
      Fix Changes.rst layout
      Fix memory leak in x509_verify_cert_ku()
      mbedtls: correctly check return value in pkcs11_certificate_dn()
      Restore pre-NCP frame parameters for new sessions
      Always clear username/password from memory on error
      Document tls-crypt security considerations in man page
      Don't assert out on receiving too-large control packets (CVE-2017-7478)
      Drop packets instead of assert out if packet id rolls over (CVE-2017-7479)

ValdikSS (1):
      Set a low interface metric for tap adapter when block-outside-dns is in use

Antonio Quartulli (4):
      attempt to add IPv6 route even when no IPv6 address was configured
      fix redirect-gateway behaviour when an IPv4 default route does not exist
      CRL: use time_t instead of struct timespec to store last mtime
      ignore remote-random-hostname if a numeric host is provided

Christian Hesse (7):
      man: fix formatting for alternative option
      systemd: Use automake tools to install unit files
      systemd: Do not race on RuntimeDirectory
      systemd: Add more security feature for systemd units
      Clean up plugin path handling
      plugin: Remove GNUism in openvpn-plugin.h generation
      fix typo in notification message

David Sommerseth (6):
      management: >REMOTE operation would overwrite ce change indicator
      management: Remove a redundant #ifdef block
      git: Merge .gitignore files into a single file
      systemd: Move the READY=1 signalling to an earlier point
      plugin: Improve the handling of default plug-in directory
      cleanup: Remove faulty env processing functions

Emmanuel Deloget (8):
      OpenSSL: check for the SSL reason, not the full error
      OpenSSL: don't use direct access to the internal of X509_STORE_CTX
      OpenSSL: don't use direct access to the internal of SSL_CTX
      OpenSSL: don't use direct access to the internal of X509_STORE
      OpenSSL: don't use direct access to the internal of X509_OBJECT
      OpenSSL: don't use direct access to the internal of RSA_METHOD
      OpenSSL: SSLeay symbols are no longer available in OpenSSL 1.1
      OpenSSL: use EVP_CipherInit_ex() instead of EVP_CipherInit()

Eric Thorpe (1):
      Fix Building Using MSVC

Gert Doering (5):
      Add openssl_compat.h to openvpn_SOURCES
      Fix '--dev null'
      Fix installation of IPv6 host route to VPN server when using iservice.
      Make ENABLE_OCC no longer depend on !ENABLE_SMALL
      Preparing for release v2.4.1 (ChangeLog, version.m4)

Gisle Vanem (1):
      Crash in options.c

Ilya Shipitsin (2):
      Resolve several travis-ci issues
      travis-ci: remove unused files

Olivier Wahrenberger (1):
      Fix building with LibreSSL 2.5.1 by cleaning a hack.

Selva Nair (4):
      Fix push options digest update
      Always release dhcp address in close_tun() on Windows.
      Add a check for -Wl, --wrap support in linker
      Fix user's group membership check in interactive service to work with domains

Simon Matter (1):
      Fix segfault when using crypto lib without AES-256-CTR or SHA256

Steffan Karger (8):
      More broadly enforce Allman style and braces-around-conditionals
      Use SHA256 for the internal digest, instead of MD5
      OpenSSL: 1.1 fallout - fix configure on old autoconf
      Fix types in WIN32 socket_listen_accept()
      Remove duplicate X509 env variables
      Fix non-C99-compliant builds: don't use const size_t as array length
      Deprecate --ns-cert-type
      Be less picky about keyUsage extensions

Ashus (2):
      Czech translation added
      Translation corrected by another developer, Elieux.

Chocobo1 (7):
      Enable DEP
      Add title and TravisCI badge to README.rst
      Enable ASLR. Closes #119.
      Use high entropy ASLR
      Address review comments
      AppVeyor: add shebang
      Readme: add AppVeyor badge

Erwin Bronkhorst (1):
      Translate missing Dutch strings and minor changes

Hexabitt (2):
      Completed all the missing translations
      Update openvpn-gui-res-fr.rc

Ilya Shipitsin (5):
      added Windows Vista/Win7/Win8/Win8.1/Win10 to compatibility manifest
      travis-ci: update openssl, add "builds from release tarballs"
      AppVeyor support
      AppVeyor: temporarily stick to mingw64-%ARCH%-gcc-core-5.4.0-3
      AppVeyor: switch to preinstalled mingw64-%ARCH%-gcc-core

Peter Chen (2):
      Update and fix localization in openvpn-gui-res-zh-hant.rc
      UI clipping fix, and misc wording fix/redundant punc removed

Samuli Seppänen (13):
      Documentation improvements
      Merge pull request #124 from Chocobo1/badge
      Merge pull request #108 from selvanair/win32-vista
      Fix builds from release tarballs
      Merge pull request #132 from mattock/master
      Merge pull request #133 from chipitsine/master
      Merge pull request #135 from chipitsine/master
      Merge pull request #140 from chipitsine/master
      Merge pull request #146 from Chocobo1/pr_109
      Merge pull request #145 from Chocobo1/appveyor
      Merge pull request #143 from chipitsine/master
      Merge pull request #136 from Hexabitt/patch-1
      Bump version to 11.5.0.0

Selva Nair (18):
      Mark status as connected only if openvpn reports CONNECTED,SUCCESS
      Suppress warning popups if silent_connection is set
      Merge pull request #112 from selvanair/master
      Close service pipe in case of startup error
      Merge pull request #121 from mattock/docfixes
      Merge pull request #123 from Chocobo1/ldflags
      Fix truncation of usage message shown when --help is used
      Merge pull request #116 from chipitsine/manifest
      Merge pull request #126 from Ashus/master
      Update _WIN32_WINNT to _WIN32_WINNT_VISTA
      Merge pull request #110 from EagleErwin/patch-1
      Check group membership without needing connection to DC
      Parse ECHO directives from openvpn
      Merge pull request #128 from selvanair/help-msg
      Merge pull request #118 from selvanair/validate-user
      Add a system-wide option to disable the password save feature
      Merge pull request #117 from selvanair/nay-to-savepass
      Merge pull request #137 from selvanair/echo

David Sommerseth (4):
      dev-tools: Added script for updating copyright years in files
      Update copyrights
      docs: Further enhance the documentation related to SWEET32
      man: Remove references to no longer present IV_RGI6 peer-info

Gert Doering (1):
      Remove IV_RGI6=1 peer-info signalling.

