Software update: OpenVPN 2.5.5

OpenVPN is a robust and easy to set up open source VPN daemon that allows several private networks to be linked together through an encrypted tunnel over the internet. For security, the OpenSSL library is used, which can handle all encryption, authentication and certification. The developers have released version 2.5.5 and the main changes in it are listed below for you.

User-visible Changes

• SWEET32/64bit cipher deprecation change was postponed to 2.7
• Windows: use network address for emulated DHCP server as default this enables use of a /30 subnet, which is needed when connecting to OpenVPN Cloud.
• require EC support in windows builds (this means it’s no longer possible to build a Windows OpenVPN binary with an OpenSSL lib without EC support)

New features

• Windows build: use CFG and Specter mitigations on MSVC builds
• bring back OpenSSL config loading to Windows builds. OpenSSL config is loaded from %installdir%SSLopenssl.cfg (typically: c:program filesopenvpnSSLopenssl.cfg) if it exists.
• This is important for some hardware tokens which need special OpenSSL config for correct operation. Track #1296

Bug fixes

• Windows build: enable EKM
• Windows build: improve various vcpkg related build issues
• Windows build: fix regression related to non-writeable status files (Trac #1430)
• Windows build: fix regression that broke OpenSSL EC support
• Windows build: fix “product version” display (2…4 -> 2.5.4)
• Windows build: fix regression preventing use of PKCS12 files
• improve “make check” to notice if “openvpn –show-cipher” crashes
• improve argv unit tests
• ensure unit tests work with mbedTLS builds without BF-CBC ciphers
• include “–push-remove” in the output of “openvpn –help”
• fix error in iptables syntax in example firewall.sh script
• fix “resolvconf -p” invocation in example “up” script
• fix “common_name” environment for script calls when “–username-as-common-name” is in effect (Trac #1434)

Documentation

• move “push-peer-info” documentation from “server options” to “client” (where it belongs)
• correct “foreign_option_{n}” typo in manpage
• update IRC information in CONTRIBUTING.rst (libera.chat)
• README.down-root: fix plugin module name