)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":1000001,"name":"Frank Lichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"change_message_id":"839dc97273a74ab22db211fe4cfc206a8478a961","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"a6cc6c4b_c6a04cd6","updated":"2026-11-02 12:35:10.000000000","message":"There is one mention of `--secret` in options_string.h which should be removed as well","commit_id":"68fd83945956945d64655703fdb33041757f812d"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"7f41ef27bbd9a943d9ffee108e6f1968d642629e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"b8e5d4df_88f99aad","in_reply_to":"a6cc6c4b_c6a04cd6","updated":"2026-11-02 13:18:56.000000000","message":"Done","commit_id":"68fd83945956945d64655703fdb33041757f812d"},{"author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"7596cade7231143f379459dd7c90c1dd1ef57dbc","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":4,"id":"22c1d061_9028f95c","updated":"2026-11-02 15:51:25.000000000","message":"Do we want to document --allow-deprecated-insecure-static-crypto as removed in unsupported-options.rst?\n\nAlso, a recursive grep in `doc/` finds references to static-key mode, but I\u0027m not sure if you want to remove those, or if you do, if that is for this patch.","commit_id":"168d741a412fe24413fcf382db0800a6ab23c95a"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"e89191b062df116c6f7d3b840166f68657d1ec6b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"08a45cea_a8f49950","in_reply_to":"22c1d061_9028f95c","updated":"2026-11-03 11:12:37.000000000","message":"I found only one in --config that is really relevant. All the other ones are referring to other types of secret. There is one reference to --test-crypto that the requirement to specific --secret has been dropped.","commit_id":"168d741a412fe24413fcf382db0800a6ab23c95a"},{"author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"149e99852e6b83767bf91f5ad2c8aea1a0659d93","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":5,"id":"daefd7f9_a8a6083c","updated":"2026-11-03 11:57:52.000000000","message":"The code looks good, not giving a full +2 because I\u0027m not sure if the docs need more work or not:\n\n- the man page intro still advertises static-key and cleartext modes;\n- --help still mentions \"Static Key \u0026 TLS-mode\";\n- --show-ciphers on mbedTLS still says static key mode allows only CBC;\n- the --auth man text still describes static-key HMAC.","commit_id":"e052d4f93e5bdb4a8596bf54d5b88926d14f1a13"}],"Changes.md":[{"author":{"_account_id":1000001,"name":"Frank Lichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"change_message_id":"1da71cf50dfd48d2e26d1c2a0c2ce98597bc8039","unresolved":true,"context_lines":[{"line_number":29,"context_line":"  today\u0027s requirements. Use TLS mode instead. If deploying a PKI CA is considered"},{"line_number":30,"context_line":"  \"too complicated\", using `--peer-fingerprint` makes TLS mode about as easy as"},{"line_number":31,"context_line":"  using `--secret`."},{"line_number":32,"context_line":" "},{"line_number":33,"context_line":"## Maintainer-visible changes"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"- The configure-time option `--enable-debug` is no longer  available"}],"source_content_type":"text/x-markdown","patch_set":1,"id":"c3244692_c5ad05e7","line":32,"updated":"2026-11-02 11:47:09.000000000","message":"spurious white-space","commit_id":"8292574b42c32903e304a7e88e92e4e60bea50a9"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"8cb9a360328bcf214974f27fc7822ed78858e803","unresolved":false,"context_lines":[{"line_number":29,"context_line":"  today\u0027s requirements. Use TLS mode instead. If deploying a PKI CA is considered"},{"line_number":30,"context_line":"  \"too complicated\", using `--peer-fingerprint` makes TLS mode about as easy as"},{"line_number":31,"context_line":"  using `--secret`."},{"line_number":32,"context_line":" "},{"line_number":33,"context_line":"## Maintainer-visible changes"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"- The configure-time option `--enable-debug` is no longer  available"}],"source_content_type":"text/x-markdown","patch_set":1,"id":"f7470c94_93585c11","line":32,"in_reply_to":"c3244692_c5ad05e7","updated":"2026-11-02 12:22:10.000000000","message":"Done","commit_id":"8292574b42c32903e304a7e88e92e4e60bea50a9"},{"author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"aba05b8359e101238813f5750ef972020b094c16","unresolved":true,"context_lines":[{"line_number":29,"context_line":"  today\u0027s requirements. Use TLS mode instead. If deploying a PKI CA is considered"},{"line_number":30,"context_line":"  \"too complicated\", using `--peer-fingerprint` makes TLS mode about as easy as"},{"line_number":31,"context_line":"  using `--secret`."