Merge ~lvoytek/ubuntu/+source/openvpn:2.5.8-MRE-jammy-allow-openssl-engines into ubuntu/+source/openvpn:ubuntu/jammy-devel

[Lena Voytek]

Allow openssl engines in jammy to maintain behavior against 2.5.5-1ubuntu3.1 prior to the 2.5.8 MRE. This commit configures them to be on using the new configuration argument provided by upstream: --with-openssl-engine=yes. This is needed based on the discussion in https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/2004676.

PPA: https://launchpad.net/~lvoytek/+archive/ubuntu/openvpn-2.5.8-allow-openssl-engine

[Andreas Hasenack (ahasenack)]

+1, I tried the package from the ppa, and can confirm loading the engine keeps being available and loaded after updating fom jammy's 2.5.5.

review: Approve

[Andreas Hasenack (ahasenack)]

Do we want to do this on top of 2.5.9 which is in unapproved? Or, as you did here, on top of 2.5.8 which is in jammy proposed?

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: lvoytek, ahasenack
Uploaders: lvoytek, ahasenack
MP auto-approved

review: Approve

[Lena Voytek (lvoytek)]

I'm fine with either. Do you know which would be more convenient for the SRU team?

[Andreas Hasenack (ahasenack)]

Let's go with 2.5.9, as that's what the bug is using. When uploading, I'll take care to include the version currently in proposed in the changes file.

[Lena Voytek (lvoytek)]

Sounds good, I rebased and uploaded with rich history. Accidentally uploaded without the previous changes the first time, so I uploaded a second copy:

dput ubuntu ../openvpn_2.5.9-0ubuntu0.22.04.2_source.changes
D: Setting host argument.
Checking signature on .changes
gpg: ../openvpn_2.5.9-0ubuntu0.22.04.2_source.changes: Valid signature from 34B8AD7D9529E793
Checking signature on .dsc
gpg: ../openvpn_2.5.9-0ubuntu0.22.04.2.dsc: Valid signature from 34B8AD7D9529E793
Package includes an .orig.tar.gz file although the debian revision suggests
that it might not be required. Multiple uploads of the .orig.tar.gz may be
rejected by the upload queue management software.
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading openvpn_2.5.9-0ubuntu0.22.04.2.dsc: done.
  Uploading openvpn_2.5.9.orig.tar.gz: done.
  Uploading openvpn_2.5.9-0ubuntu0.22.04.2.debian.tar.xz: done.
  Uploading openvpn_2.5.9-0ubuntu0.22.04.2_source.buildinfo: done.
  Uploading openvpn_2.5.9-0ubuntu0.22.04.2_source.changes: done.
Successfully uploaded packages.

diff --git a/ChangeLog b/ChangeLog
index 5da537a..3701823 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,6 +1,31 @@
 OpenVPN Change Log
 Copyright (C) 2002-2022 OpenVPN Inc <[e-mail]>
 
+2023.02.14 -- Version 2.5.9
+
+Arne Schwabe (6):
+      Implement optional cipher in --data-ciphers prefixed with ?
+      Fix handling an optional invalid cipher at the end of data-ciphers
+      Ensure that argument to parse_line has always space for final sentinel
+      Improve documentation on user/password requirement and unicodize function
+      Remove unused gc_arena
+      Fix corner case that might lead to leaked file descriptor
+
+Frank Lichtenheld (1):
+      msvc: always call git-version.py
+
+Lev Stipakov (1):
+      git-version.py: proper support for tags
+
+Max Fillinger (1):
+      Check if pkcs11_cert is NULL before freeing it
+
+Selva Nair (3):
+      Do not add leading space to pushed options
+      pull-filter: ignore leading "spaces" in option names
+      Do not include auth-token in pulled option digest
+
+
 2022.10.27 -- Version 2.5.8
 
