openvpn: Update to 2.5.2
ClosedPublic
Actions

Authored by ReillyBrogan on Jun 1 2021, 8:13 PM.

Details

Reviewers

JoshStrobl

Group Reviewers

Triage Team

Commits

R2261:c4d7f0f1e195: openvpn: Update to 2.5.2

Summary

Security Updates:

CVE-2020-15078

OpenVPN 2.5 Changes:

Connections setup is now much faster
ChaCha20-Poly1305 cipher in the OpenVPN data channel
Client-specific tls-crypt keys
Improved Data channel cipher negotiation
Removal of BF-CBC support in default configuration
HMAC based auth-token support for seamless reconnects to standalone servers or a group of servers.
Asynchronous (deferred) authentication support for auth-pam plugin
Asynchronous (deferred) support for client-connect scripts and plugins
Support IPv4 configs with /31 netmasks now
802.1q VLAN support on TAP servers
IPv6-only tunnels
New option --block-ipv6 to reject all IPv6 packets (ICMPv6)
VRF support
Netlink integration (OpenVPN no longer needs to execute ifconfig/route or ip commands)

Complete release notes available here

Test Plan

Rebuilt all reverse dependencies
Connected to a few different Openvpn servers via GNOME network-manager applet

Diff Detail

Repository

R2261 openvpn

Branch

master

Lint

No Lint Coverage

Unit

No Test Coverage

Build Status

Buildable 593
Build 593: arc lint + arc unit

Event Timeline

ReillyBrogan created this revision.Jun 1 2021, 8:13 PM

Herald added a reviewer: Triage Team. · View Herald TranscriptJun 1 2021, 8:13 PM

ReillyBrogan requested review of this revision.Jun 1 2021, 8:13 PM

Harbormaster completed remote builds in B593: Diff 27015.Jun 1 2021, 8:13 PM

Didn't mean to commit checks disabled

Harbormaster completed remote builds in B594: Diff 27016.Jun 1 2021, 8:16 PM

I think /usr/share/doc can be deleted.

Remove docs

Harbormaster completed remote builds in B595: Diff 27017.Jun 1 2021, 9:06 PM

ReillyBrogan mentioned this in T9756: Update networkmanager-openvpn to 1.8.14.Jun 1 2021, 11:24 PM

FYI @serebit Qomui doesn't build currently (source path needs to be changed). You may also consider removing it from the repos as it appears to be dead upstream.

wait why me

Actually disregard that comment @serebit for some reason I thought you were the qomui maintainer (probably because you're the maintainer of protonvpn-cli one of the other openvpn reverse dependencies)