Steffan Karger (2):
      Document that RSA_SIGN can also request TLS 1.2 signatures
      man: encourage user to read on about --tls-crypt

Samuli Seppänen (3):
      Update build parameters to match openvpn-install-2.4_rc2
      Merge pull request #63 from selvanair/less-choice-v2
      Update build parameters to match openvpn-install-2.4.0

Selva Nair (2):
      Simplifiy user choices and always install openvpn, dlls and services
      Add missing /o to Section SecService

David Sommerseth (10):
      Fix wrong configure.ac parsing of --enable-async-push
      Changes: Further improve systemd unit file updates
      systemd: Intermediate --chroot fix with the new sd_notify() implementation
      Further enhance async-push feature description
      Changes.rst: Mainatiner update on C99
      dev-tools: Add reformat-all.sh for code style unification
      The Great Reformatting - first phase
      Merge 'reformatting' branch into master
      auth-gen-token: Hardening memory cleanup on auth-token failuers
      Preparing OpenVPN v2.4_rc2 release

Gert Doering (1):
      Refactor setting close-on-exec for socket FDs

Lev Stipakov (2):
      Arm inotify only in server mode
      Add "async push" feature to Changes.rst

Magnus Kroken (1):
      mbedtls: include correct net/net_sockets header according to version

Selva Nair (2):
      Correctly state the default dhcp server address in man page
      Unhide a line in man page by fixing a typo

Steffan Karger (4):
      Fix (and cleanup) crypto flags in combination with NCP
      Deprecate --no-iv
      man: mention that --ecdh-curve does not work on mbed TLS builds
      Don't reopen tun if cipher changes

Samuli Seppänen (3):
      Merge pull request #102 from mattock/master
      Merge pull request #107 from selvanair/use-metric
      Preparing for release with openvpn-2.4_rc2

Selva Nair (2):
      Merge pull request #103 from aixxe/master
      Load icons at sizes given by DPI-dependent system metric

aixxe (1):
      Add 24x24 and 20x20 versions of each icon.

Antonio Quartulli (1):
      reload CRL only if file was modified

Christian Hesse (3):
      update year in copyright message
      Use systemd service manager notification
      Refuse to daemonize when running from systemd

David Sommerseth (1):
      Preparing OpenVPN v2.4_rc1 release

Gert Doering (1):
      Fix windows path in Changes.rst

Samuli Seppänen (1):
      Mention that OpenVPN 2.4 requires Windows Vista or higher

Selva Nair (4):
      Map restart signals from event loop to SIGTERM during exit-notification wait
      When parsing '--setenv opt xx ..' make sure a third parameter is present
      Force 'def1' method when --redirect-gateway is done through service
      Do not restart dns client service as a part of --register-dns processing

Steffan Karger (4):
      tls_process: don't set variable that's never read
      Unconditionally enable TLS_AGGREGATE_ACK
      Clean up format_hex_ex()
      Introduce and use secure_memzero() to erase secrets

Ilya Shipitsin (1):
      travis-ci: upgraded to openssl-1.0.2i

Pavel Zhovner (1):
      fix Ukrainian localization

Samuli Seppänen (8):
      Merge pull request #96 from chipitsine/master
      Merge pull request #98 from selvanair/version-info
      Merge pull request #93 from ValdikSS/russian-fixes
      Preparing for release with openvpn-2.4_beta2
      Merge pull request #94 from zhovner/master
      Merge pull request #99 from selvanair/dpi-aware
      Merge pull request #91 from selvanair/pkcs11-pin-v3
      Preparing for release with openvpn-2.4_rc1

Selva Nair (8):
      Handle dynamic challenge/response
      Support pkcs11 token insertion request and pin input
      Update version-info resource
      Make the program DPI aware
      Merge pull request #85 from stigok/patch-1
      Copy updated copyright to language files
      Rendering/Positioning fix
      Merge pull request #100 from selvanair/about-update

Stig Otnes Kolstad (1):
      Update Norwegian translations

ValdikSS (2):
      Russian translation updates
      More Russian fixes

Arne Schwabe (5):
      Document that tls-crypt also supports inline
      Fix warning that RAND_bytes is undeclared
      Remove compat-stdbool.h.
      Fix various compiler warnings
      Handle DNS6 option on Android

David Sommerseth (3):
      Changes.rst: Fixing wrong formatting
      Document the --auth-token option
      Preparing OpenVPN v2.4_beta2 release

Gert Doering (2):
      Remove remaining traces of compat-stdbool.h
      Stub implementation of "--dhcp-option DNS6 <v6addr>"

Selva Nair (3):
      Do not set ipv6 address if '--ip-win32 manual' is used
      Handle --dhcp-option DNS6 on Windows using netsh
      Set IPv6 DNS servers using interactive service

Steffan Karger (6):
      multi_process_float: revert part of c14c4a9e
      --tls-crypt fixes
      Change cmocka remote to use https in stead of git protocol
      generate_key_expansion: make assumption explicit, use C99 features
      Poor man's NCP for non-NCP peers
      Refactor data channel key generation API

Ilya Shipitsin (1):
      travis-ci: upgraded to openssl-1.0.2i

Samuli Seppänen (4):
      Merge pull request #96 from chipitsine/master
      Merge pull request #98 from selvanair/version-info
      Merge pull request #93 from ValdikSS/russian-fixes
      Preparing for release with openvpn-2.4_beta2

Selva Nair (1):
      Update version-info resource

ValdikSS (2):
      Russian translation updates
      More Russian fixes

Arne Schwabe (1):
      Make Changes.rst nicer for 2.4 release

David Sommerseth (16):
      cleanup: Remove NOP code sections in ssl.c:tls_process()
      Remove last rest of INSTALL-win32.txt references
      auth-gen-token: Add --auth-gen-token option
      auth-gen-token: Generate an auth-token per client
      auth-gen-token: Push generated auth-tokens to the client
      auth-gen-token: Authenticate generated auth-tokens when client re-authenticates
      Fix builds with --disable-crypto
      man: Improve the --keepalive section
      console: Fix compiler warning
      systemd: Improve the systemd unit files
      tun: Fix compiler warnings
      file checks: Merge warn_if_group_others_accessible() into check_file_access()
      tun: Fix weird commit error causing a double assignment
      options: Remove --tls-remote
      Remove unused variable in argv_printf_arglist()
      Preparing for release v2.4_beta1 (ChangeLog, version.m4)

