Highlighted Articles
  News
  Installing Tunnelblick
  Uninstalling Tunnelblick
  Setting up Configurations
  Using Tunnelblick
  Getting VPN Service
  Common Problems
  Configuring OpenVPN
  Release Notes
  Thanks
  FAQ

Discussion Group
Read Before You Post

Old Release Notes

On This Page
    Newer Versions
    Version 3.6
    Version 3.5
    Version 3.4
    Version 3.3
    Version 3.2
    Version 3.1
    Version 3.0

Newer Versions

Release notes for newer versions are available on the Release Notes page.

Version 3.6

3.6.10 build 4760 (2017-01-16)

Includes updated translations.

3.6.10beta06 build 4750 (2016-12-27)

Includes OpenVPN 2.4.0 (and OpenVPN 2.3.14).

3.6.10beta05 build 4740 (2016-12-22)

Includes OpenVPN 2.4_rc2 (and OpenVPN 2.3.14).
Includes scripts for signing appcasts and updates (for the Tunnelblick application itself and for configurations).
Displays stdout and stderr output from scripts in the Tunnelblick log.
No longer creates ~/Library/openvpn.
Logs more information when tunnelblickd needs to be reloaded.
Uses Sparkle's feedURLStringForUpdater for updatable configurations.
Uses SUPublicDSAKey instead of SUPublicDSAKeyFile.
Displays Tunnelblick version in splash screen.
Includes updated translations.
Fixes a spurious warning about ~/Library/openvpn.
Fixes a crash when installing an updatable configuration.
Fixes a problem with PKCS#11 tokens.

3.6.10beta04 build 4730 (2016-12-07)

Includes OpenVPN 2.3.14 and 2.4_rc1 (release candidate 1).
Includes new translations for for Azerbaijani, Catalan, and Indonesian.

3.6.10beta03 build 4720 (2016-12-03)

Includes OpenVPN 2.4_rc1 (release candidate 1) and 2.3.13.
Includes new translations for Korean and adds some Azerbaijani translations.

3.6.10beta02 build 4710 (2016-11-29)

Includes OpenVPN 2.4_beta2 and 2.3.13.
Includes updated translations.

3.6.10beta01 build 4700 (2016-11-17)

Includes OpenVPN 2.4_beta1 and 2.3.13.
Includes updated localization.

3.6.9 build 4685 (2016-11-17)

Includes OpenVPN 2.3.13 and OpenVPN 2.3.12.
Adds Yandex Public DNS to the list of known DNS providers.

3.6.9beta02 build 4675 (2016-11-04)

Includes OpenVPN 2.3.13 and OpenVPN 2.4 alpha2 in addition to 2.3.12.
Displays the computer's apparent public IP address in the Tunnelblick menu when connected to a VPN.
Includes additional popup help.
Fixes a problem that sometimes caused the "VPN Details" window to appear at login.
Fixes problems with a username/password/passphrase that is too long.
Fixes problems with non-7-bit-ASCII in username/password/passphrase or token name.
Fixes a problem in setting the focus for text input in VPN login windows.
Fixes a problem that disabled the 'Set DNS after routes are set instead of before routes are set' checkbox when 'Set nameserver' was not selected.
Fixes a potential race condition on macOS Sierra.

3.6.9beta01 build 4651 (2016-10-09)

Adds versions of OpenVPN that use LibreSSL 2.5.0. Special thanks to GΛVĪN for his work on this.
Includes OpenVPN 2.3 git-master bae1ad7 dated 2016-10-07.

3.6.8 build 4625 (2016-10-09)

Fixes a problem automatically installing configurations with Tunnelblick when Tunnelblick is not already installed.
Fixes a problem displaying popup help in some languages.

3.6.8beta10 build 4622 (2016-09-29)

Fixes a problem loading tun or tap kexts on macOS Sierra.

3.6.8beta08 build 4621 (2016-09-26) (SECURITY UPDATE)

Updates OpenSSL from version 1.0.2i to version 1.0.2j. See OpenSSL Security Advisory 26 Sep 2016.

3.6.8beta06 build 4620 (2016-09-25)

Fixes two problems that caused Tunnelblick to crash.

3.6.8beta04 build 4619 (2016-09-22) (SECURITY UPDATE)

Updates OpenSSL from version 1.0.2h to version 1.0.2i. See OpenSSL Security Advisory 22 Sep 2016.
Includes OpenVPN 2.3 git-master 38f98fd dated 2016-09-21 (and OpenVPN 2.3.12).
Updates localization.
Fixes problems with long usernames, passwords, passphrase, credentials names, and configuration names.
Fixes a problem when a configuration file is modified outside of Tunnelblick.

3.6.8beta02 build 4618 (2016-09-15)

Includes OpenVPN 2.3 git-master cbc3c5a dated 2016-09-09.
Improves handling of UTF-16 (Windows) files.
Includes a pre-built icon for authentication dialogs.
Updates localization.
Fixes a problem removing a configuration that is connected.

3.6.7c build 4606 (2016-09-26) (SECURITY UPDATE)

Updates OpenSSL from version 1.0.2i to version 1.0.2j. See OpenSSL Security Advisory 26 Sep 2016.

3.6.7b build 4604 (2016-09-25)

Fixes a problem that caused Tunnelblick to crash.

3.6.7a build 4603 (2016-09-22) (SECURITY UPDATE)

Updates OpenSSL from version 1.0.2h to version 1.0.2i. See OpenSSL Security Advisory 22 Sep 2016.

3.6.7 build 4602 (2016-09-15) (CRITICAL)

Includes only OpenVPN 2.3.12.
Fixes a problem with incorrect 'Tunnelblick has been tampered with' messages.

3.6.7beta04 build 4601 (2016-09-09) (CRITICAL)

CRITICAL: Fixes a problem that causes updates to fail when running on macOS Sierra.
Requires OS X 10.7.
Includes OpenVPN 2.3 git-master 4db0629 dated 2016-08-26.
Includes the latest version of Sparkle Updater.
Updates localization.
Fixes several problems when running on macOS Sierra.
Fixes several problems when rebranding Tunnelblick.
Fixes a problem installing configurations in auto-install folders.
Fixes a problem installing configurations containing files with extensions that are not recognized.

3.6.7beta02 build 4594 (2016-08-25)

Adds the ability to drag/drop configurations onto the list of configurations on the left side of the 'Configuration' panel of the 'VPN Details' window.
Includes OpenVPN 2.3.12 and OpenVPN 2.3 git-master 8cba9ff dated 2016-08-24.
Displays the SSL/TLS library built into Tunnelblick's copies of OpenVPN. (Currently only OpenSSL.)
Includes updated localization.
Fixes various typos (thanks to Mitchell Cash).
Fixes a problem that could occur in low memory situations.
Fixes a problem handling unexpected messages from OpenVPN servers.
Fixes a problem when running on case-sensitive filesystems.
Fixes several bad links to Google Code.

3.6.6 build 4582 (2016-08-25) 3.6.6beta02 build 4581 (2016-07-18)

Enables strict transport security when accessing tunnelblick.net (for updates and IP address checks).
Adds new popup help for the "Place icon near the Spotlight icon" checkbox.
Includes OpenVPN 2.3 git-master d728ebe dated 2016-07-14.
Warns users about problems they may have if they select "Place icon near the Spotlight icon".
Requires OS X 10.6.8 or higher.
Includes updated localization.
Fixes problems installing on Sierra.
Fixes problems with displaying the Tunnelblick icon.
Fixes problems relating to right-to-left languages such as Arabic.
Fixes a problem quitting the installation dialog.
Fixes problems when installing Tunnelblick via Munki.
Fixes problems when Tunnelblick is used by multiple users on one computer.
Fixes problems when updating or replacing Tunnelblick.

3.6.5 build 4566 (2016-07-18)

Fixes a problem with truncated text on the "Advanced" window.

3.6.5beta04 build 4565 (2016-06-23)

Includes updated localization.

3.6.5beta02 build 4564 (2016-06-22) (SECURITY UPDATE)

Includes OpenVPN 2.3.11 and OpenVPN 2.3 git-master ec0c1dc dated 2016-06-20.
Includes "admin mode", which temporarily (for five minutes) authorizes changes that require a computer administrator password.
Includes updated localization.
Fixes spurious warnings logged by atsystemstart.
Fixes a problem with IP checking by IP address on El Capitan and Sierra.
Fixes invalid permissions on some .strings files.
Fixes problems installing on Sierra.

3.6.4a build 4561 (2016-06-23)

Fixes a problem loading kexts on recent versions of OS X (caused by the build number).

3.6.4 build 4560.4563 (2016-06-22) (SECURITY UPDATE)

Includes OpenVPN version 2.3.11.
Includes updated localization.

3.6.4beta04 build 4562 (2016-05-09)

Fixes a problem that sometimes caused the "Reset the primary interface after disconnecting" setting to be ignored.
Updates localization.

3.6.4beta02 build 4561 (2016-05-03)

(3.6.4beta02 build 4561 is identical to 3.6.3 build 4560 except for version and build numbers.)

3.6.3 build 4560 (2016-05-03)

Includes OpenSSL version 1.0.2h. See OpenSSL Security Advisory 3rd May 2016.
Fixes a problem causing the 'Add a VPN' window to fail to be closed.
Fixes a problem when updating very old versions of Tunnelblick.
Fixes a problem parsing configurations with inline keys or certificates that are in comments.

3.6.3beta02 build 4559 (2016-04-24)

Allows VPN configurations to be installed by dropping them on the Tunnelblick icon in the menu bar.

3.6.2 build 4558 (2016-04-24)

Updates localization
Fixes a problem when using the non-outline view of configurations (OS X 10.4).

3.6.2beta06 build 4555 (2016-04-08)

Fixes problems with the "Welcome to Tunnelblick" window and other modal windows.
Fixes a problem that causes user-supplied up/down scripts to be ignored.
Fixes a problem with the 'Copy Diagnostic Info to Clipboard' function.

3.6.2beta02 build 4551 (2016-04-02)

Adds the ability to set the VPN Log Level from the "Settings" tab.
Allows configurations using scripts or commands to be installed automatically.
Clarifies a warning to say that an unrecognized OpenVPN option can cause a warning about suspicious programs.
Does additional checking of the application's digital signature.
Includes the source code's git status in the "diagnostic info".
Fixes problems displaying and deleting the VPN log.

3.6.1 build 4543.4551 (2016-04-02)

Adds Afrikaans and Croation translations.
Fixes a problem that caused Farsi, Icelandic, and Indonesian localization to be unavailable.
Fixes a problem that caused new installations of configuration files containing certain Unicode sequences to be corrupted.
Fixes a problem that caused connection attempts to get stuck waiting for a password without asking for a password.
Fixes problems with renaming or duplicating a configuration.

3.6.0a build 4543.4546 (2016-03-19)

Fixes a problem in 3.6.0 (not affecting 3.6.1beta02) that caused kexts to fail to load on OS X 10.11 .

3.6.1beta02 build 4544 (2016-03-18)

Closing a VPN status window prevents it from reappearing until the user attempts to connect its configuration.
Makes the "VPN Details" window resizable.

3.6.0 build 4543.4544 (2016-03-18)

Updates localization.
Updates the help pages to be consistent with changes to the application.
Makes the Info panel's credits table display properly in right-to-left languages.
Skips the DSA signature check on appcast and update notes if there is no DSA public key in the Info.plist.
Fixes a problem with the "Wait for DHCP if Tap" and "Do not wait for Internet access" options.
Fixes a problem that caused Tunnelblick to hang when installing configurations in multiple folders with names that differ only in their last character.
Fixes a problem installing configurations that are to be installed in new private folders.
Fixes a problem installing configurations that have inline options.

3.6beta24 build 4530 (2016-03-02) (SECURITY UPDATE)

Replaces OpenSSL 1.0.2f with 1.0.2g, see OpenSSL Security Advisory 1st March 2016.
Replaces OpenVPN git-master 3a5a46c with 6a4edc7 dated 2016-02-25.
Allows the OpenVPN --auth-user-pass option to specify a file containing a username and password.
Allows empty VPN passwords.
Includes only the OS X version in the anonymous profile information optionally sent during update checks.
Updates localization.
Is built using Xcode 7 and supports only the 64-bit Intel architecture.
Eliminates spurious Console log entries when OpenVPN exits immediately.

3.6beta22 build 4517 (2016-02-18) (SECURITY UPDATE)

Digitally signs all update information to thwart attacks when updating Tunnelblick even if https: access to the update website (or the website itself) is compromised.
Refuses to install configurations in auto-install folders at the time Tunnelblick is installed if the configurations contain scripts or reference external scripts.
Issues warnings if the user install configurations by double-clicking and the configurations contain scripts or reference external scripts.
Issues warnings if an automatically-updated configuration contains scripts or reference external scripts.
Does not use UUIDs and removes the UUID stored in the Tunnelblick preferences for the user running Tunnelblick. (We never used this information.)
Includes updated localization.
Fixes a problem when installing a .tblk which contains identically-named .conf and .ovpn files.
Fixes a problem when using PKCS#11.
Fixes a problem that caused double-clicks of configurations to be ignored.

3.6beta20 build 4505 (2016-02-01) (SECURITY UPDATE)

Avoids MITM attacks using the update mechanism, see the 2016-01-29 News item.
Replaces OpenSSL 1.0.2e with 1.0.2f, see OpenSSL Security Advisory 28th Jan 2016.
Replaces earlier versions of OpenVPN with version 2.3.10 and version 2.3 git master 417fe4a as of 2016-01-18.
Updates localization and credits.
Fixes crash when .tblk contains identically named .conf and .ovpn files.
Fixes crash when creating console log output.

3.6beta18 build 4486 (2015-12-28)

Allows a user to replace a configuration's certificate and key files without requiring authorization by an administrator. (Must be enabled by an administrator.)
Installs forced preferences from auto-install/forced-preferences.plist.
Replaces OpenVPN 2.3.7 with 2.3.9.
Replaces OpenVPN git-master 80442ae (2015-11-29) with 0e591a2 (2015-12-27).
Adds lz4 compression to the OpenVPN git-master version (x86_64 only).
Implements 'always', 'only-if-exists', and 'remove' entries in auto-install/preferences.plist.
Minimizes use of [NSUserDefaults synchronize].
Removes CR characters in files that may not have them on OS X when installing or converting a configuration.
Adds a timeout exit to tunnelblickd.
Clarifies language when authentication failed.
Asks users to report crashes to developers at tunnelblick.net.
Fixes a problem causing hangs on OS X 10.10 and 10.11.
Fixes a problem that deleted the passphrase (private key) when authentication of the username/password failed and the user chose to 'Try again with different credentials'.
Fixes a crash when deleting credentials that include a passphrase

3.6beta16 build 4461 (2015-12-04) (SECURITY UPDATE)

Replaces OpenSSL version 1.0.2d with version 1.0.2e. See https://www.openssl.org/news/secadv/20151203.txt.
Includes OpenVPN git-master as of commit 80442ae (2015-11-29), in addition to versions 2.3.7 and 2.3.8.
Allows auth-user-pass with a file when using the 'git-master' version of OpenVPN
Updates localization and adds support for right-to-left languages such as Arabic and Hebrew. (Only Arabic localization is currently available.)
Removing a credentials group or terminating all OpenVPN processes no longer makes Tunnelblick busy.
Successful installation or replacement of the program or configurations, reversion of configurations, and the successful termination of all OpenVPN processes are presented in the OS X Notification Center on OS X 10.8 ('Mountain Lion') and higher.
Includes more extensive checking of Tunnelblick's digital signatures at launch.
Allows up to 50 seconds before abandoning an installation attempt.
Renamed 'Notification window' to 'VPN status windows' on the 'Appearance' panel of the 'VPN Details' window.
Fixes a problem that caused Console Log warnings about a deleted thread with an uncommitted CATransaction.
Fixes a problem that caused Console Log warnings about being unable to change an NSStatusItem priority.
Fixes a problem that caused the last line of some error messages to not be displayed.
Fixes a problem loading kexts on OS X 10.10.11.2 ('El Capitan').
Fixes two problems that caused crashes on OS X 10.4 ('Tiger').
Fixes a problem that caused a hang on OS X 10.10 ('Yosemite') and 10.11 ('El Capitan').

3.6beta14 build 4441 (2015-11-20)

Fixes a problem when switching languages.
Repairs ownership and permissions of reactivateTunnelblick.sh if they are damaged.

3.6beta12 build 4435 (2015-11-19)

Includes OpenVPN git-master as of commit 7546cba (2015-11-13), in addition to 2.3.7 and 2.3.8.
Includes the "Tunnelblick Xor Patch" in all versions of OpenVPN and removes versions of OpenVPN without the patch.
Includes changes so that operations such as installing, removing, duplicating, or renaming configurations no longer make Tunnelblick busy.
Updates and adds localization for several languages, including Latvian and Indonesian.
Reactivates Tunnelblick so the "VPN Details" window regains focus after Tunnelblick obtains authorization from a computer administrator.
Deleting configurations or their credentials, making them private or shared, reverting them to their secured configurations, and setting them to show or not show on the Tunnelblick menu may be done for all selected configurations.
Changes to settings are applied to all selected configurations without a confirmation dialog.
"Make Configuration Private..." and "Make Configuration Public..." are now two separate menu items, as are "Show on Tunnelblick Menu" and "Do Not Show on Tunnelblick Menu".
Maintains panel and tab selections when relaunched.
Detects attempts to install Tunnelblick while an OpenVPN VPN is connected.
Disconnects a VPN while it is being updated and then reconnects it after the update is complete.
Comments out lines in OpenVPN configuration files that have a “status”, “write-pid”, or “replay-persist” option when a configuration is installed or converted.
Includes NSSupportsAutomaticGraphicsSwitching in the Info.plist to support use of the integrated graphics controller.
Always launches Tunnelblick after a successful install.
Logs system and Tunnelblick version numbers to the Console Log at launch.
Includes additional logging if system commands used by Tunnelblick take a long time to execute.
Highlights in red (i.e., as an error) OpenVPN's "no default was specified by either --route-gateway or --ifconfig options" log entry
Removes debug logging from Sparkle Updater subsystem.
Fixes a problem that caused some updatable configurations to fail when installing an update.
Fixes a problem copying the installer log to the Console log if user quits after an installer failure.
Fixes a problem installing a .tblk if the user's home folder is on a network volume. (This is an experimental feature.)
Fixes a problem that caused Tunnelblick to crash on OS X 10.4 ("Tiger").
Fixes a problem that caused Tunnelblick to crash if Bartender was managing the Tunnelblick icon.
Fixes a problem with placing the Tunnelblick icon near the Spotlight icon on OS X 10.9 and higher.
Fixes a problem that sometimes caused the wrong configuration to be selected after a configuration is renamed.
Fixes an out-of-date link to Online Documentation on the disk image.

3.6beta10 build 4400 (2015-09-24)

"Route all IPv4 traffic through the VPN" defaults to NO, as it was before 3.6beta09.

3.6beta09 build 4395 (2015-09-19)

Defaults to “Route all IPv4 traffic through the VPN" and “Disable IPv6 for Tun connections”.
Includes OpenVPN 2.3.8 and 2.3.7, replacing 2.3.7 and 2.3.6. This fixes a problem with usernames and passwords.
Allows “pre-disconnect.sh” scripts in Tunnelblick VPN Configurations. Such scripts are executed before disconnecting a configuration.
Displays a server-supplied error message when a username/password authentication fails.
Updates the list of free public DNS servers (used only for warning if other DNS servers are used).
User interface changes:
- Moves sound settings and the “Keep connected” checkbox to the “Advanced” window.
- Moves the “Show configuration on the Tunnelblick menu” checkbox to the “gear” menu at the bottom of the configuration list.
- Moves the “Check if the apparent public IP address changed after connecting”, the “Route all IPv4 traffic through the VPN” checkbox, and the “Reset the primary interface after disconnecting” checkbox to the main “Settings” tab.
- Adds the “Disable IPv6 for Tun connections” checkbox to the main “Settings” tab.
- Adds the “Enable IPv6 for Tap connections” checkbox to the “Advanced” settings window.
Fixes a problem with the Tunnelblick icon if the "Displays have different Spaces" setting is checked in the Mission Control System Preference.
Fixes a problem when “All configurations use Common credentials” is changed; Tunnelblick will no longer ask for each configuration’s credentials until it is relaunched.
Fixes several problems installing Tunnelblick on unusual systems.
Fixes a problem installing configurations.