},{"line_number":32,"context_line":" "},{"line_number":33,"context_line":"## Maintainer-visible changes"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"- The configure-time option `--enable-debug` is no longer  available"}],"source_content_type":"text/x-markdown","patch_set":2,"id":"448628ea_abed7b74","line":32,"updated":"2026-11-02 13:30:55.000000000","message":"Trailing whitespace shown in diff.","commit_id":"68fd83945956945d64655703fdb33041757f812d"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"e89191b062df116c6f7d3b840166f68657d1ec6b","unresolved":false,"context_lines":[{"line_number":29,"context_line":"  today\u0027s requirements. Use TLS mode instead. If deploying a PKI CA is considered"},{"line_number":30,"context_line":"  \"too complicated\", using `--peer-fingerprint` makes TLS mode about as easy as"},{"line_number":31,"context_line":"  using `--secret`."},{"line_number":32,"context_line":" "},{"line_number":33,"context_line":"## Maintainer-visible changes"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"- The configure-time option `--enable-debug` is no longer  available"}],"source_content_type":"text/x-markdown","patch_set":2,"id":"b818ef07_fe1ef158","line":32,"in_reply_to":"448628ea_abed7b74","updated":"2026-11-03 11:12:37.000000000","message":"Done","commit_id":"68fd83945956945d64655703fdb33041757f812d"}],"doc/man-sections/protocol-options.rst":[{"author":{"_account_id":1000001,"name":"Frank Lichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"change_message_id":"1da71cf50dfd48d2e26d1c2a0c2ce98597bc8039","unresolved":true,"context_lines":[{"line_number":213,"context_line":"  (typically used on routers or other embedded devices)."},{"line_number":214,"context_line":""},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"--allow-deprecated-insecure-static-crypto"},{"line_number":217,"context_line":"   **DEPRECATED** This allow using OpenVPN without TLS. This is deprecated"},{"line_number":218,"context_line":"   and will be removed in OpenVPN 2.8."},{"line_number":219,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"89eb1d48_d7e22164","side":"PARENT","line":216,"updated":"2026-11-02 11:47:09.000000000","message":"We should add notes for this and `--secret` to unsupported-options.rst","commit_id":"2de62e2fe5ed7b35cfb8bc64155e9256d4b7954f"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"8cb9a360328bcf214974f27fc7822ed78858e803","unresolved":false,"context_lines":[{"line_number":213,"context_line":"  (typically used on routers or other embedded devices)."},{"line_number":214,"context_line":""},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"--allow-deprecated-insecure-static-crypto"},{"line_number":217,"context_line":"   **DEPRECATED** This allow using OpenVPN without TLS. This is deprecated"},{"line_number":218,"context_line":"   and will be removed in OpenVPN 2.8."},{"line_number":219,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"82e6544f_2b239707","side":"PARENT","line":216,"in_reply_to":"89eb1d48_d7e22164","updated":"2026-11-02 12:22:10.000000000","message":"Done","commit_id":"2de62e2fe5ed7b35cfb8bc64155e9256d4b7954f"}],"src/openvpn/crypto.c":[{"author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"aba05b8359e101238813f5750ef972020b094c16","unresolved":true,"context_lines":[{"line_number":1716,"context_line":"    printf(\"%s  (%u bit key, \", cipher_kt_name(ciphername), cipher_kt_key_size(ciphername) * 8);"},{"line_number":1717,"context_line":""},{"line_number":1718,"context_line":"    if (cipher_kt_block_size(ciphername) \u003d\u003d 1)"},{"line_number":1719,"context_line":"   {"},{"line_number":1720,"context_line":"        printf(\"stream cipher\");"},{"line_number":1721,"context_line":"    }"},{"line_number":1722,"context_line":"    else"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"281a98f6_9f29cbdf","line":1719,"updated":"2026-11-02 13:30:55.000000000","message":"This looks like an accidental mis-indentation.","commit_id":"68fd83945956945d64655703fdb33041757f812d"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"e89191b062df116c6f7d3b840166f68657d1ec6b","unresolved":false,"context_lines":[{"line_number":1716,"context_line":"    printf(\"%s  (%u bit key, \", cipher_kt_name(ciphername), cipher_kt_key_size(ciphername) * 8);"},{"line_number":1717,"context_line":""},{"line_number":1718,"context_line":"    if (cipher_kt_block_size(ciphername) \u003d\u003d 1)"},{"line_number":1719,"context_line":"   {"},{"line_number":1720,"context_line":"        printf(\"stream