[PATCH] openvpn: Update to version 2.7.9

[PATCH] openvpn: Update to version 2.7.9

[Adolf Belka]

- Update from version 2.7.8 to 2.7.9
- Update of rootfile
- There are 3 CVE Fixes but these are for win32 as are all the security fixes. The
   majority of bug fixes are also for win32 but there are 4 bug fixes that are general
   ones. There are also several general hardening improvements.
- Changelog
2.7.9
    Security fixes
	- win32: restrict loading plugin dependencies (DLLs) to plugin, app
	  and system directories.
	- win32: run openvpn.exe from the interactive service at "high integrity
	  level", that is, process memory of openvpn.exe and all its threads are
	  protected from tampering.  Signals/Events are still permitted.
	- win32: openvpnserv: strictly filter user-defined environment variables
	  before passing to openvpn.exe (CVE-2026-121720)
	  (Issue found by Heiko Hund, <heiko@ist.eigentlich.net>, tracked in
	   Github: OpenVPN/openvpn-private-issues#186)
	- win32: openvpnserv: make validation of openvpn command line more robust
	  to invalid-quoting attacks (CVE-2026-115342)
	- win32: openvpn.exe: change parsing of commandline to use the same
	  function that the interactive service uses (CommandLineToArgvW())
	  (CVE-2026-115342)
	  (Issue found by Heiko Hund, <heiko@ist.eigentlich.net>, tracked in
	   Github: OpenVPN/openvpn-private-issues#184)
    Bug fixes
	- Username/Password parsing from --auth-user-pass file (or inline)
	  left parts of overlong usernames in the password field.  Fix.
	  (GH OpenVPN/openvpn#1140)
	- win32: openvpnserv: fix memory leak for security descriptors
	- win32: repair logging of errors in Windows tun_read_queue()
	- win32: avoid accessing uninitialized structure data if GetInterfaceInfo()
	  or GetPerAdapterInfo() fail
	- win32: openvpnserv: avoid double free() if GetTokenInformation() fails
	- win32: openvpnserv: avoid potential format-string issue on registry defaults
	- win32: openvpnserv: repair error reporting on RegGetValueA() failures
	  inside GetItfDnsServersV4()
	- win32: openvpnserv: fix inet_ntop() return code check in
	  GetItfDnsServersV6(), making it ignore DHCP-provided DNS servers.
	- route: repair printing of ROUTE_GATEWAY/ROUTE6_GATEWAY info broken
	  by commit 2777cdd3 - the actual gateway handling was correct, just not
	  printing anything anymore.
	- config: check_file_access: fix --extra-certs access check
	- win32: tun: free gc arena in windows_set_mtu() (mem leak in error path)
	- route: close socket in Haiku get_default_gateway() (FD leak)
	- win32: openvpnserv: skip conversion of empty domain names
	- win32: cmake+mingw: don't prefix the event message DLL with lib
	  (it was building 'libopenvpnservmsg.dll' instead of 'openvpnservmsg.dll')
	- win32: pass the buffer size in bytes to get_openvpn_reg_value()
	- PUSH_UPDATE server: free temporary options after sending message (memleak)
    User-visible Changes
	- Linux: set IFF_BACKPRESSURE on Linux (if available)
	  This helps the kernel tun/tap to apply proper prioritization (qdisc etc)
	  to incoming packets if userspace is slow to process them.  Without the
	  flag, the kernel would just drop everything.
	- Management/GUI: Optionally indicate username in >PASSWORD '<UP_TYPE>' prompts
	  If an openvpn config has a username set but no password, and OpenVPN
	  wants to prompt for the password, the GUI could not see the username
	  today and prompted for both.  With this change, OpenVPN sends a hint to
	  the management interface, so a GUI can pre-fill the username field, or
	  only prompt for the password.
	  This is only done if the management interface client announces
	  support for it (compatibility level >= 6).
    Building/Testing improvements
