Skip to content

Commit 8fca87b

Browse files
committed
debian-sbuild: Import source from Ubuntu 25.10
From openvpn_2.6.14-2ubuntu1.dsc Signed-off-by: Frank Lichtenheld <[email protected]>
1 parent 1f9be1a commit 8fca87b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

67 files changed

+8155
-0
lines changed
Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
openvpn (2.6.0~git20221201-1) unstable; urgency=medium
2+
3+
OpenVPN 2.6 has changed several defaults that might lead to connection
4+
problems, especially when the remote side runs an old OpenVPN version
5+
or cipher negotiations (NCP) are not in effect. This especially affects
6+
connecting to OpenVPN 2.3.x or earlier, and several limitations around
7+
old cryptographic algorithms and keys, mostly caused by the switch to
8+
OpenSSL 3.0
9+
10+
These include but are not limited to
11+
12+
- weak SHA1 or MD5 signature on certificates
13+
- 1024 bit RSA certificates, 1024 bit DH parameters, other weak keys
14+
- Use of a legacy or deprecated cipher (e.g. 64bit block ciphers)
15+
- remote OpenVPN version not supporting TLS 1.2 or later
16+
17+
Please read the release notes installed as
18+
/usr/share/doc/openvpn/changelog.gz.
19+
20+
With an optional kernel module (available as package openvpn-dco-dkms)
21+
the data plane encryption/decryption is performed in kernel space,
22+
reducing page copy overhead and increasing the throughput significantly.
23+
DCO (Data Channel Offload) should work with most configurations. In
24+
case of issues, please try running OpenVPN with --disable-dco first.
25+
26+
-- Bernhard Schmidt <[email protected]> Mon, 23 May 2022 11:04:30 +0200
27+
28+
openvpn (2.4.9-3) unstable; urgency=medium
29+
30+
To ensure the functionality of OpenVPN connections during an update,
31+
OpenVPN is not restarted after the update since this version.
32+
33+
Please restart OpenVPN or reboot the computer manually after the update.
34+
35+
-- Jörg Frings-Fürst <[email protected]> Sat, 02 May 2020 18:14:36 +0200
36+
37+
openvpn (2.4.0-4) unstable; urgency=medium
38+
39+
If you're upgrading a previous OpenVPN installation, you should check your
40+
current CRL file expiraton date. "crl-verify" option now also checks that.
41+
Regenerate your CRL file if the expiration date is in the past or your
42+
clients won't be able to connect.
43+
44+
OpenVPN 2.4 will try to connect using IPv6 first if you're using a hostname
45+
with both A and AAAA entries, if your VPN server is still running a
46+
previous (<2.4) version a long wait may occur until your 2.4 client tries
47+
with the IPv4 address.
48+
49+
-- Alberto Gonzalez Iniesta <[email protected]> Thu, 02 Feb 2017 14:15:42 +0100
50+
51+
openvpn (2.4.0-1) unstable; urgency=medium
52+
53+
OpenVPN 2.4 removed tls-remote option. Current setups using that option
54+
will fail to work. Update your configuration to use verify-x509-name
55+
instead.
56+
57+
-- Alberto Gonzalez Iniesta <[email protected]> Tue, 27 Dec 2016 22:50:20 +0100
58+
59+
openvpn (2.3~rc1-1) experimental; urgency=low
60+
61+
auth-pam and down-root plugins renamed to:
62+
openvpn-plugin-auth-pam.so
63+
openvpn-plugin-down-root.so
64+
65+
-- Alberto Gonzalez Iniesta <[email protected]> Tue, 06 Nov 2012 13:22:13 +0100
66+
67+
openvpn (2.1~rc15-1) unstable; urgency=low
68+
69+
The openvpn utility changed its handling of pkcs11 certificates when it
70+
switched from built-in code to the pkcs11-helper library (package
71+
libpkcs11-helper1 on Debian). This means that you will have to update your
72+
openvpn configuration files if you are using such certificates. For
73+
example, a stanza in a configuration file might previously have referred to
74+
a given pkcs11 certificate like this:
75+
76+
pkcs11-providers /usr/lib/opensc-pkcs11.so
77+
pkcs11-slot-type id
78+
pkcs11-slot 0
79+
pkcs11-id-type label
80+
pkcs11-id "YOUR_LABEL"
81+
82+
This stanza has to be rewritten now in the following way:
83+
84+
pkcs11-providers /usr/lib/opensc-pkcs11.so
85+
pkcs11-id 'YOUR_PKCS11_SERIALIZED_ID'
86+
87+
The pkcs11-slot, pkcs11-slot-type, pkcs11-id-type options are obsolete;
88+
a long ID string that is unique for each certificate is now used as the
89+
only identifier. Note that YOUR_PKCS11_SERIALIZED_ID will almost
90+
certainly be different from YOUR_LABEL that you used previously with the
91+
pkcs11-id option. To find out the correct serialized ID(s) for your
92+
certificate(s), you have to query the pkcs11-provider library:
93+
94+
$ openvpn --show-pkcs11-ids /usr/lib/opensc-pkcs11.so
95+
96+
The following objects are available for use.