3.6beta08 build 4371 (2015-07-10) (SECURITY UPDATE)

Replaces OpenSSL version 1.0.2c with version 1.0.2d.
Includes additional protection against local attacks.
Includes additional logging when installer must be run.
Updates localization.

3.6beta06 build 4346 (2015-06-13) (SECURITY UPDATE)

Replaces OpenSSL version 1.0.2b with version 1.0.2c.

3.6beta04 build 4340 (2015-06-12)

Replaces LZO version 2.08 with version 2.09.

3.6beta02 build 4335 (2015-06-12) (SECURITY UPDATE)

Replaces OpenSSL version 1.0.1m with version 1.0.2b.
Includes OpenVPN versions 2.3.7 in addition to 2.3.6.
Updates localization, including full Turkish localization and partial Latvian localization.
Changes OpenVPN 'verb' default from 1 to 3.
Highlights notes, warnings, and errors in the Tunnelblick log.
Launches Tunnelblick at login if any 'openvpn' processes are running (or 'openvpnstart' or 'tunnelblick-helper') or if Tunnelblick was running when the user logged out or the computer was shut down or restarted.
Includes a modified version of the 'openvpn_xorpatch' to support the unofficial OpenVPN 'scramble' option. Modifications to the patch include better syntax checking of the option and repair of a buffer overflow bug. Uses the patched version of OpenVPN automatically but only when the configuration file includes the 'scramble' option. For more details, see Tunnelblick and openvpn_xorpatch.
Includes better diagnostic info.
Reduces non-error logging by tunnelblickd.
Fixes problems flushing the DNS cache on some versions of OS X.
Fixes problems that affect some TAP connections.
Fixes problems with 'Connect when computer starts' configurations.
Fixes problems reading configuration files that have CR (0x0D) characters.
Fixes misleading output in warnings about IP address changes.
Fixes a problem that caused incorrect restore DNS and restore WINS settings when connecting Tunnelblick to an already-running OpenVPN.
Fixes problems with Deploy/Welcome.bundle permissions.
Fixes typos in help for the 'Appearances' panel.

Version 3.5

3.5.26 build 4270.5161 (2023-08-02) (SECURITY UPDATE)

Fixes several security vulnerabilities. See Assisted Local Privilege Escalation and Arbitrary File Overwrite Vulnerabilities.
Includes lzo 2.10, replacing 2.08.
Warns that updated or modified configurations may run scripts.
Discontinues migrating old file layout to 'new' (new 10 years ago) layout.
Discontinues converting .ovpn and .conf files found in Tunnelblick's standard folder to Tunnelblick VPN Configurations.

3.5.25 build 4270.5160 (2018-09-29) (SECURITY UPDATE)

Includes OpenSSL 1.0.2p instead of 1.0.2o.
Includes OpenVPN 2.3.18 and 2.4.4. More recent versions of OpenVPN do not build properly with OpenSSL 1.0.2p.

3.5.24 build 4270.5031 (2018-03-28) (SECURITY UPDATE)

Includes OpenVPN 2.3.18 and 2.4.4, each with OpenSSL 1.0.2o. See OpenSSL Security Advisory 27 March 2017.

3.5.23 build 4270.5010 (2018-03-03) (SECURITY UPDATE)

Secures Tunnelblick's connection to the OpenVPN management interface with a password.

3.5.22 build 4270.4982 (2018-01-17) (SECURITY UPDATE)

Fixes digital signatures that were invalid on older versions of OS X.

3.5.21 build 4270.4981 (2018-01-08) (SECURITY UPDATE)

Fixes a problem detecting updates.

3.5.20 build 4270.4980 (2017-12-30)

Fixes a crash on OS X earlier than 10.6.8 by making OpenVPN 2.4.4 available only on OS X 10.6.8 and higher.

3.5.19 build 4270.4970 (2017-12-07) (SECURITY UPDATE)

Includes OpenSSL 1.0.2n. See OpenSSL Security Advisory 07 December 2017.

3.5.18 build 4270.4930 (2017-12-02)

Fixes a problem that caused errors when using 'tun' connections.

3.5.17 build 4270.4900 (2017-11-03) (SECURITY UPDATE)

Includes OpenSSL 1.0.2m. See OpenSSL 1.0.2 Series Release Notes.

3.5.16 build 4270.4870 (2017-09-27) (SECURITY UPDATE)

Includes OpenVPN 2.4.4 and OpenVPN 2.3.18, each of which fixes a security issue that affects some users.

3.5.15 build 4270.4840 (2017-06-21) (SECURITY UPDATE)

Replaces OpenVPN 2.4.2 with OpenVPN 2.4.3 (OpenVPN change log).
Replaces OpenVPN 2.3.16 with OpenVPN 2.3.17 (OpenVPN change log).

From the OpenVPN Downloads page:

OpenVPN v2.4.2 was analyzed closely using a fuzzer by Guido Vranken. In the process several vulnerabilities were found, some of which are remotely exploitable in certain circumstances. We recommend you to upgrade to OpenVPN 2.4.3 or 2.3.17 as soon as possible. More details are available in our official security announcement.

[OpenVPN v2.3.17] is a minor release that mostly fixes the security issues mentioned in our security announcement.

3.5.14 build 4270.4811 (2017-05-20) (SECURITY UPDATE)

Replaces OpenVPN 2.3.15 with OpenVPN 2.3.16 (OpenVPN change log). (Also includes OpenVPN 2.4.2.)

From the OpenVPN Downloads page:

"This [OpenVPN 2.3.16] is a minor release that fixes a few bugs. This release was made primarily because CloudFlare managed to serve obsolete pre-release OpenVPN 2.3.15 tarballs which lack the fix for CVE-2017-7478. The official OpenVPN 2.3.15 Windows installers do have the fix. Nevertheless, you are advised to upgrade your OpenVPN installations to 2.3.16 or 2.4.2."

3.5.13 build 4270.4810 (2017-05-12) (SECURITY UPDATE)

Includes OpenVPN 2.4.2 and 2.3.15. See the OpenVPN Advisory.

3.5.12 build 4270.4800 (2017-01-30) (SECURITY UPDATE)

Includes OpenSSL 1.0.2k. See OpenSSL Security Advisory 26 January 2017.

3.5.11 build 4270.4564 (2016-10-02) (SECURITY UPDATE)

Updates OpenSSL from version 1.0.1t to version 1.0.1u. See OpenSSL Security Advisory 26 Sep 2016.

3.5.10 build 4270.4563 (2016-06-22) (SECURITY UPDATE)

Includes OpenVPN version 2.3.11.

3.5.9 build 4270.4560 (2016-05-03) (SECURITY UPDATE)

Replaces OpenSSL 1.0.1s with 1.0.1t, see OpenSSL Security Advisory 3rd May 2016.

3.5.8 build 4270.4530 (2016-03-02) (SECURITY UPDATE)

Replaces OpenSSL 1.0.1r with 1.0.1s, see OpenSSL Security Advisory 1st March 2016.

3.5.7 build 4270.4517 (2016-02-18) (SECURITY UPDATE)

Does not install configurations in auto-install folders at the time Tunnelblick is installed.

3.5.6 build 4270.4505 (2016-02-01) (SECURITY UPDATE)

Avoids MITM attacks using the update mechanism, see the 2016-01-29 News item.
Replaces OpenSSL 1.0.1q with 1.0.1r, see OpenSSL Security Advisory 28th Jan 2016.

3.5.5 build 4270.4461 (2015-12-04) (SECURITY UPDATE)

Replaces OpenSSL version 1.0.1p with version 1.0.1q.

3.5.4 build 4270.4395 (2015-09-19)

Fixes problems on OS X 10.4.11 ("Tiger").

3.5.3 build 4270.4371 (2015-07-10) (SECURITY UPDATE)

Replaces OpenSSL version 1.0.1o with version 1.0.1p.

3.5.2 build 4270.4346 (2015-06-13) (SECURITY UPDATE)

Replaces OpenSSL version 1.0.1n with version 1.0.1o.

3.5.1 build 4270.4335 (2015-06-12) (SECURITY UPDATE)

Replaces OpenSSL version 1.0.1m with version 1.0.1n.
Fixes problems flushing the DNS cache on some versions of OS X.

3.5.0 build 4265 (2015-04-03)

This is the first stable version of Tunnelblick 3.5 — many thanks to our tens-of-thousands of beta testers!
It is identical to 3.5beta10 except for version and build numbers.

3.5beta10 build 4262 (2015-03-30)

Updates localization and credits.
Adds output from the 'ipconfig' command to the diagnostic info.
Fixes a problem that caused Tunnelblick to incorrectly report that there are no DNS settings.
Fixes a problem that caused Tunnelblick to be unable to perform privileged activity.
Fixes several problems when running on OS X 10.4 and 10.5 ("Tiger" and "Leopard").

3.5beta08 build 4236 (2015-03-19) (SECURITY UPDATE)

Includes OpenSSL 1.0.1m. See OpenSSL Security Advisory 19 Mar 2015.
Updates localization for several languages.
Adds partial localization for Estonian and Turkish.
Adds log entries from helper programs to the output of 'Copy Diagnostic Info to Log'.
Fixes problems with configurations that connect when the computer starts.
Fixes problems scrolling the log in the 'VPN Details' window.
Fixes problems that caused log entries to not be logged properly.

3.5beta06 build 4211 (2015-01-22)

Uses a launchd daemon instead of an SUID helper to start OpenVPN on OS X Version 10.5 ("Leopard") and higher.
Updates Arabic, Japanese, and Chinese (traditional) localization.
Fixes problems with IP address checking on OS X 10.10 ("Yosemite").
Fixes problems with the VPN login or passphrase window appearing when waking from sleep or the displays change.
Fixes a problem that caused an older version of the tun/tap kexts to be used on OS X 10.6-10.8.
Fixes problems with certain malformed updates to Tunnelblick or to configurations.
Fixes a problem if certain errors occurred during an update.
Fixes a problem showing the failure notification window when an install fails.
Fixes a minor memory leak.

3.5beta04 build 4198 (2015-01-08) (SECURITY UPDATE)

Includes OpenSSL 1.0.1k. See OpenSSL Security Advisory 08 Jan 2015.
Adds easy-rsa version 3.0-rc2 to the easy-rsa folder.
Adds the per-configuration '-waitForDHCPInfoIfTap' preference which, for TAP configurations, causes the 'up' script to wait until the DHCP info has been processed before continuing with the VPN setup.
Adds the 'managementPortStartingPortNumber' preference, which specifies the port number Tunnelblick uses for communication with OpenVPN. If the port is unavailable, successive ports will be tried until an available port is found.
Includes complete localization in 20 languages.
Flushes DNS cache even if no DNS changes are made by Tunnelblick.
Logs additional information about DNS servers being used when connected to the VPN.
Fixes problems when Tunnelblick is denied access to the Keychain.
Fixes the tab sequencing in the VPN username/password dialog.

3.5beta02 build 4165 (2014-12-02) (SECURITY UPDATE)

Includes OpenVPN 2.3.6. See OpenVPN Security Announcement-97597e732b.
Includes complete localization in 18 languages including Danish and Greek and partial localization in 7 others, including Arabic and Bulgarian.
Uses new (2014-11-04) tun/tap kexts when on OS X 10.9 or 10.10 ("Mavericks" or "Yosemite").
Includes new status icon animation which clarifies the connected/connecting/disconnected VPN status — thanks to William Faulk.
Adds the ability to save only the VPN username to the Keychain without saving the VPN password.
Adds ability to localize configuration names (and folder names).
Moves the 'VPN Details' menu item to be above the configurations. May be disabled with the 'putVpnDetailsAtBottom' preference is set TRUE.
Recreates the status icon only when necessary.
Centers the login or passphrase window in the new screen when a screen change occurs or if the computer awakens from sleep unless the 'doNotRedisplayLoginOrPassphraseWindowAtScreenChangeOrWakeFromSleep' preference is set to TRUE.
Deletes log files not modified in the last week.
An empty name for an 'added menu item' (or the name after translation) causes the item to be skipped.
Adds crash report log entries for Tunnelblick components such as openvpn and atsystemstart to the 'Diagnostic Info'.
Flushes DNS cache via 'discoveryutil udnsflushcaches' and 'discoveryutil mdnsflushcache' if available.
Fixes a problem that caused double-clicks on configurations to not be processed when a window was left open.
Fixes several problems with Tunnelblick's handling of 'private keys' (passphrases).
Fixes a problem with updates to Deployed versions of Tunnelblick and a problem causing failures on OS X 10.4 ('Tiger').
Fixes a problem renaming configurations.
Fixes visibility problems with the standard status icon in 'dark mode' on OS X 10.10 ('Yosemite').
Fixes problems on OS X 10.4 and 10.5 Intel machines using OpenVPN versions higher than 2.2.1.
Fixes a problem with invalid permissions inIconSets contents.
Fixes problems that caused digital signature checking to fail on OS X 10.5.
Fixes a problem with password and passphrase windows.
Fixes status window icon animation.
Fixes typo of Feetu Nyrhinen's name on the Info panel.
Fixes a problem that caused the 'tun' kext to not be loaded even if 'dev-node tun' was specified in the OpenVPN configuration file.

Version 3.4

3.4.4 build 4055.4236 (2015-03-19)

Includes OpenSSL 1.0.1m. See OpenSSL Security Advisory 19 Mar 2015.

3.4.3 build 4055.4198 (2015-01-08)

Includes OpenSSL 1.0.1K. See OpenSSL Security Advisory 08 Jan 2015.

3.4.2 build 4055.4161 (2014-12-01)

Includes OpenVPN 2.3.6. See OpenVPN Security Announcement-97597e732b.

3.4.1 build 4054 (2014-10-15)

Includes OpenSSL 1.0.1j. See OpenSSL Security Advisory (15 Oct 2014).

3.4.0 build 4007 (2014-10-03)

Identical to 3.4beta38 (except for version and build numbers).

3.4beta38 build 4002 (2014-10-01)

Fixes several security vulnerabilities.
Includes only OpenVPN 2.3.4. (OpenVPN 2.2.1 is no longer included.)
Adds a 'Set DNS after routes have been set up' checkbox to the 'Advanced' settings window.
Secures all configurations (shared, private, and shadow) when Tunnelblick is installed.
Removes a message that the 'Place icon next to Spotlight icon' checkbox is not available on OS X 10.9 ('Mavericks') and higher.
Includes better logging when a forced preference overrides a user-specified preference.
Includes preparation for localizing configuration names and Deployed menu commands and Welcome windows.
Fixes a problem installing configurations that have both .ovpn and .conf files.
Fixes a problem that causes graphic artifacts to appear in the list of configurations in the VPN Details window.
Fixes several problems involving rebranded and "Deployed" versions of Tunnelblick.

3.4beta36 build 3945 (2014-09-02)

Fixes a problem on OS X 10.9.5 ('Mavericks') and 10.10 ('Yosemite') that causes spurious warnings that 'This version has been tampered with'.
Re-enables the 'Place icon next to Spotlight icon' checkbox on OS X 10.9 ('Mavericks') and higher.

3.4beta34 build 3935 (2014-08-07)

Updates Tunnelblick's embedded OpenSSL to version 1.0.1i from version 1.0.1h. See OpenSSL's advisory and OpenVPN's announcement for details.
Includes better handling of computer sleep/wake and fast user switching.
Removes OpenVPN version 2.2.3, leaving 2.2.1 and 2.3.4.
Holding down the 'Option' key while triple-clicking the Tunnelblick icon opens the 'VPN Details' window centered on the display.
Includes a new key, 'TBKeepExistingFilesList', for updatable configurations.
Fixes a problem which caused the Info.plist in certain Tunnelblick VPN Configurations to be ignored while installing the Configuration.
Fixes a problem that caused Tunnelblick to not recognize a semicolon (';') character as the start of a comment in an OpenVPN configuration file.
Fixes a problem that mistakenly allowed Tunnelblick to run and generate errors if it was in /Applications but its name was not Tunnelblick.app.
Fixes several problems with updatable configurations.

3.4beta32 build 3904 (2014-07-17)

Adds the ability to have Tunnelblick VPN Configurations updated the same way that Tunnelblick is updated. See Updatable Configurations for details.
Uses launchd instead of login items to control the launch of Tunnelblick when the user logs in.
Fixes a problem installing configurations with 'TBPreference...' or 'TBAlwaysSetPreference' Info.plist entries.
Fixes a problem installing configurations that that are inside Contents/Resources folders.
Fixes a problem installing configurations when logged in as a 'standard' user (i.e., a non-administrator).
Fixes a problem on OS X 10.9 and higher which caused Tunnelblick to try to access login items that were on network volumes.
Fixes a problem which caused Tunnelblick to launch at login if the user had last quit Tunnelblick via Command-Q instead of using the 'Quit Tunnelblick' menu command.
Fixes a minor memory leak.

3.4beta30 build 3893 (2014-07-08)

Includes major enhancements to installing configurations:
- Installs OpenVPN configuration files ('.ovpn' or '.conf' files) when they are double-clicked.
- Installs OpenVPN configuration files automatically if they are in a 'auto-install' or '.auto-install' folder when Tunnelblick is installed.
- Multiple OpenVPN configuration files may be included in a Tunnelblick VPN Configuration ('.tblk'); when the .tblk is installed, each of the OpenVPN configurations will be installed as a separate configuration.
- Does more extensive checking of OpenVPN configuration files:
  - They must have correct paths (relative or absolute) to key, certificate, and other files.
  - They must not contain 'Windows only' options.
  - They must not contain options reserved for use by Tunnelblick.
- Adds an 'Apply to all' checkbox when installing configurations.
- Allows non-printable characters (such as Unicode characters) anywhere in an OpenVPN configuration file.
Adds a condensed copy of the configuration file (without comments or empty lines) to the diagnostic info.
Includes preparation for updatable .tblk configurations.
Includes LZO version 2.08.
Changes many warning dialogs so they do not block other Tunnelblick operations.
Includes a new 'Inhibit automatic update checking and IP Address checking' checkbox on the 'Preferences' page. Checking it disables all Internet activity by the Tunnelblick program itself (but not by OpenVPN), overriding any other settings that allow such activity. The checkbox is unchecked by default.
Disables the 'Reset the primary interface after disconnecting' checkbox if 'Set DNS/WINS' is not set to 'Set nameserver'.
Includes changes to avoid compiler warnings on Xcode 5 and 6.
Fixes a problem with OpenVPN mis-identifying an x86_64 build as an i386 build. (Thanks to Harold Molina-Bulla.)
Fixes a problem with names of OpenVPN folders.
Fixes a misleading message in the installer log.
Fixes several problems with Unicode characters.

3.4beta28 build 3872 (2014-06-12)

Includes OpenSSL library version 1.0.1h, which fixes several security vulnerabilities (see OpenSSL Security Advisory 05 Jun 2014).
Includes (some) preparation for OS X 10.10 ('Yosemite').
Fixes a problem that crashes Tunnelblick if the 'VPN Details' window is displayed when there no configurations.
Fixes a problem that caused a failure to update the connection status and statistics.
Fixes problems flushing the DNS cache on OS X 10.5 and 10.10 ('Leopard' and 'Yosemite').
Fixes problems resetting the primary interface.
Fixes problems installing or deleting configurations that contain locked files or folders.
Fixes problems that caused the notification window to fail to appear when the pointer hovers over the Tunnelblick icon on OS X 10.5 ('Leopard').
Fixes a problem that caused delays and invalid Console log messages on OS X 10.9 and 10.10 ('Mavericks' and 'Yosemite').
Fixes a problem when a .tblk contains an up.sh or down.sh script.
Fixes several minor cosmetic problems, including the mislabeling of the 'Copy Diagnostic Info to Clipboard' button on OS X 10.4 and 10.5 ('Tiger' and 'Leopard').

3.4beta26 build 3828 (2014-05-02)

Replaces OpenVPN version 2.3.3 with version 2.3.4. Tunnelblick now contains OpenVPN versions 2.2.1, 2.3.2, and 2.3.4.
Quits Tunnelblick faster.
Warns about OpenVPN options that are not allowed on OS X because they are allowed only on Windows.
Excludes the value of the 'installationUID' preference from the diagnostic info.
Includes better OpenVPN version detection.
Includes better handling of invalid preferences.
Includes additional error logging.
Fixes problems with NUL characters in configuration files.
Fixes a problem that caused some 'Connect' button presses to be ignored.
Fixes a problem that caused some settings to be ignored.
Fixes a problem that caused spurious Console log entries about unknown preferences.
Fixes a problem with the position of the help button on Preferences panel.
Fixes a problem deleting old logs.
Fixes a problem with permissions on non-.tblk folders in Deploy.
Fixes a non-reachable double-free.
Fixes a minor memory leak.

