openvpn (2.6.14-1) unstable; urgency=medium

  [ Aquila Macedo ]
  * Add new autopkgtest for unit tests

  [ Bernhard Schmidt ]
  * New upstream version 2.6.14
    - CVE-2025-2704 possible ASSERT() on OpenVPN servers using --tls-crypt-v2
      (Closes: #1101935)

 -- Bernhard Schmidt <berni@debian.org>  Wed, 02 Apr 2025 20:56:44 +0200

openvpn (2.6.13-1) unstable; urgency=medium

  * New upstream version 2.6.13 (Closes: #1095675)

 -- Bernhard Schmidt <berni@debian.org>  Mon, 10 Feb 2025 22:09:11 +0100

openvpn (2.6.12-1) unstable; urgency=medium

  * New upstream version 2.6.12
    - Fix regression in CVE-2024-5594 patch breaking user configurations with
      AUTH_FAIL messages having trailing CR/NL characters. This often happens
      if the AUTH_FAIL reason is set by a script

 -- Bernhard Schmidt <berni@debian.org>  Thu, 18 Jul 2024 23:30:00 +0200

openvpn (2.6.11-1) unstable; urgency=medium

  * New upstream version 2.6.11 (Closes: #1074488)
    - CVE-2024-28882
      client can circumvent management client-kill
    - CVE-2024-5594
      malicious peer can DoS or send garbage to logs
  * d/openvpn@.service: Add CAP_SETPCAP required for openvpn-dco-dkms
    (Closes: #1074504)
  * drop d/patches/systemd.patch, applied upstream

 -- Bernhard Schmidt <berni@debian.org>  Mon, 08 Jul 2024 00:06:59 +0200

openvpn (2.6.9-1) unstable; urgency=medium

  * New upstream version 2.6.9
  * Switch to systemd-dev (Closes: #1060500)
  * Install systemd generator and units into /usr. (Closes: #1064399)

 -- Bernhard Schmidt <berni@debian.org>  Wed, 28 Feb 2024 08:43:25 +0100

openvpn (2.6.7-1) unstable; urgency=medium

  [ Aquila Macedo ]
  * d/control: bump debhelper-compat level to 13.
  * d/patches: Remove outdated patches
  * d/patches: fix typo in openvpn binary
  * d/patches: fix typo in manpages
  * d/copyright: Update license to BSD-2
  * d/openvpn.service: add documentation

  [ Bernhard Schmidt ]
  * New upstream version 2.6.7, fixing two CVEs (Closes: #1055805)
    - CVE-2023-46849: Use of --fragment option can lead to a division by zero
      error which can be fatal
    - CVE-2023-46850: Incorrect use of send buffer can cause memory to be sent
      to peer
  * Pick patch recommended by upstream in GH#449 to fix segfault
    introduced in 2.6.7

  [ Remus-Gabriel Chelu ]
  * Add Romanian templates translation (Closes: #1033179)

 -- Bernhard Schmidt <berni@debian.org>  Sat, 11 Nov 2023 22:01:15 +0100

openvpn (2.6.3-2.1) unstable; urgency=medium

  * Non-maintainer upload.

  [ Helmut Grohne ]
  * Do not install systemd units twice (Closes: #1054083)

 -- Jochen Sprickerhof <jspricke@debian.org>  Fri, 27 Oct 2023 16:26:34 +0200

openvpn (2.6.3-2) unstable; urgency=medium

  * Cherry-pick two bugfix commits from upstream
    - Memory leak in dco_get_peer_stats_multi for Linux
    - dangling pointer passed to pkcs11-helper

 -- Bernhard Schmidt <berni@debian.org>  Sat, 20 May 2023 17:43:32 +0200

openvpn (2.6.3-1) unstable; urgency=medium

  * New upstream version 2.6.2
    - drop patches applied upstream
    - needs new openvpn-dco-dkms version. Not adding a versioned dependency
      to untangle testing migration, because it will just not use the
      "wrong" version and run unaccelerated.
  * New upstream version 2.6.3

 -- Bernhard Schmidt <berni@debian.org>  Thu, 13 Apr 2023 09:19:40 +0200

openvpn (2.6.1-1) unstable; urgency=medium

  * Upload to unstable targetting bookworm
  * Cherry-Pick upstream commits from 2.6.2
    - fix rare ASSERT in tls-crypt
    - fix memory leaks in HMAC initial packet generation
    - set netlink socket to be non-blocking