97+
Each object shown below may be used as parameter to --pkcs11-id option
98+
please remember to use single quote mark.
99+
100+
Certificate
101+
DN: /CN=YOUR_USER
102+
Serial: SERIAL_NUMBER
103+
Serialized id: YOUR_PKCS11_SERIALIZED_ID
104+
105+
You have to paste YOUR_PKCS11_SERIALIZED_ID as seen in this output into
106+
your openvpn configuration file and make sure that the string is enclosed
107+
in single quotation marks.
108+
109+
The example above assumes that your cryptographic token can be accessed
110+
via the opensc-pkcs11.so library from libopensc2. If you have to use
111+
another library, for example a proprietary driver from the vendor of your
112+
token, then you have to adapt both the stanza in the configuration file
113+
and the path given on the command line accordingly.
114+
115+
Florian Kulzer
116+
117+
-- Alberto Gonzalez Iniesta <[email protected]> Thu, 30 Apr 2009 12:35:05 +0200
118+
119+
openvpn (2.1~rc9-3) unstable; urgency=low
120+
121+
Calling of external commands/scripts
122+
123+
Starting with version 2.1~rc9, openvpn has a new option to control the
124+
ability to execute external commands (--script-security).
125+
126+
By default (script-security 1) it will only allow the execution of
127+
built-in commands (ip, ifconfig, route,...). If you require the execution
128+
of external commands, such as /etc/openvpn/update-resolv-conf, you'll have
129+
to include the following option in your configuration file:
130+
script-security 2
131+
132+
-- Alberto Gonzalez Iniesta <[email protected]> Sat, 16 Aug 2008 13:34:24 +0200
133+
Lines changed: 257 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,257 @@
1+
In this file:
2+
3+
- systemd service file and limits/capabilities
4+
- 'writepid' option warning
5+
- Multiple tunnels
6+
- Starting or stopping multiple tunnels with a single command
7+
- Compatibility notes on 2.x vs 1.x #
8+
- Changes in string remapping (affects tls-remote certificate names)
9+
- plugin support
10+
- Using resolvconf
11+
- Out of memory issues
12+
- LDAP+TLS authentication runs into file exhaustion
13+
- Possible consequences of the 'chroot' option
14+
- Disabling all.send_redirects on tun + topology subnet setups
15+
16+
17+
openvpn for Debian
18+
------------------
19+
20+
Documentation to get OpenVPN to work is mostly on the openvpn(8) man page.
21+
You'll find example configuration files and additional docs in the
22+
/usr/share/doc/openvpn/examples directory.
23+
24+
OpenVPN requires TUN/TAP driver support in the kernel. You'll also need a
25+
tun device file. If it's not present on your system, you may create one
26+
with these commands (as root):
27+
# mkdir /dev/net
28+
# mknod /dev/net/tun c 10 200
29+
30+
systemd service file and limits/capabilities
31+
--------------------------------------------
32+
33+
If you encounter problems [1] (or errors related to permissions) starting
34+
OpenVPN, you may want to check the limits imposed to the OpenVPN service in
35+
/lib/systemd/system/[email protected], notably CapabilityBoundingSet and
36+
LimitNPROC. You may override those executing:
37+
# systemctl edit [email protected]
38+
39+
And setting CapabilityBoundingSet (or LimitNPROC) to be empty:
40+
[Service]
41+
CapabilityBoundingSet=~
42+
43+
[1] daemon() failed or unsupported: Resource temporarily unavailable (errno=11)
44+
[2] Failed running command (--route-up): external program exited with error status: 1
45+
46+
'writepid' option warning
47+
-------------------------
48+
49+
Don't specify a 'writepid' option in the .conf files, or the init.d
50+
script won't be able to stop/reload the tunnels.