cipher\");"},{"line_number":1721,"context_line":"    }"},{"line_number":1722,"context_line":"    else"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"59b69b4e_518ae570","line":1719,"in_reply_to":"281a98f6_9f29cbdf","updated":"2026-11-03 11:12:37.000000000","message":"Done","commit_id":"68fd83945956945d64655703fdb33041757f812d"}],"src/openvpn/crypto.h":[{"author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"a5fec96082b45f4d7cf1697631e0be026ec22200","unresolved":true,"context_lines":[{"line_number":64,"context_line":" * \u003ctt\u003e [ - random - ] \u003c/tt\u003e \\n"},{"line_number":65,"context_line":" * \u003ci\u003eCBC data channel crypto format in TLS-mode:\u003c/i\u003e \\n"},{"line_number":66,"context_line":" * \u003ctt\u003e [ HMAC ] [ - IV - ] [ * packet ID * ] [ * packet payload * ] \u003c/tt\u003e \\n"},{"line_number":67,"context_line":" * [ * packet payload * ] \u003c/tt\u003e"},{"line_number":68,"context_line":" *"},{"line_number":69,"context_line":" * @par"},{"line_number":70,"context_line":" * \u003cb\u003eCFB/OFB data channel crypto format\u003c/b\u003e \\n"}],"source_content_type":"text/x-csrc","patch_set":7,"id":"9452977f_f8557e07","line":67,"updated":"2026-11-09 19:21:26.000000000","message":"This line seems to be a leftover now.","commit_id":"37bc5e99832e79ab44eb53acf01dceca295bc9d9"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"3223a87388cd40e363881bfb67bb604d35105aa6","unresolved":false,"context_lines":[{"line_number":64,"context_line":" * \u003ctt\u003e [ - random - ] \u003c/tt\u003e \\n"},{"line_number":65,"context_line":" * \u003ci\u003eCBC data channel crypto format in TLS-mode:\u003c/i\u003e \\n"},{"line_number":66,"context_line":" * \u003ctt\u003e [ HMAC ] [ - IV - ] [ * packet ID * ] [ * packet payload * ] \u003c/tt\u003e \\n"},{"line_number":67,"context_line":" * [ * packet payload * ] \u003c/tt\u003e"},{"line_number":68,"context_line":" *"},{"line_number":69,"context_line":" * @par"},{"line_number":70,"context_line":" * \u003cb\u003eCFB/OFB data channel crypto format\u003c/b\u003e \\n"}],"source_content_type":"text/x-csrc","patch_set":7,"id":"ecd4dd32_d10e2c2a","line":67,"in_reply_to":"9452977f_f8557e07","updated":"2026-11-09 21:32:10.000000000","message":"Done","commit_id":"37bc5e99832e79ab44eb53acf01dceca295bc9d9"},{"author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"a5fec96082b45f4d7cf1697631e0be026ec22200","unresolved":true,"context_lines":[{"line_number":107,"context_line":" * @par"},{"line_number":108,"context_line":" * \u003cb\u003eNo-crypto data channel format\u003c/b\u003e \\n"},{"line_number":109,"context_line":" * In no-crypto mode (\\c \\-\\-cipher \\c none is specified), both TLS-mode and"},{"line_number":110,"context_line":" * static key mode are supported. No encryption will be performed on the packet,"},{"line_number":111,"context_line":" * but packets can still be authenticated. This mode does not require an IV.\\n"},{"line_number":112,"context_line":" * \u003ci\u003eNo-crypto data channel crypto format in TLS-mode:\u003c/i\u003e \\n"},{"line_number":113,"context_line":" * \u003ctt\u003e [ HMAC ] [ - packet ID - ] [ - packet payload - ] \u003c/tt\u003e \\n *"}],"source_content_type":"text/x-csrc","patch_set":7,"id":"a0850095_3bff5d62","line":110,"updated":"2026-11-09 19:21:26.000000000","message":"Paragraph still says \"both TLS-mode and static key mode are supported\".","commit_id":"37bc5e99832e79ab44eb53acf01dceca295bc9d9"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"3223a87388cd40e363881bfb67bb604d35105aa6","unresolved":false,"context_lines":[{"line_number":107,"context_line":" * @par"},{"line_number":108,"context_line":" * \u003cb\u003eNo-crypto data channel format\u003c/b\u003e \\n"},{"line_number":109,"context_line":" * In no-crypto mode (\\c \\-\\-cipher \\c none is specified), both TLS-mode and"},{"line_number":110,"context_line":" * static key mode are supported. No encryption will be performed on the packet,"},{"line_number":111,"context_line":" * but packets can still be authenticated. This mode does not require an IV.\\n"},{"line_number":112,"context_line":" * \u003ci\u003eNo-crypto data channel crypto format in TLS-mode:\u003c/i\u003e \\n"},{"line_number":113,"context_line":" * \u003ctt\u003e [ HMAC ] [ - packet ID - ] [ - packet payload - ] \u003c/tt\u003e \\n *"}],"source_content_type":"text/x-csrc","patch_set":7,"id":"8c27f3f7_dddd26ba","line":110,"in_reply_to":"a0850095_3bff5d62","updated":"2026-11-09 21:32:10.000000000","message":"Done","commit_id":"37bc5e99832e79ab44eb53acf01dceca295bc9d9"},{"author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"a5fec96082b45f4d7cf1697631e0be026ec22200","unresolved":true,"context_lines":[{"line_number":110,"context_line":" * static key mode are supported. No encryption will be performed on the packet,"},{"line_number":111,"context_line":" * but packets can still be authenticated. This mode does not require an IV.