 -- Bernhard Schmidt <berni@debian.org>  Sun, 26 Mar 2023 11:14:26 +0200

openvpn (2.6.1-1~exp1) experimental; urgency=medium

  * New upstream version 2.6.1
    - target experimental due to the freeze

 -- Bernhard Schmidt <berni@debian.org>  Fri, 10 Mar 2023 09:02:22 +0100

openvpn (2.6.0-1) unstable; urgency=medium

  * New upstream version 2.6.0
  * Drop dco netlink buffer overflow patch applied upstream
  * Drop obsolete lsb-base dependency

 -- Bernhard Schmidt <berni@debian.org>  Wed, 25 Jan 2023 22:27:04 +0100

openvpn (2.6.0~rc2-1) unstable; urgency=medium

  * New upstream version 2.6.0~rc2
  * Add upstream pending patch to work around dco netlink buffer overflow

 -- Bernhard Schmidt <berni@debian.org>  Fri, 13 Jan 2023 19:02:01 +0100

openvpn (2.6.0~rc1-1) unstable; urgency=medium

  * New upstream version 2.6.0~rc1 (Closes: #1014376)
  * Drop DCO workaround applied upstream

 -- Bernhard Schmidt <berni@debian.org>  Wed, 28 Dec 2022 22:51:31 +0100

openvpn (2.6.0~git20221222-1) unstable; urgency=medium

  * New upstream version 2.6.0~git20221222
  * Import pending upstream fix for race conditions in DCO servers
  * d/openvpn@.service: Replace LimitNPROC=100 with TasksMax=10
    (see Bug#861923 for discussion)

 -- Bernhard Schmidt <berni@debian.org>  Fri, 23 Dec 2022 22:43:39 +0100

openvpn (2.6.0~git20221215+beta2-1) unstable; urgency=medium

  * New upstream version 2.6.0~git20221215+beta2

 -- Bernhard Schmidt <berni@debian.org>  Fri, 16 Dec 2022 11:54:27 +0100

openvpn (2.6.0~git20221201-1) unstable; urgency=medium

  * New upstream version 2.6.0~git20221201, also known as 2.6_beta1
  * Update d/NEWS to list known backwards compatibility issues
  * Fix national encoding on d/po/{es,sv}.po
  * Drop obsolete patches

 -- Bernhard Schmidt <berni@debian.org>  Sun, 04 Dec 2022 21:32:37 +0100

openvpn (2.6.0~git20221116-1) unstable; urgency=medium

  * New upstream version 2.6.0~git20221116
    * Various improvements regarding MTU calculation

 -- Bernhard Schmidt <berni@debian.org>  Tue, 22 Nov 2022 11:50:13 +0100

openvpn (2.6.0~git20220818-1) unstable; urgency=medium

  * New upstream version 2.6.0~git20220818
  * Only depend on libcap-ng-dev on Linux
  * Drop d/p/disable-dco-without-necessary-capabilities applied upstream

 -- Bernhard Schmidt <berni@debian.org>  Thu, 18 Aug 2022 10:48:47 +0200

openvpn (2.6.0~git20220811-2) unstable; urgency=medium

  * Cherry-Pick proposed upstream fix to disable DCO if unable to retain
    capabilities, fixes network-manager-openvpn together with DCO
    (Closes: #1017379)

 -- Bernhard Schmidt <berni@debian.org>  Wed, 17 Aug 2022 15:30:31 +0200

openvpn (2.6.0~git20220811-1) unstable; urgency=medium

  * New upstream version 2.6.0~git20220811
    * Retain CAP_NET_ADMIN when dropping privileges (Closes: #976070)
  * Add build-dependency on libcap-ng-dev
  * Explicitly disable unit tests (Closes: #1016057)
  * Drop obsolete entries from d/copyright

 -- Bernhard Schmidt <berni@debian.org>  Thu, 11 Aug 2022 16:05:36 +0200

openvpn (2.6.0~git20220808-1) unstable; urgency=medium

  [ Gianfranco Costamagna ]
  * d/t/server-setup-with-ca:
    - cherry-pick change in easy-rsa autopkgtests to remove conflicting
      "vars" file.