51+
52+
Multiple tunnels
53+
----------------
54+
55+
When OpenVPN is started by /etc/init.d/openvpn the default is to start
56+
a separate openvpn daemon for each .conf configuration file in the
57+
/etc/openvpn directory. The /etc/default/openvpn file may be used to
58+
alter this behavior.
59+
60+
[UPDATE: with OpenVPN 2.0 one openvpn daemon can serve multiple clients. That
61+
way multiple instances of openvpn are no longer required to achieve this, and
62+
one configuration file should be enough for these cases. Take a look at the
63+
'Multi-Client Server options' on the man page]
64+
65+
Be sure that each .conf file defines a different local port
66+
number with the "port" or "lport" options; see the openvpn
67+
man page for more information.
68+
69+
Starting or stopping multiple tunnels with a single command
70+
-----------------------------------------------------------
71+
72+
It is now possible to specify multiple tunnel names to the init.d script.
73+
Just put the names after the action (start|stop), like this:
74+
75+
/etc/init.d/openvpn start vpn1 vpn4 vpn5
76+
77+
This only works with sysvinit(-core), if you're running systemd, you cannot
78+
pass arguments to init.d scripts.
79+
80+
In order to start/stop a particular VPN you may use:
81+
# service openvpn@VPN_NAME start
82+
or
83+
# systemctl start openvpn@VPN_NAME
84+
85+
/etc/network/interfaces
86+
-----------------------
87+
88+
/etc/network/interfaces can be configured to start and stop openvpn when the
89+
underlying network interface is brought up and down. To do so add a line such
90+
as "openvpn vpn1" to the stanza for the underlying network interface, where
91+
"vpn1" is the name of the vpn to start and stop.
92+
93+
It is possible to control vpn interfaces using the standard ifup/ifdown
94+
commands. This is helpful in case you want tunnels to be started right
95+
after physical networks, so any network filesystems listed in fstab can be
96+
mounted during the standard boot sequence. In order to do this several
97+
steps need to be taken:
98+
99+
- Select a specific tun/tap device name using the 'dev' option in your
100+
config file (e.g. dev tun_work). This will ensure that the name you
101+
use in /etc/network/interfaces will always match the one this vpn
102+
will utilize.
103+
104+
- Create a 'manual' type interface entry in /etc/network/interfaces.
105+
There should be only one option - openvpn, which takes a config file
106+
name as the argument (without the .conf suffix) For example:
107+
108+
auto tun_work
109+
iface tun_work inet manual
110+
openvpn work_vpn
111+
112+
- You should prevent openvpn from trying to start this tunnel when its
113+
own init script runs, since the interface is already up. This is done
114+
in /etc/default/openvpn by changing the AUTOSTART option as described
115+
in the same file
116+
117+
118+
If you'd like to use a bridged setup (utilizing a tap device) Debian provides
119+
some helper tools in the bridge-utils package to help you setting up your
120+
bridge via /etc/network/interfaces.
121+
122+
An easy example, creating a bridge interface 'br0' from 'eth0' and 'tap0',
123+
can look like this:
124+
125+
auto lo br0 eth1
126+
allow-hotplug eth0
127+
128+
iface br0 inet static
129+
address 192.168.1.1
130+
network 192.168.1.0
131+
netmask 255.255.255.0
132+
broadcast 192.168.1.255
133+
bridge_ports eth0 tap0
134+
pre-up openvpn --mktun --dev tap0
135+
136+
It's recommended to read the manpage - man 5 bridge-utils-interfaces - as well.
137+
138+
139+
#####################################
140+
# Compatibility notes on 2.x vs 1.x #
141+
#####################################
142+
143+
In version 2.0, --tun-mtu 1500 --mssfix 1450 is now the default. In 1.x the
144+
default is --link-mtu 1300 for tun interfaces and --tun-mtu 1500 for tap
145+
interfaces, with --mssfix disabled).
146+
147+
Also in version 2.0, when using TLS, --key-method 2 is now the default,
148+
it was 1 in versions 1.x.
