
Follow https://www.openbsd.org/faq/faq15.html#Ports to download, verify, and
extract the ports tree on your machine. Then:

cd ports/net/openvpn
patch < ~/openvpn-2.3.17p0.diff
make install




Joel Knight
www.packetmischief.ca

Index: Makefile
===================================================================
RCS file: /cvs/ports/net/openvpn/Makefile,v
retrieving revision 1.65.2.1
diff -p -u -r1.65.2.1 Makefile
--- Makefile	23 Nov 2016 14:29:33 -0000	1.65.2.1
+++ Makefile	23 Jun 2017 03:02:31 -0000
@@ -2,7 +2,7 @@
 
 COMMENT=	easy-to-use, robust, and highly configurable VPN
 
-DISTNAME=	openvpn-2.3.11
+DISTNAME=	openvpn-2.3.17
 REVISION=	0
 CATEGORIES=	net security
 
Index: distinfo
===================================================================
RCS file: /cvs/ports/net/openvpn/distinfo,v
retrieving revision 1.32
diff -p -u -r1.32 distinfo
--- distinfo	14 May 2016 13:14:46 -0000	1.32
+++ distinfo	23 Jun 2017 03:02:31 -0000
@@ -1,2 +1,2 @@
-SHA256 (openvpn-2.3.11.tar.gz) = kRekQ0/TXmHPlPnufvhLeuy8b6VW93n/WZVg8hl1YWM=
-SIZE (openvpn-2.3.11.tar.gz) = 1242816
+SHA256 (openvpn-2.3.17.tar.gz) = r4BsR2I6odgkbPB5CYR2b2HI0KY+oLBBJ/9cbGXkYIg=
+SIZE (openvpn-2.3.17.tar.gz) = 1292639
Index: patches/patch-Makefile_in
===================================================================
RCS file: /cvs/ports/net/openvpn/patches/Attic/patch-Makefile_in,v
retrieving revision 1.5
diff -p -u -r1.5 patch-Makefile_in
--- patches/patch-Makefile_in	14 May 2016 13:14:46 -0000	1.5
+++ patches/patch-Makefile_in	23 Jun 2017 03:02:31 -0000
@@ -1,10 +1,10 @@
 $OpenBSD: patch-Makefile_in,v 1.5 2016/05/14 13:14:46 sthen Exp $
---- Makefile.in.orig	Tue May 10 07:02:54 2016
-+++ Makefile.in	Sat May 14 13:45:56 2016
-@@ -467,8 +467,7 @@ EXTRA_DIST = \
+--- Makefile.in.orig	Tue Jun 20 05:14:57 2017
++++ Makefile.in	Thu Jun 22 12:16:20 2017
+@@ -473,8 +473,7 @@ EXTRA_DIST = \
  @GIT_CHECKOUT_TRUE@	config-version.h
  
- SUBDIRS = build distro include src sample doc tests
+ SUBDIRS = build distro include src sample doc vendor tests
 -dist_doc_DATA = README README.IPv6 README.polarssl COPYRIGHT.GPL \
 -	COPYING $(am__append_1)
 +dist_doc_DATA = $(am__append_1)
Index: patches/patch-configure
===================================================================
RCS file: /cvs/ports/net/openvpn/patches/patch-configure,v
retrieving revision 1.12
diff -p -u -r1.12 patch-configure
--- patches/patch-configure	14 May 2016 13:14:46 -0000	1.12
+++ patches/patch-configure	23 Jun 2017 03:02:31 -0000
@@ -1,7 +1,7 @@
 $OpenBSD: patch-configure,v 1.12 2016/05/14 13:14:46 sthen Exp $
---- configure.orig	Tue May 10 07:02:53 2016
-+++ configure	Sat May 14 13:45:56 2016
-@@ -17544,7 +17544,7 @@ fi
+--- configure.orig	Tue Jun 20 05:14:55 2017
++++ configure	Thu Jun 22 12:40:21 2017
+@@ -17565,7 +17565,7 @@ fi
  