  [ Bernhard Schmidt ]
  * New upstream version 2.6.0~git20220808
    - switch to master branch now that DCO support has been merged
  * Drop OpenSSL 3.0 digest name patch applied upstream

 -- Bernhard Schmidt <berni@debian.org>  Tue, 09 Aug 2022 11:31:12 +0200

openvpn (2.6.0~git20220518+dco-3) unstable; urgency=medium

  [ Lucas Kanashiro ]
  * d/t/server-setup-with-static-key: set cipher to be DES-EDE3-CBC
  * d/t/server-setup-with-static-key: use 'secret' to generate key
  * d/t/server-setup-with-*: use 'set -x' in the test scripts
  * d/t/control: add allow-stderr restriction

  [ Bernhard Schmidt ]
  * Import Ubuntu patch cherry-picked from upstream to translate OpenSSL 3.0
    digest names into OpenSSL 1.1 digest names (Closes: #1012129)

 -- Bernhard Schmidt <berni@debian.org>  Sun, 24 Jul 2022 17:13:47 +0200

openvpn (2.6.0~git20220518+dco-2) unstable; urgency=medium

  * Add d/NEWS entry about the release notes and DCO (Closes: #1011372)

 -- Bernhard Schmidt <berni@debian.org>  Mon, 30 May 2022 15:44:41 +0200

openvpn (2.6.0~git20220518+dco-1) unstable; urgency=medium

  * New upstream version 2.6.0~git20220518+dco
  * Release to unstable
  * Revert "Build against OpenSSL 3.0", OpenSSL 3.0 has landed in unstable

 -- Bernhard Schmidt <berni@debian.org>  Fri, 20 May 2022 08:35:29 +0200

openvpn (2.6.0~git20220510+dco-1) experimental; urgency=medium

  * New upstream version 2.6.0~git20220510+dco
  * Suggest openvpn-dco-dkms
  * Drop iproute2, linux builds use netlink
  * Limit libnl-genl-3-dev build-dep (for dco) to linux-any
  * Build against OpenSSL 3.0

 -- Bernhard Schmidt <berni@debian.org>  Fri, 13 May 2022 00:01:35 +0200

openvpn (2.6.0~git20220317+dco-1) experimental; urgency=medium

  * New upstream version 2.6.0~git20220317+dco
    This is a snapshot of the upstream dco branch (data-channel offloading)

 -- Bernhard Schmidt <berni@debian.org>  Mon, 21 Mar 2022 11:54:29 +0100

openvpn (2.5.6-1) unstable; urgency=high

  * New upstream version 2.5.6
    CVE-2022-0547 - Potential authentication by-pass with multiple deferred
    authentication plug-ins plug-ins (Closes: #1008015)

 -- Bernhard Schmidt <berni@debian.org>  Sun, 20 Mar 2022 21:42:05 +0100

openvpn (2.5.5-1) unstable; urgency=medium

  [ Jörg Frings-Fürst ]
  * New upstream version 2.5.5
  * Declare compliance with Debian Policy 4.6.0.1
  * d/copyright:
    - Remove duplicate entries;
    - Refresh for new upstream release
    - Add 2021 to myself

  [ Bernhard Schmidt ]
  * Refresh patches for new upstream version

 -- Bernhard Schmidt <berni@debian.org>  Mon, 21 Feb 2022 12:05:55 +0100

openvpn (2.5.1-3) unstable; urgency=medium

  * Fix autopkgtest (Closes: #983662)
    - adapt autopkgtest output to 2.5 (from Ubuntu)
    - Fix easyrsa batch mode invocation
  * Cherry-Pick "Fix condition to generate session keys" (Closes: #988478)

 -- Bernhard Schmidt <berni@debian.org>  Fri, 14 May 2021 09:40:04 +0200

openvpn (2.5.1-2) unstable; urgency=high

  * Cherry-Pick 3 (+ 1 predependency) patches from upstream to fix
    authentication bypass with deferred authentication
    (CVE-2020-15078) (Closes: #987380)

 -- Bernhard Schmidt <berni@debian.org>  Wed, 28 Apr 2021 14:41:58 +0200

openvpn (2.5.1-1) unstable; urgency=medium

  * New upstream version 2.5.1 (bugfix release)

 -- Bernhard Schmidt <berni@debian.org>  Wed, 24 Feb 2021 19:54:34 +0100

openvpn (2.5.0-1) unstable; urgency=medium

  * New upstream version 2.5.0 - final release

 -- Bernhard Schmidt <berni@debian.org>  Wed, 28 Oct 2020 19:37:34 +0100

openvpn (2.5~rc3-1) unstable; urgency=medium

  * New upstream version 2.5~rc3

 -- Bernhard Schmidt <berni@debian.org>  Tue, 20 Oct 2020 19:17:43 +0200

openvpn (2.5~rc2-1) unstable; urgency=medium

  * Downgrade debhelper-compat to 12 for easier backports
  * New upstream version 2.5~rc2

 -- Bernhard Schmidt <berni@debian.org>  Wed, 30 Sep 2020 21:12:11 +0200

openvpn (2.5~beta3-1) unstable; urgency=medium

  * Release to unstable.