Gert Doering (10):
      openvpn version line: remove [IPv6], add [AEAD] if available
      clean up *sig_info handling in link_socket_init_phase2()
      check c->c2.link_socket before calling do_init_route_ipv6_list()
      Check previously-unchecked buf_alloc_write() call in crypto self-test.
      Fix potential division by zero in shaper_reset()
      Repair topology subnet on FreeBSD 11
      Repair topology subnet on OpenBSD
      Add in_port_t check to configure.ac
      Fix compilation on MinGW with -std=c99
      Replace WIN32 by _WIN32

Heiko Hund (4):
      put argv_* functions into own file, add unit tests
      Remove unused and unecessary argv interfaces
      remove unused system_str from struct argv
      Factor out %sc handling from argv_printf()

Lev Stipakov (1):
      Drop recursively routed packets

Samuli Seppänen (6):
      Remove INSTALL-win32.txt that is now hosted in openvpn-build
      Fix update_t_client_ips.sh for out of tree builds
      Make sure that all relevant files under test go to release tarballs
      Allow passing extra arguments to fping/fping6 in t_client.rc
      Prevent generation of duplicate EXPECT_IFCONFIG entries
      Fix a logic problem in handling of --up scripts in t_client.sh

Selva Nair (2):
      Support --block-outside-dns on multiple tunnels
      Unbreak windows build

Steffan Karger (18):
      Remove verbose msg() from send_push_reply()
      Limit --reneg-bytes to 64MB when using small block ciphers
      Add a revoked cert to the sample keys
      Fix --tls-version-max in mbed TLS builds
      Don't deference type-punned pointers
      Fix builds on compilers without anonymous union support
      Refactor static/tls-auth key loading
      Add missing includes in error.h
      Make argv unit tests obey {MBEDTLS, OPENSSL}_{LIBS, CFLAGS}
      Move private file access checks to options_postprocess_filechecks()
      Deprecate key-method 1
      Refactor CRL handling
      Remove unneeded check for extra_certs_file_inline
      Fix missing return value checks in multi_process_float()
      Restore pre-NCP cipher options on SIGUSR1
      Remove unused variables from do_init_crypto_static()
      Add control channel encryption (--tls-crypt)
      Add --tls-crypt unit tests

Samuli Seppänen (3):
      Update About page
      Merge pull request #90 from selvanair/mute-no-iservice-warning
      Merge pull request #97 from selvanair/master

Selva Nair (5):
      Merge pull request #89 from mattock/about_page
      Check for interactive service only if OpenVPN version is >= 2.4
      Add missing WINAPI in the definition of HandleServiceIO
      Merge pull request #95 from selvanair/trac-758
      Preparing for release with openvpn-2.4_beta1

Adriaan de Jong (2):
      Fixed a bug where PolarSSL gave an error when using an inline file tag.
      Fix --show-pkcs11-ids (Bug #239)

Alexander Pyhalov (1):
      Default gateway can't be determined on illumos/Solaris platforms

Alon Bar-Lev (1):
      pkcs11: use generic evp key instead of rsa

Andris Kalnozols (3):
      Fix some typos in the man page.
      Do not upcase x509-username-field for mixed-case arguments.
      extract_x509_extension(): hide status message during normal operation.

Arne Schwabe (100):
      Document man agent-external-key
      Options parsing demands unnecessary configuration if PKCS11 is used
      Error message if max-routes used incorrectly
      Properly require --key even if defined(MANAGMENT_EXTERNAL_KEY)
      Remove dnsflags_to_socktype, it is not used anywhere
      Fix the proto is used inconsistently warning
      Remove dead code path and putenv functionality
      Remove unused function xor
      Move static prototype definition from header into c file
      Remove unused function no_tap_ifconfig
      Add the client id (CID) to the output of the status command
      Print client id only if compiled with man agent support. Otherwise     print an empty string.
      Allow routes to be set before opening tun, similar to ifconfig before opening tun
      Add ability to send/receive file descriptors via management interface
      Android platform specific changes.
      Emulate persist-tun on Android
      Document the Android implementation in OpenVPN
      Only print script warnings when a script is used. Remove stray mention of script-security system.
      Fix #ifdefs for P2MP_SERVER
      Move settings of user script into set_user_script function
      Move checking of script file access into set_user_script
      Fix another #ifdef/#if P2MP_SERVER
      PATCHv3 Remove unused variables or put them to the defines they are being used in
      Add support of utun devices under Mac OS X
      Add support to ignore specific options.
      Add a note what setenv opt does for OpenVPN < 2.3.3
      Implement custom HTTP header for http-proxy, and always send user-agent:
      Add reporting of UI version to basic push-peer-info set.
      Change the type of all ports in openvpn to const char* and let getaddrinfo resolve the port together with the hostname.
      Fix compile error in ssl_openssl introduced by polar external-management patch
      Simplify print_sockaddr_ex function, merge duplicate ipv4/ipv6 logic.
      Split the PROTO_UDP_xx options into AF_INET/AF_INET6 and PROTO_TCP/PROTO_UDP part.
      Fix two instances of asserting AF_INET
      Fix assertion when SIGUSR1 is received while getaddrinfo is successful
      Split link_socket_init_phase1 and link_socket_init_phase2 into     smaller more managable/readable functions. No functional changes
      Change proto_remote() function to return a constant string
      Remove the ip-remote-hint option.
      change the type of 'remote' to addrinfo*, and rename to 'remote_list'.
      When resolving fails print the error message from socket layer
      Implement dual stack client support for OpenVPN
      Move ASSERT so external-key with OpenSSL works again
      Implement listing on IPv4/IPv6 dual socket on all platform
      Add warning for using connection block variables after connection blocks
      Update IPv6 related readme files
      Introduce safety check for http proxy options
      Fix warning for max-routes: do not quit when parsing an old configuration. Format the message to be more like the other deprecated options
      Fix connecting to localhost on Android
      Move the initialization of the environment to the top so c2.es is initialized
      Workaround broken Android 4.4 VpnService API for persist-tun mode
      Implement an easy parsable log output that allows access to flags of the log message
      Introduce an option to resolve dns names in advance for --remote, --local and --http-proxy
      Fix for server selecting address family
      Don't show the connection profile store in options->ce if there is a connection_list defined.
      Add gateway and device to android control messages
      Clean up of socket code.
      Fix assert when using port-share
      Work around Solaris getaddrinfo() returing ai_protocol=0
      Fix man page and OSCP script: tls_serial_{n} is decimal
      Remove ENABLE_BUFFER_LIST
      Fix server routes not working in topology subnet with --server [v3]
      Always enable http-proxy and socks-proxy
      Remove deprecated --max-routes option from manual
      Add documentation for PERSIST_TUN_ACTION (Android specific)
      Remove possibility of using --tls-auth with non OpenVPN Static key files
      Remove unused function sock_addr_set
      Document the default for tls-cipher.
      Report missing end-tags of inline files as errors
      Fix commit e473b7c if an inline file happens to have a line break exactly at buffer limit
      Show extra-certs in current parameters, fix clang warning and logic error in preresolve
      Remove unused function h_errno_msg
      Add support for requesting the fd again to rebind to the next interface.
      Don't redirect the gateway on Android even if requested
      Fix loglevel of protect socket message
      Extend network-change command to allow reprotecting on the same network (for short connection losses)
      Use pseudo gw as default gw on Android as a workaround for not being able to read /proc/net/route
      Remove #ifdefs for client nat support.
      Do not install a host route for the VPN on Android
      Fix commit c67acea173dc9ee37220f5b9ff14ede081181992
      Do not set the buffer size by default but rely on the operation system default.
      Start Changes.rst that lists changes in 2.4.0
      Remove --enable-password-save option
      Reflect enable-password-save change in documentation
      Also remove second instance of enable-password-save in the man page
      Detect config lines that are too long and give a warning/error
      Implement the compression V2 data format for stub and lz4.
      Fix assert when comp is called with unknown algorithm, always call comp init method
      Ignore stamp-h2 we generate during build process
      Implement inlining of crl files
      Complete push-peer-info documentation and allow IV_PLAT_VER for other platforms than Windows if the client UI supplies it.
      Remove http-proxy-timeout, socks timeout and set default of server-poll-timeout to 120s
      Add documentation for http-proxy-user-pass option
      Remove http-proxy-retry and socks-proxy-retry.
      Update android documentation to match source code
      Use AES ciphers in our sample configuration files and add a few modern 2.4 examples
      Fix ENABLE_CRYPTO_OPENSSL set to YES even with --disable-crypto set
      Prefer RECVDSTADDR to PKTINFO for IPv4 in OS X since it actually works (unlike PKTINFO)
      Incorporate the Debian typo fixes where appropriate and make show_opt default message clearer
      Enable TCP non-linear packet ID
      Change the hold command to communicate the time that OpenVPN would wait to the UI.
      Remove tun-ipv6 Option. Instead assume that IPv6 is always supported.