  
  plugindir="${with_plugindir}"
Index: patches/patch-include_Makefile_in
===================================================================
RCS file: /cvs/ports/net/openvpn/patches/patch-include_Makefile_in,v
retrieving revision 1.5
diff -p -u -r1.5 patch-include_Makefile_in
--- patches/patch-include_Makefile_in	14 May 2016 13:14:46 -0000	1.5
+++ patches/patch-include_Makefile_in	23 Jun 2017 03:02:31 -0000
@@ -1,7 +1,7 @@
 $OpenBSD: patch-include_Makefile_in,v 1.5 2016/05/14 13:14:46 sthen Exp $
---- include/Makefile.in.orig	Tue May 10 07:02:54 2016
-+++ include/Makefile.in	Sat May 14 13:45:56 2016
-@@ -322,7 +322,7 @@ host_cpu = @host_cpu@
+--- include/Makefile.in.orig	Tue Jun 20 05:14:58 2017
++++ include/Makefile.in	Thu Jun 22 12:40:21 2017
+@@ -328,7 +328,7 @@ host_cpu = @host_cpu@
  host_os = @host_os@
  host_vendor = @host_vendor@
  htmldir = @htmldir@
Index: patches/patch-sample_sample-config-files_server_conf
===================================================================
RCS file: /cvs/ports/net/openvpn/patches/patch-sample_sample-config-files_server_conf,v
retrieving revision 1.3
diff -p -u -r1.3 patch-sample_sample-config-files_server_conf
--- patches/patch-sample_sample-config-files_server_conf	1 Dec 2014 21:43:39 -0000	1.3
+++ patches/patch-sample_sample-config-files_server_conf	23 Jun 2017 03:02:31 -0000
@@ -1,7 +1,7 @@
 $OpenBSD: patch-sample_sample-config-files_server_conf,v 1.3 2014/12/01 21:43:39 sthen Exp $
---- sample/sample-config-files/server.conf.orig	Sat Nov 29 14:59:45 2014
-+++ sample/sample-config-files/server.conf	Mon Dec  1 21:39:30 2014
-@@ -264,8 +264,8 @@ comp-lzo
+--- sample/sample-config-files/server.conf.orig	Tue Jun 20 05:14:37 2017
++++ sample/sample-config-files/server.conf	Thu Jun 22 12:40:21 2017
+@@ -271,8 +271,8 @@ cipher AES-256-CBC
  #
  # You can uncomment this out on
  # non-Windows systems.
Index: patches/patch-sample_sample-config-files_static-home_conf
===================================================================
RCS file: /cvs/ports/net/openvpn/patches/patch-sample_sample-config-files_static-home_conf,v
retrieving revision 1.1
diff -p -u -r1.1 patch-sample_sample-config-files_static-home_conf
--- patches/patch-sample_sample-config-files_static-home_conf	20 Apr 2013 16:22:55 -0000	1.1
+++ patches/patch-sample_sample-config-files_static-home_conf	23 Jun 2017 03:02:31 -0000
@@ -1,7 +1,7 @@
 $OpenBSD: patch-sample_sample-config-files_static-home_conf,v 1.1 2013/04/20 16:22:55 sthen Exp $
---- sample/sample-config-files/static-home.conf.orig	Mon Sep 10 17:01:08 2012
-+++ sample/sample-config-files/static-home.conf	Thu Mar  7 14:02:35 2013
-@@ -37,10 +37,10 @@ secret static.key
+--- sample/sample-config-files/static-home.conf.orig	Tue Jun 20 05:14:37 2017
++++ sample/sample-config-files/static-home.conf	Thu Jun 22 12:40:21 2017
+@@ -40,10 +40,10 @@ cipher AES-256-CBC
  ; port 1194
  
  # Downgrade UID and GID to
Index: patches/patch-sample_sample-config-files_static-office_conf
===================================================================
RCS file: /cvs/ports/net/openvpn/patches/patch-sample_sample-config-files_static-office_conf,v
retrieving revision 1.1
diff -p -u -r1.1 patch-sample_sample-config-files_static-office_conf
--- patches/patch-sample_sample-config-files_static-office_conf	20 Apr 2013 16:22:55 -0000	1.1
+++ patches/patch-sample_sample-config-files_static-office_conf	23 Jun 2017 03:02:31 -0000
@@ -1,7 +1,7 @@
 $OpenBSD: patch-sample_sample-config-files_static-office_conf,v 1.1 2013/04/20 16:22:55 sthen Exp $
---- sample/sample-config-files/static-office.conf.orig	Mon Sep 10 17:01:08 2012
-+++ sample/sample-config-files/static-office.conf	Thu Mar  7 14:02:35 2013
-@@ -34,10 +34,10 @@ secret static.key
+--- sample/sample-config-files/static-office.conf.orig	Tue Jun 20 05:14:37 2017
++++ sample/sample-config-files/static-office.conf	Thu Jun 22 12:40:21 2017
+@@ -37,10 +37,10 @@ cipher AES-256-CBC
  ; port 1194
  
  # Downgrade UID and GID to
Index: patches/patch-src_openvpn_route_c
===================================================================
RCS file: /cvs/ports/net/openvpn/patches/patch-src_openvpn_route_c,v
retrieving revision 1.5.2.1
diff -p -u -r1.5.2.1 patch-src_openvpn_route_c
--- patches/patch-src_openvpn_route_c	23 Nov 2016 14:29:33 -0000	1.5.2.1
+++ patches/patch-src_openvpn_route_c	23 Jun 2017 03:02:31 -0000
@@ -2,9 +2,9 @@ $OpenBSD: patch-src_openvpn_route_c,v 1.
 
