OpenVPN
Find a file
Arne Schwabe e0e0720ac3 Correctly handle sender jumping exactly epoch_data_keys_future_count
When the sender jumps forwards exactly epoch_data_keys_future_count in its
epoch key use the housekeeping logic does not handle this correctly and
triggers an ASSERT.

Change the code to correctly implement the special case when the new epoch
key of the sender is the highest valid key epoch in the current window of
valid epoch keys for receiving data.

Change-Id: Ib581c02a29b974184256a9f4ad0ce15ba5f9db3b
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-By: Max Fillinger <maximilian.fillinger@sentyron.com>
Reported-By: Pavel Kohout of Aisle Research <pavel.kohout@aisle.com>
Github: closes OpenVPN/openvpn-private-issues#103
CVE: 2025-15497
2026-01-15 11:10:56 +01:00
.github GHA: Maintenance update January 2026 2026-01-07 22:10:56 +01:00
contrib Update Copyright statements to 2026 2026-01-08 10:59:57 +01:00
debug build: standard directory layout 2012-03-22 22:07:08 +01:00
dev-tools Update Copyright statements to 2026 2026-01-08 10:59:57 +01:00
distro Update Copyright statements to 2026 2026-01-08 10:59:57 +01:00
doc Update Copyright statements to 2026 2026-01-08 10:59:57 +01:00
include Update Copyright statements to 2026 2026-01-08 10:59:57 +01:00
m4 doc: HTTPS upgrades and URL fixes throughout the tree 2025-10-13 17:39:46 +02:00
sample Update Copyright statements to 2026 2026-01-08 10:59:57 +01:00
src Correctly handle sender jumping exactly epoch_data_keys_future_count 2026-01-15 11:10:56 +01:00
tests Correctly handle sender jumping exactly epoch_data_keys_future_count 2026-01-15 11:10:56 +01:00
.clang-format clang-format: Switch to ColumnLimit 0 2025-08-05 15:32:53 +02:00
.git-blame-ignore-revs Add clang-format reformat commit to .git-blame-ignore-revs 2025-08-05 17:07:05 +02:00
.gitattributes cleanup: add .gitattributes to control eol style explicitly 2012-04-26 20:54:26 +02:00
.gitignore dns: apply settings via script on unixoid systems 2025-05-14 18:17:51 +02:00
.mailmap Update .mailmap to unify and clean up odd names and e-mail addresses 2016-10-18 13:46:04 +02:00
.pre-commit-config.yaml Define a .clang-format file for the project 2025-08-04 10:22:34 +02:00
.svncommitters Added mapping files from SVN commit ID to more descriptive commit IDs. 2010-10-21 11:31:26 +02:00
AUTHORS This is the start of the BETA21 branch. 2005-09-26 05:28:27 +00:00
ChangeLog Update Copyright statements to 2026 2026-01-08 10:59:57 +01:00
Changes.rst remove ENABLE_X509ALTUSERNAME conditional 2026-01-14 12:13:47 +01:00
CMakeLists.txt remove ENABLE_X509ALTUSERNAME conditional 2026-01-14 12:13:47 +01:00
CMakePresets.json Add building/testing with msbuild and the clang compiler 2024-12-27 12:30:55 +01:00
compat.m4 Update GPL header in all source files to current recommended version 2025-08-03 16:55:47 +02:00
config.h.cmake.in remove ENABLE_X509ALTUSERNAME conditional 2026-01-14 12:13:47 +01:00
configure.ac remove ENABLE_X509ALTUSERNAME conditional 2026-01-14 12:13:47 +01:00
CONTRIBUTING.rst CONTRIBUTING: Update outdated/obsolete information 2025-10-13 18:10:25 +02:00
COPYING Update Copyright statements to 2026 2026-01-08 10:59:57 +01:00
COPYRIGHT.GPL Update text of GPL to latest version from FSF 2025-08-03 16:43:58 +02:00
forked-test-driver forked-test-driver: Show test output always 2024-04-02 17:20:48 +02:00
INSTALL doc: HTTPS upgrades and URL fixes throughout the tree 2025-10-13 17:39:46 +02:00
ltrc.inc cmake: symlink whole build dir not just .json file 2024-01-17 15:01:54 +01:00
Makefile.am Update Copyright statements to 2026 2026-01-08 10:59:57 +01:00
NEWS This is the start of the BETA21 branch. 2005-09-26 05:28:27 +00:00
PORTS Update Copyright statements to 2026 2026-01-08 10:59:57 +01:00
README doc: HTTPS upgrades and URL fixes throughout the tree 2025-10-13 17:39:46 +02:00
README.awslc Add compatibility to build OpenVPN with AWS-LC. 2025-01-29 17:11:19 +01:00
README.cmake.md README.cmake.md: Document minimum required CMake version for --preset 2024-02-01 20:26:45 +01:00
README.dco.md README.dco: update Linux instructions 2025-07-16 16:16:35 +02:00
README.ec Implement tls-groups option to specify eliptic curves/groups 2020-07-21 22:33:58 +02:00
README.mbedtls Drop Mbed TLS 2.X compatibility 2025-12-01 15:00:37 +01:00
README.wolfssl Add a section about wolfSSL GPLv3 and point out missing TLS PRF support 2025-12-04 14:59:08 +01:00
renovate.json GHA: Dependency and Actions update May 2025 2025-05-18 17:41:42 +02:00
version.m4 OpenVPN Release 2.7_rc4 2025-12-17 15:48:47 +01:00

OpenVPN -- A Secure tunneling daemon

Copyright (C) 2002-2022 OpenVPN Inc. This program is free software;
you can redistribute it and/or modify
it under the terms of the GNU General Public License version 2
as published by the Free Software Foundation.

*************************************************************************

To get the latest release of OpenVPN, go to:

	https://openvpn.net/community-downloads/

To Build and Install,

	tar -zxf openvpn-<version>.tar.gz
	cd openvpn-<version>
	./configure
	make
	make install

or see the file INSTALL for more info.

For information on how to build OpenVPN on/for Windows with MinGW
or MSVC see README.cmake.md.

*************************************************************************

For detailed information on OpenVPN, including examples, see the man page
  http://openvpn.net/man.html

For a sample VPN configuration, see
  http://openvpn.net/howto.html

To report an issue, see
  https://github.com/OpenVPN/openvpn/issues/new

For a description of OpenVPN's underlying protocol,
  see the file ssl.h included in the source distribution.

*************************************************************************

Other Files & Directories:

* configure.ac -- script to rebuild our configure
  script and makefile.

* sample/sample-scripts/verify-cn

  A sample perl script which can be used with OpenVPN's
  --tls-verify option to provide a customized authentication
  test on embedded X509 certificate fields.

* sample/sample-keys/

  Sample RSA keys and certificates.  DON'T USE THESE FILES
  FOR ANYTHING OTHER THAN TESTING BECAUSE THEY ARE TOTALLY INSECURE.

* sample/sample-config-files/

  A collection of OpenVPN config files and scripts from
  the HOWTO at http://openvpn.net/howto.html

*************************************************************************

Note that easy-rsa and tap-windows are now maintained in their own subprojects.
Their source code is available here:

  https://github.com/OpenVPN/easy-rsa
  https://github.com/OpenVPN/tap-windows6

Community-provided Windows installers (MSI) and Debian packages are built from

  https://github.com/OpenVPN/openvpn-build

See the INSTALL file for usage information.