Merge ~paelzer/ubuntu/+source/openvpn:merge-eoan-2.4.7-1 into ubuntu/+source/openvpn:debian/sid

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

Usual tags to guide review:
 * [new tag] lp1828771/logical/2.4.4-2ubuntu1 -> lp1828771/logical/2.4.4-2ubuntu1
 * [new tag] lp1828771/new/debian -> lp1828771/new/debian
 * [new tag] lp1828771/old/debian -> lp1828771/old/debian
 * [new tag] lp1828771/old/ubuntu -> lp1828771/old/ubuntu
 * [new tag] lp1828771/reconstruct/2.4.6-1ubuntu3 -> lp1828771/reconstruct/2.4.6-1ubuntu3
 * [new tag] lp1828771/split/2.4.6-1ubuntu3 -> lp1828771/split/2.4.6-1ubuntu3

PPA:
https://launchpad.net/~paelzer/+archive/ubuntu/merge-eoan-2.4.7-1

[Christian Ehrhardt  (paelzer)]

Tested and working following the basic (but at least some) test from:
https://git.launchpad.net/qa-regression-testing/tree/notes_testing/openvpn/README.vm

Ends up with:

root@eoan-openvpn-cl:/etc/openvpn# service openvpn@client start
root@eoan-openvpn-cl:/etc/openvpn#
Broadcast message from root@eoan-openvpn-cl (Mon 2019-05-13 14:56:43 UTC):

Password entry required for 'Enter Private Key Password:' (PID 9320).
Please enter password with the systemd-tty-ask-password-agent tool:

root@eoan-openvpn-cl:/etc/openvpn# systemd-tty-ask-password-agent
Enter Private Key Password: ******
root@eoan-openvpn-cl:/etc/openvpn# service openvpn@client status
● <email address hidden> - OpenVPN connection to client
   Loaded: loaded (/lib/systemd/system/openvpn@.service; disabled; vendor preset: enabled)
   Active: active (running) since Mon 2019-05-13 14:56:43 UTC; 9s ago
     Docs: man:openvpn(8)
           https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
           https://community.openvpn.net/openvpn/wiki/HOWTO
 Main PID: 9309 (openvpn)
   Status: "Initialization Sequence Completed"
    Tasks: 1 (limit: 541)
   Memory: 1.9M
   CGroup: /<email address hidden>
           └─9309 /usr/sbin/openvpn --daemon ovpn-client --status /run/openvpn/client.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/client.conf --writepid /run/openvp

May 13 14:56:50 eoan-openvpn-cl ovpn-client[9309]: Data Channel: using negotiated cipher 'AES-256-GCM'
May 13 14:56:50 eoan-openvpn-cl ovpn-client[9309]: Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
May 13 14:56:50 eoan-openvpn-cl ovpn-client[9309]: Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
May 13 14:56:50 eoan-openvpn-cl ovpn-client[9309]: ROUTE_GATEWAY 192.168.122.1/255.255.255.0 IFACE=ens3 HWADDR=52:54:00:ab:e9:6c
May 13 14:56:50 eoan-openvpn-cl ovpn-client[9309]: TUN/TAP device tun0 opened
May 13 14:56:50 eoan-openvpn-cl ovpn-client[9309]: TUN/TAP TX queue length set to 100
May 13 14:56:50 eoan-openvpn-cl ovpn-client[9309]: /sbin/ip link set dev tun0 up mtu 1500
May 13 14:56:50 eoan-openvpn-cl ovpn-client[9309]: /sbin/ip addr add dev tun0 local 10.8.0.6 peer 10.8.0.5
May 13 14:56:50 eoan-openvpn-cl ovpn-client[9309]: /sbin/ip route add 10.8.0.1/32 via 10.8.0.5
May 13 14:56:50 eoan-openvpn-cl ovpn-client[9309]: Initialization Sequence Completed
root@eoan-openvpn-cl:/etc/openvpn# ifconfig tun0
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
        inet 10.8.0.6 netmask 255.255.255.255 destination 10.8.0.5
        inet6 fe80::41b:f9cf:8b6a:521d prefixlen 64 scopeid 0x20<link>
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
        RX packets 1 bytes 48 (48.0 B)
        RX errors 0 dropped 0 overruns 0 frame 0
        TX packets 2 bytes 96 (96.0 B)
        TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

root@eoan-openvpn-cl:/etc/openvpn# ping 10.8.0.1
PING 10.8.0.1 (10.8.0.1) 56(84) bytes of data.
64 bytes from 10.8.0.1: icmp_seq=1 ttl=64 time=0.392 ms
64 bytes from 10.8.0.1: icmp_seq=2 ttl=64 time=0.494 ms
^C
--- 10.8.0.1 ping ...

[Andreas Hasenack (ahasenack)]

+1

The logical tag was the old one, but it was easy enough to recreate locally

review: Approve

[Christian Ehrhardt  (paelzer)]

Odd where this tag got missing, the commands are all in my shell history but the tag is missing.
Well, as this was an easier one thanks for recreating and reviewing it!

Pushing tags for upload and dputting to Eoan

diff --git a/debian/changelog b/debian/changelog
index f676f8d..09e92aa 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,19 @@
+openvpn (2.4.7-1ubuntu1) eoan; urgency=medium
+
+  * Merge with Debian unstable (LP: #1828771). Remaining changes:
+    - d/control: Demote easy-rsa to Suggests (universe package).
+    - debian/openvpn@.service: Add '--script-security 2' similar to what got
+      added to debian/openvpn.init.d ages ago (LP 1454725)
+    - d/p/openvpn-fips-2.4.patch: Allow MD5 in FIPS mode (openssl) for PRF.
+      (LP 1807439)
+  * Dropped changes:
+    - d/openvpn@.service: Add CAP_AUDIT_WRITE to avoid issues with callout
+      scripts breaking due to sudo/pam being unable to audit the action.
+      Fixed in upstream issue #918, suggested to Debian in #868806 (LP 1787208)
+      [in Debian now]
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 13 May 2019 15:55:22 +0200
+
 openvpn (2.4.7-1) unstable; urgency=medium
 