 - add support for on-link routes
 
---- src/openvpn/route.c.orig	Tue May 10 08:02:33 2016
-+++ src/openvpn/route.c	Thu Nov 17 07:15:54 2016
-@@ -1501,12 +1501,14 @@ add_route (struct route_ipv4 *r,
+--- src/openvpn/route.c.orig	Tue Jun 20 05:14:37 2017
++++ src/openvpn/route.c	Thu Jun 22 12:40:22 2017
+@@ -1515,12 +1515,14 @@ add_route (struct route_ipv4 *r,
      argv_printf_cat (&argv, "-rtt %d", r->metric);
  #endif
  
Index: patches/patch-src_openvpn_tun_c
===================================================================
RCS file: /cvs/ports/net/openvpn/patches/patch-src_openvpn_tun_c,v
retrieving revision 1.8.4.1
diff -p -u -r1.8.4.1 patch-src_openvpn_tun_c
--- patches/patch-src_openvpn_tun_c	23 Nov 2016 14:29:33 -0000	1.8.4.1
+++ patches/patch-src_openvpn_tun_c	23 Jun 2017 03:02:31 -0000
@@ -5,9 +5,9 @@ $OpenBSD: patch-src_openvpn_tun_c,v 1.8.
   address.  In subnet topology, use the local address as a fake dest addr, and
   manually add a route for the prefix on the interface.
 
---- src/openvpn/tun.c.orig	Tue May 10 08:02:33 2016
-+++ src/openvpn/tun.c	Thu Nov 17 10:42:55 2016
-@@ -914,8 +914,17 @@ do_ifconfig (struct tuntap *tt,
+--- src/openvpn/tun.c.orig	Tue Jun 20 05:14:37 2017
++++ src/openvpn/tun.c	Thu Jun 22 20:55:43 2017
+@@ -915,8 +915,18 @@ do_ifconfig (struct tuntap *tt,
  
        tt->did_ifconfig = true;
  
@@ -23,10 +23,11 @@ $OpenBSD: patch-src_openvpn_tun_c,v 1.8.
 +# define MULTI_AF
 +#endif
 +
++
+       in_addr_t remote_end;		/* for "virtual" subnet topology */
+ 
        /*
-        * On OpenBSD, tun interfaces are persistent if created with
-        * "ifconfig tunX create", and auto-destroyed if created by
-@@ -925,66 +934,6 @@ do_ifconfig (struct tuntap *tt,
+@@ -928,80 +938,6 @@ do_ifconfig (struct tuntap *tt,
        /* example: ifconfig tun2 10.2.0.2 10.2.0.1 mtu 1450 netmask 255.255.255.255 up */
        if (tun)
  	argv_printf (&argv,
@@ -40,12 +41,13 @@ $OpenBSD: patch-src_openvpn_tun_c,v 1.8.
 -      else
 -	if ( tt->topology == TOP_SUBNET )
 -	{
+-	    remote_end = create_arbitrary_remote( tt );
 -	    argv_printf (&argv,
 -			  "%s %s %s %s mtu %d netmask %s up -link0",
 -			  IFCONFIG_PATH,
 -			  actual,
 -			  ifconfig_local,
--			  ifconfig_local,
+-			  print_in_addr_t (remote_end, 0, &gc),
 -			  tun_mtu,
 -			  ifconfig_remote_netmask
 -			  );
@@ -62,6 +64,19 @@ $OpenBSD: patch-src_openvpn_tun_c,v 1.8.
 -			  );
 -      argv_msg (M_INFO, &argv);
 -      openvpn_execve_check (&argv, es, S_FATAL, "OpenBSD ifconfig failed");
+-
+-      /* Add a network route for the local tun interface */
+-      if (!tun && tt->topology == TOP_SUBNET)
+-        {
+-          struct route_ipv4 r;
+-          CLEAR (r);
+-          r.flags = RT_DEFINED;
+-          r.network = tt->local & tt->remote_netmask;
+-          r.netmask = tt->remote_netmask;
+-          r.gateway = remote_end;
+-          add_route (&r, tt, 0, NULL, es);
+-        }
+-
 -      if ( do_ipv6 )
 -	{
 -	  argv_printf (&argv,
@@ -93,7 +108,7 @@ $OpenBSD: patch-src_openvpn_tun_c,v 1.8.
  			  "%s %s %s %s mtu %d netmask 255.255.255.255 up",
  			  IFCONFIG_PATH,
  			  actual,
-@@ -1007,9 +956,7 @@ do_ifconfig (struct tuntap *tt,
+@@ -1024,9 +960,7 @@ do_ifconfig (struct tuntap *tt,
  	}
        else
        /*
@@ -104,7 +119,7 @@ $OpenBSD: patch-src_openvpn_tun_c,v 1.8.
         */
  		argv_printf (&argv,
  			  "%s %s %s netmask %s mtu %d broadcast %s",
-@@ -1021,11 +968,11 @@ do_ifconfig (struct tuntap *tt,
+@@ -1038,11 +972,11 @@ do_ifconfig (struct tuntap *tt,
  			  ifconfig_broadcast
  			  );
        argv_msg (M_INFO, &argv);
@@ -118,7 +133,7 @@ $OpenBSD: patch-src_openvpn_tun_c,v 1.8.
  	  argv_printf (&argv,
  			  "%s %s inet6 %s/%d",
  			  IFCONFIG_PATH,
-@@ -1034,17 +981,30 @@ do_ifconfig (struct tuntap *tt,
+@@ -1051,17 +985,30 @@ do_ifconfig (struct tuntap *tt,
  			  tt->netbits_ipv6
  			  );
  	  argv_msg (M_INFO, &argv);
