At the same time, utilize the Negotiable Crypto Parameters (NCP) feature
in OpenVPN v2.4, which allows clients using the old BF-CBC default cipher
to connect without any issues.
F-27 Change request: https://fedoraproject.org/wiki/Changes/New_default_cipher_in_OpenVPN
This change was approved in the FESCO meeting 2017-08-04.
Also fix a truncated changelog entry for openvpn-2.4.3-1
- Fix remotely-triggerable ASSERT() on malformed IPv6 packet {CVE-2017-7508}
- Prevent two kinds of stack buffer OOB reads and a crash for invalid input data {CVE-2017-752
- Fix potential double-free in --x509-alt-username {CVE-2017-7521}
- Fix remote-triggerable memory leaks {CVE-2017-7521}
- Ensure OpenVPN systemd services are restarted upon upgrades
- Verify PGP signature of source tarball as part of package building
- Build against system lz4 library
Also:
- Switching back to OpenSSL 1.0, via compat-openssl10 and
compat-openssl10-pkcs11-helper (rhbz#1443749, rhbz#1432125, rhbz#1440468)
- Re-enable --enable-x509-alt-username which got removed during the clean-up
patches (rhbz#1443942)
- Build with lz4 library from Fedora
- Splitting out -devel files into a separate package
- Removed several contrib and sample files which makes is not
strictly needed in this package.
- build: Enable tests runs by default, long running tests can
be disabled with "--without tests_long"
- build: Removed defined %%{plugins} macro not in use
- Added .rpmlint to whitelist false positives
- Use systemd-rpm macros
- Remove %triggerun for openvpn < 2.2.1 (which is way too old anyhow
for newer Fedoras)
- Fixed several issues with installed files
- Fixed ./configure arguments - several of them where outdated or
used wrong
- Removed the deprecated openvpn@.service in favour of the new
upstream unit files
- Added README.systemd which describes the new unit files
- Fixed wrong mixing of %doc and %{_pkgdocdir} causing duplication
of sample and contrib directories
- Install management-notes.txt, which contains useful information
about the OpenVPN management interface commands
- Don't own %{_localstatedir}/run/%{name} ... that's handled by
tmpfiles.d/openvpn.conf instead.
- Own /etc/openvpn{,client,server}/
- Added mbed TLS patch to allow RSA keys down to 1024 bits plus SHA1
and RIPE-160 hasing algorithms (based on OpenVPN 3 legacy profile)
- Removed no-functional ./configure options
- Use upstream tmfiles.d/openvpn
- Package newer openvpn-client/server@.service unit files
Switch to using the %perl_default_filter macro for filtering the perl
dependency. The older attempt which used a %__perl_requires override no
longer works on F19.
Some of the examples installed with %doc use perl, but we don't want the
whole openvpn package to start depend on perl because of that.
David Sommerseth
Fedora Release Engineering
Jon Ciesla
Orion Poplawski
Dennis Gilmore
Ralf Corsépius
Peter Robinson
Ville Skyttä
Kalev Lember