   [ Bernhard Schmidt ]
@@ -17,6 +33,30 @@ openvpn (2.4.7-1) unstable; urgency=medium
 
  -- Bernhard Schmidt <[e-mail]>  Wed, 20 Feb 2019 14:50:03 +0100
 
+openvpn (2.4.6-1ubuntu3) disco; urgency=medium
+
+  * d/p/openvpn-fips-2.4.patch: Allow MD5 in FIPS mode (openssl) for PRF.
+    (LP: #1807439)
+
+ -- Joy Latten <[e-mail]>  Wed, 09 Jan 2019 12:25:59 -0600
+
+openvpn (2.4.6-1ubuntu2) cosmic; urgency=medium
+
+  * d/openvpn@.service: Add CAP_AUDIT_WRITE to avoid issues with callout
+    scripts breaking due to sudo/pam being unable to audit the action.
+    Fixed in upstream issue #918, suggested to Debian in #868806 (LP: #1787208)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 03 Sep 2018 10:57:35 +0200
+
+openvpn (2.4.6-1ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/control: Demote easy-rsa to Suggests (universe package).
+    - debian/openvpn@.service: Add '--script-security 2' similar to what got
+      added to debian/openvpn.init.d ages ago (LP 1454725)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 20 Aug 2018 13:30:20 +0200
+
 openvpn (2.4.6-1) unstable; urgency=medium
 
   [ Jörg Frings-Fürst ]
@@ -60,6 +100,15 @@ openvpn (2.4.5-1) unstable; urgency=medium
 
  -- Bernhard Schmidt <[e-mail]>  Sun, 04 Mar 2018 22:23:47 +0100
 
+openvpn (2.4.4-2ubuntu1) bionic; urgency=low
+
+  * Sync with Debian. Remaining changes:
+    - debian/openvpn@.service: Add "--script-security 2" similar to what got
+      added to debian/openvpn.init.d ages ago (LP: #1454725)
+    - Demote easy-rsa to Suggests (universe package).
+
+ -- Dimitri John Ledkov <[e-mail]>  Sat, 10 Feb 2018 20:27:56 +0000
+
 openvpn (2.4.4-2) unstable; urgency=medium
 
   * Build against OpenSSL 1.1.0 (Closes: #828477)
@@ -67,6 +116,15 @@ openvpn (2.4.4-2) unstable; urgency=medium
 
  -- Bernhard Schmidt <[e-mail]>  Mon, 11 Dec 2017 00:22:11 +0100
 
+openvpn (2.4.4-1ubuntu1) bionic; urgency=medium
+
+  * Sync with Debian. Remaining changes:
+    - debian/openvpn@.service: Add "--script-security 2" similar to what got
+      added to debian/openvpn.init.d ages ago (LP: #1454725)
+    - Demote easy-rsa to Suggests (universe package).
+
+ -- Jeremy Bicha <[e-mail]>  Sat, 28 Oct 2017 15:13:58 -0400
+
 openvpn (2.4.4-1) unstable; urgency=medium
 
   [ Jörg Frings-Fürst ]
@@ -188,6 +246,65 @@ openvpn (2.4.0-5) unstable; urgency=high
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Thu, 11 May 2017 14:15:21 +0200
 
+openvpn (2.4.0-4ubuntu1.3) zesty-security; urgency=medium
+
+  * SECURITY UPDATE: Remotely-triggerable ASSERT() on malformed IPv6 packet
+    - debian/patches/CVE-2017-7508.patch: remove assert in
+      src/openvpn/mss.c.
+    - CVE-2017-7508
+  * SECURITY UPDATE: Remote-triggerable memory leaks
+    - debian/patches/CVE-2017-7512.patch: fix leaks in
+      src/openvpn/ssl_verify_openssl.c.
+    - CVE-2017-7512
+  * SECURITY UPDATE: Pre-authentication remote crash/information disclosure
+    for clients
+    - debian/patches/CVE-2017-7520.patch: prevent two kinds of stack buffer
+      OOB reads and a crash for invalid input data in src/openvpn/ntlm.c.
+    - CVE-2017-7520
+  * SECURITY UPDATE: Potential double-free in --x509-alt-username and
+    memory leaks
+    - debian/patches/CVE-2017-7521.patch: fix double-free in
+      src/openvpn/ssl_verify_openssl.c.
+    - CVE-2017-7521
+  * SECURITY UPDATE: DoS in establish_http_proxy_passthru()
+    - debian/patches/establish_http_proxy_passthru_dos.patch: fix
+      null-pointer dereference in src/openvpn/proxy.c.
+    - No CVE number
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 22 Jun 2017 08:37:49 -0400
+
+openvpn (2.4.0-4ubuntu1.2) zesty-security; urgency=medium
+
+  * SECURITY UPDATE: pre-authentication denial-of-service vulnerability
+    (both client and server) from a too-large control packet.
+    - debian/patches/CVE-2017-7478.patch: Do not assert on too-large
+      control packet
+    - CVE-2017-7478
+  * SECURITY UPDATE: authenticated remote DoS vulnerability due to
+    packet ID rollover
+    - debian/patches/CVE-2017-7479-prereq.patch: merge
+      packet_id_alloc_outgoing() into packet_id_write()
+    - debian/patches/CVE-2017-7478.patch: do not assert when packet ID
+      rollover occurs
+    - CVE-2017-7478
+  * SECURITY UPDATE: auth tokens left in memory after de-auth
+    - debian/patches/wipe_tokens_on_de-auth.patch: always wipe token
+      as soon as a TLS session is considered broken.
+
+ -- Steve Beattie <[e-mail]>  Wed, 10 May 2017 15:21:05 -0700
+
+openvpn (2.4.0-4ubuntu1) zesty; urgency=medium
+
+  * Merge with Debian unstable. Remaining Ubuntu changes:
+    - debian/openvpn@.service: Add "--script-security 2" similar to what got
+      added to debian/openvpn.init.d ages ago (LP: #1454725)
+    - Demote easy-rsa to Suggests (universe package).
+  * Drop:
+    - debian/control: Actually drop the initscripts dependency.
+      (Closes: #804968). Already in Debian
+
+ -- Jon Grimm <[e-mail]>  Fri, 10 Feb 2017 12:16:57 -0600
+
 openvpn (2.4.0-4) unstable; urgency=medium
 