\\n"},{"line_number":112,"context_line":" * \u003ci\u003eNo-crypto data channel crypto format in TLS-mode:\u003c/i\u003e \\n"},{"line_number":113,"context_line":" * \u003ctt\u003e [ HMAC ] [ - packet ID - ] [ - packet payload - ] \u003c/tt\u003e \\n *"},{"line_number":114,"context_line":" */"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"#ifndef CRYPTO_H"}],"source_content_type":"text/x-csrc","patch_set":7,"id":"7f2849f1_029908e4","line":113,"updated":"2026-11-09 19:21:26.000000000","message":"There seems to be a stray `*` here.","commit_id":"37bc5e99832e79ab44eb53acf01dceca295bc9d9"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"3223a87388cd40e363881bfb67bb604d35105aa6","unresolved":false,"context_lines":[{"line_number":110,"context_line":" * static key mode are supported. No encryption will be performed on the packet,"},{"line_number":111,"context_line":" * but packets can still be authenticated. This mode does not require an IV.\\n"},{"line_number":112,"context_line":" * \u003ci\u003eNo-crypto data channel crypto format in TLS-mode:\u003c/i\u003e \\n"},{"line_number":113,"context_line":" * \u003ctt\u003e [ HMAC ] [ - packet ID - ] [ - packet payload - ] \u003c/tt\u003e \\n *"},{"line_number":114,"context_line":" */"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"#ifndef CRYPTO_H"}],"source_content_type":"text/x-csrc","patch_set":7,"id":"69e7b673_b579026a","line":113,"in_reply_to":"7f2849f1_029908e4","updated":"2026-11-09 21:32:10.000000000","message":"Done","commit_id":"37bc5e99832e79ab44eb53acf01dceca295bc9d9"}],"src/openvpn/crypto_mbedtls.c":[{"author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"a5fec96082b45f4d7cf1697631e0be026ec22200","unresolved":true,"context_lines":[{"line_number":1013,"context_line":"    printf(\"The following ciphers and cipher modes are available for use\\n\""},{"line_number":1014,"context_line":"           \"with \" PACKAGE_NAME \".  Each cipher shown below may be used as a\\n\""},{"line_number":1015,"context_line":"           \"parameter to the --data-ciphers (or --cipher) option.  Using a\\n\""},{"line_number":1016,"context_line":"           \"GCM or CBC mode is recommended. \\n\\n\");"},{"line_number":1017,"context_line":"#endif"},{"line_number":1018,"context_line":""},{"line_number":1019,"context_line":"    for (size_t i \u003d 0; i \u003c cipher_info_table_entries; i++)"}],"source_content_type":"text/x-csrc","patch_set":7,"id":"301243a1_361f34b6","line":1016,"updated":"2026-11-09 19:21:26.000000000","message":"Probably stray space before the first `\\n`.","commit_id":"37bc5e99832e79ab44eb53acf01dceca295bc9d9"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"3223a87388cd40e363881bfb67bb604d35105aa6","unresolved":false,"context_lines":[{"line_number":1013,"context_line":"    printf(\"The following ciphers and cipher modes are available for use\\n\""},{"line_number":1014,"context_line":"           \"with \" PACKAGE_NAME \".  Each cipher shown below may be used as a\\n\""},{"line_number":1015,"context_line":"           \"parameter to the --data-ciphers (or --cipher) option.  Using a\\n\""},{"line_number":1016,"context_line":"           \"GCM or CBC mode is recommended. \\n\\n\");"},{"line_number":1017,"context_line":"#endif"},{"line_number":1018,"context_line":""},{"line_number":1019,"context_line":"    for (size_t i \u003d 0; i \u003c cipher_info_table_entries; i++)"}],"source_content_type":"text/x-csrc","patch_set":7,"id":"eab8ae19_c180a8ff","line":1016,"in_reply_to":"301243a1_361f34b6","updated":"2026-11-09 21:32:10.000000000","message":"Done","commit_id":"37bc5e99832e79ab44eb53acf01dceca295bc9d9"}],"src/openvpn/init.c":[{"author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"a5fec96082b45f4d7cf1697631e0be026ec22200","unresolved":true,"context_lines":[{"line_number":1013,"context_line":"        }"},{"line_number":1014,"context_line":""},{"line_number":1015,"context_line":"        msg(D_GENKEY | M_NOPREFIX, \"Randomly generated %d bit key written to %s\", nbits_written,"},{"line_number":1016,"context_line":"            options-\u003egenkey_filename ? options-\u003egenkey_filename : \"stdout\");"},{"line_number":1017,"context_line":"        return true;"},{"line_number":1018,"context_line":"    }"},{"line_number":1019,"context_line":"    else if (options-\u003egenkey \u0026\u0026 options-\u003egenkey_type \u003d\u003d