  [ Lucas Kanashiro ]
  * Add two DEP-8 test cases for the server side
  * Drop reload support from systemd unit files (LP: #1868127)

  [ Bernhard Schmidt ]
  * Revert "d/gbp.conf for experimental 2.5 branch"
  * New upstream version 2.5~beta3

 -- Bernhard Schmidt <berni@debian.org>  Tue, 01 Sep 2020 16:53:43 +0200

openvpn (2.5~beta1-3) experimental; urgency=medium

  * Disable iproute2 support in favour of the new netlink based default.
    Thanks to Fabio Pedretti

 -- Bernhard Schmidt <berni@debian.org>  Sun, 16 Aug 2020 14:04:11 +0200

openvpn (2.5~beta1-2) experimental; urgency=medium

  * Set Build-Conflicts: systemctl, see Bug#959828

 -- Bernhard Schmidt <berni@debian.org>  Sun, 16 Aug 2020 10:33:47 +0200

openvpn (2.5~beta1-1) experimental; urgency=medium

  * d/gbp.conf for experimental 2.5 branch
  * New upstream version 2.5~beta1
  * Adjust patches for new major upstream version
  * Add python3-docutils to build-depends for manpage generation

 -- Bernhard Schmidt <berni@debian.org>  Sat, 15 Aug 2020 21:32:49 +0200

openvpn (2.4.9-3) unstable; urgency=medium

  [ Jörg Frings-Fürst ]
  * Fix the bug that occurs during the update (Closes: #959464):
    "ERROR: Cannot ioctl TUNSETIFF tunX: Device or resource busy (errno=16)"
    - debian/rules: Change dh_installsystemd from "--restart-after-upgrade" to
      "--no-restart-after-upgrade -r".
    - Remove restart from debian/postinst.
    - Add hint to reboot if openvpn is running.
    - Add new chapter into debian/NEWS.
  * Migrate to debhelper 13.
  * debian/postinst:
    - Remove now useless code for version less than 2.3.2-6.
  * debina/copyright:
    - Add year 2020 to Bernhard Schmidt.

 -- Jörg Frings-Fürst <debian@jff.email>  Sat, 02 May 2020 18:14:36 +0200

openvpn (2.4.9-2) unstable; urgency=medium

  * Cherry-Pick upstream patch to fix ssl_do_config error with
    invalid OpenSSL system configuration (Closes: #958296)
    Thanks to Jonas Andradas for reporting and Arne Schwabe for debugging.
  * Use DEB_HOST_MULTIARCH for libraries (Closes: #958315)
  * Enable Salsa CI

 -- Bernhard Schmidt <berni@debian.org>  Tue, 21 Apr 2020 21:58:53 +0200

openvpn (2.4.9-1) unstable; urgency=medium

  [ Jörg Frings-Fürst ]
  * New upstream release (Closes: #950610).
  * Refresh debian/patches/openvpn-pkcs11warn.patch.
  * Remove upstream applied fix-pkcs11-helper-hang.patch.
  * Add libp11-kit-dev to Build - Depends (Closes: #940727).
  * Add symlinks for plugins into /usr/lib/openvpn/ (Closes: #946348).
  * Declare compliance with Debian Policy 4.5.0 (No changes needed).
  * Switch to debhelper-compat:
    - debian/control: change to debhelper-compat (=12).
    - remove debian/compat.
  * debian/copyright:
    - Add year 2020 to debian/*.
    - Add year 2019 to *.
  * debian/control:
    - Add Rules-Requires-Root: No.

  [ Bernhard Schmidt ]
  * New upstream version 2.4.9
    - CVE-2020-11810
      illegal client float can break VPN session for other users

 -- Bernhard Schmidt <berni@debian.org>  Sun, 19 Apr 2020 15:52:57 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog openvpn`.