   * Add NEWS entries on possible 2.4 migration issues.
@@ -257,6 +374,24 @@ openvpn (2.3.11-2) unstable; urgency=medium
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Mon, 23 May 2016 09:55:30 +0200
 
+openvpn (2.3.11-1ubuntu2) yakkety; urgency=medium
+
+  * debian/control: Actually drop the initscripts dependency.
+    (Closes: #804968)
+
+ -- Martin Pitt <[e-mail]>  Wed, 22 Jun 2016 16:54:51 +0200
+
+openvpn (2.3.11-1ubuntu1) yakkety; urgency=medium
+
+  * Merge with Debian unstable. Remaining Ubuntu changes:
+    - debian/openvpn@.service: Add "--script-security 2" similar to what got
+      added to debian/openvpn.init.d ages ago (see LP: #260291).
+    - Demote easy-rsa to Suggests (universe package).
+  * Drop intrusive changes (showing per-VPN result messages) from
+    debian/openvpn.init.d. This isn't being used under systemd.
+
+ -- Martin Pitt <[e-mail]>  Fri, 20 May 2016 17:30:27 +0200
+
 openvpn (2.3.11-1) unstable; urgency=medium
 
   * New upstream release.
@@ -268,6 +403,25 @@ openvpn (2.3.11-1) unstable; urgency=medium
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Tue, 10 May 2016 17:41:53 +0200
 
+openvpn (2.3.10-1ubuntu2) xenial; urgency=medium
+
+  * debian/openvpn@.service: Add --script-security similar to what got added
+    to debian/openvpn.init.d ages ago (see LP #260291). (LP: #1454725)
+
+ -- Martin Pitt <[e-mail]>  Tue, 02 Feb 2016 13:33:39 +0100
+
+openvpn (2.3.10-1ubuntu1) xenial; urgency=medium
+
+  * Merge with Debian unstable (LP: #1536568). Remaining Ubuntu changes:
+    - debian/openvpn.init.d:
+      + Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      + Show per-VPN result messages.
+      + Add "--script-security 2" by default for backwards compatabliity.
+        (LP #260291)
+    - Demote easy-rsa to Suggests
+
+ -- Gianfranco Costamagna <[e-mail]>  Thu, 21 Jan 2016 11:37:08 +0100
+
 openvpn (2.3.10-1) unstable; urgency=medium
 
   * New upstream release. (Closes: #804368)
@@ -286,6 +440,21 @@ openvpn (2.3.10-1) unstable; urgency=medium
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Wed, 20 Jan 2016 12:01:36 +0100
 
+openvpn (2.3.8-1ubuntu1) xenial; urgency=medium
+
+  * Merge with Debian unstable. Remaining Ubuntu changes:
+    - debian/openvpn.init.d:
+      + Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      + Show per-VPN result messages.
+      + Add "--script-security 2" by default for backwards compatabliity.
+    - Demote easy-rsa to Suggests
+    - Run openvpn@.service before systemd-user-sessions.service to avoid
+      gettys and lightdm starting on top of possible password prompts. This
+      provides the equivalent of the init.d script's X-Start-Before:.
+      (Closes: #803032)
+
+ -- Martin Pitt <[e-mail]>  Mon, 04 Jan 2016 11:48:31 +0100
+
 openvpn (2.3.8-1) unstable; urgency=medium
 
   * New upstream release. Drop patch from 2.3.7-2.
@@ -299,6 +468,21 @@ openvpn (2.3.8-1) unstable; urgency=medium
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Wed, 28 Oct 2015 17:34:26 +0100
 
+openvpn (2.3.7-2ubuntu1) xenial; urgency=medium
+
+  * Merge with Debian unstable. Remaining Ubuntu changes:
+    - debian/openvpn.init.d:
+      + Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      + Show per-VPN result messages.
+      + Add "--script-security 2" by default for backwards compatabliity.
+    - Demote easy-rsa to Suggests
+    - Run openvpn@.service before systemd-user-sessions.service to avoid
+      gettys and lightdm starting on top of possible password prompts. This
+      provides the equivalent of the init.d script's X-Start-Before:.
+      (Closes: #803032)
+
+ -- Martin Pitt <[e-mail]>  Mon, 26 Oct 2015 09:32:31 +0100
+
 openvpn (2.3.7-2) unstable; urgency=medium
 
   * Move libsystemd-daemon-dev Build-Dep to libsystemd-dev.
@@ -309,6 +493,20 @@ openvpn (2.3.7-2) unstable; urgency=medium
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Tue, 08 Sep 2015 08:23:19 +0000
 
+openvpn (2.3.7-1ubuntu1) wily; urgency=medium
+
+  * Merge with Debian unstable. Remaining Ubuntu changes:
+    - debian/openvpn.init.d:
+      + Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      + Show per-VPN result messages.
+      + Add "--script-security 2" by default for backwards compatabliity.
+    - Demote easy-rsa to Suggests
+    - Run openvpn@.service before systemd-user-sessions.service to avoid
+      gettys and lightdm starting on top of possible password prompts. This
+      provides the equivalent of the init.d script's X-Start-Before:.
+
+ -- Martin Pitt <[e-mail]>  Wed, 08 Jul 2015 12:28:54 +0200
+
 openvpn (2.3.7-1) unstable; urgency=medium
 
   * New upstream version
@@ -330,6 +528,20 @@ openvpn (2.3.5-1) unstable; urgency=medium
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Wed, 29 Oct 2014 17:44:06 +0100
 