 Antonio Quartulli (1):
diff --git a/Changes.rst b/Changes.rst
index cafb1f2..3ba78c6 100644
--- a/Changes.rst
+++ b/Changes.rst
@@ -1,3 +1,35 @@
+Overview of changes in 2.5.9
+============================
+
+New features
+------------
+- Optional ciphers in ``--data-ciphers``
+  Ciphers in ``--data-ciphers`` can now be prefixed with a ``?`` to mark
+  those as optional and only use them if the SSL library supports them.
+
+User-visible Changes
+--------------------
+- when compiling from a git checkout, put proper branch names into
+  windows builds
+
+Bugfixes
+--------
+- do not include auth-token in pulled-option digest (interferes with
+  persist-tun when auth-token is in use, GH #200).
+
+- fix corner case that might lead to leaked file descriptor
+
+- fix parser bug (parse_line()) that can lead to buffer overflows on
+  malformed command line or server ccd file handling.  Not exploitable.
+
+- pull-filter: ignore leading spaces in option names (work around server side
+  bug with erroneous extra spaces)
+
+- push: do not add leading spaces to "out of renegotiations" pushed auth-token
+
+- fix NULL pointer crash on "openvpn --show-tls" with mbedtls
+
+
 Overview of changes in 2.5.8
 ============================
 
diff --git a/build/msvc/msvc-generate/Makefile.mak b/build/msvc/msvc-generate/Makefile.mak
index ae8b084..1c1c4ba 100644
--- a/build/msvc/msvc-generate/Makefile.mak
+++ b/build/msvc/msvc-generate/Makefile.mak
@@ -51,10 +51,13 @@ $(OUTPUT_PLUGIN): $(INPUT_PLUGIN) $(OUTPUT_PLUGIN_CONFIG)
 	cscript //nologo msvc-generate.js --config="$(OUTPUT_PLUGIN_CONFIG)" --input="$(INPUT_PLUGIN)" --output="$(OUTPUT_PLUGIN)"
 
 $(OUTPUT_MAN): $(INPUT_MAN)
-    -FOR /F %i IN ('where rst2html.py') DO python %i "$(INPUT_MAN)" "$(OUTPUT_MAN)"
+	-FOR /F %i IN ('where rst2html.py') DO python %i "$(INPUT_MAN)" "$(OUTPUT_MAN)"
 
-$(OUTPUT_MSVC_GIT_CONFIG):
-    python git-version.py $(SOLUTIONDIR)
+# Force regeneration because we can't detect whether it is outdated
+$(OUTPUT_MSVC_GIT_CONFIG): FORCE
+	python git-version.py $(SOLUTIONDIR)
+
+FORCE:
 
 clean:
 	-del "$(OUTPUT_MSVC_VER)"
diff --git a/configure b/configure
index 6b01f1c..b8acf1a 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for OpenVPN 2.5.8.
+# Generated by GNU Autoconf 2.71 for OpenVPN 2.5.9.
 #
 # Report bugs to <[e-mail]>.
 #
@@ -621,8 +621,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='OpenVPN'
 PACKAGE_TARNAME='openvpn'
-PACKAGE_VERSION='2.5.8'
-PACKAGE_STRING='OpenVPN 2.5.8'
+PACKAGE_VERSION='2.5.9'
+PACKAGE_STRING='OpenVPN 2.5.9'
 PACKAGE_BUGREPORT='[e-mail]'
 PACKAGE_URL=''
 
@@ -1507,7 +1507,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures OpenVPN 2.5.8 to adapt to many kinds of systems.
+\`configure' configures OpenVPN 2.5.9 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1578,7 +1578,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of OpenVPN 2.5.8:";;
+     short | recursive ) echo "Configuration of OpenVPN 2.5.9:";;
    esac
   cat <<\_ACEOF
 
@@ -1794,7 +1794,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-OpenVPN configure 2.5.8
+OpenVPN configure 2.5.9
 generated by GNU Autoconf 2.71
 
 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2588,7 +2588,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by OpenVPN $as_me 2.5.8, which was
+It was created by OpenVPN $as_me 2.5.9, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -3364,13 +3364,13 @@ if test -z "${htmldir}"; then
 fi
 
 
-printf "%s\n" "#define OPENVPN_VERSION_RESOURCE 2,5,8,0" >>confdefs.h
+printf "%s\n" "#define OPENVPN_VERSION_RESOURCE 2,5,9,0" >>confdefs.h
 
 OPENVPN_VERSION_MAJOR=2
 
 OPENVPN_VERSION_MINOR=5
 
-OPENVPN_VERSION_PATCH=.8
+OPENVPN_VERSION_PATCH=.9
 
 
 printf "%s\n" "#define OPENVPN_VERSION_MAJOR 2" >>confdefs.h
@@ -3379,7 +3379,7 @@ printf "%s\n" "#define OPENVPN_VERSION_MAJOR 2" >>confdefs.h
 printf "%s\n" "#define OPENVPN_VERSION_MINOR 5" >>confdefs.h
 