3.4beta24 build 3806 (2014-04-18)

Includes OpenVPN 2.3.3 (as well as 2.2.1 and 2.3.2).
Adds additional security checking of programs that Tunnelblick runs as root.
Moves the 'Copy Diagnostic Info to Clipboard' to the main part of the 'VPN Details' window.
Adds a 'quit' command forAppleScript which terminates Tunnelblick properly so it is not launched at the next login.
When 'sanitizing' a configuration file for 'Examine OpenVPN Configuration File' and 'Copy Diagnostic Info to Clipboard', Tunnelblick strips lines that appear between lines that contain '-----BEGIN' and '-----END' (even in comments). (This strips certificates and keys created by Open Access.)
On OS X 10.6.8 and higher when using OpenVPN 2.3.3 and higher in a TUN configuration, Tunnelblick no longer automatically loads the tunnelblick tun kernel extension (kext). In this situation, OpenVPN will use the UTUN device driver built into OS X.
Warns user if the system clock is not set correctly.
Checks Tunnelblick preference files for errors.
Changes words for 'In:' and 'Out:' in Russian.
Adds additional information to a warning message about LSSharedFileListItemResolve returning an error.
Fixes a problem that caused the initial notification window to remain visible even when the pointer moved away from the Tunnelblick icon.
Fixes a problem that could cause loss of embedded certificates and/or keys when editing a configuration file.
Fixes problems that sometimes caused the 'Load tun' and 'Load tap' settings to be ignored.
Fixes a problem which sometimes displayed an incomplete window title for the 'VPN Details' window in languages other than English.
Fixes a problem which sometimes caused a crash.
Fixes a small memory leak.

3.4beta22 build 3789 (2014-04-08)

Includes OpenSSL library version 1.0.1g, which does not have the "heartbeat" vulnerability.
Shows a notification window for the most recently connected configuration upon mouseover of the Tunnelblick icon even if no configuration has been connected since Tunnelblick was launched.
On OS X 10.9 ('Mavericks'), forces the Tunnelblick icon to be in the standard status icon position (to the left of other icons at the time Tunnelblick is launched). This is a temporary limitation until a bug in OS X is fixed.
Allows non-ASCII characters (such as accented characters) in token names, passphrases, usernames, and passwords. (Available only in OpenVPN 2.3 and higher.)
Includes version 1.11 of pkcs11-helper.
Can use kill() to send SIGTERM to OpenVPN processes.
Reorders options to OpenVPN that are required by Tunnelblick so they cannot be overridden by entries in the configuration file.
Sets the 'IV_GUI_VER' environment variable when starting OpenVPN.
Adds a list of any unusual files in a .tblk to the diagnostic info.
Includes additional information in the Tunnelblick log if a script fails.
Displays 'OpenVPN is a registered trademark of OpenVPN Technologies, Inc.' on the Info panel.
Adds an entry to the Console Log if there are options in the configuration file that will be ignored because they are used by Tunnelblick or are incompatible with Tunnelblick.
Fixes problems prepending new search domains and a new domain name to search domains. MANY THANKS TO ANDREW DAUGHERITY FOR FINDING AND FIXING THIS BUG.
Fixes a problem that caused some scripts to fail.
Fixes a problem selecting the default OpenVPN version for one or more configurations.
Fixes a cosmetic error in the output of 'Copy Diagnostic Info to Clipboard'.
Fixes a problem with 'Connect when computer starts' configurations that have a name that contains '-S'.

3.4beta20 build 3727 (2014-01-16)

Replaces embedded OpenSSL 1.0.1e with 1.0.1f (see OpenSSL Vulnerabilities).
Checks and corrects ownership/permissions of launchd .plist files when Tunnelblick launches.
Adds a list of loaded non-Apple kexts to the 'Diagnostic Info'.
Adds detailed logging if the 'DB-ALL' preference is set.
Inhibits use of the default 'openvpn' domain if the per-configuration '-doNotUseDefaultDomain' preference is set.
Fixes a problem that caused the Tunnelblick icon to show the connection status incorrectly.
Fixes two problems that caused settings to change without the user requesting the change.
Fixes a problem with the Tunnelblick icon disappearing for five seconds after the computer wakes from sleep if Tunnelblick is not set to check for an apparent public IP address change.
Fixes a problem using Tunnelblick after the 'Examine OpenVPN Configuration' command is used.
Fixes a problem that caused the incorrect display of the 'Do not show on Tunnelblick menu' checkbox.
Fixes a problem with repeated unexpected disconnection sounds when waking from sleep and there is no Internet access and 'Check if the apparent public IP address changed after connecting' is not enabled.
Fixes a problem recognizing OpenVPN processes that were running when Tunnelblick was launched.
Fixes a problem starting more than one configuration 'when computer starts'.
Fixes a problem disconnecting with the disconnect menu command or notification window disconnect button.
Fixes a problem disconnecting configurations set to start when the computer starts.
Fixes problems when Tunnelblick is launched when more than one configuration is already connecting or connected.
Fixes a problem that caused the 'VPN Details' window to move to the center of the screen when the 'VPN Details' menu command is clicked.
Fixes a problem reconnecting after computer sleep if 'Check if apparent public IP address changes after connecting' is not checked.
Fixes several minor memory leaks.

3.4beta18 build 3704 (2013-12-18)

Includes a new status icon (the icon in the menu bar) more in keeping with recent OS X aesthetics and which includes Retina images. (The old icon may be selected as the 'Tunnelblick 3.3 icon' on the Appearance panel of the 'VPN Details' window.)
Changes to Tunnelblick's handling of computer sleep:
- Adds a 'Disconnect when computer goes to sleep' checkbox on the 'Advanced' settings window; it is checked by default.
- Before reconnecting any configurations after the computer wakes up from sleep, Tunnelblick waits for an Internet connection if checking that the IP address changed is allowed; or waits for a timeout period (the default is five seconds) if it is not.
Allows selection of the display on which notification windows will be shown if multiple displays are available.
Adds a 'Run MTU maximum size test after connecting' checkbox to the 'While Connected' tab of the 'Advanced' window.
Adds a button to obtain additional information when the user is asked if Tunnelblick should check for apparent public IP address changes. Clicking the button displays the new "Privacy and Security" wiki page.
Adds a symlink named 'default' to the Contents/Resources/openvpn' folder. The link points to the default OpenVPN binary, which is the lowest version of OpenVPN included in that copy of Tunnelblick. (Useful for scripts: they needn't search the 'openvpn' folder to find an OpenVPN binary.)
Fixes a problem converting some OpenVPN configurations to Tunnelblick VPN Configurations.

3.4beta16 build 3679 (2013-11-22)

Adds the 'Include anonymous profile information' checkbox to the Preferences panel.
Adds the 'Keep connected' checkbox to the Settings tab of Configurations panel. This will attempt to reconnect a configuration if OpenVPN crashes.
Allows the 'Place next to Spotlight icon' checkbox (on the Appearance panel) to be checked on OS X 10.9 ("Mavericks") with multiple displays if 'Displays have separate spaces' is unchecked in the Mission Control preferences. (Otherwise the checkbox may not be checked on Mavericks with multiple displays.)
Allows a 'preferences.plist' file in auto-install or .auto-install folders. Tunnelblick references specified in the file are set as specified when Tunnelblick is installed. (See Automatic Installation for details.)
Checks for apparent IP address changes asynchronously.
Sets timer tolerances on Mavericks for lower power use.
Adds Tunnelblick settings and specific configuration settings to the info generated by 'Copy Diagnostic Info to Clipboard'.
Complains about OpenVPN options that cause writing to a file that is not specified with an absolute path.
Does not allow files larger than 10MB to be in Tunnelblick VPN Configurations.
Complains about files whose paths contain prohibited characters.
Increases the number of status windows allowed on the screen from 64 to 4096.
Fixes a problem with connection restarts (caused, for example, by the OpenVPN --ping-restart option) by not starting OpenVPN with the -up-restart option. The -up-restart option can be added to the configuration file if it is needed. Note: The OpenVPN configuration must not contain the 'persist-tun' option or restarts will still fail. (The OpenVPN documentation seems to be incorrect with respect to these two options.)
Fixes a problem that sometimes caused a crash when a configuration is deleted or Tunnelblick is started with no configurations.
Fixes a problem that sometimes caused a crash when an OpenVPN configuration file contains UTF-8 characters.
Fixes a problem that sometimes caused a crash during the installation of a Tunnelblick VPN Configuration if a file is empty.
Fixes a problem that sometimes caused a hang during a disconnection which encountered certain errors.
Fixes problems that sometimes caused Tunnelblick to refuse to install Tunnelblick VPN Configurations containing certain OpenVPN configuration file constructs or that contain files in subfolders.
Fixes a problem that caused Tunnelblick to sometimes ignore OpenVPN configurations.
Fixes a problem that caused unpredictable behavior if a free port could not be found for managing OpenVPN.
Fixes a problem that caused an unnecessary warning in the system log about an unknown preference.

3.4beta14 build 3649 (2013-10-25)

Implements 'Examine OpenVPN Configuration File' for Shared and Deployed configurations.
On OS X 10.6 ('Snow Leopard') and higher, allows the user to select multiple configurations in the VPN Details window and then change settings for all of the selected configurations. (A confirmation dialog prevents inadvertent changes.) The only setting that cannot be changed this way is the 'Connect' setting.
Adds per-configuration 'OpenVPN version' selection to the VPN Details window and removes 'OpenVPN version' selection from the Preferences panel.
Adds a per-configuration 'Check that the apparent IP address changed after connecting' checkbox to the Advanced settings window.
Replaces the 'Use Tunnelblick tun/tap drivers' checkbox on the Advanced settings window with pop-up buttons (one for tun and one for tap) that allow the user to always use the driver, never use the driver, or have Tunnelblick decide whether to use the driver based on the configuration file.
Adds a button on the Utilities panel that opens a web page with instructions for uninstalling Tunnelblick.
Moves 'Show configuration on Tunnelblick menu' to the Advanced settings window.
Fixes a problem when installing a Tunnelblick VPN Configuration that includes CR-LF sequences in the OpenVPN configuration file.
Fixes a problem with the appearance of the bottom of the configuration list in the VPN Details window.
Fixes a memory leak that would occur only under very unusual conditions.

3.4beta12 build 3636 (2013-10-17)

Logs more information if a sound is not found.
Fixes a problem on OS X 10.5 and 10.6 ('Leopard' and 'Snow Leopard') that caused incorrect 'invalid signature' warnings.
Fixes a problem on OS X 10.9 ('Mavericks') that caused Tunnelblick to crash when launched on some systems.
Fixes a problem on OS X 10.8 and 10.9 ('Mountain Lion' and 'Mavericks') with 'Copy Diagnostic Info to Clipboard'.
Fixes a problem that causes the log to 'freeze' under certain circumstances.
Fixes a problem when user-supplied scripts output a lot of text to stdout or stderr.
Fixes an error in the Italian (IT) localization.

3.4beta10 build 3614 (2013-10-05)

Includes additional security checking when Tunnelblick is launched:
- Verifies the digital signature of the Sparkle framework.
- Verifies that kexts and digital signatures are secured.
- Verifies that everything in the application is writable only by root.
- Checks that the system folders used by Tunnelblick are secure.
Includes better error checking and reporting when installing a Tunnelblick VPN Configuration.
Option-click (Alt-click) on most configuration settings checkboxes allows the choice of changing the setting for the selected configuration or for all configurations.
Includes a new per-configuration preference, '-openvpnVersion' which can contain an OpenVPN version string (for example, '2.3.2'). A value of '-' will use the latest version of OpenVPN. If set, it will override the application-wide 'openvpnVersion' preference. (This preference cannot yet be set by the GUI.)
Includes the ability to use an asterisk ("*") in front of the name of a connection-specific preference to indicate that all configurations should use that preference by default. (A specific preference for a configuration will override this default.)
Includes a new TBAlwaysSetPreference key to Info.plist of a .tblk. It is used like TBPreference, but it causes the preference to be set 'always' — it is reset each time the configuration is connected and when Tunnelblick starts up.
Recovers more gracefully from OpenVPN crashes.
Includes better help on the 'Advanced' settings page.
Fixes a problem that caused settings on the 'While Connected' tab of the 'Advanced' window to be ignored.
Fixes a problem with the release of a DHCP lease on a TAP connection when using the 'Set name server' DNS/WINS setting.
Fixes a problem that did not allow .crl files in a Tunnelblick VPN Configuration (.tblk).
Fixes several problems that caused failures when installing a Tunnelblick VPN Configuration.

3.4beta08 build 3576 (2013-09-06)

Fixes a problem that caused update checks to fail.

3.4beta06 build 3571 (2013-09-06)

Fixes a crash when accessing checkboxes on the 'Advanced' window.
Uses digitally signed tun and tap kexts on OS X 10.9 ('Mavericks').
Recovers more gracefully from some crashes.
Fixes a typo in the ES (Spanish) translation.
Fixes a problem that sometimes caused a spurious entry in the Console Log.
Fixes a small memory leak.

3.4beta04 build 3555 (2013-08-21)

Uses https: for update checks and loading all update information. (Updates are still protected by being digitally signed; this is an additional level of security.)
Uses https: for IP address checks that use a domain name in the URL to test DNS. Tunnelblick continues to use http: for IP address checks that use an IP address in the URL, which is done if the first IP address check (using a domain name in the URL) fails. This is done because https: requires a domain name, not an IP address. There is no information sent out that is encrypted, and the received data for this request is discarded, so encryption is not necessary, anyway.
Adds a 'Check for updates to beta versions' checkbox in the 'Updates' section of the 'Preferences' panel, which controls the new 'updateCheckBetas' preference. If checked, Tunnelblick will check for new beta versions of Tunnelblick that are available for update, otherwise, Tunnelblick will check for new stable versions. Checked by default when running a beta version, unchecked by default when running a stable version.

Note: This feature may be used to revert to the latest stable version from a later beta version: if this is un-checked in a beta version, Tunnelblick will offer to install the latest stable version, which may be a 'downgrade' from the beta version to an earlier stable version.

Uses new URLs when checking for updates:
- 'https://www.tunnelblick.net/appcast-s.rss' to check for new stable versions, and
- 'https://www.tunnelblick.net/appcast-b.rss' to check for new beta versions.
The URL of customized or Deployed versions of Tunnelblick that contain a non-standard update feed URL have '-s' or '-b' appended to the last component of the URL before the extension (e.g. 'https://example.com/ccc.ddd' becomes 'https://example.com/ccc-s.ddd' or 'https://example.com/ccc-b.ddd' to check for stable and beta versions, respectively).
Updates several Dutch (NL) translations; a Italian (IT) translation, and a Chinese (simplified) translation.
Fixes spacing problems on the 'Preferences' tab that occur when there is only one version of OpenPVN included in Tunnelblick.

3.4beta02 build 3550 (2013-08-07)

This is the first beta release of Tunnelblick 3.4 and includes fixes for several bugs in 3.3.0:

Removed some extra debug logging.
Includes a stack trace in the error message sent to the Console Log when a fatal error occurs on OS X 10.6 and higher.
Fixes a problem installing Tunnelblick VPN Configurations that include .cer, .cert, .der, .p12, .p7b, .p7c, or .pfx files.
Fixes problems that cause Tunnelblick to crash or hang if there were no configurations and the 'VPN Details' menu command was clicked.
Fixes problems when there are no configurations.
Fixes problems that can lead to a Tunnelblick crash or hang under an unusual OS X error condition.
Fixes problems that cause Tunnelblick to crash or hang if many changes to the configurations are made very quickly.
Fixes a problem that caused the 'Welcome to Tunnelblick' window to appear more than once when multiple changes to the configurations are made very quickly.
Fixes a problem that caused the status window to fail to appear when the pointer is over the Tunnelblick icon after checking or un-checking the 'Place [Tunnelblick icon](the) next to Spotlight icon' checkbox in the 'Appearances' panel.
Fixes a problem on OS X 10.9 ('Mavericks') that caused Tunnelblick to always launch after login even if it had quit before logging out.
Fixes a problem on OS X 10.9 ('Mavericks') that sometimes caused the Tunnelblick icon to disappear from the status bar on a computer with multiple displays.
Fixes a problem displaying the hex code for invalid characters in files.
Fixes a typo in message sent to the Console Log about 'login intems' (changed to 'login items').

Version 3.3

3.3.4 build 3518.3872 (2014-06-12)

Includes OpenSSL library version 1.0.1h, which fixes several security vulnerabilities (see OpenSSL Security Advisory 05 Jun 2014).

3.3.2 build 3518.3792 (2014-04-08)

Includes OpenSSL library version 1.0.1g, which does not have the "heartbeat" vulnerability.
Implements 'Examine OpenVPN Configuration File' for Shared and Deployed configurations.
Includes a better Console log message when a sound is not found.
Option-click on a checkbox allows the option of changing a setting for all configurations.
Allows .crl files in a .tblk.
Allows non-printing characters in comments and single- and double-quotes and after a backslash in OpenVPN configuration files and scripts that are being coverted into Tunnelblick VPN Configurations.
Checks that additional system folders are secure.
Adds TBAlwaysSetPreference key to Info.plist of a .tblk. It is like TBPreference, but it causes the preference to be set 'always' — it is reset each time the configuration is connected and when Tunnelblick starts up.
Adds a new per-configuration preference, '-openvpnVersion' which can contain an OpenVPN version string (for example, '2.3.2'). If set, it will override the application-wide 'openvpnVersion' preference.
Adds the ability to use an asterisk (*) in front of the name of a connection-specific preference to indicate that all configurations should use that preference by default. (A specific preference for a configuration will override this default.)
Some error messages were made clearer and more specific.
Does better error checking and reports problems directly to the user when installing a Tunnelblick VPN Configuration.
Clarifies help on the 'Advanced' settings page.
Attempts to recover when OpenVPN crashes without having run the 'down' script by running the 'route-pre-down' and 'down' scripts from Tunnelblick and runs the 'route- pre-down' script to release the DHCP lease on a TAP connection if needed.
Verifies the digital signature of Sparkle framework.
Verifies that kexts and digital signatures are secured.
Verifies that everything in the application is only writable by root.
Attempts to display an error message in a GUI window if it can't display normal windows.
Adds clearer error handling for problems with Applications, Library, and Application Support folders that are insecure.
Signs kexts for Mavericks.
Includes additional logging of ownership changes made by installer.
Catches SIGTRAP if not debugging and add signal name to Console output.
Fixes crash when accessing checkboxes on 'Advanced' window.
Includes a Sparkle patch to allow downgrades to stable versions from beta versions.
Uses https: for update checks and loading all update information and adds the ability check for updates to beta versions and to 'downgrade' from beta to stable. (Updates are still protected by being digitally signed so they cannot be forged; this is an additional level of security.)
Uses https: for IP address checks that use a domain name in the URL to test DNS. (Tunnelblick continues to use http: for IP address checks that use an IP address in the URL, which is done if the first IP address check (using a domain name in the URL) fails.)
Adds a new checkbox in the 'Updates' section of the 'Preferences' panel: 'Check for updates to beta versions', which controls the 'updateCheckBetas' preference. If checked, Tunnelblick will check for new beta versions of Tunnelblick that are available for update, otherwise, Tunnelblick will check for new stable versions. Checked by default when running a beta version, unchecked by default when running a stable version. Note: If this is un-checked in a beta version, Tunnelblick will offer to install the latest stable version, which may be a 'downgrade' from the beta version to an earlier stable version.
Uses new URLs when checking for updates:
- 'https://www.tunnelblick.net/appcast-s.rss' to check for new stable versions, and
- 'https://www.tunnelblick.net/appcast-b.rss' to check for new beta versions.
The URL of customized or Deployed versions of Tunnelblick that contain a non- standard update feed URL have '-s' or '-b' appended to the last component of the URL before the extension (e.g. 'https://example.com/ccc.ddd' becomes 'https://example.com/ccc-s.ddd' or 'https://example.com/ccc-b.ddd' to check for stable and beta versions, respectively).
Removed unused files English.lproj/Description.rtf and English.lproj/Credits.rtf.
Adds stack trace to Console Log on fatal error; removes debugging entries from Console Log.
Filters CR characters from .sh, .conf, .ovpn, .crt, .key, and .pem files when installing a .tblk.
Corrects the name of Chinese (traditional) (ZH_TW) localizer from 'Pompin Wu' to 'Pomin Wu'.
Fixes several problems that caused failures when installing Tunnelblick VPN Configurations.
Fixes a problem when installing a Tunnelblick VPN Configuration that includes CR-LF sequences in the OpenVPN configuration file.
Fixes a problem on OS X 10.5 and 10.6 ('Leopard' and 'Snow Leopard') that caused spurious 'invalid signature' errors.
Fixes a problem that causes the log to 'freeze' under certain conditions.
Fixes a problem when Tunnelblick scripts output a lot to stdout or stderr.
Fixes a problem with 'Copy Diagnostic Info to Clipboard' on Mountain Lion and Mavericks.
Fixes typos in(ZH_CN), Spanish (ES), Finnish (FI), Italian (IT), Norwegian (NB), Dutch (NL), and Chinese (simplified) translations.
Fixes a bug that caused settings on the 'While Connected' tab of the 'Advanced' window to be ignored.
Fixes a problem on Mavericks that caused Tunnelblick to crash on launch on some systems.
Fixes a problem that caused the status window to fail to appear when the pointer is over the Tunnelblick icon after checking or un-checking the 'Place Tunnelblick icon next to Spotlight icon' checkbox in the 'Appearances' panel.
Fixes a problem on OS X 10.9 ('Mavericks') that caused Tunnelblick to always launch after login even if it had quit before logging out.
Fixes a problem on OS X 10.9 ('Mavericks') that sometimes caused the Tunnelblick icon to disappear from the status bar on a computer with multiple displays.
Fixes a problem that caused the status window to fail to appear when the pointer is over the Tunnelblick icon after checking or un-checking the 'Place Tunnelblick icon next to Spotlight icon' checkbox in the 'Appearances' panel.
Fixes a problem on OS X 10.9 ('Mavericks') that caused Tunnelblick to always launch after login even if it had quit before logging out.
Fixes a problem on OS X 10.9 ('Mavericks') that sometimes caused the Tunnelblick icon to disappear from the status bar on a computer with multiple displays.
Fixes problems that cause Tunnelblick to crash or hang if many changes to the configurations are made very quickly.
Fixes a problem that caused the 'Welcome to Tunnelblick' window to appear more than once when multiple changes to the configurations are made very quickly.
Fixes problems when there are no configurations.
Fixes spacing problems on the 'Preferences' tab that occur when there is only one version of OpenPVN included in Tunnelblick.
Fixes problems that can lead to a Tunnelblick crash or hang under an unusual OS X error condition.
Fixes problems that cause Tunnelblick to crash or hang if many changes to the configurations are made very quickly.
Fixes a problem that caused the 'Welcome to Tunnelblick' window to appear more than once when multiple changes to the configurations are made very quickly.
Fixes a problem converting or installing configurations with .cer, .cert, .der, .p12, .p7b, .p7c, and .pfx files; (3) Fixes a problem displaying the hex code for invalid characters in files.
Fixes a problem that sometimes caused a spurious entry in the Console Log.
Fixes a small memory leak.