+openvpn (2.3.4-5ubuntu1) wily; urgency=medium
+
+  * Merge with Debian unstable. Remaining Ubuntu changes:
+    - debian/openvpn.init.d:
+      + Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      + Show per-VPN result messages.
+      + Add "--script-security 2" by default for backwards compatabliity.
+    - Demote easy-rsa to Suggests
+    - Run openvpn@.service before systemd-user-sessions.service to avoid
+      gettys and lightdm starting on top of possible password prompts. This
+      provides the equivalent of the init.d script's X-Start-Before:.
+
+ -- Martin Pitt <[e-mail]>  Thu, 07 May 2015 15:35:52 +0200
+
 openvpn (2.3.4-5) unstable; urgency=high
 
   * Apply upstream patch that fixes possible DoS by authenticated
@@ -388,6 +600,52 @@ openvpn (2.3.3-1) experimental; urgency=medium
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Mon, 17 Mar 2014 19:40:12 +0100
 
+openvpn (2.3.2-9ubuntu4) vivid; urgency=medium
+
+  * Run openvpn@.service before systemd-user-sessions.service to avoid gettys
+    and lightdm starting on top of possible password prompts. This provides
+    the equivalent of the init.d script's X-Start-Before:.
+
+ -- Martin Pitt <[e-mail]>  Mon, 13 Apr 2015 16:09:01 -0500
+
+openvpn (2.3.2-9ubuntu3) vivid; urgency=medium
+
+  * Add better_systemd_detection.patch to avoid calling systemd-ask-password
+    under upstart. Backported from upstream. (Closes: #747265)
+  * Add systemd unit and generator from current Debian package. This avoids
+    using the init.d script, which unnecessarily blocks lightdm startup on the
+    network becoming online even if there are no auto-start connections
+    (LP: #1443489).
+
+ -- Martin Pitt <[e-mail]>  Mon, 13 Apr 2015 11:22:56 -0500
+
+openvpn (2.3.2-9ubuntu2) vivid; urgency=medium
+
+  * SECURITY UPDATE: server denial of service via too-short control channel
+    packets
+    - debian/patches/CVE-2014-8104.patch: drop too-short control channel
+      packets instead of asserting out in src/openvpn/ssl.c.
+    - CVE-2014-8104
+  * debian/patches/update_certs.patch: update test certs to fix FTBFS.
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 01 Dec 2014 15:26:58 -0500
+
+openvpn (2.3.2-9ubuntu1) utopic; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/openvpn.init.d:
+      + Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      + Show per-VPN result messages.
+      + Add "--script-security 2" by default for backwards compatabliity.
+    - Demote easy-rsa to Suggests
+    - Patch libtool.m4 and configure to support ppc64el.
+    - Refresh delta with debian/openvpn.init.d:
+      + Make stop action reliable by killing if needed
+        (LP: #1274254, LP: #1200519)
+      + Use new path for status file (LP: #1261088)
+
+ -- Stéphane Graber <[e-mail]>  Fri, 02 May 2014 16:00:55 -0400
+
 openvpn (2.3.2-9) unstable; urgency=medium
 
   * Create /run/openvpn in init script even if no VPN is
@@ -403,6 +661,33 @@ openvpn (2.3.2-8) unstable; urgency=medium
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Fri, 14 Mar 2014 12:59:57 +0100
 
+openvpn (2.3.2-7ubuntu3) trusty; urgency=medium
+
+  [ Simon Deziel ]
+  * Refresh delta with debian/openvpn.init.d:
+   - Make stop action reliable by killing if needed
+     (LP: #1274254, LP: #1200519)
+   - Use new path for status file (LP: #1261088)
+
+ -- Stéphane Graber <[e-mail]>  Tue, 04 Feb 2014 09:31:39 -0500
+
+openvpn (2.3.2-7ubuntu2) trusty; urgency=medium
+
+  * Patch libtool.m4 and configure to support ppc64el.
+
+ -- Matthias Klose <[e-mail]>  Mon, 30 Dec 2013 12:32:35 +0100
+
+openvpn (2.3.2-7ubuntu1) trusty; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/openvpn.init.d:
+      + Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      + Show per-VPN result messages.
+      + Add "--script-security 2" by default for backwards compatabliity.
+    - Demote easy-rsa to Suggests
+
+ -- Stéphane Graber <[e-mail]>  Mon, 02 Dec 2013 18:14:42 -0500
+
 openvpn (2.3.2-7) unstable; urgency=low
 
   * Fix postinst when no *.pid files exist in /run/sendsigs.omit.d/.
@@ -419,6 +704,17 @@ openvpn (2.3.2-6) unstable; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Wed, 27 Nov 2013 13:58:33 +0100
 
+openvpn (2.3.2-5ubuntu1) trusty; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/openvpn.init.d:
+      + Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      + Show per-VPN result messages.
+      + Add "--script-security 2" by default for backwards compatabliity.
+    - Demote easy-rsa to Suggests
+
+ -- Stéphane Graber <[e-mail]>  Mon, 21 Oct 2013 13:07:37 -0400
+
 openvpn (2.3.2-5) unstable; urgency=low
 
   * Patch init script to fix race conditions on restarts.
@@ -428,6 +724,16 @@ openvpn (2.3.2-5) unstable; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Mon, 15 Jul 2013 16:10:59 +0200
 
+openvpn (2.3.2-4ubuntu1) saucy; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/openvpn.init.d:
+      + Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      + Show per-VPN result messages.
+      + Add "--script-security 2" by default for backwards compatabliity.
+
+ -- Stéphane Graber <[e-mail]>  Tue, 09 Jul 2013 17:20:31 -0400
+
 openvpn (2.3.2-4) unstable; urgency=low
 
   * Fix depends on iproute to iproute2.
@@ -460,6 +766,23 @@ openvpn (2.3.2-1) unstable; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Mon, 03 Jun 2013 18:48:44 +0200
 
+openvpn (2.3.1-2ubuntu2) saucy; urgency=low
+
+  * Move easy-rsa from Recommends to Suggests as it's not in main and isn't
+    actually required to operate an openvpn server.
+
+ -- Stéphane Graber <[e-mail]>  Wed, 19 Jun 2013 14:37:54 -0400
+
+openvpn (2.3.1-2ubuntu1) saucy; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/openvpn.init.d:
+      + Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      + Show per-VPN result messages.
+      + Add "--script-security 2" by default for backwards compatabliity.
+
+ -- Stéphane Graber <[e-mail]>  Fri, 24 May 2013 17:42:45 -0400
+
 openvpn (2.3.1-2) unstable; urgency=low
 