Boris Lytochkin (1):
      Log serial number of revoked certificate

Christian Hesse (1):
      fix build with automake 1.13(.1)

Christian Niessner (1):
      Fix corner case in NTLM authentication (trac #172)

Christos Trochalakis (1):
      Adjust server-ipv6 documentation

Cristian Rodriguez (1):
      Use SSL_MODE_RELEASE_BUFFERS if available

Daniel Hahler (1):
      options: fix option check for "plugin"

Daniel Kubec (4):
      Added support for TLS Keying Material Exporters [RFC-5705]
      Added document for TLS Keying Material Exporters [RFC-5705]
      sample-plugin: TLS Keying Material Exporter [RFC-5705] demonstration plug-in
      Fix buffer size parameter for exported keying material.

David Sommerseth (45):
      Make git ignore some more files
      Remove the support for using system() when executing external programs or scripts
      Fix double-free issue in pf_destroy_context()
      Reset the version.m4 version for the master branch
      Avoid recursion in virtual_output_callback_func()
      The get_default_gateway() function uses warn() instead of msg()
      Improve the git revision tracking
      man page: Update man page about the tls_digest_{n} environment variable
      Remove the --disable-eurephia configure option
      plugin: Extend the plug-in v3 API to identify the SSL implementation used
      autoconf: Fix typo
      t_client.sh: Check for fping/fping6 availability
      t_client.sh: Write errors to stderr and document requirements
      t_client.sh: Add prepare/cleanup possibilties for each test case
      Fix file checks when --chroot is being used
      Adjusted autotools files to build more cleanly on newer autoconf/automake versions
      Improve error reporting on file access to --client-config-dir and --ccd-exclusive
      Don't let openvpn_popen() keep zombies around
      Don't try to use systemd-ask-password if it is not available
      Clean up the pipe closing in openvpn_popen()
      Add systemd unit file for OpenVPN
      systemd: Use systemd functions to consider systemd availability
      systemd: Reworked the systemd unit file to handle server and client configs better
      autotools: Fix wrong ./configure help screen default values
      down-root plugin: Replaced system() calls with execve()
      down-root: Improve error messages
      plugin, down-root: Fix compiler warnings
      sockets: Remove the limitation of --tcp-nodelay to be server-only
      plugins, down-root: Code style clean-up
      Provide compile time OpenVPN version information to plug-ins
      Provide OpenVPN runtime version information to plug-ins
      Avoid partial authentication state when using --disabled in CCD configs
      Only build and run cmocka unit tests if its submodule is initialized
      Another fix related to unit test framework
      Remove NOP function and callers
      Revert "Drop recursively routed packets"
      Fix client connection instant timeout
      t_client.sh: Make OpenVPN write PID file to avoid various sudo issues
      t_client.sh: Add support for Kerberos/ksu
      t_client.sh: Improve detection if the OpenVPN process did start during tests
      Rework the user input interface to make it more modular
      Re-implement the systemd support using the new query user API
      systemd: Do not mask usernames when querying for it via systemd-ask-password
      Move memcmp_constant_time() to crypto.h
      Update .mailmap to unify and clean up odd names and e-mail addresses

David Woodhouse (2):
      pkcs11: Load p11-kit-proxy.so module by default
      Make 'provider' option to --show-pkcs11-ids optional where p11-kit is present

Davide Brini (2):
      Provide more accurate warning message
      Document authfile for socks server

Dmitrij Tejblum (1):
      Fix is_ipv6 in case of tap interface.

Dorian Harmans (1):
      Add CHACHA20-POLY1305 ciphersuite IANA name translations.

Felix Janda (1):
      Use OPENVPN_ETH_P_* so that <netinet/if_ether.h> is unecessary

Fish (1):
      Add lz4 support to MSVC.