3.3 build 3518 (2013-07-22)

This is the first stable release of Tunnelblick 3.3. It is identical to version 3.3beta56 except for version information.

3.3beta56 build 3515 (2013-07-19)

Expected to be the last beta before the 3.3 stable release.

Complete Catalan, Czech, Finnish, French, Hungarian, Italian, Japanese, Korean, Norwegian, Dutch, Portuguese, Russian, Slovak, Swedish, and Chinese (simplified) localization.
Allows the replacement of a Tunnelblick VPN Configuration that has an Info.plist even if it does not have a CFBundleIdentifier entry.
Detects rich text files and files with illegal characters when installing a Tunnelblick VPN Configuration or converting an OpenVPN configuration.
Allows the Info.plist of a Tunnelblick VPN Configuration to be located either in the .tblk folder directly, or in its "Contents" subfolder.
Fixes a problem that sometimes caused an incorrect display of the settings of a Tunnelblick VPN Configuration that had been replaced.
Fixes a problem that caused an unnecessary dialog window to appear when canceling the installation of a Tunnelblick VPN Configuration.
Fixes a problem that sometimes caused no configuration to be selected the first time a freshly-installed Tunnelblick is launched.
Fixes a problem that sometimes caused an invalid OpenVPN version to select the default version of OpenVPN, instead of the latest version.
Fixes a problem that caused overwritten or truncated text in the status window, the 'Advanced' window, and the Log tab of the 'VPN Details' window in some languages.
Fixes a problem in status window that displays the 'In:' and 'Out:' text incorrectly in languages other than English.
Fixes a problem that caused the 'Remove Credentials' submenu to be too narrow to fit localized text, and updates the Japanese localization with better translations.

3.3beta54 build 3415 (2013-06-08)

Includes complete German, Spanish, and Polish localization.
Includes OpenVPN version 2.3.2.
Adds the ability to edit a configuration name by clicking on it and editing it directly (OS X 10.6 and higher only).
Adds the ability to always use the latest OpenVPN version that is available.
Adds a confirmation dialog if user has no Tunnelblick VPN Configurations and does not want to convert OpenVPN configurations to Tunnelblick VPN Configurations.
Fixes a problem that caused openvpn and down-root.so binaries to not be digitally signed.
Fixes a problem disconnecting configurations using the down-root plugin if killall is allowed.
Fixes a problem with up & down scripts failing when /etc/resolv.conf is empty except for comments.
Fixes a problem that displayed the wrong version of VPN that would be used if the requested version is not available.
Fixes a problem usingWiFi after disconnecting if 'Reset the primary interface after disconnecting' is checked.
Fixes a problem converting an OpenVPN configuration that contains an inline key/cert/etc.
Fixes a problem that failed to keep a configuration selected after it was renamed.
Fixes a problem verifying digital signatures of Deployed versions of Tunnelblick.
Fixes a problem that could cause double-freeing of memory.
Fixes a problem that could cause the the status window to show incorrect statistics.
Fixes a problem that could cause credits on Info panel to appear in an incorrect font.

3.3beta52 build 3352 (2013-05-20)

Fixes problems converting an OpenVPN configuration file that:
- Uses files with extensions that Tunnelblick does not know how to secure properly; or
- Does not end with a linefeed; or
- Has '[options; or
- Has a path component that starts with a dot (".").
Fixes a problem that caused Tunnelblick to be unable to install a Tunnelblick VPN Configuration (".tblk") that has a path component that starts with a dot (".").
Fixes a problem on OS X 10.4 ("Tiger") that caused the copyright date in the startup screen to be displayed incorrectly.
Fixes a extraneous warning about Info.plist options that do not exist being ignored when installing or converting to a .tblk.
Fixes a minor memory leak.

3.3beta50 build 3302 (2013-05-11)

Saves and restores the configuration selected in the configuration list in the 'VPN Details' window.
Saves and restores folder expansion states in the configuration list in the 'VPN Details' window.
Fixes a problem converting OpenVPN configuration files that have backslashes in paths.
Fixes a problem converting OpenVPN configuration files that have multiple OpenVPN options using the same file or files with the same name.
Fixes a problem converting OpenVPN configuration files that have script file names that do not have a '.sh' extension.
Fixes a problem displaying line numbers in OpenVPN configuration files in the log when converting OpenVPN configurations.
Fixes a problem that caused Deployed versions to ignore forced preferences.

3.3beta48 build 3292 (2013-05-08)

Allows install and launch of a 'Deployed' version of Tunnelblick:
- If it is a 'rebranded' version of Tunnelblick (source code modified to use a different name); and
- If Info.plist does not have 'tunnelblick.net' in the 'updateFeedURL' forced preference (or in SUFeedURL if there is no 'updateFeedURL' forced preference); and
- If Info.plist does not have 'net.tunnelblick' in the CFBundleIdentifier; and
- All copies of the program include the Deploy folder. (Even updates must include the Deploy folder. Udpates did not previously require the Deploy folder because it would be restored from backups maintained by the program. The program no longer maintains backups.)
Allows the 'skipWarningAboutNoSignature' preference to be forced. This preference inhibits warnings about the application not being digitally signed.
Adds additional DNS information to the Tunnelblick log.
Adds a 'Copy Console Log to Clipboard' button to the Utilities panel.
When installing Tunnelblick VPN Configurations (.tblks) that include nested .tblks inside them, TBReplaceIdentical, TBSharePackage, and TBUninstall in the outer Info.plist will override corresponding entries in the nested .tblks.
No longer restores the 'Setup:' DNS key in scutil if it isn't needed (some OS X 10.7 setups, and all OS X below 10.7).
Fixes a security issue when installing Tunnelblick VPN Configurations (.tblks).
Fixes a problem in the build of OpenVPN 2.3.1 that caused it to reject the 'keysize' option.
Fixes a problem that caused failures when using auto-install and .auto-install folders to install Tunnelblick VPN Configurations when Tunnelblick is installed.
Fixes a problem that caused 'pre-connect', 'connected.sh', 'reconnecting.sh', and 'post-disconnect.sh' scripts in shared configurations to not be executed.
Fixes a problem when the installer fails when trying to connect an unsecured configuration. (This would only happen if something is drastically wrong with the system, such as incorrect ownership or permissions on /Library).

3.3beta46 build 3281 (2013-04-22)

Security: Digitally signs Tunnelblick's copies of OpenVPN.
Includes a 64-bit Intel version of OpenVPN 2.3.1.

3.3beta44 build 3276 (2013-04-16)

Fixes a problem when converting an OpenVPN configuration with the 'auth-user-pass' option to a Tunnelblick VPN Configuration.
Fixes a problem updating the configurations display when a configuration is added or deleted.

3.3beta42 build 3270 (2013-04-13)

Fixes a problem that caused DHCP over tap connections to fail.
Fixes a problem that caused the failure to install a 'Tunnelblick VPN Configuration'.
Fixes a problem that caused fatal errors in the down script if a '-useDownRootPlugin'preference was set for the configuration but 'user nobody' and 'group nobody' were not used.
Fixes a problem that caused warnings about obsolete preferences.
Fixes a problem that caused the Console log to not be included on the Clipboard when the 'Copy Diagnostic Info to the Clipboard' button is used by a user who is not an administrator.
Diagnostic information now includes the user's status as a 'standard' or 'admin' user.

3.3beta40 build 3265 (2013-04-11)

Fixes a problem with Tunnelblick's new 64-bit OpenVPN 2.2.1 by only including the 32-bit versions of OpenVPN.

3.3beta38 build 3258 (2013-04-09)

On OS X 10.6 ('Snow Leopard') and higher, Tunnelblick now displays configurations in a way that is similar to the 'List View' in a Finder window: contents of folders can be hidden or exposed by clicking on a disclosure triangle next to the folder name. This may be disabled (and the old way of displaying configurations used) by setting the 'doNotShowOutlineViewOfConfigurations' preference to 'TRUE'.
Replaces OpenVPN version 2.3alpha1 with version 2.3.1, and runs OpenVPN, OpenSSL, and LZO in 64-bit mode when it is available (Intel only) — many thanks to HAROLD MOLINA-BULLA.
Enhances installation of Tunnelblick VPN Configurations with improved error detection and correction.
- The user can now replace an existing configuration with a new one.
- Tunnelblick now complains about files referenced in the OpenVPN configuration file that do not exist or are accessed via a path instead of just a filename.
- Tunnelblick now removes CR characters from script files.
Changes the 'Copy Log to Clipboard' button to the 'Copy Diagnostic Info to Clipboard' button. The info copied to the clipboard includes the configuration file contents, the log contents, and recent Console log output from Tunnelblick and OpenVPN. (Configuration file contents have inline data removed so as to not disclose private keys.)
Keeps a history of Tunnelblick versions that were launched, and displays the most recently used prior version in the log.
Adds a checkbox to 'Route all traffic through the VPN' on the Advanced settings window. This adds the 'redirect-gateway def1' option to the arguments to OpenVPN. Note that even if is NOT checked, the configuration file may include the option, or the server may push the option.) Default is not checked.
Adds a checkbox to 'Reset the primary interface after disconnecting' on the Advanced settings window. The reset is done via an 'ifconfig down' followed by an 'ifconfig up' on the primary interface after the configuration is disconnected. Default is not checked.
Adds the 'doNotLaunchOnLogin' preference, which causes Tunnelblick to not launch when the user next logs in, even if Tunnelblick was running when the user logged out. This preference cannot be set in the GUI; to set it type the following into Terminal 'defaults write net.tunnelblick.tunnelblick doNotLaunchOnLogin -bool yes'. To restore normal behavior, type 'defaults write net.tunnelblick.tunnelblick doNotLaunchOnLogin -bool yes'.
Allows Tunnelblick.app to have any name (but it still must be installed into /Applications).
Updates LZO to version 2.06.
Updates the help displays.
Changes to the maximum log size now take effect immediately.
Clarified entry made in Console log when Tunnelblick is shut down because of a Command-Q typed by the user.
Fixes a problem that didn't repair invalid ownership of /Library/Application Support/Tunnelblick/Users if the ownership was modified by the user.
Fixes a problem that sometimes caused the last part of the log to be hidden.
Fixes a problem that caused failures when converting a shared Tunnelblick VPN Configurations to be private.
Fixes a problem that allowed the user to resize the VPN Details window when a panel other than 'Configurations' is being displayed on OS X 10.7 ('Lion') and higher.

3.3beta36 build 3228 (2013-03-28)

Removes uninstaller from disk image.

3.3beta34 build 3218 (2013-03-27)

Security update: Replaces OpenSSL 1.0.1c with 1.0.1e. See OpenSSL's advisory.
Accepts multiple "dhcp-option DOMAIN-SEARCH <domain>" options in the configuration file or "pushed" by the VPN server. If present and search domains were not manually set, they are prepended to any search domains that came from DHCP.
Adds an Uninstaller to the Tunnelblick disk image. Double-click to uninstall /Applications/Tunnelblick, or drop a Tunnelblick application onto a copy of the Uninstaller on your boot drive.
Removes the 'Suggestion or Bug Report' menu item. (Only 4 suggestions or bug reports were made among several hundred submissions.)
Displays dialog when a fatal error occurs.
Clearer error messages when a menu icon set is not found.
No longer checks for unsigned updates.
Adds the contents of /etc/resolv.conf to the Tunnelblick log before and after making network configuration changes.
Adds Erwann Thoraval in the credits for French translations on the Info panel for all languages.
Fixes problems indenting configuration subfolders properly in the VPN Details window.
Fixes misspelling of 'Disconnect' in status window.
Fixes bug that caused the Info panel to display an incorrect OpenVPN version if no OpenVPN version was chosen on the Preferences panel.
Fixes bug that caused the Tunnelblick icon to not respond to clicks properly after a sleep/wake cycle.
Fixes bug that caused the Tunnelblick icon to disappear when an aborted logout takes place.
Fixes bug that caused reverting a configuration to its last secure shadow copy to fail.
Fixes bug that caused a spurious warning if Tunnelblick was Quit by Activity Monitor or reinstallation.
Fixes warnings about unknown preferences.
Complains with an error dialog window if an internal error occurs while trying to check the security of a configuration.

3.3beta32 build 3183 (2013-01-05)

Fixes several security issues.
Fixes a problem that disabled all choices in the 'Connect' menu on the 'Settings' tab of the 'Configurations' panel of the 'VPN Details' window.
Fixes a delay when disconnecting if only one configuration is connected.
Fixes a problem that did not connect a configuration automatically after updating a shadow configuration.
Fixes problems that caused some scripts in Tunnelblick VPN Configurations to not be executed.

3.3beta30 build 3176 (2012-12-25)

Updates the easy-rsa programs to fix bugs in the Tunnelblick patches.
Secures the easy-rsa folder and its contents.
Warns the user when trying to install a Tunnelblick VPN Configuration (.tblk) into a Deployed version of Tunnelblick that does not allow shared and/or private configurations.
Fixes bugs in Sparkle Updater's isDeployed and hasDeployBackups detection
Fixes a bug that caused a log message to show permissions as decimal instead of octal.
Fixes a bug that caused installer to fail if /Library/Application Support/Deploy subfolder was not secure."
Fixes bug that caused failures in conversion of an OpenVPN configuration file to a Tunnelblick VPN Configuration (.tblk) if the configuration file does not use separate key, certificate, script, etc. files.

3.3beta28 build 3153 (2012-10-24)

Configurations can share credentials (usernames/passwords and pass phrases) so that the credentials need not be entered separately for each configuration. (This may be set on the 'Advanced' settings window's 'VPN Credentials' tab.)
Triple-clicking the Tunnelblick icon opens the VPN Details window, as does relaunching Tunnelblick from a Dock icon or double-clicking the application in a Finder window.
Adds 'Speak' to list of connect/disconnect sounds. If selected, connections and unexpected disconnections will be announced with the system default voice.
Defaults to use the oldest version of OpenVPN available, instead of the newest version.
Adds the 'Check apparent IP address after connecting' checkbox to the 'Preferences' panel. There is no default; the user is asked whether to do this the first time the user launches Tunnelblick.
Adds the 'Reconnect when computer wakes up from sleep (if connected when computer went to sleep)' checkbox to the 'Advanced' settings panel. The default is to reconnect.
Adds the 'Revert Configuration...' menu command to revert a private configuration to it's last secured (shadow) version.
When requesting a computer administrator username/password for installation, Tunnelblick also shows that it will convert OpenVPN configurations to Tunnelblick VPN Configurations if the user has requested the conversion.
Adds a subcommand to openvpnstart to revert a configuration to when it was last secured.
Does not warn about Tunnelblick being unsigned if Debug build.
Fixes a problem that sometimes left horizontal lines on the list of configurations when the list was scrolled up and down.
Fixes a problem if a configuration was Deployed and needed to be secured.
Fixes a problem that caused the help button on the 'While Connected' tab of the 'Advanced' settings window to do nothing.
Fixes several problems running Tunnelblick on OS X 10.4 ('Tiger').
Inhibits flush of DNS cache on OS X 10.7 or 10.8 if Hands Off is running. (This was included in 3.3beta26.)
Fixes a bug that sometimes caused Tunnelblick installations to fail.

3.3beta26 build 3143 (2012-10-12)

Installs, and should be used, only if no Deployed versions of Tunnelblick have previously been installed. (This restriction will probably be removed in later releases.)
Installs even if there are OpenVPN configurations (.ovpn and .conf files).
Offers to convert OpenVPN configurations to Tunnelblick VPN Configurations. OpenVPN configurations that are NOT converted are NOT AVAILABLE for connection.
Recognizes files with '.cert' extensions as certificate files.
When installing a Tunnelblick VPN Configuration, automatically removes path prefixes from configuration file entries that accept paths or commands.
Adds a 'Show when disconnected' checkbox to the 'Notification window' section of the Appearance preferences tab of the 'VPN Details' window. This is checked by default.
Checks Tunnelblick's digital signature, and warns the user if it is missing or invalid.
Fixes a problem that caused configurations in submenus not to be sorted properly.
Changes the status/notification window's single Connect/Disconnect button to two separate buttons.
Adds more specific error messages when files with unrecognized extensions or folders are in a Tunnelblick VPN Configuration (.tblk) that is being installed.
Removes the 'keyboardShortcutKeyCode' and 'keyboardShortcutModifiers' preferences.
Fixes problems installing from a disk image.
Fixes a problem that disabled the keyboard shortcut (hotkey) until the VPN Details window was opened.
Fixes a problem causing the Tunnelblick icon to become invisible when changing settings on the 'Appearance' panel.
Fixes a problem displaying a shortened log on OS X 10.4 ('Tiger').
Fixes a problem that caused Tunnelblick to not create a shadow configuration file when installing a Tunnelblick VPN Configuration (.tblk).
Fixes a problem that caused the download statistics shown in the status/notification window to be incorrect.

3.3beta24 build 3126 (2012-09-13)

Fixes problems installing from disk image.

3.3beta22 build 3117 (2012-09-12)

Installs, and should be used, only if:
- All private configurations are Tunnelblick VPN Configurations (.tblk files);
- It is not a Deployed version; and
- No Deployed versions of Tunnelblick have previously been installed.
Will install to, and may only be run from, /Applications.
Fixes security issues raised by Tunnelblick Issue 212.