   * Add net-tools to Build-Depends. (Closes: #709108)
@@ -487,6 +810,32 @@ openvpn (2.3~rc1-1) experimental; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Mon, 05 Nov 2012 16:31:15 +0100
 
+openvpn (2.2.1-8ubuntu3) raring; urgency=low
+
+  [ Marc Gariépy ]
+  * Add --script-security to the init.d script (was generated but not passed
+    to openvpn). (LP: #1124398)
+
+ -- Stéphane Graber <[e-mail]>  Wed, 13 Feb 2013 16:10:48 -0500
+
+openvpn (2.2.1-8ubuntu2) quantal; urgency=low
+
+  * Rebuild for new armel compiler default of ARMv5t.
+
+ -- Colin Watson <[e-mail]>  Mon, 08 Oct 2012 08:36:47 +0100
+
+openvpn (2.2.1-8ubuntu1) precise; urgency=low
+
+  * Merge at Simon Deziel's request to build with PIE.
+  * Merge from Debian unstable. Remaining changes:
+    + debian/openvpn.init.d:
+      - Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      - Show per-VPN result messages.
+      - Add "--script-security 2" by default for backwards compatabliity.
+    + debian/control: Add lsb-base >= 3.2-14 to allow status_of_proc()
+
+ -- Stéphane Graber <[e-mail]>  Fri, 30 Mar 2012 13:19:09 -0400
+
 openvpn (2.2.1-8) unstable; urgency=low
 
   * Enable "PIE" and "BINDOW" hardening flags.
@@ -511,6 +860,17 @@ openvpn (2.2.1-6) unstable; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Fri, 09 Mar 2012 13:44:50 +0100
 
+openvpn (2.2.1-5ubuntu1) precise; urgency=low
+
+  * Merge from Debian unstable. Remaining changes: (LP: #907828)
+    + debian/openvpn.init.d:
+      - Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      - Show per-VPN result messages.
+      - Add "--script-security 2" by default for backwards compatabliity.
+    + debian/control: Add lsb-base >= 3.2-14 to allow status_of_proc()
+
+ -- Stéphane Graber <[e-mail]>  Sat, 25 Feb 2012 21:08:48 -0500
+
 openvpn (2.2.1-5) unstable; urgency=low
 
   * Avoid sending ICMP redirects when using tun devices and "subnet"
@@ -533,6 +893,20 @@ openvpn (2.2.1-4) unstable; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Wed, 08 Feb 2012 16:31:32 +0100
 
+openvpn (2.2.1-3ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing.  Remaining changes:
+   + debian/openvpn.init.d:
+      - Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      - Show per-VPN result messages.
+      - Add "--script-security 2" by default for backwards compatabliity.
+    + debian/control: Add lsb-base >= 3.2-14 to allow status_of_proc()
+    + debian/update-resolv-conf: Support multiple domains.
+    + fix bug where '--script-security 2' would be passed for all
+      daemons after the first. (LP: #794916)
+
+ -- Chuck Short <[e-mail]>  Sat, 31 Dec 2011 04:55:56 +0000
+
 openvpn (2.2.1-3) unstable; urgency=low
 
   * The iproute fiasco release.
@@ -561,6 +935,20 @@ openvpn (2.2.1-1) unstable; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Tue, 13 Dec 2011 11:04:22 +0100
 
+openvpn (2.2.0-2ubuntu1) oneiric; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+   + debian/openvpn.init.d:
+      - Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      - Show per-VPN result messages.
+      - Add "--script-security 2" by default for backwards compatabliity.
+    + debian/control: Add lsb-base >= 3.2-14 to allow status_of_proc()
+    + debian/update-resolv-conf: Support multiple domains.
+    + fix bug where '--script-security 2' would be passed for all
+      daemons after the first. (LP: #794916
+
+ -- Chuck Short <[e-mail]>  Thu, 16 Jun 2011 18:33:37 +0100
+
 openvpn (2.2.0-2) unstable; urgency=low
 
   * Upload to unstable
@@ -595,6 +983,45 @@ openvpn (2.1.3-5) experimental; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Tue, 22 Mar 2011 10:57:18 +0100
 
+openvpn (2.1.3-4.1ubuntu2) oneiric; urgency=low
+
+  [Alexander Zielke]
+  * fix bug where '--script-security 2' would be passed for all
+    daemons after the first. (LP: #794916)
+
+ -- Scott Moser <[e-mail]>  Thu, 09 Jun 2011 13:59:08 -0400
+
+openvpn (2.1.3-4.1ubuntu1) oneiric; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+   + debian/openvpn.init.d:
+      - Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      - Show per-VPN result messages.
+      - Add "--script-security 2" by default for backwards compatabliity.
+    + debian/control: Add lsb-base >= 3.2-14 to allow status_of_proc()
+    + debian/update-resolv-conf: Support multiple domains.
+
+ -- Chuck Short <[e-mail]>  Tue, 17 May 2011 02:14:39 +0100
+
+openvpn (2.1.3-4.1) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Drop hard-coded dependency on libssl0.9.8.  (Closes: #623503)
+
+ -- Philipp Kern <[e-mail]>  Mon, 09 May 2011 23:20:03 +0200
+
+openvpn (2.1.3-4ubuntu1) oneiric; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    + debian/openvpn.init.d:
+      - Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      - Show per-VPN result messages.
+      - Add "--script-security 2" by default for backwards compatabliity.
+    + debian/control: Add lsb-base >= 3.2-14 to allow status_of_proc()
+    + debian/update-resolv-conf: Support multiple domains.
+
+ -- Chuck Short <[e-mail]>  Tue, 22 Mar 2011 23:28:26 +0000
+
 openvpn (2.1.3-4) unstable; urgency=low
 
   * Updated JuanJo's IPv6 patch. Now really fixes use from xinetd.
@@ -617,6 +1044,31 @@ openvpn (2.1.3-3) unstable; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Fri, 11 Mar 2011 13:08:12 +0100
 