 
-printf "%s\n" "#define OPENVPN_VERSION_PATCH \".8\"" >>confdefs.h
+printf "%s\n" "#define OPENVPN_VERSION_PATCH \".9\"" >>confdefs.h
 
 
 
@@ -3905,7 +3905,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='openvpn'
- VERSION='2.5.8'
+ VERSION='2.5.9'
 
 
 printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
@@ -20500,7 +20500,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by OpenVPN $as_me 2.5.8, which was
+This file was extended by OpenVPN $as_me 2.5.9, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -20568,7 +20568,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-OpenVPN config.status 2.5.8
+OpenVPN config.status 2.5.9
 configured by $0, generated by GNU Autoconf 2.71,
   with options \\"\$ac_cs_config\\"
 
diff --git a/debian/changelog b/debian/changelog
index 241b094..0558d64 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,29 @@
+openvpn (2.5.9-0ubuntu0.22.04.2) jammy; urgency=medium
+
+  * d/rules: Use --with-openssl-engine=yes during configuration to maintain the
+    existing behavior of technically allowing openssl engine access in jammy.
+    For more information see
+    https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/2004676/comments/6
+
+ -- Lena Voytek <[e-mail]>  Fri, 29 Sep 2023 16:14:48 -0700
+
+openvpn (2.5.9-0ubuntu0.22.04.1) jammy; urgency=medium
+
+  * New upstream release 2.5.9 (LP: #2004676):
+    - The version is being updated to the latest in 2.5.x rather than 2.6.x to
+      avoid feature releases and focus on bug fixes
+    - Updates:
+      + Allow optional ciphers in --data-ciphers
+    - Bug Fixes Include:
+      + Fix null pointer error when running openvpn --show-tls with mbedtls
+      + Fix corner case that could lead to leaked file descriptor
+      + Fix parsing issue in pull-filter when there are leading spaces
+      + Fix possible buffer overflow in parse_line argument
+      + See https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn25 for
+        additional bug fixes and information
+
+ -- Lena Voytek <[e-mail]>  Tue, 15 Aug 2023 10:48:49 -0700
+
 openvpn (2.5.8-0ubuntu0.22.04.1) jammy; urgency=medium
 
   * New upstream releases 2.5.6-2.5.8 (LP: #2004676):
diff --git a/debian/rules b/debian/rules
index a49ff29..62b5639 100755
--- a/debian/rules
+++ b/debian/rules
@@ -17,7 +17,7 @@ export DEB_BUILD_MAINT_OPTIONS = hardening=+all
 
 override_dh_auto_configure:
 	-test -f tests/t_client.sh.not || mv tests/t_client.sh tests/t_client.sh.not
-	$(ENV_VARS) dh_auto_configure -- $(shell dpkg-buildflags --export=configure) --host=$(DEB_HOST_GNU_TYPE) --build=$(DEB_BUILD_GNU_TYPE) --prefix=/usr --mandir=\$${prefix}/share/man --includedir=\$${prefix}/include/openvpn --enable-pkcs11 --enable-x509-alt-username $(EXTRA_ARGS)
+	$(ENV_VARS) dh_auto_configure -- $(shell dpkg-buildflags --export=configure) --host=$(DEB_HOST_GNU_TYPE) --build=$(DEB_BUILD_GNU_TYPE) --prefix=/usr --mandir=\$${prefix}/share/man --includedir=\$${prefix}/include/openvpn --enable-pkcs11 --enable-x509-alt-username --with-openssl-engine=yes $(EXTRA_ARGS)
 
 
 override_dh_auto_build:
diff --git a/doc/man-sections/protocol-options.rst b/doc/man-sections/protocol-options.rst
index e9d5d63..25f8db1 100644
--- a/doc/man-sections/protocol-options.rst
+++ b/doc/man-sections/protocol-options.rst
@@ -184,6 +184,13 @@ configured in a compatible way between both the local and remote side.
   supported by the client will be pushed to clients that support cipher
   negotiation.
 