3.3beta21b build 3114.3185 (2013-01-08)

Security update to prepare for Tunnelblick 3.3beta32.
Fixes problem detecting Deployed versions of Tunnelblick.
Fixes problem detecting that Tunnelblick is not installed in /Applications.

3.3beta21a build 3114.1 (2012-09-12)

New 'Welcome window' feature:
- If a 'Welcome' folder exists as a subfolder of Deploy and contains an 'index.html' file, that file will be displayed as a welcome screen when Tunnelblick is launched.
- Otherwise, if a 'welcomeURL' preference exists and is being forced, that URL will be displayed as a welcome screen when Tunnelblick is launched.
- If a 'welcomeWidth' and/or 'welcomeHeight' preference exists, its numeric value will be used for the width or height of the HTML display area of the welcome screen (otherwise, the area will be 500 pixels square).
- If a 'doNotShowWelcomeDoNotShowAgainCheckbox' preference exists and is true, a 'Do not show this again' checkbox will appear in the welcome window.
- If a 'skipWelcomeScreen' preference exists and is true, the welcome screen will not be shown.
Prevents the display of notification windows for configurations that are disconnected if the 'doNotShowDisconnectedNotificationWindows' preference is true.
Fixes incorrect display of VPN traffic statistics.
Restores support for PowerPC processors and OS X 10.4 ("Tiger")
Prepares for update to 3.3beta22

3.3beta20 build 3105 (2012-08-20)

After installing this version, Tunnelblick can only be updated by a computer administrator.
Attempts IP address check five seconds after a VPN connection is made, with a thirty second timeout. This makes it less likely that the 'No DNS' message will appear when DNS is working properly.
Shows '(Deployed)' in the Info panel for Deployed versions of Tunnelblick.
Refuses to install a signed version of Tunnelblick over a Deployed version unless the signed version has its own Deploy folder.
Adds additional check for valid URL for updates and logs error instead of silently failing to check for updates.
Fixes several problems caused by digital signatures.
Fixes a problem in the standard down script for TAP connections.
Fixes a problem that caused DNS cache flushes to fail silently.
Fixes a problem with route-pre-down scripts if 'user nobody' and 'group nobody' are specified and openvpn-down-root.so is used.
Changes to Sparkle Updater to prepare for later releases

3.3beta18 build 3081 (2012-08-04)

Fixes several problems on Mountain Lion and temporarily adds extra logging to help diagnose problems.
Restores the default 'Set nameserver' DNS/WINS setting to restart when 'SearchDomain' is changed.
Adds a new checkbox on the 'Advanced' settings page that tells Tunnelblick to add the domain name provided by OpenVPN to the start of the list of search domains. This checkbox is disabled and unchecked unless the DNS/WINS setting is set to 'Set nameserver'. Adding the domain name does not take place if the search domains are manually set.
Checks that the computer's apparent public IP address changes when connected to a VPN. This can help diagnose connection and DNS problems. (Tunnelblick asks for permission to do this the first time it is launched for each user on a computer.)
Fixes a crash of the Tunnelblick UI in certain complex circumstances.

3.3beta16 build 3070 (2012-07-27)

Fixes a problem that stops updates from being installed.

3.3beta14 build 3067 (2012-07-27)

Fixes problems with DNS on OS X 10.8 ("Mountain Lion") when using the default DNS/WINS setting of 'Set nameserver'.

3.3beta12 build 3060 (2012-07-24)

Reverts to OpenVPN 2.3-alpha1 to fix problems with the build of OpenVPN 2.3_alpha2.
Fixes problems causing long delays when logging out or sleeping, restarting, or shutting down the computer.
Fixes a problem causing the Tunnelblick icon to disappear.

3.3beta10 build 3048 (2012-07-20)

Fixes a problem disabling network connection monitoring.
Fixes a problem with OpenVPN version 2.3alpha2 being 'unknown' and disabling scripts.
Fixes a problem implementing preferences having to do with what to do when there are changes to the network settings.

3.3beta08 build 3044 (2012-07-19)

SECURITY UPDATE: Updates OpenSSL to 1.0.1c (OpenSSL's advisory)
Tunnelblick is now digitally signed by an Apple 'identified developer', so that it may be installed with the default settings for Gatekeeper on OS X 10.8 ("Mountain Lion").
Updates to and uses OpenVPN version 2.3alpha2 by default. OpenVPN version 2.2.1 can be used instead by selecting it in the 'Preferences' panel of the 'VPN Details' window.
Fixes a problem that caused configurations to connect and disconnect repeatedly on OS X 10.8 ("Mountain Lion").
Fixes a problem that caused a warning on the console log that the 'SUSkippedVersion' preference was unknown.

3.3beta06 build 3028 (2012-05-08)

Enhances security by digitally signing Sparkle.framework (signed versions only).
Fixes a problem installing or launching Tunnelblick when a .tblk exists but is not a folder (i.e., not an OS X package).
Fixes problems on OS X 10.4 ('Tiger').
Fixes a problem that sometimes caused updates to unsigned versions of Tunnelblick instead of to signed versions.
Note: this was not caused by a problem in Tunnelblick itself — it was caused by a misconfiguration on the tunnelblick.net website (the website used to check for updates). The misconfiguration was fixed on 2012-05-05 at 23:54 +04:00.

3.3beta04 build 3002 (2012-04-28)

SECURITY UPDATE: Replaces OpenSSL 1.0.1 with 1.0.1b.
Enhances security by making all of the application's contents owned by root.
Fixes bug when on OS X 10.4 ("Tiger") that used an unavailable method.
Fixes invalid links in Sparkle (which implements updates) FR_CA localization.
Fixes Issue 205 (notification windows overlapping each other).
Fixes some compiler warnings from Xcode 4.

3.3beta02 (2012-03-16)

Includes several changes with respect to notification windows:
Notification windows display the total amount of data uploaded and downloaded and recent up and down transfer rates for client connections.
When the pointer (mouse) is over the Tunnelblick icon in the menu bar, the notification windows for all configurations that have been active since Tunnelblick was launched are displayed. (This may be changed on the 'Appearances' panel of the 'VPN Details' window.)
Notification windows do not fade away if the pointer is over any notification window (or the Tunnelblick icon, as described above).
Notification windows for disconnected configurations have a 'Connect' button.
Fixes a bug that caused notification windows to appear in Mission Control on Lion even though they were closed.
Adds Openvpn 2.3alpha1, removes OpenVPN 2.1.4.
Adds a 'Utilities' tab to the VPN Details window. It includes:
- A 'Terminate all OpenVPN processes' button.
- A 'Run easy-rsa in Terminal' button.
- Click the '?' button on the tab for more information about these features.
Adds the ability to have a 'route-pre-down.tunnelblick.sh' script that is run before closing a connection. Tunnelblick's 'Set Nameserver' scripts use this to release a TAP device's DHCP lease. This feature (and the DHCP lease release) is available only when using OpenVPN 2.3alpha1 and only in Tunnelblick VPN Configurations.
Includes a customized version of OpenVPN's 'easy-rsa' 2.0 command-line scripts for creating certificates and keys.
Adds twoAppleScript nouns for configurations: 'bytesIn' and 'bytesOut' report bytes in or out through a client connection since Tunnelblick was launched.
Adds a 'Suggestion or Bug Report...' menu item to beta versions of Tunnelblick unless the 'doNotShowSuggestionOrBugReportMenuItem' preference is true.
Includes OpenSSL 1.0.1.
Does not try to connect if the OpenVPN log file could not be created.
Does not allow Unicode characters in usernames, passwords, and private keys (OpenVPN does not accept them).
Includes more debugging information when OpenVPN starts or fails to start.
Includes enhancements to the Tunnelblick build/clean process (see r1965 for details).
Includes preparations for Mountain Lion.
Disconnects a configuration if a Tunnelblick VPN Configuration script returns a non-zero (mod 256) result.
Logs explanations of why a disconnection occurred.
Logs Tunnelblick VPN Configuration script execution and result codes.
Logs unknown 'foreign_option's found by the standard up script.
Fixes a bug in log display of the command line used to start OpenVPN (cosmetic problem).
Fixes a bug causing loss of contents in the log display if the log contains invalid characters.
Fixes problems with the log display if the display gets large.
Fixes a problem with 'While connected' actions not always being saved in the 'Advanced' settings window.
Fixes a problem when there are no icon sets.
Fixes several compiler warnings detected by Xcode 4.

Version 3.2

3.2.9 (2013-05-14)

Preparation for updating to Tunnelblick 3.3.
Only this and later versions will be able to update to Tunnelblick 3.3 when it becomes available as a stable release.

3.2.8 (2012-08-10)

Fixes several problems caused by digital signatures.

3.2.7 (2012-08-06)

SECURITY UPDATE: Includes OpenSSL 1.0.0j, the latest security update to the 1.0.0 branch of OpenSSL.
Tunnelblick 3.2 has reverted to using the OpenSSL 1.0.0 branch (from the 1.0.1 branch) because of problems with OpenSSL 1.0.1b on some PowerPC computers.
Fixes a problem when a Tunnelblick VPN Configuration (.tblk) is not a folder.
Fixes crashes of the Tunnelblick UI under two separate sets of complex circumstances.

3.2.6 (2012-05-03)

Fixes a crash on OS X 10.4 ("Tiger") or PowerPC.

3.2.5 (2012-04-29)

Fixes a problem with the digital signatures of updates in 3.2.4.

3.2.4 (2012-04-27)

SECURITY UPDATE: Replaces OpenSSL 1.0.0g with 1.0.1b.
Fixes a problem with 'While connected' actions not always being saved in the 'Advanced' settings window.
Disconnects a configuration if a Tunnelblick VPN Configuration script returns a non-zero (mod 256) result.
Logs explanations of why a disconnection occurred.
Logs Tunnelblick VPN Configuration script execution and result codes.
Logs unknown 'foreign_option's found by the standard up script.
Fixes a problem when there are no icon sets.
Fixes bugs in OpenVPN's easy-rsa scripts that cause errors when the path to easy-rsa contains whitespace.
Fixes several compiler warnings detected by Xcode 4.

3.2.3 (2012-01-25)

Fixes a security vulnerability in OpenSSL by updating to OpenSSL version 1.0.0g. See OpenSSL's advisory for details.
Fixes a bug that sometimes caused repeated restarts of a connection when the search domain changed after the connection was established.
"Deployed" versions that update from the Tunnelblick website always update to unsigned versions to avoid problems with the OS X Keychain.
Fixes some French localization.
At launch, if Tunnelblick is updating from the official Tunnelblick site and has an invalid digital signature (for example, the program is a Deployed version or has been modified in some other way by the user), an update to an unsigned version of Tunnelblick will be offered immediately — even if the user has turned off automatic updates — unless the "updateCheckAutomatically" preference is being forced to false or the user is not an administrator and the "onlyAdminCanUpdate' preference is false or not present.

3.2.2 (2012-01-09)

Fixes six OpenSSL security flaws by updating OpenSSL from 1.0.0e to 1.0.0f. See OpenSSL's advisory for details.
Fixes a problem that caused a restart of the connection as a result of a DHCP renewal.
Fixes failure to ask what should be done when the user enters an incorrect private key (passphrase).

3.2.1 (2011-12-29)

Fixes a problem preventing installation or updates for some users on OS X 10.4.
Fixes problems connecting (loading tun/tap kexts) for some users.

3.2 (2011-12-19)

Stable 3.2 release — not a beta release.
Fixes a security vulnerability found in Tunnelblick 3.2beta36. (See 2011-12-20 Tunnelblick Vulnerability FAQ for details.)
Includes complete Japanese localization by Yoshihisa Kawamoto.
Fixes a memory leak and a problem that caused a failure to localize tabs in the "Advanced" settings window.

3.2beta36 (2011-12-10)

Includes additional Japanese localization by Yoshihisa Kawamoto.
Adds more control over what Tunnelblick does when a network setting changes. Controls are located on the "While Connected" tab of the Advanced configuration settings. (These controls may not be modified if the per-configuration 'CONFIGURATIONNAME-leasewatchOptions' preference is present. That preference is now deprecated.)
Includes fixes to format of Czech localization of credits.
Includes additional log entry if ExecuteAuthorized fails.
When installing and securing Tunnelblick, logs a warning but continues to install if the private configurations folder is not present. (Previously, the installation was abandoned if the private configurations folder was not present.)

3.2beta34 (2011-11-27)

Includes a Hungarian translation by Marcell Szabo, and a Czech translation by Petr Šrajer.
Includes the latest Tuntap release (version 20111101) for Snow Leopard and higher (Tunnelblick uses version 19990913 for Tiger and Leopard). This should fix the "kernel: Failed to add membership to all-hosts multicast address on interface" error in Lion.
Fixes a bug in the build process that causes an extra copy of a tun/tap kext to be stored inside each tun/tap kext when a build has already been done.
Fixes problems updating Tunnelblick caused by digital signatures on Deployed versions. When installing updates on a non-customized version of Tunnelblick (i.e., the Info.plist SUFeedURL entry is "https://tunnelblick.net/appcast.rss"):
- If the "updateSigned" preference is set, the application will be updated with a signed version;
- Otherwise, if the "updateUnsigned" preference is set, the application will be updated with an unsigned version;
- Otherwise, versions before 3.2beta34 are updated with signed versions; versions 3.2beta34 and higher are updated with signed versions only if they are themselves signed, otherwise they are updated with unsigned versions.
- "Signed" does not refer to the update itself, which is always digitally signed for authenticity. It refers to the Tunnelblick.app application being signed so that the updated version can use Keychain items without OS X prompting the user for permission.
- See Tunnelblick and Digital Signatures for more details.
For an "Unsigned Release" build, " Unsigned" is appended to CFBundleShortVersionString (the marketing version string). Similarly, for a "Debug" build, " Debug" is appended.

3.2beta32 (2011-10-12)

Includes OpenSSL version 1.0.0e.
Complete Polish localization by Magdelena Zajac and Łukasz M.
Improved French localization by Olivier Borowski.
Removes extra logging by Tuntap kexts introduced in 3.2beta30.
Does not allow a configuration to be renamed or made private or made shared unless the configuration is disconnected.
Fixes a problem with configurations set to connect 'when computer starts'.
Fixes a problem not accepting digits in domain names pushed by the VPN server. Now accepts A-Z, a-z, 0-9, '-', and '.' in domain names. Does NOT accept internationalized domain names.

3.2beta30 (2011-08-31)

Includes an experimental version of the Tuntap kexts (device drivers) that are used when running on OS X 10.7 "Lion". This should fix problems with kernel panics on some processors. (The older, stable versions of the drivers are used on OS X 10.4 - 10.6.)
Includes both OpenVPN 2.1.4 and OpenVPN 2.2.1. The latest version (2.2.1) will be used unless a different version is selected in the 'Preferences' pane of the 'VPN Details' window.
Includes complete localization for Catalan, German, Spanish, French, Korean, Norwegian, Dutch, Portuguese, Russian, Swedish, and Chinese (simplified).
Changes ownership/permissions of key, certificate, etc. files in a .tblk from root:wheel 0600 to root:admin 0640. This allows easier access to them for Admins (who could always access them with sudo anyway).
Translates the "Double-click to begin" message that appears in the disk image window to several more languages.
Several changes to preferences and forced-preferences:
If the 'doNotShowAddConfigurationMenuItem' preference is set, the 'Add a Configuration' menu item will not be shown even if there are no configurations.
Added the following preferences; each does what its name implies: - doNotShowVpnDetailsMenuItem - disableAdvancedButton - disableCheckNowButton - disableResetDisabledWarningsButton - disableCopyLogToClipboardButton - disableAddConfigurationButton (disables the '+' button) - disableRemoveConfigurationButton (disables the '-' button) - disableWorkOnConfigurationButton (disables the 'gear' button) - disableRenameConfigurationMenuItem - disableDuplicateConfigurationMenuItem - disableMakeConfigurationPrivateOrSharedMenuItem - disableExamineOpenVpnConfigurationFileMenuItem - disableShowOpenVpnLogInFinderMenuItem - disableDeleteConfigurationCredentialsInKeychainMenuItem
Removed the 'disableShareConfigurationButton' preference.
Removed the 'doNotShowForcedPreferenceMenuItems' preference.
Removed the 'doNotShowKeyboardShortcutSubmenu' preference.
Removed the 'doNotShowOptionsSubmenu' preference.
Several bugfixes:
Fixes a bug that caused the splash window to not be closed properly and thus appear in Exposé even after Tunnelblick has finished launching.
Fixes a bug that caused abnormally high CPU usage after closing the 'VPN Details' window if it was displaying the 'Info' panel.
Fixes a bug that tried to create a shadow copy of configuration files that were unsecured in Deploy or Shared. Now asks to secure them instead.
Fixes a bug that caused problems for 'connect when computer starts' configurations when the configuration is in a subfolder or the configuration's name contains slashes, dashes, or periods.
Fixes a bug that caused a forced 'updateFeedURL' preference to be ignored. (Note: this preference can only be forced; an 'updateFeedURL' user preference will be ignored for security reasons).
Fixes a bug that caused the 'updateCheckInterval' preference to be ignored
Fixes a bug that caused the 'Notification window' button to be enabled even if the 'connectionWindowDisplayCriteria' preference was forced.
Fixes a bug that caused the Tunnelblick icon to continue to blink whenAppleScript was used to 'connect all', even after all connections had been successfully made.

3.2beta28 (2011-07-31)

Johan Nilsson and Tim Malmström have provided Swedish localization.
Prevents kernel panics on OS X 10.7 "Lion" by reverting to OpenVPN 2.1.4.
Tunnelblick can now be updated even if its name is not Tunnelblick.app.
A splash window with status information appears while Tunnelblick is starting up. It will not be displayed if 'Display window while Tunnelblick is starting up' is unchecked on the 'Appearance' panel of the 'VPN Details' window. (Controlled by the 'doNotShowSplashWindow' preference.)
You can now select and copy the version information in the Info panel.
Fixes bug that caused a failure to display an error message and a many-second delay when user tries to set a non-.tblk to start when the computer starts.

3.2beta26 (2011-07-20)

Aleix Dorca has provided a complete Catalan localization.
Emma Segev and Tjalling Soldatt have provided complete Dutch localization.
Peter K. O'Connor has provided complete Chinese (simplified) localization.
Dennis Ukhanov, Eugene Trufanov, Nail Gilmanov, & Victor Ptichkin have provided complete Russian localization.
Changes the 'Show/Hide Configuration on Tunnelblick Menu' menu command to be the 'Show on menu' checkbox on the 'Settings' tab.
Un-rebrands the license description unless the 'doNotUnrebrandLicenseDescription' preference is set.
Fixes bugs when menu icon sets are not available.
Fixes bugs when updating Tunnelblick while a connection is active.
Fixes console warning about unrecognized preference.

3.2beta24 (2011-07-14)

Complete German localization by Marcus Schneider.
Complete French localization by Jeremy Sherman.
Complete Korean localization by Kyoungmin Kim.
Complete Norwegian localization by Jon Luberth.
Complete Portuguese localization by Denis Volpato Martins.
Includes OpenVPN version 2.2.1.
Now loads sounds each time the Configurations panel is displayed, so any sounds added by the user can be used immediately.
Adds protection against race conditions in sleeping and quitting.
The credits and license description on the Info panel are now localized.
Fixes a bug that didn't update 'Settings' tab items properly when a different configuration was selected in the 'Configurations' panel.
Fixes a bug that caused several items to appear in English instead of the preferred language, even if a preferred language translation of the item was available.
Fixes a bug that caused the 'Glass' sound to be used when a tunnel is established and the 'Basso' sound to be used when a tunnel was torn down if the preference for the sound was set to 'None'
Fixes a bug that caused the 'Advanced' window to pop up in front of any other application's window when the notification window appears.
Fixes a bug that ignored the Enter and Escape keys when entering a VPN username/password or passphrase.
Fixes a bug that caused the 'Glass' sound to be used when a tunnel is established and the 'Basso' sound to be used when a tunnel was torn down if the preference for the sound was set to 'None'
Fixes a bug that caused problems and failed to properly warn the user that a private configuration cannot be set to start when the computer starts.
Fixes several small memory leaks.

