Re: openvpn 2.6 -> 2.7

Am 02.05.26 um 11:56 schrieb Miroslav Lachman:
> On 02/05/2026 10:52, Andrea Venturoli wrote:
>> Hello.
>>
>> Foreword: I'm not complaining at all! This is just a asking for some 
>> comments.
>>
>> I'm been using OpenVPN 2.6 heavily for a long time.
>> I see in main it was upgraded to 2.7, while in 2026Q2 there's still 
>> 2.6.19, which is vulnerable (2.6.20 is out).
>>
>> Unfortunately 2.7 breaks many of my configs and while I can easily 
>> upgrade some of them, for many others it will be hard and long to 
>> have the other side fixed.
>>
>> Reading that 2.6 will be supported until half 2028, I'm evaluating 
>> staying with 2.6 a bit longer (while trying to avoid running 
>> vulnerable versions).
>>
>> I'm wondering whether an openvpn26 (or openvpn-legacy or whatever) 
>> port would make sense.
>> I can probably easily downgrade 2.7 -> 2.6 and keep it updated in my 
>> local port tree, but maybe there are other people interested?
>>
>> Any other comment?
>
> I didn't checked 2.7 changes for incompatibilities yet (still running 
> 2.6), but I think creating security/openvpn26 is a good idea. Not sure 
> about the plugins connected to security/openvpn (whether they should 
> have a flavors)
>
> Just my €0.02
>

Hi Andrea and Miroslav,

thanks Andrea for pointing out the pending update to 2.6.20, the 
necessary update I made has been pushed to 2026Q2 by arrowd@ earlier today.

Re the MFH, we still need to have the VuXML pushed to main to mark 
OpenVPN 2.6.20 as "fixed" for the two vulnerabilities mentioned in VuXML ->
update is in <https://github.com/freebsd/freebsd-ports/pull/507>.


Re openvpn26, since support ends in August 2028 and I don't know when 
exactly, I think we can do it if it's still supported upstream, but 
let's try not to create too much hassle and put flavors out but first 
see what's the use case. Also added to the PR#507 (for main, as the 
VuXML update).

Regards,
Matthias