GENKEY_TLS_CRYPTV2_SERVER)"}],"source_content_type":"text/x-csrc","patch_set":7,"id":"6ecfa9e1_f8f4cf62","line":1016,"updated":"2026-11-09 19:21:26.000000000","message":"Should this be `genkey_filename` (instead of `options-\u003egenkey_filename`)?","commit_id":"37bc5e99832e79ab44eb53acf01dceca295bc9d9"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"3223a87388cd40e363881bfb67bb604d35105aa6","unresolved":false,"context_lines":[{"line_number":1013,"context_line":"        }"},{"line_number":1014,"context_line":""},{"line_number":1015,"context_line":"        msg(D_GENKEY | M_NOPREFIX, \"Randomly generated %d bit key written to %s\", nbits_written,"},{"line_number":1016,"context_line":"            options-\u003egenkey_filename ? options-\u003egenkey_filename : \"stdout\");"},{"line_number":1017,"context_line":"        return true;"},{"line_number":1018,"context_line":"    }"},{"line_number":1019,"context_line":"    else if (options-\u003egenkey \u0026\u0026 options-\u003egenkey_type \u003d\u003d GENKEY_TLS_CRYPTV2_SERVER)"}],"source_content_type":"text/x-csrc","patch_set":7,"id":"29eb7a78_7c402423","line":1016,"in_reply_to":"6ecfa9e1_f8f4cf62","updated":"2026-11-09 21:32:10.000000000","message":"Done","commit_id":"37bc5e99832e79ab44eb53acf01dceca295bc9d9"}],"src/openvpn/options.c":[{"author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"aba05b8359e101238813f5750ef972020b094c16","unresolved":true,"context_lines":[{"line_number":1597,"context_line":""},{"line_number":1598,"context_line":"    init_options(\u0026defaults);"},{"line_number":1599,"context_line":""},{"line_number":1600,"context_line":"    if (!options-\u003etest_crypto)"},{"line_number":1601,"context_line":"    {"},{"line_number":1602,"context_line":"        notnull(options-\u003edev, \"TUN/TAP device (--dev)\");"},{"line_number":1603,"context_line":"    }"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"800e53f0_74471d6a","line":1600,"updated":"2026-11-02 13:30:55.000000000","message":"With the early return, we never get here anymore.","commit_id":"68fd83945956945d64655703fdb33041757f812d"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"e89191b062df116c6f7d3b840166f68657d1ec6b","unresolved":false,"context_lines":[{"line_number":1597,"context_line":""},{"line_number":1598,"context_line":"    init_options(\u0026defaults);"},{"line_number":1599,"context_line":""},{"line_number":1600,"context_line":"    if (!options-\u003etest_crypto)"},{"line_number":1601,"context_line":"    {"},{"line_number":1602,"context_line":"        notnull(options-\u003edev, \"TUN/TAP device (--dev)\");"},{"line_number":1603,"context_line":"    }"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"36213a18_84557d36","line":1600,"in_reply_to":"800e53f0_74471d6a","updated":"2026-11-03 11:12:37.000000000","message":"Done","commit_id":"68fd83945956945d64655703fdb33041757f812d"},{"author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"7596cade7231143f379459dd7c90c1dd1ef57dbc","unresolved":true,"context_lines":[{"line_number":2013,"context_line":"    /*"},{"line_number":2014,"context_line":"     * SSL/TLS mode sanity checks."},{"line_number":2015,"context_line":"     */"},{"line_number":2016,"context_line":"    if (options-\u003etls_server + options-\u003etls_client + options-\u003etest_crypto !\u003d 1)"},{"line_number":2017,"context_line":"    {"},{"line_number":2018,"context_line":"        msg(M_USAGE, \"OpenVPN configuration must use either --tls-server or --tls-client\");"},{"line_number":2019,"context_line":"    }"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"714bf9a8_e33178da","line":2016,"updated":"2026-11-02 15:51:25.000000000","message":"Since we know that `options-\u003etest_crypto` is always zero here, we can drop it from the `if()`.","commit_id":"168d741a412fe24413fcf382db0800a6ab23c95a"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"e89191b062df116c6f7d3b840166f68657d1ec6b","unresolved":false,"context_lines":[{"line_number":2013,"context_line":"    /*"},{"line_number":2014,"context_line":"     * SSL/TLS mode sanity checks."},{"line_number":2015,"context_line":"     */"},{"line_number":2016,"context_line":"    if (options-\u003etls_server + options-\u003etls_client + options-\u003etest_crypto !