149+
150+
To sum up, to make 2.0 work with 1.x put the following in the 1.x configuration
151+
files:
152+
153+
tun-mtu 1500
154+
tun-mtu-extra 32
155+
mssfix 1450
156+
key-method 2 ## (if you're using TLS)
157+
158+
159+
Or, in case you'd rather not modify the 1.x configuration, set the 2.x side
160+
configuration like this:
161+
162+
If using TLS:
163+
key-method 1
164+
If "dev tun":
165+
link-mtu 1300
166+
If "dev tap":
167+
tun-mtu 1500
168+
tun-mtu-extra 32
169+
170+
OpenVPN 1.x won't be able to act as a client against a OpenVPN 2.x
171+
acting as multiple client server. OpenVPN 1.x can only work with 2.x
172+
in point-to-point tunnels.
173+
174+
Changes in string remapping
175+
---------------------------
176+
177+
Quoting James Yonan:
178+
"Prior to 2.0-beta12, the string remapping code was a bit ad-hoc. Since then
179+
I've tried to unify all string remapping towards a consistent model which
180+
remaps illegal chars to '_'. The choice of underbar is arbitrary -- any inert
181+
character will do."
182+
183+
So, you must use '_' instead of '.' to represent spaces in certificates names
184+
from now on.
185+
186+
plugin support
187+
--------------
188+
189+
Plugins are now included in the package. They get installed in
190+
/usr/lib/<DEB_HOST_MULTIARCH>/openvpn/plugins.
191+
Info on what they are and what they do in README.auth-pam and README.down-root.
192+
Append /usr/lib/<DEB_HOST_MULTIARCH>/openvpn/plugins to the plugin name in
193+
the plugin option.
194+
i.e.
195+
plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so [service-type]
196+
197+
Using resolvconf
198+
----------------
199+
200+
Have a look at the shell script /etc/openvpn/update-resolv-conf
201+
It parses DHCP options from openvpn to update /etc/resolv.conf
202+
To use set as 'up' and 'down' script in your openvpn *.conf:
203+
204+
up /etc/openvpn/update-resolv-conf
205+
down /etc/openvpn/update-resolv-conf
206+
207+
You will need to install resolvconf package.
208+
209+
Out of Memory issues
210+
-------------------
211+
212+
You might run into issues with openvpn complaining about out of memory. The
213+
reason for this behavior is that openvpn uses mlockall to pin all of its
214+
pages into memory. To correct this issue you can put a "ulimit -l
215+
<reasonable number>" in the openvpn init script.
216+
217+
LDAP+TLS authentication runs into file exhaustion
218+
-------------------------------------------------
219+
220+
When LDAP is used with TLS support a file handle to /dev/urandom is created but
221+
never released on every authentication. This is due to a bug in libgcrypt.
222+
223+
Lars Ellenberg provided the following worked around:
224+
Append LD_PRELOAD=/lib/security/pam_ldap.so before the call to openvpn (in the
225+
init.d script). ie:
226+
227+
..... (around line 58 of the init.d script)....
228+
LD_PRELOAD=/lib/security/pam_ldap.so start-stop-daemon --start --quiet --oknodo
229+
230+
Thanks Andreas Metzler, Lars Ellenberg, Simon Josefsson & chantra for debugging
231+
this issue.
232+
233+
234+
Possible consequences of the 'chroot' option
235+
--------------------------------------------
236+
237+
When running OpenVPN on a chroot environment you have to take into account that
238+
things as /dev/log may change (i.e. when syslog is reloaded by logrotate) and
239+
that may result in OpenVPN not logging anymore.
240+
241+
Christian Schneider suggested this solution:
242+
Create an additional "dev/log" socket in the jail by "-a" option to sysklogd or
243+
"$AddUnixListenSocket" parameter in /etc/rsyslog.conf, respectively
244+
245+
Kudos to him, for finding out and proposing a solution.
246+
247+
248+
Disabling all.send_redirects on tun + topology subnet setups
249+
------------------------------------------------------------
250+
251+
If any of your VPNs uses "dev tun" and "topology subnet" but does not use
252+
"client-to-client", OpenVPN's init.d script will disable all.send_redirects
253+
(set it to 0) to avoid sending ICMP redirects trough the tun interfaces (and
254+
confusing clients).
255+
256+
257+
-- Alberto Gonzalez Iniesta <[email protected]> Fri, 24 Feb 2012 11:03:50 +0100

0 commit comments

Comments
 (0)