Gert Doering (112):
      Implement --mssfix handling for IPv6 packets.
      Fix option inconsistency warnings about "proto" and "tun-ipv6"
      Fix parameter type for IP_TOS setsockopt on non-Linux systems.
      Fix client crash on double PUSH_REPLY.
      Update README.IPv6 to match what is in 2.3.0
      Repair "tcp server queue overflow" brokenness, more <stdbool.h> fallout.
      Permit pool size of /64.../112 for ifconfig-ipv6-pool
      Add MIN() compatibility macro
      Fix directly connected routes for "topology subnet" on Solaris.
      Print "Virtual IPv6 Address" on management interface queries [v4]
      Use constrain_int() instead of MIN()+syshead.c compat definition - v2.
      Fix NULL-pointer crash in route_list_add_vpn_gateway().
      Fix usage of 'compression ...' from global config.
      Make push-peer-info visible in "normal" per-instance environment.
      Fix problem with UDP tunneling due to mishandled pktinfo structures.
      Improve documentation and help text for --route-ipv6.
      Fix argument type warning introduced by http extra proxy header patch.
      Fix IPv6 examples in t_client.rc-sample
      Fix slow memory drain on each client renegotiation.
      t_client.sh: ignore fields from "ip -6 route show" output that distort results.
      Fix IPv6_V6ONLY logic.
      Implement LZ4 compression.
      Provide LZ4 sources in src/compat/ and use if no system lz4 library found.
      Document "lz4" argument to "compress" config option.
      Make code and documentation for --remote-random-hostname consistent.
      Reduce IV_OPENVPN_GUI_VERSION= to IV_GUI_VER=
      remove some 'unused variable' warnings
      Cleanup ir6->netbits handling.
      Document issue with --chroot, /dev/urandom and PolarSSL.
      Rename 'struct route' to 'struct route_ipv4'
      Replace copied structure elements with including <net/route.h>
      Add "test-driver" and "compile" to .gitignore
      Fix crash when using --inetd.
      IPv6 address/route delete fix for Win8
      Add SSL library version reporting.
      Minor t_client.sh cleanups
      Repair --multihome on FreeBSD for IPv4 sockets.
      Rewrite manpage section about --multihome
      More IPv6-related updates to the openvpn man page.
      Conditionalize calls to print_default_gateway on !ENABLE_SMALL
      Merge get_default_gateway() implementation for all 4+1 BSD variants.
      Drop incoming fe80:: packets silently now.
      Recognize AIX, define TARGET_AIX
      Add tap driver initialization and ifconfig for AIX.
      implement adding/deleting routes on AIX, for IPv4 and IPv6
      Make t_client.sh work on AIX.
      Fix t_lpback.sh platform-dependent failures
      Call init script helpers with explicit path (./)
      Fix windows build on older mingw versions.
      New approach to handle peer-id related changes to link-mtu.
      Print remote IPv4 address on a dual-stack v6 socket in IPv4 format
      Fix incorrect use of get_ipv6_addr() for iroute options.
      Remove count_netmask_bits(), convert users to use netmask_to_netbits2()
      Fix leftover 'if (false) ;' statements
      Print helpful error message on --mktun/--rmtun if not available.
      explain effect of --topology subnet on --ifconfig
      Add note about file permissions and --crl-verify to manpage.
      repair --dev null breakage caused by db950be85d37
      assume res_init() is always there.
      Correct note about DNS randomization in openvpn.8
      Disallow usage of --server-poll-timeout in --secret key mode.
      slightly enhance documentation about --cipher
      Enforce "serial-tests" behaviour for tests/Makefile
      Revert "Enforce "serial-tests" behaviour for tests/Makefile"
      On signal reception, return EAI_SYSTEM from openvpn_getaddrinfo().
      Use configure.ac hack to apply serial_test AM option only if supported.
      Use EAI_AGAIN instead of EAI_SYSTEM for openvpn_getaddrinfo().
      Move res_init() call to inner openvpn_getaddrinfo() loop
      Fix FreeBSD ifconfig for topology subnet tunnels.
      Produce a meaningful error message if --daemon gets in the way of asking for passwords.
      Document --daemon changes and consequences (--askpass, --auth-nocache).
      Fix build on OpenSolaris (non-gmake)
      Un-break --auth-user-pass on windows
      refactor struct route_ipv6, bring in line with struct route_ipv4 again
      refactor struct route_ipv6_list, bring in line with struct route_list again
      Add route_ipv6_gateway* data structures for rgi6 support.
      Create basic infrastructure for IPv6 default gateway handling / redirection.
      Make client delay less before sending PUSH_REQUEST
      get_default_gateway_ipv6(): Linux / Netlink implementation.
      Implement handling of overlapping IPv6 routes with IPv6 remote VPN server address
      Implement '--redirect-gateway ipv6'
      get_default_gateway_ipv6(): *BSD / MacOS / Solaris PF_ROUTE implementation
      Fix IPv6 host routes to LAN gateway on OpenSolaris
      Replace unaligned 16bit access to TCP MSS value with bytewise access
      Repair test_local_addr() on WIN32
      Add custom check for inet_pton()/inet_ntop() on MinGW/WIN32
      get_default_gateway_ipv6(): Win32 implementation using GetBestRoute2()
      Remove support for snappy compression.
      Fix info.af == AF_UNSPEC case for server with --mtu-disc
      Fix FreeBSD-specific mishandling of gc arena pointer in create_arbitrary_remote()
      remove unused gc_arena in FreeBSD close_tun()
      Un-break compilation on *BSD
      Fix isatty() check for good.
      Fix openserv/validate.o linking issues on mingw.
      Fix library order in -lmbedtls test.
      Implement push-remove option to selectively remove pushed options.
      Upgrade bundled compat-lz4 to upstream release r131.
      Change --enable-pedantic to use -std=c99 and not -ansi (C90).
      Fix problems with NCP and --inetd.
      Do not abort t_client run if OpenVPN instance does not start.
      Fix IP_PKTINFO related compilation failure on NetBSD 7.0
      Show compile-time variant for --multihome in --version output.
      Fix win32 building with C99 mode
      Fix t_client runs on OpenSolaris
      make t_client robust against sudoers misconfiguration
      add POSTINIT_CMD_suf to t_client.sh and sample config
      Fix --multihome for IPv6 on 64bit BSD systems.
      Enable -D_SVR4_2 for compilation on Solaris
      Revert "Enable -D_SVR4_2 for compilation on Solaris"
      Enable -D_XPG4_2 for compilation on Solaris
      Preparing for release v2.4_alpha1 (ChangeLog, version.m4)
      Preparing for release v2.4_alpha2 (ChangeLog, version.m4)

Guy Yur (1):
      Fix --redirect-private in --dev tap mode.