+  Starting with OpenVPN 2.5.9 a cipher can be prefixed with a :code:`?` to mark
+  it as optional. This allows including ciphers in the list that may not be
+  available on all platforms.
+  E.g. :code:`AES-256-GCM:AES-128-GCM:?CHACHA20-POLY1305` would only enable
+  Chacha20-Poly1305 if the underlying SSL library (and its configuration)
+  supports it.
+
   Cipher negotiation is enabled in client-server mode only. I.e. if
   ``--mode`` is set to 'server' (server-side, implied by setting
   ``--server`` ), or if ``--pull`` is specified (client-side, implied by
diff --git a/doc/openvpn.8 b/doc/openvpn.8
index 1b8dfcd..197d1eb 100644
--- a/doc/openvpn.8
+++ b/doc/openvpn.8
@@ -887,6 +887,13 @@ For servers, the first cipher from \fBcipher\-list\fP that is also
 supported by the client will be pushed to clients that support cipher
 negotiation.
 .sp
+Starting with OpenVPN 2.5.9 a cipher can be prefixed with a \fB?\fP to mark
+it as optional. This allows including ciphers in the list that may not be
+available on all platforms.
+E.g. \fBAES\-256\-GCM:AES\-128\-GCM:?CHACHA20\-POLY1305\fP would only enable
+Chacha20\-Poly1305 if the underlying SSL library (and its configuration)
+supports it.
+.sp
 Cipher negotiation is enabled in client\-server mode only. I.e. if
 \fB\-\-mode\fP is set to \(aqserver\(aq (server\-side, implied by setting
 \fB\-\-server\fP ), or if \fB\-\-pull\fP is specified (client\-side, implied by
diff --git a/doc/openvpn.8.html b/doc/openvpn.8.html
index 12705c9..2a6f0b8 100644
--- a/doc/openvpn.8.html
+++ b/doc/openvpn.8.html
@@ -1113,6 +1113,12 @@ and defaults to <code>AES-256-GCM:AES-128-GCM</code>.</p>
 <p>For servers, the first cipher from <tt class="docutils literal"><span class="pre">cipher-list</span></tt> that is also
 supported by the client will be pushed to clients that support cipher
 negotiation.</p>
+<p>Starting with OpenVPN 2.5.9 a cipher can be prefixed with a <code>?</code> to mark
+it as optional. This allows including ciphers in the list that may not be
+available on all platforms.
+E.g. <code>AES-256-GCM:AES-128-GCM:?CHACHA20-POLY1305</code> would only enable
+Chacha20-Poly1305 if the underlying SSL library (and its configuration)
+supports it.</p>
 <p>Cipher negotiation is enabled in client-server mode only. I.e. if
 <tt class="docutils literal"><span class="pre">--mode</span></tt> is set to 'server' (server-side, implied by setting
 <tt class="docutils literal"><span class="pre">--server</span></tt> ), or if <tt class="docutils literal"><span class="pre">--pull</span></tt> is specified (client-side, implied by
diff --git a/include/openvpn-plugin.h b/include/openvpn-plugin.h
index 8185984..d4202ab 100644
--- a/include/openvpn-plugin.h
+++ b/include/openvpn-plugin.h
@@ -53,7 +53,7 @@ extern "C" {
  */
 #define OPENVPN_VERSION_MAJOR 2
 #define OPENVPN_VERSION_MINOR 5
-#define OPENVPN_VERSION_PATCH ".8"
+#define OPENVPN_VERSION_PATCH ".9"
 
