OpenVPN 3 Linux v27.1 (Stable release)
The v27.1 release is purely a bug fix release
* FEATURE DEPRECATION: openvpn3-autoload
** THIS IS THE LAST RELEASE SHIPPING THIS UTILITY - MIGRATE NOW **
The openvpn3-autoload feature was deprecated already in the
v20 release. This feature will be removed in the next major
release.
The replacement is the openvpn3-session@.service systemd unit.
Please see the openvpn3-systemd man page [1] for more details.
If you depend on openvpn3-autoload today, please migrate ASAP
to the systemd approach.
[1] <https://codeberg.org/OpenVPN/openvpn3-linux/src/branch/master/docs/man/openvpn3-systemd.8.rst>
* Regression: File descriptor leaks with reconnects
The v27 release attempted to fix a file descriptor leak which
happens when the VPN session is triggered to do a full reconnect
to the server. It turned out that this change caused a lot more
issues and resulted in a large regression when the server-side
sent a PUSH_UPDATE event to update routing tables.
This file descriptor leak fix has been reverted in the v27.1
release, as the investigation revealed that this requires a more
careful change inside the OpenVPN 3 Core Library in addition.
The file descriptor leak can be an issue for users on unstable
Internet connections, where the client is triggered to do a full
in-session restart.
The only workaround is to stop the session completely before
starting it again. Using the openvpn3-session@.service unit file,
this is done with a single
# systemctl restart openvpn3-session@CONFIG_NAME.service
command. This is planned to be fixed in the next major release,
where it will upgrade to OpenVPN 3 Core Library v3.12.
* Bugfix: VPN sessions using DCO interfaces misbehave with PUSH_UPDATE
When the server pushed a PUSH_UPDATE event to the client with updates
to the network configuration, this would cause the DCO-based VPN tunnel
to freeze and become dysfunctional. This has been resolved and the
DCO interface is fully capable of reconfiguring the network when
requested by the server.
* Bugfix: Retrieve tunnel statistics for DCO interfaces
It has been a long outstanding bug where the session traffic details
were not updated when DCO interfaces were used. This is now fixed and
the openvpn3 session-stats command will now report up-to-date
statistics.
* Build: Fixed issues building with GCC-16.1
Several new compiler warnings appeared, especially in environments
enabling hardened builds, when the GCC compiler was upgraded to
version 16.1. This should be resolved.
Fixing these issues was a requirement to make Fedora 44 builds
available.
* OpenVPN 3 Core Library update
The OpenVPN 3 Core Library has been updated to version 3.11.7. This
resolves several bugs related to the ovpn-dco-v2 kernel module
integration, fixes issues with large wire packets when the
--tls-crypt-v2 feature is used and provides additional fixes for
GCC-16.1 related compiler warnings.
Known issues:
- The openvpn3-service-netcfg service does not differentiate between
--dns server X resolve-domains and --dns search-domains when using
the --resolv-conf mode, which is not the intended behaviour. This
was discovered in the v24 release and is scheduled to be
fixed in the next releases. When this gets fixed, only
--dns search-domains will be considered as search domains and
--dns server X resolve-domains will enable split-DNS when using
--systemd-resolved and otherwise ignored when using
--resolv-conf with openvpn3-service-netcfg.
---- Changes from v27 to v27.1 -------------------------------------
Antonio Quartulli (2):
dco: retrieve peer stats from kernel module
netcfg: Make tun_builder_new() DCO-aware for PUSH_UPDATE reconfiguration
David Sommerseth (11):
common: Fix dhcp-option and dns handling of multiple occurrences
Revert "client: Plug a file descriptor leak with virtual tun interfaces"
ovpn3cli/init-config: Show the compiled-in username for the openvpn user
build/selinux: Refactor the building setup for SELinux policies
common: Fix missing static declarations in ExclusiveOptionError and ConfigFileException
policy: Add needed D-Bus policy to access net.openvpn.v3.netcfg.GetPeer
docs: Remove the "tech-preview" label from DCO functionality
scripts: Fix get-version extracting wrong git commit for openvpn3-core
vendor: Upgrade to ASIO 1.38.0
build: Fix the systemd requirement dependecy again
core: Update to OpenVPN 3 Core Library v3.11.7
--------------------------------------------------------------------