6 files changed, 30 insertions, 14 deletions

diff --git a/UPDATING b/UPDATING
index 77abd63b4553..89ef99cde675 100644
--- a/UPDATING
+++ b/UPDATING
@@ -24,6 +24,15 @@ you update your ports collection, before attempting any port upgrades.
   Users who require the rrsync script must install Python separately,
   as indicated in the install message.
 
+20260401:
+  AFFECTS: users of security/openvpn
+  AUTHOR: mandree@FreeBSD.org
+
+  The openvpn 2.7 port update no longer installs the openvpn-client.up
+  and openvpn-client.down scripts into libexec/, but instead a
+  dns-updown script into libexec/openvpn/.
+  Review your configuration, and the openvpn man page for --dns-updown.
+
 20260329:
   AFFECTS: users of java/openjdk25 and java/openjdk26 with the jre flavor
   AUTHOR: jrm@FreeBSD.org
diff --git a/security/openvpn/Makefile b/security/openvpn/Makefile
index b331c2205fff..b267e810c066 100644
--- a/security/openvpn/Makefile
+++ b/security/openvpn/Makefile
@@ -1,5 +1,5 @@
 PORTNAME=		openvpn
-DISTVERSION=		2.6.20
+DISTVERSION=		2.7.1
 PORTREVISION?=		0
 CATEGORIES=		security net net-vpn
 MASTER_SITES=		https://swupdate.openvpn.org/community/releases/ \
@@ -157,8 +157,6 @@ post-build:
 post-install:
 	${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/openvpn/plugins/openvpn-plugin-auth-pam.so
 	${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/openvpn/plugins/openvpn-plugin-down-root.so
-	${INSTALL_SCRIPT} ${WRKSRC}/contrib/pull-resolv-conf/client.up ${STAGEDIR}${PREFIX}/libexec/openvpn-client.up
-	${INSTALL_SCRIPT} ${WRKSRC}/contrib/pull-resolv-conf/client.down ${STAGEDIR}${PREFIX}/libexec/openvpn-client.down
 	${INSTALL_SCRIPT} ${WRKDIR}/openvpn-client ${STAGEDIR}${PREFIX}/sbin/openvpn-client
 	${MKDIR} ${STAGEDIR}${PREFIX}/include
 
diff --git a/security/openvpn/distinfo b/security/openvpn/distinfo
index 390e5c562461..076472f98da7 100644
--- a/security/openvpn/distinfo
+++ b/security/openvpn/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1777718418
-SHA256 (openvpn-2.6.20.tar.gz) = 952ecee5b911a5353c0a6d40af62a7076c6dea1481ef204ce6d3f10481531315
-SIZE (openvpn-2.6.20.tar.gz) = 1942940
+TIMESTAMP = 1774966723
+SHA256 (openvpn-2.7.1.tar.gz) = 9858477ec2894a8a672974d8650dcb1af2eeffb468981a2b619f0fa387081167
+SIZE (openvpn-2.7.1.tar.gz) = 2088230
diff --git a/security/openvpn/files/openvpn-client.in b/security/openvpn/files/openvpn-client.in
index 471757811795..20f806fd7a9c 100644
--- a/security/openvpn/files/openvpn-client.in
+++ b/security/openvpn/files/openvpn-client.in
@@ -1,6 +1,5 @@
 #!/bin/sh
 
-exec %%PREFIX%%/sbin/openvpn --script-security 2 \
-    --up %%PREFIX%%/libexec/openvpn-client.up \
-    --plugin openvpn-plugin-down-root.so %%PREFIX%%/libexec/openvpn-client.down \
+exec %%PREFIX%%/sbin/openvpn \
+    --dns-updown force \
     --config "$@"
diff --git a/security/openvpn/files/pkg-message.in b/security/openvpn/files/pkg-message.in
index c527aec28683..770c343816b8 100644
--- a/security/openvpn/files/pkg-message.in
+++ b/security/openvpn/files/pkg-message.in
@@ -4,12 +4,13 @@
 Edit /etc/rc.conf[.local] to start OpenVPN automatically at system
 startup. See %%PREFIX%%/etc/rc.d/openvpn for details.
 
-Connect to VPN server as a client with this command to include
-the client.up/down scripts in the initialization:
+Connect to VPN server as a client with this command to include the
+%%PREFIX%%/libexec/openvpn/dns-updown script in the initialization:
 openvpn-client <spec>.ovpn
 
 For compatibility notes when interoperating with older OpenVPN
-versions, please see <http://openvpn.net/relnotes.html>
+versions, please see online documentation at
+<https://github.com/OpenVPN/openvpn/blob/release/2.7/Changes.rst>
 
 Note that OpenVPN does not officially support LibreSSL.
 
@@ -29,6 +30,16 @@ when an unprivileged user account is desired.
 
 It is advisable to review existing configuration files and
 to consider adding/changing user openvpn and group openvpn.
+
+For compatibility notes when interoperating with older OpenVPN
+versions, please see online documentation at
+<https://github.com/OpenVPN/openvpn/blob/release/2.7/Changes.rst>
+
+Note that the 2.7 version of the port replaced the
+libexec/openvpn-client.down and .up scripts with a shared
+%%PREFIX%%/libexec/openvpn/dns-updown script
+(the sbin/openvpn-client script has been updated accordingly).
+
 EOM
 }
 ]
diff --git a/security/openvpn/pkg-plist b/security/openvpn/pkg-plist
index a91ef85f2ee3..aaa55c692b28 100644
--- a/security/openvpn/pkg-plist
+++ b/security/openvpn/pkg-plist
@@ -2,8 +2,7 @@ include/openvpn-msg.h
 include/openvpn-plugin.h
 lib/openvpn/plugins/openvpn-plugin-auth-pam.so
 lib/openvpn/plugins/openvpn-plugin-down-root.so
-libexec/openvpn-client.down
-libexec/openvpn-client.up
+libexec/openvpn/dns-updown
 share/man/man5/openvpn-examples.5.gz
 share/man/man8/openvpn.8.gz
 sbin/openvpn