 /*
  * Plug-in types.  These types correspond to the set of script callbacks
diff --git a/sample/sample-plugins/Makefile b/sample/sample-plugins/Makefile
index b4b72d0..9e2e420 100644
--- a/sample/sample-plugins/Makefile
+++ b/sample/sample-plugins/Makefile
@@ -213,7 +213,7 @@ OPENSSL_CFLAGS =
 OPENSSL_LIBS = -lssl -lcrypto
 OPENVPN_VERSION_MAJOR = 2
 OPENVPN_VERSION_MINOR = 5
-OPENVPN_VERSION_PATCH = .8
+OPENVPN_VERSION_PATCH = .9
 OPTIONAL_CRYPTO_CFLAGS =  
 OPTIONAL_CRYPTO_LIBS =  -lssl -lcrypto
 OPTIONAL_DL_LIBS = -ldl
@@ -234,13 +234,13 @@ P11KIT_LIBS =
 PACKAGE = openvpn
 PACKAGE_BUGREPORT = [e-mail]
 PACKAGE_NAME = OpenVPN
-PACKAGE_STRING = OpenVPN 2.5.8
+PACKAGE_STRING = OpenVPN 2.5.9
 PACKAGE_TARNAME = openvpn
 PACKAGE_URL = 
-PACKAGE_VERSION = 2.5.8
+PACKAGE_VERSION = 2.5.9
 PATH_SEPARATOR = :
 PKCS11_HELPER_CFLAGS = 
-PKCS11_HELPER_LIBS = 
+PKCS11_HELPER_LIBS = -lpthread -ldl -lcrypto -lpkcs11-helper
 PKG_CONFIG = /usr/bin/pkg-config
 PKG_CONFIG_LIBDIR = 
 PKG_CONFIG_PATH = 
@@ -267,7 +267,7 @@ TAP_WIN_MIN_MINOR = 9
 TEST_CFLAGS =     -I$(top_srcdir)/include 
 TEST_LDFLAGS =  -lssl -lcrypto  -llzo2 -lcmocka
 TMPFILES_DIR = 
-VERSION = 2.5.8
+VERSION = 2.5.9
 abs_builddir = /home/flichtenheld/openvpn/community/openvpn-release-scripts/release/openvpn/sample/sample-plugins
 abs_srcdir = /home/flichtenheld/openvpn/community/openvpn-release-scripts/release/openvpn/sample/sample-plugins
 abs_top_builddir = /home/flichtenheld/openvpn/community/openvpn-release-scripts/release/openvpn
diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c
index de80dcf..de7cafd 100644
--- a/src/openvpn/forward.c
+++ b/src/openvpn/forward.c
@@ -1714,8 +1714,6 @@ process_outgoing_link(struct context *c)
 void
 process_outgoing_tun(struct context *c)
 {
-    struct gc_arena gc = gc_new();
-
     /*
      * Set up for write() call to TUN/TAP
      * device.
@@ -1801,7 +1799,6 @@ process_outgoing_tun(struct context *c)
     buf_reset(&c->c2.to_tun);
 
     perf_pop();
-    gc_free(&gc);
 }
 
 void
diff --git a/src/openvpn/misc.c b/src/openvpn/misc.c
index 40b3bf5..e4662a7 100644
--- a/src/openvpn/misc.c
+++ b/src/openvpn/misc.c
@@ -273,6 +273,7 @@ get_user_pass_cr(struct user_pass *up,
                 msg(D_LOW, "No password found in %s authfile '%s'. Querying the management interface", prefix, auth_file);
                 if (!auth_user_pass_mgmt(up, prefix, flags, auth_challenge))
                 {
+                    fclose(fp);
                     return false;
                 }
             }
diff --git a/src/openvpn/misc.h b/src/openvpn/misc.h
index 570e473..1e52056 100644
--- a/src/openvpn/misc.h
+++ b/src/openvpn/misc.h
@@ -74,6 +74,7 @@ struct user_pass
 #else
 #define USER_PASS_LEN 128
 #endif
+    /* Note that username and password are expected to be null-terminated */
     char username[USER_PASS_LEN];
     char password[USER_PASS_LEN];
 };
diff --git a/src/openvpn/ntlm.c b/src/openvpn/ntlm.c
index e370748..9158cfd 100644
--- a/src/openvpn/ntlm.c
+++ b/src/openvpn/ntlm.c
@@ -143,6 +143,19 @@ my_strupr(char *str)
     }
 }
 