Heikki Hannikainen (1):
      Always load intermediate certificates from a PKCS#12 file

Heiko Hund (20):
      Fix display of plugin hook types
      Support UTF-8 --client-config-dir
      close more file descriptors on exec
      Ignore UTF-8 byte order mark
      reintroduce --no-name-remapping option
      make --tls-remote compatible with pre 2.3 configs
      add new option for X.509 name verification
      Support non-ASCII TAP adapter names on Windows
      Support non-ASCII characters in Windows tmp path
      make sure sa_family_t is defined
      convert struct signal_info element
      grow route lists dynamically
      fix route struct name
      refine assertion to allow other modes than CBC
      Fix compilation on Windows
      fix warnings on Windows
      extend management interface command "state"
      put virtual IPv6 addresses into env
      interactive service v3
      Windows: do_ifconfig() after open_tun()

Holger Kummert (1):
      Del ipv6 addr on close of linux tun interface

Hubert Kario (2):
      ocsp_check - signature verification and cert staus results are separate
      ocsp_check - double check if ocsp didn't report any errors in execution

Ilya Shipitsin (3):
      initial travis-ci support
      skip t_lpback.sh and t_cltsrv.sh if openvpn configured --disable-crypto
      enable "--disable-crypto" build configuration for travis

Ivo Manca (1):
      Plug memory leak in mbedTLS backend

James Bekkema (1):
      Fix socket-flag/TCP_NODELAY on Mac OS X

James Geboski (1):
      Fix --askpass not allowing for password input via stdin

James Yonan (14):
      Added support for the Snappy compression algorithm
      Always push basic set of peer info values to server.
      TLS version negotiation
      Added "setenv opt" directive prefix.  If present, and if the     directive that follows is recognized, it will be processed     as if the "setenv opt" prefix was absent.  If present and if     the directive that follows is not recognized, the directive     will be ignored rather than cause a fatal error.
      MSVC fixes
      Set SSL_OP_NO_TICKET flag in SSL context for OpenSSL builds, to disable TLS stateless session resumption.
      Use native strtoull() with MSVC 2013.
      Define PATH_SEPARATOR for MSVC builds.
      Fixed some compile issues with show_library_versions()
      Added flags parameter to format_hex_ex.
      Extended x509-track for OpenSSL to report SHA1 fingerprint.
      Fixed port-share bug with DoS potential
      Added directive to specify HTTP proxy credentials in config.
      Bind to local socket before dropping privileges

Jan Just Keijser (6):
      man page patch for missing options
      make 'explicit-exit-notify' pullable again
      include ifconfig_ environment variables in --up-restart env set
      Fix "White space before end tags can break the config parser"
      Author: Jan Just Keijser <janjust@nikhef.nl>
      Make certificate expiry warning patch (091edd8e299686) work on OpenSSL 1.0.1 and earlier.

Jann Horn (1):
      Remove quadratic complexity from openvpn_base64_decode()

Jeffrey Cutter (1):
      Update contrib/pull-resolv-conf/client.up for no DOMAIN

Jens Neuhalfen (6):
      Make intent of utun device name validation clear
      Fix buffer overflow by user supplied data
      ignore the local config file t_client.rc in git
      Prevent integration test timeout bc. of sudo
      Add unit testing support via cmocka
      Add a test for auth-pam searchandreplace

Jens Wagner (1):
      Fix spurious ignoring of pushed config options (trac#349).

Jesse Glick (1):
      Allow use of NetBeans without saving nbproject/ directory.

Joachim Schipper (5):
      doc/management-notes.txt: fix typo
      Fix typo in ./configure message
      Refactor tls_ctx_use_external_private_key()
      --management-external-key for PolarSSL
      external_pkcs1_sign: Support non-RSA_SIG_RAW hash_ids

Jonathan K. Bullard (3):
      Fix mismatch of fprintf format specifier and argument type
      Fix null pointer dereference in options.c
      Fail if options have extra parameters [v2]

Josh Cepek (7):
      Fix parameter listing in non-debug builds at verb 4
      (updated) [PATCH] Warn when using verb levels >=7 without debug
      Fix proto tcp6 for server & non-P2MP modes
      Fix Windows script execution when called from script hooks
      Correct error text when no Windows TAP device is present
      Require a 1.2.x PolarSSL version
      Push an IPv6 CIDR mask used by the server, not the pool's size

Julien Muchembled (1):
      Fix --mtu-disc option with IPv6 transport

Kenneth Rose (1):
      Fix v3 plugins to support returning values back to OpenVPN.

Klee Dienes (1):
      tls_ctx_load_ca: Improve certificate error messages

Leon Klingele (1):
      Add link to bug tracker

Leonardo Basilio (1):
      Correctly report TCP connection timeout on windows.

Lev Stipakov (26):
      Peer-id patch v7
      Add the peer-id to the output of the status command
      Prevent memory drain for long lasting floating sessions
      Disallow lameduck's float to an address taken by another client
      Fix NULL dereferencing
      Fix mssfix default value in connection_list context
      This fixes MSVS 2013 compilation.
      Continuation of MSVS fixes
      Fast recovery when host is in unreachable network
      Fix compilation error with --disable-crypto
      Send push reply right after async auth complete
      Fix compilation with --disable-server
      Refine float logging
      Generate openvpn-plugin.h for MSVC build
      Replace variable length array with malloc
      Use adapter index instead of name for windows IPv6 interface config
      Notify clients about server's exit/restart
      Use adapter index for add/delete_route_ipv6
      Pass adapter index to up/down scripts
      Detecting and logging Windows versions
      Report Windows bitness
      Fix "implicit declaration" compiler warning
      Drop recursively routed packets
      Support for disabled peer-id
      Exclude peer-id from pulled options digest
      Use separate list for per-client push options

Lukasz Kutyla (1):
      Fix privilege drop if first connection attempt fails

Matthias Andree (1):
      Enable TCP_NODELAY configuration on FreeBSD.

Max Muster (1):
      Remove duplicate cipher entries from TLS translation table.

Michael McConville (1):
      Fix undefined signed shift overflow

Michal Ludvig (1):
      Support for username-only auth file.