\u003d 1)"},{"line_number":2017,"context_line":"    {"},{"line_number":2018,"context_line":"        msg(M_USAGE, \"OpenVPN configuration must use either --tls-server or --tls-client\");"},{"line_number":2019,"context_line":"    }"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"70b90f1a_085382ba","line":2016,"in_reply_to":"714bf9a8_e33178da","updated":"2026-11-03 11:12:37.000000000","message":"Done","commit_id":"168d741a412fe24413fcf382db0800a6ab23c95a"},{"author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"7596cade7231143f379459dd7c90c1dd1ef57dbc","unresolved":true,"context_lines":[{"line_number":2035,"context_line":"        msg(M_USAGE, \"--tls-version-min bigger than --tls-version-max\");"},{"line_number":2036,"context_line":"    }"},{"line_number":2037,"context_line":""},{"line_number":2038,"context_line":""},{"line_number":2039,"context_line":"    check_ca_required(options);"},{"line_number":2040,"context_line":"#ifdef ENABLE_PKCS11"},{"line_number":2041,"context_line":"    if (!options-\u003epkcs11_providers[0] \u0026\u0026 options-\u003epkcs11_id)"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"cf50b019_e22754bf","line":2038,"updated":"2026-11-02 15:51:25.000000000","message":"This now ends up as double blank lines.","commit_id":"168d741a412fe24413fcf382db0800a6ab23c95a"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"e89191b062df116c6f7d3b840166f68657d1ec6b","unresolved":false,"context_lines":[{"line_number":2035,"context_line":"        msg(M_USAGE, \"--tls-version-min bigger than --tls-version-max\");"},{"line_number":2036,"context_line":"    }"},{"line_number":2037,"context_line":""},{"line_number":2038,"context_line":""},{"line_number":2039,"context_line":"    check_ca_required(options);"},{"line_number":2040,"context_line":"#ifdef ENABLE_PKCS11"},{"line_number":2041,"context_line":"    if (!options-\u003epkcs11_providers[0] \u0026\u0026 options-\u003epkcs11_id)"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"87c4e0d1_b8674ec1","line":2038,"in_reply_to":"cf50b019_e22754bf","updated":"2026-11-03 11:12:37.000000000","message":"Done","commit_id":"168d741a412fe24413fcf382db0800a6ab23c95a"},{"author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"a5fec96082b45f4d7cf1697631e0be026ec22200","unresolved":true,"context_lines":[{"line_number":562,"context_line":"    \"                  digest algorithm alg (default\u003d%s).\\n\""},{"line_number":563,"context_line":"    \"                  (usually adds 16 or 20 bytes per packet)\\n\""},{"line_number":564,"context_line":"    \"                  Set alg\u003dnone to disable authentication.\\n\""},{"line_number":565,"context_line":"    \"--cipher alg    : Ignored. You should usually use --data-ciphers instead.\\n\""},{"line_number":566,"context_line":"    \"--data-ciphers list : List of ciphers that are allowed to be negotiated.\\n\""},{"line_number":567,"context_line":"#ifndef ENABLE_CRYPTO_MBEDTLS"},{"line_number":568,"context_line":"    \"--engine [name] : Enable OpenSSL hardware crypto engine functionality.\\n\""}],"source_content_type":"text/x-csrc","patch_set":7,"id":"013d601b_9cf96d3a","line":565,"updated":"2026-11-09 19:21:26.000000000","message":"`--cipher` still works in p2p mode in options.c, so it doesn\u0027t seem to be completely ignored.\n\nMaybe we should say something like \"Deprecated, use --data-ciphers / --data-ciphers-fallback instead.\"","commit_id":"37bc5e99832e79ab44eb53acf01dceca295bc9d9"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"3223a87388cd40e363881bfb67bb604d35105aa6","unresolved":true,"context_lines":[{"line_number":562,"context_line":"    \"                  digest algorithm alg (default\u003d%s).\\n\""},{"line_number":563,"context_line":"    \"                  (usually adds 16 or 20 bytes per packet)\\n\""},{"line_number":564,"context_line":"    \"                  Set alg\u003dnone to disable authentication.\\n\""},{"line_number":565,"context_line":"    \"--cipher alg    : Ignored. You should usually use --data-ciphers instead.\\n\""},{"line_number":566,"context_line":"    \"--data-ciphers list : List of ciphers that are allowed to be negotiated.\\n\""},{"line_number":567,"context_line":"#ifndef ENABLE_CRYPTO_MBEDTLS"},{"line_number":568,"context_line":"    \"--engine [name] : Enable OpenSSL hardware crypto engine functionality.\\n\""}],"source_content_type":"text/x-csrc","patch_set":7,"id":"ffe0364e_db1ce1b7","line":565,"in_reply_to":"013d601b_9cf96d3a","updated":"2026-11-09 21:32:10.000000000","message":"Yeah there are corner conditions in p2p where it still is used but I think we should no longer note on that cornercase here.","commit_id":"37bc5e99832e79ab44eb53acf01dceca295bc9d9"}],"tests/unit_tests/openvpn/test_crypto.c":[{"author":{"_account_id":1000001,"name":"Frank Lichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"change_message_id":"1da71cf50dfd48d2e26d1c2a0c2ce98597bc8039","unresolved":true,"context_lines":[{"line_number":370,"context_line":"    o.authname \u003d \"none\";"},{"line_number":371,"context_line":"    init_key_type(\u0026kt, o.ciphername, o.authname, false);"},{"line_number":372,"context_line":""},{"line_number":373,"context_line":"    