	- test_provider: Fix compiler warning with clang 23
	- configure: Call AC_PROG_CC before AC_USE_SYSTEM_EXTENSIONS
	- configure: Output compiler version
	- automake: Add build-tests recursive target
	- configure: Require automake 1.16
	- clang-format: Enable InsertNewlineAtEOF
	- t_client.sh.in: Check whether addresses are in "tentative" state
	- config.h.cmake.in: Fix issues with string functions
	- Add missing includes for C files and their own headers
    Code improvements/general hardening
	- crypto_epoch: wipe key material with secure_memzero()
	- do not look up "none" cipher in OpenSSL - this avoids leaving an "error"
	  on the OpenSSL error stack, which can then later lead to spurious
	  SSL error prints on CRL loading.
	- Make CRL reload EOF detection independent of stale error queue entries
	  (GH: OpenVPN/openvpn#1104)
	- tls_crypt: fix handling of "cipher final output" (which is always empty
	  on today's SSL libraries, so no impact today, but might not be in future)
	- crypto: ASSERT() opt before first use in openvpn_decrypt_aead()
	- auth_token: wipe the server secret key after loading it
	- port-share: do not write journal file through symlinks or hardlinks
	  (and also document how port-share directory should be set up)
	  (GH OpenVPN/openvpn#1124)
	- dns-updown: close first pipe if creating the second one fails
	  (avoid leaking file descriptors on error)
	- init: check parameters for NULL before strlen() in send_cc_message
	  (not triggerable today)
	- crypto_openssl: Clear PEM decoded key data before freeing it
	- Increase the buffer size for alert-message in management user-pass query
	  (so long usernames can be hinted towards the GUI)
	- win32: openvpnserv: validate message size for dns/nrpt/wins handlers
	  (GH: OpenVPN/openvpn#1129)
	- win32: plugin: detect too long plugin paths on Windows
	- win32: openvpnserv: null-terminate iface.name in address and route handlers
	  (GH: OpenVPN/openvpn#1130)
    Documentation improvements
	- Fix numbering of examples in management-notes.txt
	- Document "notify" as auth pending method
	- Convert Changes.rst to Markdown (2.7)
    Long-term code maintenance
	- OpenSSL 4.1 compatibility: use ASN1_STRING_get_length() now, providing
	  a fallback to ASN1_STRING_length() for older SSL libraries.
	- Linux: sitnl: use RTM_SETLINK for updating existing interfaces
	  (instead of RTM_NEWLINK)
	- gen-sample-keys.sh: Don't apply server extensions to CSRs
	- review all usages of strncpy()
	  (change to strncpynt(), memcpy(), etc. where appropriate)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/openvpn | 2 +-
 lfs/openvpn                     | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/rootfiles/common/openvpn b/config/rootfiles/common/openvpn
index 46c242d10..1b8a3517f 100644
--- a/config/rootfiles/common/openvpn
+++ b/config/rootfiles/common/openvpn
@@ -15,7 +15,7 @@ usr/sbin/openvpn-authenticator
 #usr/share/doc/openvpn
 #usr/share/doc/openvpn/COPYING
 #usr/share/doc/openvpn/COPYRIGHT.GPL
-#usr/share/doc/openvpn/Changes.rst
+#usr/share/doc/openvpn/Changes.md
 #usr/share/doc/openvpn/README
 #usr/share/doc/openvpn/README.auth-pam
 #usr/share/doc/openvpn/README.down-root
diff --git a/lfs/openvpn b/lfs/openvpn
index b705fdd6c..a511fc281 100644
--- a/lfs/openvpn
+++ b/lfs/openvpn
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 2.7.8
+VER        = 2.7.9
 
 THISAPP    = openvpn-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = dfe77dc1c066cc03540b7249963db2030fabe62c52d3e460aab571f11c2ae304204793ca348964308f8713b282244cbe043a7c4546649d4f2fb923ae38e26591
+$(DL_FILE)_BLAKE2 = 543946533cac5805698f9397d066fe99c8d35e3aadc530c8239b2a586cff7ccbc0b0f60cb061c95a8934e2cfd12b3ebfef887ed76f51906ce4378882a0f418c2
 
 install : $(TARGET)
 
-- 
2.56.0