Mike Gilbert (2):
      Add configure check for the path to systemd-ask-password
      Include systemd units in the source tarball (make dist)

Niels Ole Salscheider (1):
      Fix build with libressl

Peter Sagerson (1):
      Fix configure interaction with static OpenSSL libraries

Philipp Hagemeister (2):
      Add topology in sample server configuration file
      Implement on-link route adding for iproute2

Phillip Smith (1):
      Use bob.example.com and alice.example.com to improve clarity of documentation

Robert Fischer (1):
      Updated manpage for --rport and --lport

Samuel Thibault (1):
      Ensure that client-connect files are always deleted

Samuli Seppänen (15):
      Removed ChangeLog.IPv6
      Added cross-compilation information INSTALL-win32.txt
      Updated README
      Cleaned up and updated INSTALL
      Fix to --shaper documentation on the man-page
      Properly escape dashes on the man-page
      Improve documentation in --script-security section of the man-page
      Add CONTRIBUTING.rst
      Update CONTRIBUTING.rst to allow GitHub PRs for code review purposes
      Clarify the fact that build instructions in README are for release tarballs
      Mention tap-windows6 in INSTALL file
      Use an up-to-date easy-rsa URL on the man-page
      Clarify which Windows versions require which TUN/TAP driver
      Deprecate the automatic part of openvpnserv.exe in favor of openvpnserv2.exe
      Automatically cache expected IPs for t_client.sh on the first run

Selva Nair (26):
      Fix termination when windows suspends/sleeps
      Do not hard-code windows systemroot in env_block
      Handle ctrl-C and ctrl-break events on Windows
      Unbreak read username password from management
      Restrict options/configs for startup through interactive service
      Send stdout and stderr of OpenVPN started by interactive service to NUL
      Handle localized Administrators group name in windows
      Fix interactive service ignoring stop command if openvpn is running
      Use appropriate buffer size for WideCharToMultiByte output in interactive.c
      Refactor and move the block-outside-dns code to a new file (block_dns.[ch])
      Add support for block-outside-dns through the interactive service
      Ensure input read using systemd-ask-password is null terminated
      Support reading the challenge-response from console
      Make error non-fatal while deleting address using netsh
      Add support for register-dns through interactive service
      Fix handling of out of memory error in interactive service
      Fix the comparison of pull options hash on restart
      Set WFP engine handle to NULL in win_wfp_uninit()
      Make block-outside-dns work with persist-tun
      Add an option to filter options received from server
      Ignore SIGUSR1/SIGHUP during exit notification
      Fix management-external-cert option parsing error
      Return process id of openvpn from interactive service to client
      Exponentially back off on repeated connect retries
      Promptly close the netcmd_semaphore handle after use
      Avoid format specifier %zu for Windows compatibility