+openvpn (2.1.3-2ubuntu3) natty; urgency=low
+
+  * update-resolv-conf: Correctly handle multiple dns search domains,
+    using the same logic as nameservers.  Patch courtesy of Jeremy 
+    Zawodny. (LP: #662847)
+
+ -- Dave Walker (Daviey) <[e-mail]>  Fri, 11 Mar 2011 00:23:59 +0000
+
+openvpn (2.1.3-2ubuntu2) natty; urgency=low
+
+  * update-resolv-conf: Support mulitple domains (LP: #714358)
+
+ -- Chuck Short <[e-mail]>  Mon, 14 Feb 2011 15:21:46 -0500
+
+openvpn (2.1.3-2ubuntu1) natty; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    + debian/openvpn.init.d:
+      - Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      - Show per-VPN result messages.
+      - Add "--script-security 2" by default for backwards compatabliity.
+    +  debian/control: Add lsb-base >= 3.2-14 to allow status_of_proc()
+
+ -- Chuck Short <[e-mail]>  Sat, 23 Oct 2010 01:59:28 +0100
+
 openvpn (2.1.3-2) unstable; urgency=low
 
   * Applied upstream patch to solve random routes added when using
@@ -624,6 +1076,24 @@ openvpn (2.1.3-2) unstable; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Thu, 21 Oct 2010 12:21:33 +0200
 
+openvpn (2.1.3-1ubuntu2) natty; urgency=low
+
+  * Fix jjo-ipv6-support.patch to avoid assertion failure at socket.c:629 in
+    corner cases where ! host && addr (LP: #627973)
+
+ -- Thierry Carrez (ttx) <[e-mail]>  Wed, 20 Oct 2010 16:22:25 +0200
+
+openvpn (2.1.3-1ubuntu1) natty; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    + debian/openvpn.init.d:
+      - Do not use start-stop-daemon and </dev/null to avoid blocking boot.
+      - Show per-VPN result messages.
+      - Add "--script-security 2" by default for backwards compatablitiy
+    + debian/control: Add lsb-base >= 3.2-14 to allow status_of_proc()
+
+ -- Chuck Short <[e-mail]>  Tue, 05 Oct 2010 06:21:14 +0100
+
 openvpn (2.1.3-1) unstable; urgency=low
 
   * New upstream release (Closes: #595684)
@@ -635,6 +1105,17 @@ openvpn (2.1.3-1) unstable; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Wed, 29 Sep 2010 13:07:37 +0200
 
+openvpn (2.1.0-3ubuntu1) maverick; urgency=low
+
+  * Merge from debian unstable. Remaining changes:
+    + debian/openvpn.init.d:
+      - Do not use start-stop-daemon and use </dev/null to avoid blocking boot
+      - Show per-VPN result messages
+      - Add "--script-security 2" by default for backwards compatablitiy
+    + debian/control: Add lsb-base >= 3.2-14 to allow status_of_proc()
+
+ -- Chuck Short <[e-mail]>  Mon, 12 Jul 2010 09:39:43 -0400
+
 openvpn (2.1.0-3) unstable; urgency=low
 
   * The 'happy birthday to me' release
@@ -644,6 +1125,24 @@ openvpn (2.1.0-3) unstable; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Fri, 09 Jul 2010 12:22:09 +0200
 
+openvpn (2.1.0-2ubuntu2) maverick; urgency=low
+
+  * debian/patches/client_hang_when_server_dont_push.patch: Fix client hanging
+    on PUSH_REQUEST when server does not push any option (LP: #579737)
+
+ -- Thierry Carrez <[e-mail]>  Mon, 28 Jun 2010 10:45:23 +0200
+
+openvpn (2.1.0-2ubuntu1) maverick; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    + debian/openvpn.init.d:
+      - Do not use start-stop-daemon and use </dev/null to avoid blocking boot
+      - Show per-VPN result messages
+      - Add "--script-security 2" by default for backwards compatablitiy
+     + debian/control: Add lsb-base >= 3.2-14 to allow status_of_proc() 
+
+ -- Chuck Short <[e-mail]>  Wed, 05 May 2010 03:06:19 +0100
+
 openvpn (2.1.0-2) unstable; urgency=low
 
   * Patched ssl.[ch] to fix integer overflow. (Closes: #576827)
@@ -656,6 +1155,17 @@ openvpn (2.1.0-2) unstable; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Sat, 10 Apr 2010 17:26:42 +0200
 
+openvpn (2.1.0-1ubuntu1) lucid; urgency=low
+
+  * Merge from debian testing (LP: #509078), remaining changes:
+    + debian/openvpn.init.d:
+      - Do not use start-stop-daemon and use < /dev/null to avoid blocking boot
+      - Show per-VPN result messages
+      - Add "--script-security 2" by default for backwards compatibility
+    + debian/control: Add lsb-base >= 3.2-14 to allow status_of_proc()
+
+ -- Jan Brinkmann <[e-mail]>  Fri, 22 Jan 2010 00:47:33 +0100
+
 openvpn (2.1.0-1) unstable; urgency=low
 
   * New upstream release
@@ -693,6 +1203,20 @@ openvpn (2.1~rc20-3) unstable; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Wed, 04 Nov 2009 17:18:03 +0100
 
+openvpn (2.1~rc20-2ubuntu1) lucid; urgency=low
+
+  * Merge from debian testing, remaining changes:
+    + debian/openvpn.init.d:
+      - Do not use start-stop-daemon and use < /dev/null to avoid blocking
+        boot.
+      - show per-VPN result messages
+      - add "--script-security 2" by default for backwards compatibility
+      - Add lab-base >= 3.2-14 to allow status_of_proc()
+     + Dropped debian/patches/redirect-gateway.patch: Already applied 
+       upstream.
+
+ -- Chuck Short <[e-mail]>  Fri, 06 Nov 2009 01:36:35 +0000
+
 openvpn (2.1~rc20-2) unstable; urgency=low
 