3.2beta22 (2011-07-01)

Includes LZO 2.05, replacing 2.03.
Sleep/wake change: When the computer wakes up, it now tries to reconnect all configurations that were connected, or were in the process of being connected, when it went to sleep. (Previously, Tunnelblick only tried to reconnect only those configurations that were connected when the computer went to sleep.)
Added an additional layer of protection against attacks.
Fixes a bug that caused connection failures for configurations on remote volumes or using shadow copies.
Fixes a bug that caused .tblk configurations on remote volumes or using shadow copies to ask for an administrator username/password each time a connection attempt was made.
Fixes a bug that didn't localize some window text.
Fixes a bug when using Set nameserver that caused domain/search name to be cut off.
Fixes a bug that caused shadow copies of configuration files to not be renamed, duplicated, removed, shared, or made private.
Fixes a bug that failed to remove some credentials when a configuration was removed.

3.2beta20 (2011-06-29)

Fixes a bug causing domains to be ignored when 'Set nameserver' is selected.

3.2beta18 (2011-06-27)

Fixes problems with sounds "on connect" and "on unexpected disconnect":
- Shows default sounds as "None".
- Changes to the sound settings take effect immediately.
Shows a splash screen during installation.
Cascades status windows when multiple status windows are being displayed simultaneously.
Monitors log only when it is being displayed.
Changes 'Connection window' to 'Notification window' on the Appearance panel of the 'VPN Details' window.
Makes the log non-editable.
Enables Apple help instead of browser-based help when running on Snow Leopard.
Sorts configurations and sounds numerically (e.g., config2, config4, config35 instead of config2, config35, config4).
Minimizes CPU usage at high OpenVPN verb levels.
Streamlines the share/make private dialog.
Fixes problems displaying the 'VPN Details' window when there are no configurations.
Fixes a problem that displayed incorrect sound 'on connect' and 'on unexpected disconnect' selections when no selections have been made. (Should have displayed 'None' for each, but displayed 'Glass' and 'Basso'.)
Fixes bug causing 100% CPU utilization when an unexpected error occurs while exiting the program.
Fixes problems renaming a configuration which is in a subfolder.
Fixes a small memory leak when the 'Show/Hide on Tunnelblick Menu' item is clicked.
Fixes a small memory leak when the VPN login window is shown.
Fixes a small memory leak when the 'Advanced' button on the 'Settings' tab of the 'Configurations' pane is clicked.

3.2beta16 (2011-06-24)

Portuguese localization by Denis Volpato Martins. Thanks!
Includes a single up/down script pair for Set nameserver which works for both tun and tap devices. Thanks to Nick Williams!
Implements a new simplified menu, which moves all options and preferences to a new 'VPN Details' window.
The new 'VPN Details' window:
Allows easy management of configurations, including renaming, duplicating, and removing them, and the ability to remove a configuration's credentials from the Keychain.
Includes a new GUI for modifying configuration settings, program preferences, and the appearance of the Tunnelblick icon and menu.
Optionally plays a sound when the connection is completed or unexpectedly terminated or restarted.
Implements a new facility for installing configurations at the time Tunnelblick is installed, and updating them at any time thereafter.
Installation of these configurations is triggered by including them in 'Tunnelblick Configurations.bundle' in Tunnelblick.app/Contents/Resources/. Thus they can be distributed as part of the normal Tunnelblick update mechanism.
The configurations are 'Tunnelblick VPN Configurations' (.tblk packages) and include all the options such configurations provide.
The configurations may be updated automatically, separate from the application.
Configuration updates (like Tunnelblick updates) must be digitally signed, or be transmitted over an SSL connection.
Configuration updates do not modify Tunnelblick.app, so they do not require modifying the digital signature of Tunnelblick.app.
The 'Tunnelblick Configurations.bundle' includes Info.plist entries that specify a URL for checking for and obtaining updates.
Includes sample code for a VPN service provider to allow signup for service from a Tunnelblick menu command. This includes several screens stepping the user through acceptance of terms of service, password assignment, etc. an interacts with a service provider's webserver. It is implemented as a compile-time option, turned off in the source code at present. (This was developed for a VPN service provider, but is being released in generic form under the GPL as a part of Tunnelblick.)
Implements a new 'universal login' facility that allows a single username/password combination stored in the Keychain to be used for all configurations that do not have a separate username/password combination in the Keychain. This facility was designed to be used by the above VPN service provider signup code (although it does not presently use it).
Fixes problem with Tunnelblick icon not appearing in security dialogs.
Fixes problem displaying help on Snow Leopard.
Fixes problem with displaying logs for multiple configurations.
Implements 'reset all warnings' better.
Includes additional protection against symlink attacks.

3.2beta14 (2011-05-17)

Fixes a crash on startup on OS X 10.4 ("Tiger") and 10.5 ("Leopard").
Fixes a typo in the help page for the "Appearance" preferences.

3.2beta12 (2011-05-16)

Tunnelblick has a window for preferences. Configuration settings are still modified on the 'Details' window.
Tunnelblick optionally displays a new, animated 'connecting' window as a configuration is being connected or reconnected. When the connection succeeds the window disappears. Display of the window is controlled by a preference which is set in the new preference window.
Menu streamlining:
- The 'Options...' submenu has been replaced by the 'Preferences...' item.
- The top line of the menu now allows the user to 'Disconnect All' configurations. It continues to display the number of active connections, and, if there is only one active connection, now displays the name of that connection.
- The 'Details' menu item has been renamed to 'VPN Details'.
- The 'Disconnect...' menu items now optionally display connection times.
- The 'Add a Configuration...' menu item has been renamed to "Add a VPN..." and moved from the 'Options...' submenu to the main menu.
Preferences changes:
- Most preference changes take effect immediately; none require relaunching Tunnelblick.
- The keyboard shortcut may be any of Command-Option-F1 through Command-Option-F12.
- The 'skipWarningAboutNoTunOrTap' preference has been renamed to '-skipWarningAboutNoTunOrTap' (it was missing the '-').
- Preferences are now stored in ~/Library/Application Support/Preferences/net.tunnelblick.tunnelblick.plist (because Tunnelblick's CFBundleIdentifier is now 'net.tunnelblick.tunnelblick'). The existing preferences file is renamed appropriately and a symbolic link to the new preferences file is put in its place when this version of Tunnelblick is first launched.
Adds digital signatures to Tunnnelblick.app so that the popups each time Tunnelblick is updated that ask whether Tunnelblick can access the Keychain will no longer appear (after they do for this update). Note: this only works on OS 10.5 ("Leopard") and above.
A symbolic link at ~/Library/openvpn that does not point to ~/Library/Application Support/Tunnelblick no longer forces Tunnelblick to quit. Instead, a warning is issued in the Console log.
The 'VPN Details' window has a minimum sizeto avoid a problem with OS X changing the button layout.
Fixes a bug that caused Tunnelblick to display the icon animation even though a user has requested that a connection attempt be cancelled after authentication fails.
Fixes a bug that caused the tooltip for the Tunnelblick icon and the status message (the first line of the menu exposed when you click the Tunnelblick icon) to display the wrong number of connections.
Fixes mislabeling of menu 'connection' items to clarify that they may be disconnected at any time they are not already disconnected.
Fixes a bug that caused 'Set nameserver (alternate 1)' to fail for some TAP connections.
Fixes a bug that did not allow Tunnelblick to launch on some OS X 10.4 ('Tiger') installations.
Fixes problem (since 3.2beta08) that user cannot set a configuration to connect or not connect when the computer starts. Note: configurations already set to start when the computer starts continued to work; this bug only affected trying to change a configuration from/to connecting when the computer starts.

If you build (compile) Tunnelblick:

You should create a signing certificate with Common Name 'TunnelblickSigning' using Keychain Access (see Apple's instructions). A certificate with that Common Name will be used automatically by the build scripts. If it is not present, no signing will take place and warnings will be issued during the build process.
Warnings during the build process that a target is already signed may appear if building the application but not rebuilding that particular target. These warnings may be ignored.

3.2beta10 (2011-04-29)

Includes OpenVPN 2.2 and PKCS#11 1.08.
Includes complete Portuguese localization by Denis Volpato Martins. Thanks, Denis!
Removes the 'Clear log' button from the Details window. (It is no longer needed because the log display is cleared at the start of each connection and its size is limited to 100,000 characters. This limit can be overridden by the 'maxLogDisplaySize' preference.).
Uses much less CPU time processing the log at high 'verb' levels.
Fixes bug that failed to properly deal with NetBIOSName when monitoring the connection.
Fixes bug that sometimes caused kexts to not be unloaded.
Fixes bugs when using TAP, DHCP, and 'Set nameserver (alternate 1)'
Fixes bugs causing the connection time display to freeze.
Adds messages to the Console log that invalid user-supplied values are being ignored (usually preference values or Info.plist entries).

3.2beta08 (2011-04-26)

No longer uses the down-root plugin if there are no 'user' or 'group' options in the configuration file. (The 'XXX-useDownRootPlugin' preference is removed in this situation.)
'Monitor connection' is more tolerant of unimportant changes and is more flexible:
Allows scutil's output keys to be in any order.
Only monitorsDomainName,ServerAddresses, andSearchDomains for DNS and NetBIOSName, Workgroup, and WINSAddresses for WINS/SMB.
New per-configration preference 'XXX-leasewatchOptions' (where XXX is the name of the configuration) consists of '-i' followed by the letters d, a, s, n, g, w to ignore theDomainName,ServerAddresses,SearchDomains, NetBIOSName, Workgroup, and WINSAddresses, respectively. If not present, all items are monitored. Example: to ignore all WINS/SMB changes, use '-ingw' (without the quotation marks).
New 'Set nameserver (3.1)' setting allows use of older 'Set nameserver' scripts.
Higher 'verb' levels may be used without performance degradation:
Tunnelblick doesn't process log files until you view the log in the Details window. So you can capture the log using high verb levels, disconnect, and then view the last 10,000 lines (approximately) of the log in Tunnelblick. If you need access to the entire log, you can find it in the /Library/Application Support/Tunnelblick/Logs folder. The log is overwritten each time you connect, and is deleted when Tunnelblick exits.
Tunnelblick only tries to load the last 1,000,000 characters of the log file, so long log files don't take a long time to process.
Tunnelblick rate-limits queueing of notifications when the log file changes.
Tunnelblick 'chunks' additions to the log display.
The log is cleared before each connection attempt is made.
Fixes bug that caused Tunnelblick to not connect 'automatically connect on launch' configurations. (The bug was apparently introduced in 3.2beta04.)
Fixes bug that sometimes causes retry of VPN username/password or passphrase to fail.
Fixes a bug that could cause an inability to start Tunnelblick because the installer was unable to properly secure it.

3.2beta06 (2011-04-06)

Allows copy/paste of usernames, passwords, and passphrases in the VPN login window. (For security reasons, passwords and passphrases may only be pasted.)
Fixes a bug that sometimes failed to alert the user when a VPN username/password or passphrase failed to be authenticated, making it work better with some OpenVPN servers. (There is still a bug in OpenVPN which causes Tunnelblick to fail to report some failures; this bug is fixed in OpenVPN 2.2rc, which Tunnelblick betas will start using 'soon'.)
Allows Tunnelblick VPN Configurations ('.tblk' packages) to be uninstalled. If a Tunnelblick VPN Configuration is double-clicked and the 'TBUninstall' key is included in its Info.plist (with any value), the installed configuration that has corresponding attributes (install location, bundle ID) will be uninstalled. If the key is the string 'ignoreError' (without the quote marks), any failures in the uninstall process will not be reported to the user.
Allows the deletion of backups of the Deploy folder by installing a version of Tunnelblick.app which includes an empty /Contents/Resources/Deploy folder. (This allows a user to install a fresh un-Deployed Tunnelblick over a Deployed version.)
MovesLeaseWatch.plist to /Library/Application Support/Tunnelblick so Tunnelblick.app is not modified (thus preserving the validity of the application's digital signature, if any).
Adds translations of additional OpenVPN connection status.
Includes changes to avoid two false-positive Xcode 3.2.5 analyzer warnings inNetSocket.m.
Fixes a bug that sometimes caused unnecessary 'The change will take effect the next time you connect' messages.
Fixes a bug that sometimes caused Tunnelblick to be unable to establish communications with OpenVPN.
Fixes a bug that sometimes — on OS X 10.4 ('Tiger') only — caused Tunnelblick to hang while quitting or connecting to a VPN server.
Fixes a problem that installed nested Tunnelblick VPN Configurations (.tblk packages) incorrectly.
Fixes a bug that caused Tunnelblick to refuse to install Tunnelblick VPN Configurations if they contained subfolders.
Fixes a bug that caused a Console log entry that a flag file does not exist after installing certain Tunnelblick VPN Configurations (.tblk).
Fixes a bug that caused tun/tap kexts to be loaded even though preferences specify that the kext(s) are not to be loaded.

3.2beta04 (2011-02-19)

Adds AppleScript support.
Includes complete French localization by Jeremy W. Sherman. Thanks, Jeremy!
Includes OpenSSL 1.0.0d.
Unloading of the foo.tap and foo.tun kexts is now attempted only if they are already loaded (previously, it was always attempted and errors were ignored).
Fixes problems with fast user switching (previously, user switches were ignored, which caused problems if Tunnelblick was used by more than one user and could cause the icon to indicate no VPN connection when one existed):
- When a user is switched out, all configurations that are not set to "connect when computer starts" will be disconnected unless the per-connection "-doNotDisconnectOnFastUserSwitch" preference is set true.
- When a user is switched in, Tunnelblick will attempt to connect any configurations that were connected at the time the user was switched out but are no longer connected unless the per-connection "-doNotReconnectOnFastUserSwitch" preference is set true.
Fixes potential race condition when computer wakes up.
Fixes bug that can cause unnecessary warnings about unknown OpenVPN processes.
Fixes bug that caused up/down scripts in .tblks to not be executed.
Fixes bug that can cause crashes after connecting to a VPN.

3.2beta02 (2011-02-02)

The following scripts may be included in a Tunnelblick VPN Configuration (.tblk package):
- The 'pre-connect.sh' script is executed (as root) before Tunnelblick would unload and/or load the tun or tap kexts (whether or not any unload or load takes place).
- The 'post-tun-tap-load.sh' script is executed (as root) after Tunnelblick unloads and/or loads the tun or tap kexts (whether or not any unload or load takes place). Thus, the script is executed immediately before starting OpenVPN.
- The 'connected.sh' script is executed (as root) when a configuration connects. This script is executed only if Tunnelblick is running at the time of the event, which may not be the case for 'when computer starts' configurations.
- The 'reconnecting.sh' script is executed (as root) when OpenVPN loses the VPN connection and is trying to reconnect. This script is executed only if Tunnelblick is running at the time of the event, which may not be the case for 'when computer starts' configurations.
- The 'post-disconnect.sh' script is executed (as root) after OpenVPN has closed the connection. This script is executed only if Tunnelblick is running at the time of the event, which may not be the case for 'when computer starts' configurations.
Fixes problem installing Tunnelblick via double-click when the user's home folder is not on the same volume as /Applications/Tunnelblick.app
Warns the user if a configuration is set to to connect when the computer starts and it is a Tunnelblick VPN Configuration (.tblk package) which includes a 'connected.sh', 'reconnecting.sh', or 'post-disconnect.sh' script. Those scripts are not executed unless Tunnelblick itself is running when the event occurs, which may not be the case for 'when computer starts' configurations.
Tunnelblick (but not third-party) preparation for OS X 10.7 (Lion), including isolating deprecated methods and changes for GCC 4.2. Warnings about 'object file compiled with -mlong-branch' when building Tunnelblick are now gone — building Tunnelblick generates warnings only for third-party software. (Still generates code for OS X 10.4, 10.5, and 10.6)
Fixes a few small memory leaks: one VPNConnection objects per sleep/wake cycle, two NSStrings per connect/disconnect, one NSMutableArray and two NSImages each time the "Use Original Icon" menu command is clicked, several objects each time executeAuthorized is run, and Issue 171.
Removed 5 second delay before launching Tunnelblick after installation
Removed references to "intValueOfBuildForBundle" because it is no longer used
Updated copyright notices and added Free Software Foundation license URL

Version 3.1

*3.1.7 (2011-04-03)

Fixes problems causing tun/tap kexts to be loaded even though preferences specify that the kext(s) are not to be loaded.
Fixes a problem with installing some Tunnelblick VPN Configurations (.tblk).

*3.1.6 (2011-02-19)

Fixes a bug that caused up/down scripts in Tunnelblick VPN Configurations (.tblks) to be ignored.

3.1.5 (2011-02-01)

Fixes a bug causing installation/repair failures on OS X 10.4 ("Tiger") PPC.

3.1.4 (2011-01-28)

Fixes a bug causing installation/repair failures on OS X 10.4 ("Tiger").

3.1.3 (2011-01-27)

Fixes a security vulnerability which affects all earlier Tunnelblick 3.1 versions (but not any 3.0 versions).
Adds a 'Use Original Icon' item to the 'Options' menu to allow easy switching between the original grayscale Tunnelblick icon and the new yellow-light-at-the-end-of-the-tunnel Tunnelblick icon.

This menu item is not displayed:

If the 'doNotShowUseOriginalIconMenuItem' preference item exists and is true; or
If Tunnelblick.app/Contents/Resources/IconSets/TunnelBlick-black-white.TBMenuIcons does not exist; or
If the 'menuIconSet' preference exists and contains anything other than 'TunnelBlick.TBMenuIcons' or 'TunnelBlick-black-white.TBMenuIcons'.
Displays "(Private)", "(Shared)", or "(Deployed)" after a configuration name only if more than one type of configuration is present.
Warns (in the Console log) about missing or incomplete icon sets and attempts to use the standard icon set.
Fixes a bug that sometimes misinterpreted the configuration file causing a "No 'dev tun' or 'dev tap' found" warning to appear even when such an option did appear in the configuration file.
Fixes a bug that sometimes caused the warning that "OpenVPN is not responding to disconnect requests" to appear when OpenVPN had already responded to a disconnection request.
Fixes bugs that sometimes caused Tunnelblick icon to show the "connecting" animation even though a connection attempt has been completed successfully or abandoned, or after abandoning an attempt to hook up to an existing OpenVPN process.
Fixes a bug that sometimes caused logging to be disabled if the openvpn-down-root.so plugin were used.
Fixes a bug that caused a warning that there are no configurations during the process of updating a "Deployed" version of Tunnelblick.
Fixes a bug that could cause Tunnelblick to hang during installation from a disk image. (Not likely to ever happen, though!)

3.1.2 (2010-12-25)

Removes the 'warns the user when certain unexpected disconnections occur' feature added in version 3.1.1 because it caused Tunnelblick to hang under certain conditions of sleep/wake cycles and/or screensavers. This feature will return in more robust form in a future beta release.

3.1.1 (2010-12-18)

Fixes a problem with the left navigation sometimes not being displayed properly when the Details window does not have left navigation but adding a configuration changes it to have left navigation.
Fixes a problem installing Tunnelblick VPN Configurations (.tblk packages) that have a CFBundleIdentifier containing upper-case letters.
Fixes a problem when a .tblk that is being installed has a path which includes a component which includes the string '.tblk'
Fixes a problem checking permissions on configuration file when user's home folder is not the usual /Users/username folder — for example, when it is on a network volume (Issue 163).
Fixes a problem with the Tunnelblick icon not displaying correctly for multiple simultaneous connections. Now the icon is a closed tunnel if all configurations that the user expects to be closed are in fact closed, is an open tunnel if all configurations that the user expects to be open are in fact open; otherwise the icon is an animation — neither open nor closed.
Fixes a problem trying to set a configuration that is in a subfolder to connect at system start.
Fixes openvpnstart crashes when certain errors occurred. (Tunnelblick itself did not crash.)
Fixes problems when using 'shadow' configuration files.
Warns the user when certain unexpected disconnections occur.
Adds a message to the OpenVPN log displayed in the Details window when Tunnelblick obtains a VPN passphrase or username/password from the Keychain.
Waits to go to sleep until all OpenVPN processes have terminated, unless the 'doNotPutOffSleepUntilOpenVPNsTerminate' boolean preference is set true.
Changes Tunnelblick icon animation and open tunnel icon to show yellow beyond the tunnel, brightening the icon subtly. To use the old icon animation, set the 'menuIconSet' preference to the string 'TunnelBlick-black-white.TBMenuIcons'. Many thanks to Wes Plate for this new icon set.
Fixes the inability to display the build number when the Tunnelblick version number that has a period in the build number (as do these 3.1.1 builds).
Fixes a typographical error in an error message referring to a known problem in OpenVPN 2.1 — the error message incorrectly referred to OpenVPN 2.2.

