| Age | Commit message (Collapse) | Author |
|---|
|
2.7.7 carries CVE-2026-84732: two fixes in the reliability layer, an
unbounded reliable TLS timeout and acks being honoured for packets that
cannot be outstanding. Debian skipped 2.7.6, so debian/2.7.7-1 is the
next packaging tag after the debian/2.7.5-1 this was pinned to.
The carried gerrit 1734 patch stays: 2.7.7 still has no
net_iface_ovpn_mode(), so pre-created DCO interfaces are not yet handled
upstream. It applies to the new tree with line offsets only, and no
Debian patch touches the files it edits.
|
|
VyOS creates the "ovpn" device whenever the daemon cannot - a client whose
server is not reachable yet never opens its tun - so OpenVPN has to adopt a
device it did not make. It takes the device but not its ifindex today, so
dco_new_peer() fails, the daemon exits and deletes the interface on its way
out. systemd starts it again and the second attempt creates a device of its
own, which hides the whole thing behind a tunnel that does come up.
Carry Ralf's fix until it is released: it resolves the ifindex on the
-EEXIST path, refuses a device whose operating mode does not match, and
leaves a pre-existing interface alone on close.
https://gerrit.openvpn.net/c/openvpn/+/1734 (patchset 2)
|
|
The in-tree "ovpn" module requires OpenVPN 2.7 or later, while bookworm
ships 2.6.14 which speaks only ovpn-dco-v2. DCO stays inert until
userspace is upgraded.
systemd-dev does not exist in bookworm, so it is stripped before
mk-build-deps reads debian/control. The package is also added to the
rebuild trigger, without which it would never reach the mirror.
|