   * init.d script: Added X-Interactive header. (Closes: #549424)
@@ -717,6 +1241,25 @@ openvpn (2.1~rc19-2) unstable; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Sun, 30 Aug 2009 20:20:11 +0200
 
+openvpn (2.1~rc19-1ubuntu2) karmic; urgency=low
+
+  * debian/patches/redirect-gateway.patch: Fix regression introduced in
+    2.1rc17 that makes redirect-gateway (without options) to be ignored.
+    Patch cherrypicked from upstream 2.1rc20 (SVN r5011), LP: #445695
+
+ -- Thierry Carrez <[e-mail]>  Tue, 13 Oct 2009 09:31:20 +0200
+
+openvpn (2.1~rc19-1ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable (LP: #404099), remaining changes:
+    - debian/openvpn.init.d:
+      - Do not use start-stop-daemon and use < /dev/null to avoid blocking boot
+      - show per-VPN result messages
+      - add "--script-security 2" by default for backwards compatibility
+      - Added lsb-base>=3.2-14 depend to allow status_of_proc()
+
+ -- Bhavani Shankar <[e-mail]>  Fri, 24 Jul 2009 19:22:13 +0530
+
 openvpn (2.1~rc19-1) unstable; urgency=low
 
   * New upstream version
@@ -726,6 +1269,17 @@ openvpn (2.1~rc19-1) unstable; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Tue, 21 Jul 2009 17:00:56 +0200
 
+openvpn (2.1~rc15-1ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable (LP: #372358), remaining changes:
+    - debian/openvpn.init.d: 
+      - Do not use start-stop-daemon and use < /dev/null to avoid blocking boot
+      - show per-VPN result messages 
+      - add "--script-security 2" by default for backwards compatibility
+      - Added lsb-base>=3.2-14 depend to allow status_of_proc()
+
+ -- Andres Rodriguez <[e-mail]>  Tue, 05 May 2009 14:25:37 -0500
+
 openvpn (2.1~rc15-1) unstable; urgency=low
 
   * New upstream version (Closes: #515575)
@@ -745,6 +1299,33 @@ openvpn (2.1~rc15-1) unstable; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Thu, 30 Apr 2009 12:35:05 +0200
 
+openvpn (2.1~rc11-1ubuntu3) jaunty; urgency=low
+
+  * debian/openvpn.init.d:
+    - Fix unexpected operator on startup (LP: #340120)
+
+ -- Michael Jeanson <[e-mail]>  Mon, 09 Mar 2009 16:02:50 -0400
+
+openvpn (2.1~rc11-1ubuntu2) intrepid; urgency=low
+
+  * debian/openvpn.init.d:
+    - Revert fix from #454371 that was merged at 2.1~rc7-4 to prevent
+      openvpn prompts from blocking the boot (LP: #280428)
+    - Fix VPNs always reported started [ OK ]
+
+ -- Thierry Carrez <[e-mail]>  Wed, 15 Oct 2008 17:12:54 +0200
+
+openvpn (2.1~rc11-1ubuntu1) intrepid; urgency=low
+
+  * Merge with Debian (LP: #279655), remaining diffs:
+    - debian/openvpn.init.d: Added 'status' action to init script, show
+      per-VPN result messages and add "--script-security 2" by default for
+      backwards compatibility
+    - debian/control: Added lsb-base>=3.2-14 depend to allow status_of_proc()
+  * Fixes regression when calling commands with arguments (LP: #277447)
+
+ -- Thierry Carrez <[e-mail]>  Tue, 07 Oct 2008 16:30:44 +0200
+
 openvpn (2.1~rc11-1) unstable; urgency=low
 
   * New upstream version
@@ -765,6 +1346,23 @@ openvpn (2.1~rc10-1) unstable; urgency=low
 
  -- Alberto Gonzalez Iniesta <[e-mail]>  Thu, 11 Sep 2008 16:58:37 +0200
 
+openvpn (2.1~rc9-3ubuntu2) intrepid; urgency=low
+
+  * debian/openvpn.init.d:
+    - Added 'status' action to init script (LP: #251641)
+    - Restored per-VPN result messages by using log_action_begin_msg and
+      one log_daemon_msg per VPN instead of log_progress_msg (LP: #264966)
+  * debian/control: Added lsb-base>=3.2-14 depend to allow status_of_proc()
+
+ -- Thierry Carrez <[e-mail]>  Tue, 09 Sep 2008 10:45:45 +0200
+
+openvpn (2.1~rc9-3ubuntu1) intrepid; urgency=low
+
+  * debian/openvpn.init.d: Add "--script-security 2" by default for backwards compatibility
+    (LP: #260291)
+
+ -- Chuck Short <[e-mail]>  Mon, 25 Aug 2008 10:20:31 -0400
+
 openvpn (2.1~rc9-3) unstable; urgency=low
 