3.1 (2010-12-05)

Only the version and build numbers were updated.

3.1beta24 (2010-12-03)

Updates to use OpenSSL 1.0.0c, which fixes several security vulnerabilities.
Searches for the icon set folder in Tunnelblick.app/Contents/Resources/Deploy and then in /Library/Application Support/Tunnelblick/Shared before defaulting to the version in Tunnelblick.app/Contents/Resources.
Fixes bug that caused an unneeded folder (dmgFiles) to be built into Tunnelblick.app/Contents/Resources.

3.1beta22 (2010-12-01)

Updated to include OpenVPN 2.1.4 and OpenSSL 1.0.0b.
Adds a note to the OpenVPN log (in the Details window) when the computer goes to sleep or wakes up and a connection is terminated/restarted.
Fixes a problem modifying 'Set nameserver' on other-than-the-first connection.
Fixes an OpenVPN problem with special case route targets ('remote_host')

3.1beta20 (2010-10-31)

Removed confusing question when Tunnelblick is launched and foo.tap and/or foo.tun (old Tunnelblick kexts) are loaded. The question asked if foo.tun and foo.tap should be unloaded. Now they are unloaded only as needed to make a connection: foo.tap is unloaded if net.tunnelblick.tap is being loaded for the connection, and foo.tun is unloaded if net.tunnelblick.tun is being loaded for the connection. The 'skipAskingToUnloadFooKexts' preference is no longer used. To override Tunnelblick's automatic loading of the tun or tap kexts required for a connection, see the following per-configuration Preferences: "-doNotLoadTunKext", "-doNotLoadTapKext", "-loadTunKext", and "-loadTapKext".

3.1beta18 (2010-010-16)

When there are more than eight configurations, the Details window changes to display a list of connections on the left side and a single tab with the log and controls on the right. This was done because of OS X problems when there are a large numbers of tabs. The 'maximumNumberOfTabs' preference specifies the maximum number of tabs to display; if there are more than that many configurations, the display will change as described above. The preference defaults to 8. Set this preference to 0 to always show configurations in a list on the left.
Streamlines installation by double-clicking to have only one dialog box explaining what will be installed and asking for admin username/password.
Fixes bug which prevented Standard users from installing Tunnelblick by double-clicking.
Fixes bugs in automatic installation of .tblks when installing Tunnelblick.

3.1beta16 (2010-010-08)

Replaces the 'Set nameserver' checkbox with a drop-down list that can display additional choices to allow different up/down scripts to be used.
- The following choices will always be displayed:
  - 'Do not set nameserver' to not use any scripts (equivalent to not having a check in the old 'Set nameserver' checkbox')
  - 'Set nameserver' to use the standard Tunnelblick scripts (equivalent to having a check in the old 'Set nameserver' checkbox')
- The following two additional choices will be displayed only if custom scripts are not being used:
  - 'Set nameserver (3.0b10)' to use scripts from Tunnelblick 3.0b10 (for backward compatibility)
  - 'Set nameserver (alternate 1)' to use scripts based on Ben Low's scripts. These scripts:
    - Implement multiple domains 'pushed' from the server
    - Fix some issues with some TAP connections that cause 'write to TUN/TAP : Input/output error (code=5)' and other errors
    - Do not implement 'Monitor connection'
- Note: Some Deployed versions of Tunnelblick and Tunnelblick VPN configurations may include custom scripts that will inhibit the display of these two additional choices.
- Running this version changes the 'useDNS' per-configuration preference from a boolean to a number. This is a downward-compatible change — earlier versions of Tunnelblick may be run after running this version and modifying the 'Set nameserver' selection. The earlier version will consider anything other than 'Do not set nameserver' as if the 'Set nameserver' checkbox were checked.
- Warning: If Build 2054 changes the setting to 'Set nameserver (3.0b10)' or 'Set nameserver (alternate 1)', using an earlier version of Tunnelblick to modify the checkbox so it is checked will revert the setting back to 'Set nameserver'.
Adds the ability to add menu items to the Tunnelblick menu to execute programs (e.g., scripts).
Adds the ability to specify programs that should be executed when Tunnelblick is launched or when a connection is attempted. (See Additional Menu Commands and Programs for details.)
Includes localization-related code tweaks by Stefan Bethke and additional German localization by Stefan Bethke, Marcus Schneider, and 'Dr Hok'.
Fixes a formatting error when displaying file permissions in error messages about being unable to change permissions.
Fixes a problem causing a connection restart when 'Set nameserver' is used, a DHCP renewal occurs, and there are no WINS settings.
Fixes issues when usingOpenDirectory and the user's home directory is on a non-Mac platform.

3.1beta14 (2010-09-09)

Fixes Issue 159 problem that, under certain circumstances, crashes client.down.tunnelblick.sh
Includes OpenVPN version 2.1.3.
Thanks to Mohammad A. Haque: Includes the OpenSSL v. 1.0.0a library imbedded into the included OpenVPN binary. This adds support for the following:

Digests:
ecdsa-with-SHA1 160 bit digest size
MD2 128 bit digest size
RSA-MD2 128 bit digest size
RSA-SHA224 224 bit digest size
RSA-SHA256 256 bit digest size
RSA-SHA384 384 bit digest size
RSA-SHA512 512 bit digest size
SHA224 224 bit digest size
SHA256 256 bit digest size
SHA384 384 bit digest size
SHA512 512 bit digest size
whirlpool 512 bit digest size

Ciphers: CAMELLIA-128-CBC 128 bit default key (fixed)
CAMELLIA-128-CFB 128 bit default key (fixed)
CAMELLIA-128-CFB1 128 bit default key (fixed)
CAMELLIA-128-CFB8 128 bit default key (fixed)
CAMELLIA-128-OFB 128 bit default key (fixed)
CAMELLIA-192-CBC 192 bit default key (fixed)
CAMELLIA-192-CFB 192 bit default key (fixed)
CAMELLIA-192-CFB1 192 bit default key (fixed)
CAMELLIA-192-CFB8 192 bit default key (fixed)
CAMELLIA-192-OFB 192 bit default key (fixed)
CAMELLIA-256-CBC 256 bit default key (fixed)
CAMELLIA-256-CFB 256 bit default key (fixed)
CAMELLIA-256-CFB1 256 bit default key (fixed)
CAMELLIA-256-CFB8 256 bit default key (fixed)
CAMELLIA-256-OFB 256 bit default key (fixed)
DES-EDE3-CFB1 192 bit default key (fixed)
DES-EDE3-CFB8 192 bit default key (fixed)
IDEA-CBC 128 bit default key (fixed)
IDEA-CFB 128 bit default key (fixed)
IDEA-OFB 128 bit default key (fixed)
RC5-CBC 128 bit default key (variable)
RC5-CFB 128 bit default key (variable)
RC5-OFB 128 bit default key (variable)
SEED-CBC 128 bit default key (fixed)
SEED-CFB 128 bit default key (fixed)
SEED-OFB 128 bit default key (fixed)

TLS Ciphers: CAMELLIA128-SHA
CAMELLIA256-SHA
DHE-DSS-CAMELLIA128-SHA
DHE-DSS-CAMELLIA256-SHA
DHE-DSS-SEED-SHA
DHE-RSA-CAMELLIA128-SHA
DHE-RSA-CAMELLIA256-SHA
DHE-RSA-SEED-SHA
ECDH-ECDSA-AES128-SHA
ECDH-ECDSA-AES256-SHA
ECDH-ECDSA-DES-CBC3-SHA
ECDH-ECDSA-RC4-SHA
ECDH-RSA-AES128-SHA
ECDH-RSA-AES256-SHA
ECDH-RSA-DES-CBC3-SHA
ECDH-RSA-RC4-SHA
ECDHE-ECDSA-AES128-SHA
ECDHE-ECDSA-AES256-SHA
ECDHE-ECDSA-DES-CBC3-SHA
ECDHE-ECDSA-RC4-SHA
ECDHE-RSA-AES128-SHA
ECDHE-RSA-AES256-SHA
ECDHE-RSA-DES-CBC3-SHA
ECDHE-RSA-RC4-SHA
IDEA-CBC-SHA
PSK-3DES-EDE-CBC-SHA
PSK-AES128-CBC-SHA
PSK-AES256-CBC-SHA
PSK-RC4-SHA
SEED-SHA

For a complete list of available digests, ciphers, and TLS ciphers, type the following into Terminal: {{{ sudo ./openvpn --show-digests --show-ciphers --show-tls }}}

("sudo" is needed if Tunnelblick.app has been run at least once, because Tunnelblick secures the OpenVPN binary by making it owned and executable only by root.)

3.1beta12 (2010-08-08)

Includes Italian localization thanks to Pierpaolo Gulla (Grazie!).
Implements a single, system-wide keyboard shortcut (command-option-F1 by default) to expose the Tunnelblick menu.
- This make it possible to use Tunnelblick with only a keyboard.
- The keyboard shortcut may be used whenever Tunnelblick is running - it does not need to be the front-most application.
- A new submenu of the Options submenu has been added to allow the key to be changed to any of the function keys from F1 through F12. The display of the new submenu is inhibited if the 'doNotShowKeyboardShortcutSubmenu' preference is set to TRUE.
- Two new unsigned integer preferences: 'keyboardShortcutKeyCode' contains the virtual keycode for the key, and 'keyboardShortcutModifiers' contains the code for the modifier keys.
No longer displays Tooltips by default. They are displayed only if the 'showTooltips' preference is set to TRUE. This is necessary because tooltips on menu items interfere with the proper operation ofVoiceOver, OS X's built-in screen access solution.
Terminates faster if going to sleep or if no unknown OpenVPN processes exist and no 'when computer starts' configurations are connected.
Works around the following OpenVPN bug: when in the 'RESOLVE' state, the OpenVPN process ignores the first SIGTERM (via kill or management interface) and delays termination for tens of seconds after a second or subsequent SIGTERM. Works around this by warning the user that this is happening, then repeatedly sending SIGTERM and, after a timeout period (default is 180 seconds), considering the connection closed even if OpenVPN doesn't acknowledge the closing. Two new preferences specify the time in seconds between sending SIGTERMs ('openvpnTerminationInterval') and the total maximum time in seconds to wait before considering the connection closed ('openvpnTerminationTimeout').
Logs errors trying to create or update 'Launch Tunnelblick' in the private configurations folder.
Fixes bugs (race conditions) when the log view is being updated and whenMenuExtras are added.
Fixes bug with placement of the 'when computer starts' radio button in non-English versions of Tunnelblick.

3.1beta10 (2010-07-29)

Configurations located in subfolders are displayed in submenus of the main Tunnelblick menu.
The 'wizard' that runs when there are no configurations present or when the user selects 'Add a configuration...' has been enhanced.
When there are no configurations available, two menu items are displayed in place of the configurations: 'No VPN Configurations Available' and 'Add a Configuration...'. (The 'Add a Configuration...' menu item will not be displayed if the 'doNotShowAddConfigurationMenuItem' preference is true.)
An 'Add a Configuration...' menu item was added to the 'Options...' submenu. (It will not be displayed if the 'doNotShowAddConfigurationMenuItem' preference is true.) This menu item starts the configuration wizard.
When a Tunnelblick VPN Configuration (.tblk package) is installed, all Tunnelblick VPN Configurations within it will be installed. If these 'inner' configurations are inside subfolders of the outer .tblk, they will be installed as subfolders of the configurations folders and will appear in submenus of the main Tunnelblick menu.
automatic installation of configurations from the .dmg has changed: Only one Tunnelblick VPN Configuration (.tblk packages) in the '.auto-install' or '.auto-install' folders and their subfolders is installed.
The ability to install Tunnelblick VPN Configurations from malformed folder contents has been improved.
Tunnelblick now tries up to five times to get the login items, avoiding a timing issue.
The log display in the Details window is now read-only from the keyboard.
If it doesn't exist, Tunnelblick creates a symlink to ~/Library/Application Support/Tunnelblick/Configurations from ~/Library/openvpn. This avoids a problem when a user launches a new version of Tunnelblick one or more times without having ever used an older version, and then tries to use an older version.
Attempts to repair more configuration folder problems, such as the existence of both the old and new folders.
Fixes bugs in the shadow copy mechanism that caused connect failures, log-hookup failures, and (possibly) other problems. Thanks to Jim Bo for pointing out the first problem and suggesting a solution.
Fixes bug that caused tun/tap kexts to fail to unload when a connection was closed
Fixes incorrect help message for 'openvpnstart'

3.1beta08 (2010-07-10) IMPORTANT NOTE FOR THOSE USING "WHEN COMPUTER STARTS" WITH EARLY 3.1BETA VERSIONS: The first time that you update to Tunnelblick 3.1beta08 or above from 3.1beta02 - 3.1beta06, Tunnelblick will not recognize any running "when computer starts" configurations. Five to ten seconds after you start Tunnelblick, they will be identified as unknown OpenVPN processes and you will be given the choice to leave them alone or disconnect them. You should chose to disconnect them in this dialog and then manually connect them in Tunnelblick. (You do not need to do this immediately, but you will not be able to control them with Tunnelblick. The dialog will appear each time you start Tunnelblick if these connections are still active.) This need only be done once, and is not necessary if there are no "when computer starts" configurations that are connected at the time you update.

Benji Greig has created an updated Tunnelblick icon that looks great in Coverflow. He has also created a distinctive icon for Tunnelblick VPN Configurations, and a new background image for the Disk Image. Thanks, Benji!
Log processing and display have been rewritten:
- OpenVPN log files are kept in /tmp/tunnelblick/logs using filenames encoded with the configuration file path, the management port number, and the arguments to openvpnstart when the connection was created.
- Script log files are kept in the same directory, using filenames encoded with the configuration file path.
- Log files are created each time a connection is made. 'Pipes' are no longer used for the script files, and the OpenVPN management interface is not used to process log data.
- When displaying the log, the entries are merged such that script log entries follow OpenVPN log entries that have the same date/time.
- The log display now shows the most recent 10000 entries. Earlier entries are not displayed, but they are available in the log files stored in /tmp/tunnelblick/logs.
- Formatting of the log display is improved."
The DNS cache is flushed after a tunnel is established and after it is torn down. This is enabled by default but may be disabled by the per-connection "-doNotFlushCache" preference.
Tunnelblick VPN Configurations (.tblk packages) may now be shadow copied
Configurations (.conf, .ovpn, and .tblk) may be stored in subfolders. Note that .tblk configurations are installed at the top level of the shared or private folder; they must then be moved to a subfolder if that is desired.
Sets share/private button to 'Share configuration' when it is disabled.
Fixes bug that caused 'Ignoring change of Network Primary Service' message to be displayed when no change occurred.
Fixes bug that caused unload of tun/tap kext at exactly the right time while a restart was taking place if the user disconnected a different configuration that used the same tun/tap kext.
Fixes bug that caused .conf configuration files to be ignored.
Fixes bug that caused failure to connect if "Monitor connection" was checked and the standard up script was used.
Fixes bug that caused restarts to fail if a different configuration was disconnected at exactly the right (or wrong!) time.
Fixes bug that didn't clean up when installation of a .tblk package failed.
Fixes bug that caused 'Set nameserver' script (i.e., 'leasewatch') to be run when it is not necessary.
Fixes bug that caused launch of leasewatch script (when 'Set nameserver' is checked) to fail if automatically connecting when computer starts
Fixes bug which causes format errors in the log display if a script generates log entries which don't have a "**" after the date/time. (Inserts a "**" in such entries in the log display.)

3.1beta06 (2010-06-07)

Takes into account both the 'dev-type' and 'dev' options in the configuration file when trying to determine if it is a 'tun' or 'tap' connection. Tunnelblick tries to determine that so it can load only the tap or tun kext (device driver) that is required. Note: there appears to be a bug in OpenVPN that makes the dev-type option fail; this does not help that problem.
Runs new scripts, pre-connect.sh and post-disconnect.sh, as root before connecting and/or after disconnecting if the scripts exist. (They must be in a .tblk package). This allows manipulation of kexts and/or the network configuration before the tun/tap kexts are loaded and OpenVPN is run and after OpenVPN exits and the kexts are unloaded.
Changed "Online Documentation.webloc" that is put in the .dmg so it will go to the new main documentation page.
Fixes bug that caused .conf configuration files to be ignored.
Fixes bug that caused failure to connect if "Monitor connection" was checked and the standard up script was used.
Fixes bug that caused restarts to fail if a different configuration was disconnected at exactly the right (or wrong!) time.
Fixes bug that didn't clean up when installation of a .tblk package failed.

3.1beta04 (2010-05-27)

Creates pipes for script output to "Details" window on demand instead of when Tunnelblick launches
Deletes logs for 'when computer starts' connections when they are disconnected
Doesn't un-check 'Connect automatically' if administrator permission to change from 'when Tunnelblick launches' to 'when computer starts' is cancelled, so connect 'when Tunnelblick launches' will remain in effect
Allows cancel out of dialog asking if 'openvpn-down-root.so' should be used
Marks start and end of OpenVPN log entries from before Tunnelblick was launched
Displays a notice if then OpenVPN log entries from before Tunnelblick was launched are more than 10,000,000 bytes long.
Includes path of openvpnstart to be used in Console log messages that a configuration will 'connect when computer starts'
Reinforces security of openvpnstart — it now verifies it is protected before doing any operations
Reformats dates in OpenVPN log entries from before Tunnelblick was launched to YYYY-MM-DD HH:MM:SS
A DHCP renew which restores the original DNS and/or WINS information no longer causes the connection to restart. This new behavior can reversed be by setting Tunnelblick the boolean preferences '-doNotRestoreOnDnsReset' and/or '-doNotRestoreOnWinsReset' to TRUE.
Modified the up, down, and leasewatch scripts:
- client.up.osx.s and client.nomonitor.up.osx.sh are replaced by client.up.tunnelblick.sh
- client.down.osx.s and client.nomonitor.down.osx.sh are replaced by client.down.tunnelblick.sh
- The up and down scripts may be called with optional arguments (before the standard OpenVPN-supplied arguments) that are prefixed by a '-'. The arguments are:
  - -m to monitor the network configuration (reflects the 'Monitor connection' checkbox);
  - -w to cause restoration of expected WINS configuration if it changes to the pre-VPN configuration (via DHCP renewal, for example); and
  - -d to cause restoration of expected DNS configuration if it changes to the pre-VPN configuration (via DHCP renewal, for example).
- The -w and -d options are specified if the boolean Tunnelblick preferences '-doNotRestoreOnDnsReset' and/or '-doNotRestoreOnWinsReset' are TRUE.
- The up script saves, and leasewatch and the down script access, additional parameters (the state of the optional arguments, network primary service ID, and logfile path) in the System Configuration database as /Network/OpenVPN/...
- The up script saves the pre-VPN WINS (SMB) configuration in the System Configuration database as /Network/OpenVPN/OldSMB
- The down script ignores the optional arguments (accessing any it needs via the System Configuration database)
- leasewatch behavior has changed, although a Tunnelblick preference restores the old behavior. It used to restart the connection if the DNS or WINS configuration changed from the post-VPN-creation configuration (which reflects 'pushed' values from the OpenVPN server). This caused a restart of the connection when a DHCP renewal changed the settings to the pre-VPN configuration. This situation is now detected, and the DNS and/or WINS configurations are restored to the post-VPN-creation configuration instead of restarting the connection. This new behavior may be inhibited (forcing the old behavior to restart the connection) by setting the boolean Tunnelblick preferences '-doNotRestoreOnDnsReset' and/or '-doNotRestoreOnWinsReset' to FALSE.
- Tunnelblick itself has been modified to use the new scripts, but only if the old scripts are not present. That means that an automated build process, for example, which replaces client.up.osx.sh with a customized version, will continue to work, because Tunnelblick will see the old script, and use that instead of using the new script (even if the new script is present).
- The openvpnstart 'bitMask' argument has additional bits that specify options to send to the scripts (as described above)
openvpnstart puts a warning in the OpenVPN log (in the Details window) if the path to the up or down script is very long, which could result in OpenVPN sending incomplete arguments to the scripts. (OpenVPN truncates the command line it uses to start the scripts to 255 characters.)"
Warnings from the openvpnstart program are now included in the OpenVPN log displayed in the 'Details' window
Fixes bug that caused load of tap devices to fail when connecting
Fixes bug that sometimes caused log file contents not to display
Fixes bug that caused output from leasewatch ('Monitor connection' checkbox checked) to be stored in a /tmp file instead of displayed in the OpenVPN Log on the Details window for Tunnelblick VPN Configurations (.tblk packages)
Fixes bug with 'connect on computer start' causing Tunnelblick to ask, in error, to flip the value of the checkbox
Fixes bug with 'when Tunnelblick launched' and 'when computer starts' radio buttons

