net/openvpn-acct-wtmpx 20130210nb8 NetBSD

Overview of changes in 2.7.8 Security fixes - Check for NULL-Bytes in certificate subjects - refuse all such certificates now as "invalid" (CVE-2026-84790). - TLS handshake with tls-crypt-v2: do not try to add a wrapped client key if no key material is available (client bug in response to an ill-behaving server). (No CVE assigned as "a malicious server can stop the client from working properly" is not considered a CVE-worthy security issue according to the CRA guidelines) - options: fix unsigned underflow when clearing domain_search_list (CVE-2026-88964) - win32: stop cmd.exe from expanding variables in quoted arguments (CVE-2026-84256) Bug fixes - DCO: remove installed iroutes at client exit time, not at delayed …

Overview of changes in 2.7.7 Security fixes - reliability layer: Avoid unbounded reliable TLS timeout (CVE-2026-84732) - reliability layer: Ignore acks for packets that cannot be outstanding (CVE-2026-84732) - Windows: fix ``CreateProcess()`` command line quoting for characters that are special to ``cmd.exe`` and where a combination of validation script plus rogue CA could lead to misbehavior (CVE-2026-84256) - Windows: fix ``tapctl`` to always call ``netsh.exe`` with full path (as we do elsewhere) (CVE-2026-84226) - Windows: don't use NULL DACL with system objects, namely the ``--service`` exit event and the ``netsh.exe`` guard semaphore. The old approach was prone to a local DoS where one user could interfere …

2.7.6 Enable TCP_NODELAY by default and push it to clients options: make 'tun' the default for '--dev' Correctly calculate packet id size when epoch packet format is in use test_tls_crypt: Fix issue with temp file name on big endian systems ssl_pkt: Fix doxygen warning about read_control_auth t_client.sh.in: Do not run resolvectl if systemd is not running test_tls_crypt: Fix test failure on Windows ssl: Ignore hard reset packets with a non-zero packet id mingw: avoid C99 "hh" scanf length modifier interactive: forbid "--setenv opt" in startup data CMake: detect cmocka_version.h via include path, not by linking options: limit ping and keepalive values to one day Make --x509-username-field work with Mbed TLS Remove --providers from --help output for Mbed TLS

This is a workaround and should be fixed properly per-package - they should use the pkgsrc LDFLAGS, but this restores what happened before the mk/ cleanup. Fixes relro build for packages that do not honor LDFLAGS. Package list provided by mef@, thanks! Workaround commit requested by bsiegert on tech-pkg.

2.7.5 mudp: send HMAC reset reply synchronously options: fix use-after-free of DNS options on client connect Ensure pushed tun-mtu is no lower than TUN_MTU_MIN Make get_random return int64 instead of long Clean up metadata handling in tls_crypt_v2_extract_client_key Ensure we only get the session from valid tokens for external-auth Ensure tls-crypt keys are not setup twice dco_freebsd: Add check_malloc_return after realloc Fix some msg() calls with wrong number of arguments in Windows-only code openvpnserv: Address some uninitVariable warnings from cppcheck openvpnserv: Fix memory leak when loading DLLs renovate: Fix typo in regex manager GHA: Maintenance update June 2026 GHA: Switch to using VS 2026 Fix 1-byte buffer overrun on NTLMv2 proxy responses. …