   * debian/rules: run ./configure with path to 'route', for
diff --git a/debian/control b/debian/control
index f546f4f..0f93792 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: openvpn
 Section: net
 Priority: optional
-Maintainer: Bernhard Schmidt <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Bernhard Schmidt <[e-mail]>
 Uploaders: Jörg Frings-Fürst <[e-mail]>
 Build-Depends:
  debhelper (>= 11),
@@ -33,8 +34,8 @@ Depends:
 Suggests:
  openssl,
  resolvconf,
- openvpn-systemd-resolved
-Recommends: easy-rsa
+ openvpn-systemd-resolved,
+ easy-rsa
 Description: virtual private network daemon
  OpenVPN is an application to securely tunnel IP networks over a
  single UDP or TCP port. It can be used to access remote sites, make
diff --git a/debian/openvpn@.service b/debian/openvpn@.service
index da7adc7..eb4be12 100644
--- a/debian/openvpn@.service
+++ b/debian/openvpn@.service
@@ -13,7 +13,7 @@ Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO
 Type=notify
 PrivateTmp=true
 WorkingDirectory=/etc/openvpn
-ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --config /etc/openvpn/%i.conf --writepid /run/openvpn/%i.pid
+ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/%i.conf --writepid /run/openvpn/%i.pid
 PIDFile=/run/openvpn/%i.pid
 KillMode=process
 ExecReload=/bin/kill -HUP $MAINPID
diff --git a/debian/patches/openvpn-fips-2.4.patch b/debian/patches/openvpn-fips-2.4.patch
 new file mode 100644
index 0000000..4d2221d
--- /dev/null
+++ b/debian/patches/openvpn-fips-2.4.patch
@@ -0,0 +1,102 @@
+Description:  Use openssl FIPS flag to indicate MD5 use for PRF.
+ MD5 is not allowed in FIPS 140-2 except for PRF. OpenVPN needs
+ to send EVP_MD_CTX_FLAG_NON_FIPS_ALLOW flag to FIPS mode openssl
+ for PRF to indicate the exception.
+Bug: https://community.openvpn.net/openvpn/ticket/725
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1807439
+Author: Stephan Mueller <[e-mail]>
+
+diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
+index 03e880e..25e8fc4 100644
+--- a/src/openvpn/crypto.c
++++ b/src/openvpn/crypto.c
+@@ -876,7 +876,7 @@ init_key_ctx(struct key_ctx *ctx, struct key *key,
+     if (kt->digest && kt->hmac_length > 0)
+     {
+         ctx->hmac = hmac_ctx_new();
+-        hmac_ctx_init(ctx->hmac, key->hmac, kt->hmac_length, kt->digest);
++        hmac_ctx_init(ctx->hmac, key->hmac, kt->hmac_length, kt->digest, 0);
+ 
+         msg(D_HANDSHAKE,
+             "%s: Using %d bit message hash '%s' for HMAC authentication",
+diff --git a/src/openvpn/crypto_backend.h b/src/openvpn/crypto_backend.h
+index b7f519b..8662600 100644
+--- a/src/openvpn/crypto_backend.h
++++ b/src/openvpn/crypto_backend.h
+@@ -604,10 +604,11 @@ void hmac_ctx_free(hmac_ctx_t *ctx);
+  * @param key           The key to use for the HMAC
+  * @param key_len       The key length to use
+  * @param kt            Static message digest parameters
++ * @param prf_use       Intended use for PRF in TLS protocol
+  *
+  */
+ void hmac_ctx_init(hmac_ctx_t *ctx, const uint8_t *key, int key_length,
+-                   const md_kt_t *kt);
++                   const md_kt_t *kt, bool prf_use);
+ 
+ /*
+  * Free the given HMAC context.
+diff --git a/src/openvpn/crypto_mbedtls.c b/src/openvpn/crypto_mbedtls.c
+index 0cb7f81..d7f931d 100644
+--- a/src/openvpn/crypto_mbedtls.c
++++ b/src/openvpn/crypto_mbedtls.c
+@@ -857,7 +857,7 @@ hmac_ctx_free(mbedtls_md_context_t *ctx)
+ 
+ void
+ hmac_ctx_init(mbedtls_md_context_t *ctx, const uint8_t *key, int key_len,
+-              const mbedtls_md_info_t *kt)
++              const mbedtls_md_info_t *kt, bool prf_use)
+ {
+     ASSERT(NULL != kt && NULL != ctx);
+ 
+diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c
+index 9e8d3f3..d5302ae 100644
+--- a/src/openvpn/crypto_openssl.c
++++ b/src/openvpn/crypto_openssl.c
+@@ -926,11 +926,17 @@ hmac_ctx_free(HMAC_CTX *ctx)
+ 
+ void
+ hmac_ctx_init(HMAC_CTX *ctx, const uint8_t *key, int key_len,
+-              const EVP_MD *kt)
++              const EVP_MD *kt, bool prf_use)
+ {
+     ASSERT(NULL != kt && NULL != ctx);
+ 
+     HMAC_CTX_reset(ctx);
++
++   /* FIPS 140-2 explicitly allows MD5 for the use in PRF although it is not
++    * to be used anywhere else */
++    if(kt == EVP_md5() && prf_use)
++       HMAC_CTX_set_flags(ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
++
+     HMAC_Init_ex(ctx, key, key_len, kt, NULL);
+ 
+     /* make sure we used a big enough key */
+diff --git a/src/openvpn/ntlm.c b/src/openvpn/ntlm.c
+index 077fa3e..83585e2 100644
+--- a/src/openvpn/ntlm.c
++++ b/src/openvpn/ntlm.c
+@@ -88,7 +88,7 @@ gen_hmac_md5(const uint8_t *data, int data_len, const uint8_t *key, int key_len,
+     const md_kt_t *md5_kt = md_kt_get("MD5");
+     hmac_ctx_t *hmac_ctx = hmac_ctx_new();
+ 
+-    hmac_ctx_init(hmac_ctx, key, key_len, md5_kt);
++    hmac_ctx_init(hmac_ctx, key, key_len, md5_kt, 0);
+     hmac_ctx_update(hmac_ctx, data, data_len);
+     hmac_ctx_final(hmac_ctx, result);
+     hmac_ctx_cleanup(hmac_ctx);
+diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
+index c0e1dd6..f929237 100644
+--- a/src/openvpn/ssl.c
++++ b/src/openvpn/ssl.c
+@@ -1637,8 +1637,8 @@ tls1_P_hash(const md_kt_t *md_kt,
+     chunk = md_kt_size(md_kt);
+     A1_len = md_kt_size(md_kt);
+ 
+-    hmac_ctx_init(ctx, sec, sec_len, md_kt);
+-    hmac_ctx_init(ctx_tmp, sec, sec_len, md_kt);
++    hmac_ctx_init(ctx, sec, sec_len, md_kt, 1);
++    hmac_ctx_init(ctx_tmp, sec, sec_len, md_kt, 1);
+ 
+     hmac_ctx_update(ctx,seed,seed_len);
+     hmac_ctx_final(ctx, A1);
diff --git a/debian/patches/series b/debian/patches/series
index 8b19c3d..b488507 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -7,3 +7,4 @@ match-manpage-and-command-help.patch
 spelling_errors.patch
 systemd.patch
 fix-pkcs11-helper-hang.patch
+openvpn-fips-2.4.patch