for (int i \u003d 990; i \u003c\u003d 1015; i++)"},{"line_number":374,"context_line":"    {"},{"line_number":375,"context_line":"        /* 992 - 1008 should end up with the same mssfix value all they"},{"line_number":376,"context_line":"         * all result in the same CBC block size/padding and \u003c\u003d 992 and \u003e\u003d1009"}],"source_content_type":"text/x-csrc","patch_set":1,"id":"57ac51db_9707e911","line":373,"updated":"2026-11-02 11:47:09.000000000","message":"Why all these changes to the numbers? Separate patch that spilled over?","commit_id":"8292574b42c32903e304a7e88e92e4e60bea50a9"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"8cb9a360328bcf214974f27fc7822ed78858e803","unresolved":false,"context_lines":[{"line_number":370,"context_line":"    o.authname \u003d \"none\";"},{"line_number":371,"context_line":"    init_key_type(\u0026kt, o.ciphername, o.authname, false);"},{"line_number":372,"context_line":""},{"line_number":373,"context_line":"    for (int i \u003d 990; i \u003c\u003d 1015; i++)"},{"line_number":374,"context_line":"    {"},{"line_number":375,"context_line":"        /* 992 - 1008 should end up with the same mssfix value all they"},{"line_number":376,"context_line":"         * all result in the same CBC block size/padding and \u003c\u003d 992 and \u003e\u003d1009"}],"source_content_type":"text/x-csrc","patch_set":1,"id":"f3a3e24c_a475dae9","line":373,"in_reply_to":"57ac51db_9707e911","updated":"2026-11-02 12:22:10.000000000","message":"No, the old calculation tested all these with secret which uses a different header size (e.g. no op code but 8 byte packet id instead of 4 byte). I changed the tests to use/work with TLS now.","commit_id":"8292574b42c32903e304a7e88e92e4e60bea50a9"},{"author":{"_account_id":1000001,"name":"Frank Lichtenheld","display_name":"Frank Lichtenheld","email":"frank@lichtenheld.com","username":"flichtenheld","status":"OpenVPN Inc."},"change_message_id":"839dc97273a74ab22db211fe4cfc206a8478a961","unresolved":true,"context_lines":[{"line_number":308,"context_line":"    o.ciphername \u003d \"none\";"},{"line_number":309,"context_line":""},{"line_number":310,"context_line":"    linkmtu \u003d calc_options_string_link_mtu(\u0026o, \u0026f);"},{"line_number":311,"context_line":"    assert_int_equal(linkmtu, 1405);"},{"line_number":312,"context_line":""},{"line_number":313,"context_line":"    /* tls client, auth SHA1, cipher AES-256-GCM */"},{"line_number":314,"context_line":"    o.authname \u003d \"SHA1\";"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"08cacf2d_60252549","line":311,"updated":"2026-11-02 12:35:10.000000000","message":"This test seems to be redundant now?","commit_id":"68fd83945956945d64655703fdb33041757f812d"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"7f41ef27bbd9a943d9ffee108e6f1968d642629e","unresolved":false,"context_lines":[{"line_number":308,"context_line":"    o.ciphername \u003d \"none\";"},{"line_number":309,"context_line":""},{"line_number":310,"context_line":"    linkmtu \u003d calc_options_string_link_mtu(\u0026o, \u0026f);"},{"line_number":311,"context_line":"    assert_int_equal(linkmtu, 1405);"},{"line_number":312,"context_line":""},{"line_number":313,"context_line":"    /* tls client, auth SHA1, cipher AES-256-GCM */"},{"line_number":314,"context_line":"    o.authname \u003d \"SHA1\";"}],"source_content_type":"text/x-csrc","patch_set":2,"id":"a9d635ea_0cd599b9","line":311,"in_reply_to":"08cacf2d_60252549","updated":"2026-11-02 13:18:56.000000000","message":"Done","commit_id":"68fd83945956945d64655703fdb33041757f812d"},{"author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"7596cade7231143f379459dd7c90c1dd1ef57dbc","unresolved":true,"context_lines":[{"line_number":341,"context_line":"    o.ce.proto \u003d PROTO_UDP;"},{"line_number":342,"context_line":"    o.tls_client \u003d true;"},{"line_number":343,"context_line":""},{"line_number":344,"context_line":"    /* No crypto at all */"},{"line_number":345,"context_line":"    o.ciphername \u003d \"none\";"},{"line_number":346,"context_line":"    o.authname \u003d \"none\";"},{"line_number":347,"context_line":"    struct key_type kt;"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"5273dc8a_419c3fe2","line":344,"updated":"2026-11-02 15:51:25.000000000","message":"This is now the same test as \"auth none, cipher none\". We might drop one of them.","commit_id":"168d741a412fe24413fcf382db0800a6ab23c95a"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"e89191b062df116c6f7d3b840166f68657d1ec6b","unresolved":false,"context_lines":[{"line_number":341,"context_line":"    o.ce.proto \u003d PROTO_UDP;"},{"line_number":342,"context_line":"    