Steffan Karger (181):
      PolarSSL-1.2 support
      Improve PolarSSL key_state_read_{cipher, plain}text messages
      Improve verify_callback messages
      Config compatibility patch. Added translate_cipher_name.
      Switch to IANA names for TLS ciphers.
      Fixed autoconf script to properly detect missing pkcs11 with polarssl.
      Use constant time memcmp when comparing HMACs in openvpn_decrypt.
      Fixed tls-cipher translation bug in openssl-build
      Fixed usage of stale define USE_SSL to ENABLE_SSL
      Do not pass struct tls_session* as void* in key_state_ssl_init().
      Require polarssl >= 1.2.10 for polarssl-builds, which fixes CVE-2013-5915.
      Also update TLSv1_method() calls in support code to SSLv23_method() calls.
      Update TLSv1 error messages to SSLv23 to reflect changes from commit 4b67f98
      If --tls-cipher is supplied, make --show-tls parse the list.
      Remove OpenSSL tmp_rsa_callback. Removes support for ephemeral RSA in TLS.
      Make tls_ctx_restrict_ciphers accept NULL as char *cipher_list.
      Disable export ciphers by default for OpenSSL builds.
      Fix compiler warning for unused result of write()
      Remove unused variables from ssl_verify_polarssl.c's x509_get_serial()
      Fix compiler warnings in ssl_polarssl.c
      Bump minimum OpenSSL version to 0.9.8
      Add openssl-specific common cipher list names to ssl.c.
      Disable unsupported TLS cipher modes by default, cleans --show-tls output.
      configure.ac: check for SSL_OP_NO_TICKET flag in OpenSSL
      configure.ac: use CPPFLAGS for SSL_OP_NO_TICKET check
      Upgrade to PolarSSL 1.3
      Improve error reporting during key/cert loading with PolarSSL.
      Update openvpn-plugin.h for PolarSSL 1.3.
      Add support for elliptic curve diffie-hellmann key exchange (ECDH)
      Add an elliptic curve testing cert chain to the sample keys
      Change signedness of hash in x509_get_sha1_hash(), fixes compiler warning.
      Fix OCSP_check.sh to also use decimal for stdout verification.
      Make serial env exporting consistent amongst OpenSSL and PolarSSL builds.
      Fix build system to accept non-system crypto library locations for plugins.
      Remove function without effect (cipher_ok() always returned true).
      Remove unneeded wrapper functions in crypto_openssl.c
      Remove unneeded defines (were needed for pre-0.9.7 OpenSSL).
      Fix merge error in a6c573d, the ssl ctx is now abstracted.
      Use generic openvpn_x509_cert_t in ssl_verify_polarssl.c
      Fix ssl.c, ssl_verify_* includes
      Move #include "ssl_verify.h" from ssl.h to the source files that need it.
      Remove dependency on manage.h from ssl_verify.h
      Remove unused variable 'proxy' from socket_restart_pause()
      Add (default disabled) --enable-werror option to configure
      Fix --disable-ssl builds, were broken by cleanup in 63dc03d.
      configure.ac: fix SSL_OP_NO_TICKET check
      Fix bug that incorrectly refuses oid representation eku's in polar builds
      Update README.polarssl
      cleanup: remove #if 0'ed function initiate_untrusted_session() from ssl.c.
      Rename ALLOW_NON_CBC_CIPHERS to ENABLE_OFB_CFB_MODE, and add to configure.
      Add proper check for crypto modes (CBC or OFB/CFB)
      Improve --show-ciphers to show if a cipher can be used in static key mode
      Extend t_lpback tests to test all ciphers reported by --show-ciphers
      Don't issue warning for 'translate to self' tls-ciphers
      Don't exit daemon if opening or parsing the CRL fails.
      Define dummy SSL_OP_NO_TICKET flag if not present in OpenSSL.
      Fix typo in cipher_kt_mode_{cbc, ofb_cfb}() doxygen.
      Fix some unintialized variable warnings
      Fix clang warning in options.c
      Fix compiler warnings in ssl_polarssl.c.
      Fix regression with password protected private keys (polarssl)
      Remove unused variables from ssl_verify_openssl.c extract_x509_extension()
      Fix assertion error when using --cipher none
      Add --tls-version-max
      Modernize sample keys and sample configs
      Drop too-short control channel packets instead of asserting out.
      Really fix '--cipher none' regression
      Update doxygen (a bit)
      Set tls-version-max to 1.1 if cryptoapicert is used
      openssl: add crypto_msg(), to easily log openssl errors
      openssl: add more descriptive message for 'no shared cipher' error
      Remove ENABLE_SSL define (and --disable-ssl configure option)
      openssl: use crypto_msg(), get rid of openssl-specific code in error.c
      Add option to disable Diffie Hellman key exchange by setting '--dh none'
      Account for peer-id in frame size calculation
      Disable SSL compression
      Use tls-auth in sample config files
      Fix frame size calculation for non-CBC modes.
      Get rid of old OpenSSL workarounds.
      polarssl: make sure to always null-terminate the cn
      Allow for CN/username of 64 characters (fixes off-by-one)
      Change float log message to include common name, if available.
      Remove unneeded parameter 'first_time' from possibly_become_daemon()
      Remove size limit for files inlined in config
      polarssl: remove code duplication in key_state_write_plaintext{, _const}()
      Improve --tls-cipher and --show-tls man page description
      polarssl: disable 1/n-1 record splitting
      cleanup: remove md5 helper functions
      Re-read auth-user-pass file on (re)connect if required
      Clarify --capath option in manpage
      Call daemon() before initializing crypto library
      write pid file immediately after daemonizing
      Increase control channel packet size for faster handshakes
      Make __func__ work with Visual Studio too
      fix regression: query password before becoming daemon
      Fix using management interface to get passwords.
      reintroduce md5_digest wrapper struct to fix gcc warnings
      Fix out-of-tree builds; openvpn-plugin.h should be in AC_CONFIG_HEADERS
      Fix overflow check in openvpn_decrypt()
      Replace strdup() calls for string_alloc() calls
      Check return value of ms_error_text()
      polarssl: add easy logging for PolarSSL errors
      polarssl: Improve PolarSSL logging
      openssl: be less verbose about cipher translation errors
      hardening: add insurance to exit on a failed ASSERT()
      Fix memory leak in auth-pam plugin
      openssl: remove usage of OPENSSL_malloc() from show_available_curves
      polarssl: fix --client-cert-not-required
      polarssl: add --verify-client-cert optional support
      Fix (potential) memory leak in init_route_list()
      Add macro to ensure we exit on fatal errors
      polarssl: also allocate PKCS#11 certificate object on demand
      polarssl: don't use deprecated functions anymore
      polarssl: require >= 1.3.8
      Fix memory leak in add_option() by simplifying get_ipv6_addr
      remove nonsense const specifier in nonfatal() return value
      openssl: properly check return value of RAND_bytes()
      Fix rand_bytes return value checking
      Fix openssl builds with custom-built library: specify most-dependent first
      Support duplicate x509 field values in environment
      Warn user if their certificate has expired
      Disable certificate notBefore/notAfter sanity check on OpenSSL < 1.0.2
      Make assert_failed() print the failed condition
      cleanup: get rid of httpdigest.c type warnings
      Fix regression in setups without a client certificate
      polarssl: actually use polarssl debug logging
      polarssl: optimize polar_ok() for non-errors
      Update manpage: OpenSSL might also need /dev/urandom inside chroot
      polarssl: use wrappers to access md_info_t member functions
      polarssl: remove now redundant 128-bit blowfish key override
      socks.c: fix check on get_user_pass() return value(s)
      configure.ac: simplify crypto library configuration
      configure.ac: fix polarssl autodetection
      Allow NULL argument in cipher_ctx_get_cipher_kt()
      Remove reuse of key_type during init of data channel auth and tls-auth
      Move crypto_options into key_state and stop using context in SSL-mode.
      Move key_ctx_bi into crypto_options
      Move packet_id into crypto_options
      Change openvpn_encrypt() to append to work buffer only
      Create separate function for replay check
      Add AEAD cipher support (GCM)
      Add cipher name translation for OpenSSL.
      Add preliminary server-side support for negotiable crypto parameters
      Minor AEAD patch cleanup
      Clean up get_tls_handhake_key()
      Fix OCSP_check.sh
      Make AEAD modes work with OpenSSL 1.0.1-1.0.1c
      hardening: add safe FD_SET() wrapper openvpn_fd_set()
      Only include aead encrypt/decrypt functions if AEAD modes are supported
      Fix potential null-pointer dereference
      Fix memory leak in argv_extract_cmd_name()
      Replace MSG_TEST() macro for static inline msg_test()
      fixup: change init_key_type() param name in declaration too
      Further restrict default cipher list
      PolarSSL x509_get_sha1_hash now returns correct SHA1 fingerprint.
      Implemented x509-track for PolarSSL.
      Migrate to mbed TLS 2.x
      Rename files with 'polarssl' in the name to 'mbedtls'
      configure.ac: link to all mbed TLS libs during library detection
      mbedtls: check that private key and certificate match on start
      mbedtls: improve error reporting in tls verify callback
      Remove trailing newline from verify callback error messages
      Don't limit max incoming message size based on c2->frame
      cleanup: remove alloc_buffers argument from multi_top_init()
      mbedtls: don't set debug threshold if compiled without MBEDTLS_DEBUG_C
      Add client-side support for cipher negotiation
      Add options to restrict cipher negotiation
      Add server-side support for cipher negotiation
      Allow ncp-disable and ncp-ciphers to be specified in ccd files
      Fix '--cipher none --cipher' crash
      Discourage using 64-bit block ciphers
      Fix unittests for out-of-source builds
      Fix --mssfix when using NCP
      Drop gnu89/c89 support, switch to c99
      cleanup: remove code duplication in msg_test()
      Add SHA256 fingerprint support
      Make sure options->ciphername and options->authname are always defined
      Update cipher-related man page text
      Fix duplicate PUSH_REPLY options
      Check --ncp-ciphers list on startup
      Fix use-after-free bug in prepare_push_reply()

TDivine (1):
      Fix "code=995" bug with windows NDIS6 tap driver.

Tamas TEVESZ (1):
      Add support for client-cert-not-required for PolarSSL.

Thomas Veerman (2):
      Fix "." in description of utun.
      Update expiry date in management event loop

ValdikSS (4):
      Add Windows DNS Leak fix using WFP ('block-outside-dns')
      Clarify mssfix documentation
      Clarify --block-outside-dns documentation
      Update --block-outside-dns to work on Windows Vista

Vasily Kulikov (1):
      Mac OS X Keychain management client

Yawning Angel (1):
      Fix SOCKSv5 method selection

Yegor Yefremov (3):
      socket: remove duplicate expression
      polarssl: fix unreachable code
      cert_data: fix memory leak

kangsterizer (1):
      Fix typo in sample build script to use LDFLAGS

svimik (1):
      Fix segfault when enabling pf plug-ins