Where can we get release notes for openvpn3 core

[akodithy]

Where can we get summary of changes/release notes for each openvpn3 core release similar to https://github.com/OpenVPN/openvpn/releases/tag/v2.6.11? We need this info so that we can know the impact and testing scenarios to be covered if we upgrade to this version. Checked https://github.com/OpenVPN/openvpn3/releases/tag/release%2F3.9 and it only mentions “OpenVPN 3 Core library version 3.9” and there is no mention about security fixes, new features, bug fixes etc that went in this release.

On checking further, got some info about openvpn3 core changes from openvpn3 linux project but info looks very brief. For example, this link https://github.com/OpenVPN/openvpn3-linux/releases/tag/v21 mentions below about openvpn3 core changes between 3.7 and 3.8.2:

* Improvement: Upgrade OpenVPN 3 Core Library to v3.8.2
 
  This is an upgrade from Core Library 3.7, which provides more
  enhancements and adds support for the newer ovpn-dco-v2 kernel module

I agree that we can get all changes by performing git compare between two versions but this will require lot more effort for developers to understand changes and summarize (For example, checked release/3.8...release/3.9 for changes between 3.8 and 3.9 and it showed 329 commits and 324 files changed and so, going thru them will take lot more time).

[dsommers]

Since I've mostly been involved in closing these releases, I'll try to do a similar approach as I do in OpenVPN 3 Linux ... adding a some more "release notes" type of comment in the git tag.

To quickly summarize Core 3.9 - in random order:

• Lots of minor improvements fixing issues pointed out by the Trails of bits security audit
• Fixing inactive N option not being honoured
• Fixing incorrect unsigned/signed int handling in the RandomAPI
• Swig type fixes
• Use OpenSSL 3.0 API for KDF
• Fix for NULL-dereference in PKCS#7 (this code path is not used for OpenVPN protocol, but for AWS integration, thus low security impact)
• Added support for mbed TLS 3.0
• Further improvements of "unknown/unsupported options" handling
• Logging infrastructure improvements
• Refine forced re-authentication flow
• Added support for the auth-nocache option
• Fixed incorrect behaviour with cipher none
• Implement support for the new dns option
• Fix ADPATER_DOMAIN_SUFFIX doesn't work when using ovpnagent and DCO
• Enhance --redirect-gateway block-local as a Tunnelcrack defence mechanism