o.tls_client \u003d true;"},{"line_number":343,"context_line":""},{"line_number":344,"context_line":"    /* No crypto at all */"},{"line_number":345,"context_line":"    o.ciphername \u003d \"none\";"},{"line_number":346,"context_line":"    o.authname \u003d \"none\";"},{"line_number":347,"context_line":"    struct key_type kt;"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"cfa0eed3_e2518ed5","line":344,"in_reply_to":"5273dc8a_419c3fe2","updated":"2026-11-03 11:12:37.000000000","message":"Done","commit_id":"168d741a412fe24413fcf382db0800a6ab23c95a"},{"author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"7596cade7231143f379459dd7c90c1dd1ef57dbc","unresolved":true,"context_lines":[{"line_number":358,"context_line":"    frame_calculate_dynamic(\u0026f, \u0026kt, \u0026o, NULL);"},{"line_number":359,"context_line":"    assert_int_equal(f.mss_fix, 955);"},{"line_number":360,"context_line":""},{"line_number":361,"context_line":"    /* secret, cipher AES-128-CBC, auth none */"},{"line_number":362,"context_line":"    o.ciphername \u003d \"AES-128-CBC\";"},{"line_number":363,"context_line":"    o.authname \u003d \"none\";"},{"line_number":364,"context_line":"    init_key_type(\u0026kt, o.ciphername, o.authname, false);"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"2fbe1351_4c951cb1","line":361,"updated":"2026-11-02 15:51:25.000000000","message":"Leftover comment?","commit_id":"168d741a412fe24413fcf382db0800a6ab23c95a"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"e89191b062df116c6f7d3b840166f68657d1ec6b","unresolved":false,"context_lines":[{"line_number":358,"context_line":"    frame_calculate_dynamic(\u0026f, \u0026kt, \u0026o, NULL);"},{"line_number":359,"context_line":"    assert_int_equal(f.mss_fix, 955);"},{"line_number":360,"context_line":""},{"line_number":361,"context_line":"    /* secret, cipher AES-128-CBC, auth none */"},{"line_number":362,"context_line":"    o.ciphername \u003d \"AES-128-CBC\";"},{"line_number":363,"context_line":"    o.authname \u003d \"none\";"},{"line_number":364,"context_line":"    init_key_type(\u0026kt, o.ciphername, o.authname, false);"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"896ad5ac_938bad53","line":361,"in_reply_to":"2fbe1351_4c951cb1","updated":"2026-11-03 11:12:37.000000000","message":"Done","commit_id":"168d741a412fe24413fcf382db0800a6ab23c95a"},{"author":{"_account_id":1000053,"name":"Răzvan Cojocaru","display_name":"Razvan Cojocaru","email":"razvanc@mailbox.org","username":"razvanc"},"change_message_id":"7596cade7231143f379459dd7c90c1dd1ef57dbc","unresolved":true,"context_lines":[{"line_number":389,"context_line":"    /* Same but with compression added. Compression adds one byte extra to the"},{"line_number":390,"context_line":"     * payload so the payload should be reduced by compared to the no"},{"line_number":391,"context_line":"     * compression calculation before */"},{"line_number":392,"context_line":"    for (int i \u003d 990; i \u003c\u003d 1010; i++)"},{"line_number":393,"context_line":"    {"},{"line_number":394,"context_line":"        /* 992 - 1008 should end up with the same mssfix value all they"},{"line_number":395,"context_line":"         * all result in the same CBC block size/padding and \u003c\u003d 992 and \u003e\u003d1009"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"81a515f3_4b35be73","line":392,"updated":"2026-11-02 15:51:25.000000000","message":"Should this loop go to 1015 as well?","commit_id":"168d741a412fe24413fcf382db0800a6ab23c95a"},{"author":{"_account_id":1000003,"name":"Arne Schwabe","display_name":"Arne Schwabe","email":"arne-openvpn@rfc2549.org","username":"plaisthos"},"change_message_id":"e89191b062df116c6f7d3b840166f68657d1ec6b","unresolved":false,"context_lines":[{"line_number":389,"context_line":"    /* Same but with compression added. Compression adds one byte extra to the"},{"line_number":390,"context_line":"     * payload so the payload should be reduced by compared to the no"},{"line_number":391,"context_line":"     * compression calculation before */"},{"line_number":392,"context_line":"    for (int i \u003d 990; i \u003c\u003d 1010; i++)"},{"line_number":393,"context_line":"    {"},{"line_number":394,"context_line":"        /* 992 - 1008 should end up with the same mssfix value all they"},{"line_number":395,"context_line":"         * all result in the same CBC block size/padding and \u003c\u003d 992 and \u003e\u003d1009"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"ce87c6fc_43383eb1","line":392,"in_reply_to":"81a515f3_4b35be73","updated":"2026-11-03 11:12:37.000000000","message":"Done","commit_id":"168d741a412fe24413fcf382db0800a6ab23c95a"}]}