+/**
+ * This function expects a null-terminated string in src and will
+ * copy it (including the terminating NUL byte),
+ * alternating it with 0 to dst.
+ *
+ * This basically will transform a ASCII string into valid UTF-16.
+ * Characters that are 8bit in src, will get the same treatment, resulting in
+ * invalid or wrong unicode code points.
+ *
+ * @note the function will blindly assume that dst has double
+ * the space of src.
+ * @return  the length of the number of bytes written to dst
+ */
 static int
 unicodize(char *dst, const char *src)
 {
diff --git a/src/openvpn/options.c b/src/openvpn/options.c
index 20d1273..2ddf30d 100644
--- a/src/openvpn/options.c
+++ b/src/openvpn/options.c
@@ -4926,8 +4926,6 @@ parse_argv(struct options *options,
            unsigned int *option_types_found,
            struct env_set *es)
 {
-    int i, j;
-
     /* usage message */
     if (argc <= 1)
     {
@@ -4937,7 +4935,7 @@ parse_argv(struct options *options,
     /* config filename specified only? */
     if (argc == 2 && strncmp(argv[1], "--", 2))
     {
-        char *p[MAX_PARMS];
+        char *p[MAX_PARMS+1];
         CLEAR(p);
         p[0] = "config";
         p[1] = argv[1];
@@ -4947,9 +4945,9 @@ parse_argv(struct options *options,
     else
     {
         /* parse command line */
-        for (i = 1; i < argc; ++i)
+        for (int i = 1; i < argc; ++i)
         {
-            char *p[MAX_PARMS];
+            char *p[MAX_PARMS+1];
             CLEAR(p);
             p[0] = argv[i];
             if (strncmp(p[0], "--", 2))
@@ -4961,6 +4959,7 @@ parse_argv(struct options *options,
                 p[0] += 2;
             }
 
+            int j;
             for (j = 1; j < MAX_PARMS; ++j)
             {
                 if (i + j < argc)
@@ -5001,6 +5000,12 @@ apply_pull_filter(const struct options *o, char *line)
         return true;
     }
 
+    /* skip leading spaces matching the behaviour of parse_line */
+    while (isspace(*line))
+    {
+        line++;
+    }
+
     for (f = o->pull_filter_list->head; f; f = f->next)
     {
         if (f->type == PUF_TYPE_ACCEPT && strncmp(line, f->pattern, f->size) == 0)
diff --git a/src/openvpn/push.c b/src/openvpn/push.c
index 7c36530..43db191 100644
--- a/src/openvpn/push.c
+++ b/src/openvpn/push.c
@@ -536,7 +536,7 @@ send_push_reply_auth_token(struct tls_multi *multi)
 
     /* Construct a mimimal control channel push reply message */
     struct buffer buf = alloc_buf_gc(PUSH_BUNDLE_SIZE, &gc);
-    buf_printf(&buf, "%s, %s", push_reply_cmd, e->option);
+    buf_printf(&buf, "%s,%s", push_reply_cmd, e->option);
     send_control_channel_string_dowork(multi, BSTR(&buf), D_PUSH);
     gc_free(&gc);
 }
@@ -779,8 +779,10 @@ push_update_digest(md_ctx_t *ctx, struct buffer *buf, const struct options *opt)
     char line[OPTION_PARM_SIZE];
     while (buf_parse(buf, ',', line, sizeof(line)))
     {
-        /* peer-id might change on restart and this should not trigger reopening tun */
-        if (strprefix(line, "peer-id "))
+        /* peer-id and auth-token might change on restart and this should not trigger reopening tun */
+        if (strprefix(line, "peer-id ")
+            || strprefix(line, "auth-token ")
+            || strprefix(line, "auth-token-user "))
         {
             continue;
         }
@@ -891,13 +893,13 @@ remove_iroutes_from_push_route_list(struct options *o)
         /* cycle through the push list */
         while (e)
         {
-            char *p[MAX_PARMS];
+            char *p[MAX_PARMS+1];
             bool enable = true;
 
             /* parse the push item */
             CLEAR(p);
             if (e->enable
-                && parse_line(e->option, p, SIZE(p), "[PUSH_ROUTE_REMOVE]", 1, D_ROUTE_DEBUG, &gc))
+                && parse_line(e->option, p, SIZE(p)-1, "[PUSH_ROUTE_REMOVE]", 1, D_ROUTE_DEBUG, &gc))
             {
                 /* is the push item a route directive? */
                 if (p[0] && !strcmp(p[0], "route") && !p[3])
diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c
index be0e57f..9958099 100644
--- a/src/openvpn/ssl_mbedtls.c
+++ b/src/openvpn/ssl_mbedtls.c
@@ -168,7 +168,13 @@ tls_ctx_free(struct tls_root_ctx *ctx)
         }
 
 #if defined(ENABLE_PKCS11)
-        pkcs11h_certificate_freeCertificate(ctx->pkcs11_cert);
+        /* ...freeCertificate() can handle NULL ptrs, but if pkcs11 helper
+         * has not been initialized, it will ASSERT() - so, do not pass NULL
+         */
+        if (ctx->pkcs11_cert)
+        {
+            pkcs11h_certificate_freeCertificate(ctx->pkcs11_cert);
+        }
 #endif
 
         if (ctx->allowed_ciphers)
diff --git a/src/openvpn/ssl_ncp.c b/src/openvpn/ssl_ncp.c
index b94c786..4ab39a5 100644
--- a/src/openvpn/ssl_ncp.c
+++ b/src/openvpn/ssl_ncp.c
@@ -108,7 +108,18 @@ mutate_ncp_cipher_list(const char *list, struct gc_arena *gc)
          * (and translate_cipher_name_from_openvpn/
          * translate_cipher_name_to_openvpn) also normalises the cipher name,
          * e.g. replacing AeS-128-gCm with AES-128-GCM
+         *
+         * ciphers that have ? in front of them are considered optional and
+         * OpenVPN will only warn if they are not found (and remove them from
+         * the list)
          */
+
+        bool optional = false;
+        if (token[0] == '?')
+        {
+            token++;
+            optional = true;
+        }
         const cipher_kt_t *ktc = cipher_kt_get(token);
         if (strcmp(token, "none") == 0)
         {
@@ -120,8 +131,9 @@ mutate_ncp_cipher_list(const char *list, struct gc_arena *gc)
         }
         if (!ktc && strcmp(token, "none") != 0)
         {
-            msg(M_WARN, "Unsupported cipher in --data-ciphers: %s", token);
-            error_found = true;
+            const char* optstr = optional ? "optional ": "";
+            msg(M_WARN, "Unsupported %scipher in --data-ciphers: %s", optstr, token);
+            error_found = error_found || !optional;
         }
         else
         {
diff --git a/tests/unit_tests/openvpn/test_ncp.c b/tests/unit_tests/openvpn/test_ncp.c
index 4337f6d..6e1e50a 100644
--- a/tests/unit_tests/openvpn/test_ncp.c
+++ b/tests/unit_tests/openvpn/test_ncp.c
@@ -74,6 +74,20 @@ test_check_ncp_ciphers_list(void **state)
         assert_ptr_equal(mutate_ncp_cipher_list(bf_chacha, &gc), NULL);
     }
 
+    /* Check that optional ciphers work */
+    assert_string_equal(mutate_ncp_cipher_list("AES-256-GCM:?vollbit:AES-128-GCM", &gc),
+                        aes_ciphers);
+
+    /* Check that optional ciphers work */
+    assert_string_equal(mutate_ncp_cipher_list("?AES-256-GCM:?AES-128-GCM", &gc),
+                        aes_ciphers);
+
+    /* All unsupported should still yield an empty list */
+    assert_ptr_equal(mutate_ncp_cipher_list("?kugelfisch:?grasshopper", &gc), NULL);
+
+    /* If the last is optional, previous invalid ciphers should be ignored */
+    assert_ptr_equal(mutate_ncp_cipher_list("Vollbit:Littlebit:AES-256-CBC:BF-CBC:?nixbit", &gc), NULL);
+
     /* For testing that with OpenSSL 1.1.0+ that also accepts ciphers in
      * a different spelling the normalised cipher output is the same */
     bool have_chacha_mixed_case = cipher_kt_get("ChaCha20-Poly1305");
diff --git a/version.m4 b/version.m4
index dd66b1a..53d1edf 100644
--- a/version.m4
+++ b/version.m4
@@ -3,12 +3,12 @@ define([PRODUCT_NAME], [OpenVPN])
 define([PRODUCT_TARNAME], [openvpn])
 define([PRODUCT_VERSION_MAJOR], [2])
 define([PRODUCT_VERSION_MINOR], [5])
-define([PRODUCT_VERSION_PATCH], [.8])
+define([PRODUCT_VERSION_PATCH], [.9])
 m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_MAJOR])
 m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_MINOR], [[.]])
 m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_PATCH], [[]])
 define([PRODUCT_BUGREPORT], [[e-mail]])
-define([PRODUCT_VERSION_RESOURCE], [2,5,8,0])
+define([PRODUCT_VERSION_RESOURCE], [2,5,9,0])
 dnl define the TAP version
 define([PRODUCT_TAP_WIN_COMPONENT_ID], [tap0901])
 define([PRODUCT_TAP_WIN_MIN_MAJOR], [9])