3.1beta02 (2010-05-14)

Polish (PL) localization by Grzegorz Danecki. Dziękuję bardzo!
Additional Norwegian (Bokmål, NB) localization by Jon Luberth. Tusen takk!
Additional French (FR) localisation by François Varas. Merci beaucoup!
Additional Catalan localization by Aleix Dorca. Moltes gràcies!
Many thanks also to Michael Williams. Many new enhancements are possible due to the his work. He contributed code that allows configurations in more than one folder to be available simultaneously. This has triggered an overhaul of the way Tunnelblick handles configurations, adding many new features.
Configurations may now be shared among all users of a computer, or they may be private to a particular user.
- A new button in the 'Details' window makes changing the availability of a configuration easy. The button displays either 'Share configuration' or 'Make configuration private', as appropriate.
- To be shared, a configuration must be a 'Tunnelblick VPN Configuration' (see below).
- The Shared folder (/Library/Application Support/Tunnelblick/Shared) and its contents are protected. It is owned by root and may only be modified by administrators.
- Shared configurations (like deployed configurations) may only be examined, not edited. (But you can make it private, edit it, and then share it).
A new kind of configuration, a 'Tunnelblick VPN Configuration', may be used and may be shared among all users of a computer, or remain private to an individual user (see Tunnelblick VPN Configurations for details):
- A Tunnelblick VPN Configuration is an OS X folder with an extension of '.tblk'.
- A Tunnelblick VPN Configuration includes one .ovpn configuration file, and many include key and certificate files and shell scripts. It can also include default settings for per-configuration preferences and version information to help manage enterprise distribution of configurations.
- Tunnelblick VPN Configurations must be installed before they can be used. They can be installed by double-clicking them, or dragging and dropping them on a Tunnelblick icon in Finder (but not the Tunnelblick icon in the Status Bar near the Spotlight icon). They can also be automatically installed when installing Tunnelblick by including them in the disk image. The user is given the option of installing them as private or shared. All of this behavior can be controlled and/or inhibited by preferences, which can be 'forced' in a Deployed version of Tunnelblick.
- Tunnelblick VPN Configurations and their contents are secured. Key and certificate files, for example, may not be read by the user. (The protection is not as robust as that for Deployed configurations, so that users may edit the configuration, but they are secure in the sense that a user is never allowed to use a configuration that has not been authorized by a computer administrator.)
Tunnelblick can now start Tunnelblick VPN Connections (clients or servers) when the computer starts:
- A new option in the Details window is available for Shared and Deployed .tblk packages: to connect automatically 'when the computer starts'.
- When Tunnelblick is launched, it attaches itself to any OpenVPN processes which were started because of that option and allows control (disconnect/connect) of them, and displays their logs.
- When Tunnelblick quits, it closes only those connections which do not have 'when computer starts' selected. Thus OpenVPN instances started outside of Tunnelblick will continue, as will those started by Tunnelblick at any time that have 'when computer starts' selected at the time Tunnelblick quits.
- If any unknown OpenVPN processes are running a few seconds after Tunnelblick is launched (i.e., after it has 'hooked up' to ones it started because of the 'when the computer starts' option), it pops up a window which gives the user the option to terminate them or ignore them. A checkbox in the window allows the user to 'Do not display this message again, always ignore'. There is a preference, 'hookupTimeout' that is the number of seconds to try, with a default of five seconds.
- Note that these 'when the computer starts' configurations must not ask for usernames, passwords, or private keys. (There is no user to ask, and no Tunnelblick to pull them out of the Keychain and give to OpenVPN.)
Tunnelblick now deals with the .tun and .tap kexts more flexibly:
- Loads and unloads them on demand: loaded at connect, unloaded at disconnect. An load is ignored if the kext is already loaded and an unload is ignored if the kext is in use.
- Scans the configuration file to determine if 'tap' or 'tun' is being used, and loads only the appropriate kext at connect. (Tunnelblick uses whatever is specified in the first 'dev' option in the configuration file.)
- New per-configuration preferences can be used to override the automatic detection of which kexts to load at connect: -loadTapKext, -loadTunKext, -doNotLoadTapKext, and -doNotLoadTunKext are all to be prefixed by the configuration name. (If both 'load...' and 'doNotLoad...' preferences exist for a specific configuration, the specified kext will not be loaded.)
- When Tunnelblick launches, it unloads net.tunnelblick.tun and net.tunnelblick.tap so that the versions in use will always be loaded from the running version of Tunnelblick.app. The unload will not occur if the kexts are in use — for example, by an instance of OpenVPN started when the computer started.
- If foo.tap and foo.tun are loaded when Tunnelblick launches, it offers to unload them. (They are the old Tunnelblick kexts.) This simplifies the transition to the new net.tunnelblick.tun/tap for most users without a computer restart.
Configurations are now listed in case-INsensitive alphabetic order and are no longer surrounded by single-quote marks on the drop-down menu.
You can now include private and/or shared configurations in Deployed configurations. This is NOT DONE UNLESS a preference named 'useLibraryConfigurationsWithDeployedOnes' and/or 'useSharedConfigurationsWithDeployedOnes' (boolean) is forced TRUE in the 'forced-preference.plist' file.
If a deployed configuration and/or a shared configuration and/or a normal configuration ( in ~/Library/Application Support/Tunnelblick/Configurations) have the same names, the deployed one will be displayed if it exists, otherwise the shared one will be displayed if it exists, and the other(s) will be hidden and unavailable. A warning will be issued to notify the user if any configurations are hidden.
Shared configurations are indicated by '(Shared)' after their names in the Tunnelblick menu and in the title of the "Details" window, and private configurations are indicated by '(Private). If there are also deployed configurations, they are indicated by '(Deployed)' after their names.
The 'Edit Configuration' button becomes 'Examine Configuration' when the configuration may not be edited, i.e., it is a Deployed or Shared configurations.
Editing a configuration file requires it to be unprotected first, even on Snow Leopard.
After unprotecting a configuration file, the previous version (which is still protected) is available as xxx-previous. (If a non-administrator accidentally or mistakenly unprotects a configuration they will still be able to connect by using the xxx-previous version.)
The full path of the configuration file is displayed as a tooltip for connection names in the Tunnelblick menu.
Tunnelblick now detects it is located on a volume which doesn't support suid (thumb drives and network volumes, for example). In that circumstance, Tunnelblick offers to install itself to /Applications on the boot volume (the same way it does when Tunnelblick.app is located on a disk image).
- Note that although Tunnelblick cannot run from such a volume, configurations can reside on such a volume, or even on a volume that does not support root ownership of files, such as a network volume or a volume formatted as FAT32. Configurations on such a volume will be 'shadow copied' to the boot volume before being used. This is done automatically for network volumes, and will be done for non-network volumes if the 'useShadowConfigurationFiles' preference is true.
Changed title of 'OpenVPN Log - Tunnelblick' window to 'Details - Tunnelblick'.
Removed extra Console Log message that the program needed repair.
Fix omission and improve formatting of openvpnstart command line tool.
Deals better with situation of ~/Library/openvpn and /Library/Application Support/Tunnelblick/Configurations being inconsistent.
Fixed bug that sometimes ignored the 'updateSendProfileInfo' preference.
Fixed bug that sometimes send partial anonymous profile information when checking for updates.
Fixed bug that caused wildcard matches of forced preferences to always fail.
Fixed bug that allowed setting of user preferences for forced preferences (although they are then ignored).
Fixed bug that caused incorrect permissions (644) to be set on subfolders of Tunnelblick.app/Contents/Resources/Deploy, making them inaccessible. If an existing deployed version of Tunnelblick has such subfolders, upon update (via the built-in updater or a fresh .dmg) the permissions of subfolders will be corrected (to be 755) at first launch).
Fixed bug that sometimes created and used shadow copies of Deployed configurations.
Fixed bug that caused unnecessary check of ownership/permissions of Tunnelblick.app/Contents/Resources/Deploy.

Version 3.0

3.0.1 (2011-01-12)

Fixes bug that causes a serious security vulnerability.
Fixes bugs relating to forced-preferences.plist wildcards used in Deployed versions of Tunnelblick.
Added full Norwegian localization and added missing German localization of one string.

3.0 (2010-03-03)

Fixes incorrect display of 'Automatically Check for Updates' preference on first run after some updates.
Out of beta!

3.0b28 (2010-02-24)

Wildcards for forced preferences (see Deploying Tunnelblick).
Displays configuration name in title of "Details" window.
Inserts full command line used for starting OpenVPN into the "Details" window.
Full German localization. Many thanks to Markus Schneider.

3.0b26 (2010-02-09)

Now uses OpenVPN version 2.1.1.
Adds Chinese localization (both simplified and traditional). Many thanks to Aming Lau.
Installation has been simplified: The Tunnelblick disk image gives instructions to "Double-click to begin" in several languages. Double-clicking starts a small installer. The installer detects installs/reinstalls/upgrades/downgrades and puts the current copy of Tunnelblick.app in the Trash before replacing it, then offers to launch the new version. Warns about other copies of Tunnelblick running during an install and offers to stop them. (Simply copying Tunnelblick.app to /Applications or elsewhere on the hard drive still works, too.)
The "Welcome to Tunnelblick" window now gives the user much more information, and offers the options of creating and editing a sample configuration file or opening the Configurations folder in Finder.
Uses Sparkle Updater version 1.5b6 for better security. Updates must be signed with 2048-bit DSA signatures. Updating behavior is now controlled by Tunnelblick preferences, which may be forced. Deployers note: many of these preferences should be forced for security reasons in a deployed environment.
Tunnelblick now explains why it is asking for an administrator username/password in authentication dialogs.
Tunnelblick's "Details" window now includes detailed information about why a connection was restarted by leasewatch (when the 'Monitor connection' checkbox is checked).
The program's menu has been streamlined.
Connection timers are now displayed by default (unless the 'showConnectedDurations' preference is FALSE).
Fixes problem editing configuration files on Tiger and Leopard by allowing non-admin users (without an administrator username/password) to unprotect the configuration file before invoking TextEdit. This ability can be disabled with the 'onlyAdminsCanUnprotectConfigurationFiles' preference. On Snow Leopard (which automatically unprotects files when they are modified), warns user that an administrator username/password will be required to connect if the configuration file is modified. Note: The 'Edit Configuration' button may be still disabled with a per-configuration preference.
Enhancements: Displays command line used to launch 'openvpnstart' in the "Details" window. Detects and gives a detailed error message if a configuration file is identical to the sample provided by Tunnelblick. Creates a "Launch Tunnelblick" link in the Configurations folder. Localizes paths that are displayed to the user — for example, in French (FR), 'Library' becomes 'Bibliothèque'. Detects, complains, and quits if not running on OS X 10.4 ("Tiger") or above. Added Quick Start Guide to disk image.
Bug fixes: Fixes bug that caused crashes when started automatically on login on some versions of Leopard and Snow Leopard. Fixes bug that didn't localize the title for the "Details" window. Fixes bug that displayed 'monitoring connection' when 'Set nameserver' is not checked. Fixes bug opening wrong copy of sample configuration file in TextEdit. Fixes bug that tries to to create Configurations folder when not necessary. Fixes bug that tried to create configuration file in Deploy. Fixes typo in dialog for remote home folders. Fixes sporadic failure to detect multiple simultaneous connections.
Known Issues: See the Known Issues wiki.

3.0b24 (2009-12-12)

New 'Monitor connection' checkbox in the "Details" window (defaults to checked). When checked, Tunnelblick monitors connection interfaces as it has since 3.0b18. When unchecked, Tunnelblick ignores connection interface changes, as version 3.0b10 did. This allows more users to use the latest version (some users couldn't because of repeated restarts caused by Tunnelblick detecting connection interface changes). Please note that OpenVPN itself restarts connections under certain circumstances. New scripts are used when 'Monitor connection' is not checked and 'Set DNS' is checked: client.nomonitor.up.osx.sh and client.nomonitor.down.osx.sh.
New 'Options' submenu has entries to change commonly used preferences, check for updates, and view the 'About...' window.
Tun/tap kernel extensions are loaded when Tunnelblick launches and unloaded when Tunnelblick quits.
Configuration and other files are now located in ~/Library/Application Support/Tunnelblick/Configurations to conform to OS X standards. The ~/Library/openvpn folder is moved to this new location automatically during the first launch of Tunnelblick after updating to 3.0b24, and is replaced by a symbolic link to the new location. For details see the discussion.
Adds Català (Catalan) localization, thanks to Aleix Dorca.
Additional Español (Spanish) and Deutsch (German) localization, thanks to Diego Rivera and Markus Schneider, respectively.
Adds OS X version information to the start of the OpenVPN Log.
Adds configuration, 'Set nameserver', and 'Monitor connection' status to the OpenVPN Log before attempting to make a connection.
Adds new Deployment features:
- Always restores the Resources/Deploy folder from a backup if it does not exist and a backup does. An entry is put in the Console Log, but no other user notification is made. (This happens after an auto-update without the Deploy folder.)
- Monitors Resources/Deploy (if it exists) for changes to configuration files.
- If Deploy contains only **.conf, **.oven, **.up.sh, **.down.sh, and forced-preferences.plist files, then the ~/Library/openvpn folder will be used for all other files (including other scripts).
- If 'Set nameserver' is checked and 'Monitor connection' is checked, then if Deploy/CONFIGNAME.up.sh exists, it will be used instead of Resources/client.up.osx.sh, and if Deploy/CONFIGNAME.down.sh exists, it will be used instead of Resources/client.down.osx.sh.
- If 'Set nameserver' is checked and 'Monitor connection' is not checked, then if Deploy/CONFIGNAME.nomonitor.up.sh exists, it will be used instead of Resources/client.nomonitor.up.osx.sh, and if Deploy/CONFIGNAME.nomonitor.down.sh exists, it will be used instead of Resources/client.nomonitor.down.osx.sh.
- If 'Set nameserver' is checked, then if the 'CONFIGNAME-useDownRootPlugin' preference is true, then Resources/openvpn-down-root.so will be used as a plugin for OpenVPN.
- Sets owner to root:wheel and permissions to 600 for .cer, .crt, .der, .key, .p12, .p7b, .p7c, .pem, and .pfx files in the Deploy folder.
Adds new per-configuration preferences:
- 'CONFIGNAMEdisableEditConfiguration' is a boolean. If set, disables the 'Edit configuration' button. If cleared (the default), enables the button.
- 'CONFIGNAME-notMonitoringConnection' is a boolean. If present, its value reflects/is used for the 'Monitor connection' checkbox. Default is set.
- 'CONFIGNAME-useDownRootPlugin' is a boolean. If set, causes the 'openvpn-down-root.so' plugin to be loaded. If cleared (the default), the plugin is not loaded.
Closing a connection, putting the computer to sleep, or quitting Tunnelblick may be delayed a few seconds while Tunnelblick waits for OpenVPN processes to terminate.
Bug fixes: Fixes bug that sometimes caused authentication failures with usernames or passwords longer than 12 characters. Fixes bug that sometimes caused the 'Retry' button to be interpreted as 'Cancel' in the Authentication Failed dialog. Fixes bug that caused a connection attempt to fail with a 'script failed: could not execute external program' error if 'Set nameserver' is checked and there is a space character in the name of Tunnelblick.app or in the path to it. Fixes bug that caused 'Get Info' of Tunnelblick.app to show incorrect copyright information. Fixes bug that often caused loss of last few lines of OpenVPN Log before disconnecting. Fixes bug that sometimes caused problems restoring connections when awakening from sleep. Fixes bug that sometimes caused the Sparkle updater window to not appear on Snow Leopard. Fixes inconsistent logging of ownership/permissions repairs. Fixes bug that caused Tunnelblick to check for updates at launch even though preference to do so was cleared, not set. Fixes bug that ignored forced-preferences.plist when there was no configuration files in Deploy. Fixes bug with configuration files that are actually symbolic links. Fixes bug that didn't verify that ownership/permissions on Deploy contents copied correctly to backup. Complains with specific message in Console log if a configuration file needs repair but is locked. Fixes problems when a configuration file is a link.

Known Issues:

The standard scripts that "Set nameserver" uses handle DNS for most common setups. You must use custom scripts to do anything else. See Using Tunnelblick for details.
Localization is not complete.

3.0b22 (2009-11-01)

Includes OpenVPN version 2.1_rc20, which fixes problems with the "redirect-gateway" option.
Includes the 32/64-bit version of tuntap, which fixes problems running Tunnelblick on Snow Leopard under the 64-bit kernel. Thanks to the tuntap project, to Mohammad A. Haque for Xcode help, and to Jean-Philippe Jung for testing.
Stores username in Keychain instead of preferences.
Stores shadow copies of configuration files in /Library/Application Support/Tunnelblick/Users/username instead of /Library/Tunnelblick/username.
Bug fixes: Fixes bugs that interfere with storage or retrieval of usernames and passwords. Adds new configs to "Details" window when it has been opened but is currently closed. Clears "automatically launch Tunnelblick upon login" for error exits. Clean exit if 'running from .dmg' error. Fixes several memory and CF leaks. Fixes bug that caused attempt to kill openvpn process that had already been killed. Fixes potential problem detecting locked configuration files during shadow copying. Installer detects and reports errors making ownership and permission modifications.
Enhancement: Creates openvpn-down-root.so and puts a copy of it in Tunnelblick.app/Contents/Resources, allowing use of OpenVPN 'user' and 'group' options by adding a line to the configuration file. SeeUsing Tunnelblick for details.
Deployment enhancements: Several changes have been made which make it easy to create a customized version of Tunnelblick that can easily be deployed to multiple clients or installed once for all users of a computer. Configuration, key, and certificate files and up/down scripts can be put into a Deploy folder within Tunnelblick.app, and Tunnelblick will use them instead of using files in ~/Library/openvpn. These files are read-only, and, combined with read-only preference overrides, can create a tamper-proof application. Such deployed applications may be updated via the automatic update mechanism without losing the configuration information. Detailed information is available in Deploying Tunnelblick.
Other enhancements: Clarifies language in a few places. Adds a specific error message if unrecoverable error. Warns if all config files removed and gives a choice of quitting or installing and editing a sample config file. Warns if zero-length passphrase, username, or password. Adds Tunnelblick icon and the configuration name to all applicable dialog windows. Puts dialogs on top of other windows.

Known Issues:

The standard scripts that "Set nameserver" uses handle DNS for most common setups. You must use custom scripts to do anything else. See Using Tunnelblick for details.
Localization is not complete.

3.0b20 (2009-10-09)

Fixes issues with "Set nameserver" on Snow Leopard.
Inhibits console message that tun and tap are already loaded.
Sends details of some error messages to the "Details" window instead of the Console log.
Prefixes all non-OpenVPN messages in the log window with "*Tunnelblick:".

Known Issues:

Does not work under Snow Leopard when booted into 64-bit mode. (Works when booted into 32-bit mode.)
The "--redirect-gateway" OpenVPN option fails silently, causing incorrect routing, if no flags are specified (which is a syntax error). Previously, a flag of "def1" was assumed.
Localization is not complete.
The standard scripts that "Set nameserver" uses handle DNS for most common setups. You must use custom scripts to do anything else. See Using Tunnelblick for details.

3.0b18 (2009-09-23)

Implements different behavior when configuration files change: when a configuration file is added, all connections are maintained. When a configuration file is deleted, only the corresponding connection is disconnected (and an alert window is displayed). In either case, the menu and Log window reflect the change immediately without restarting Tunnelblick. Changes to a configuration file's contents or metadata are ignored (but will be used the next time a connection is attempted).
Works with home folders on network volumes and/or when the home folder is not permitted to have files owned by root. This is implemented transparently with "shadow" copies of configuration files. It is automatic if the config file is on a network volume or if Tunnelblick's "useShadowConfigurationFiles" preference is set.
Moves "Set nameserver" checkbox to avoid inadvertent changes.
Fixes issues when DNS is set manually, when 'dhcp-option DOMAIN ...' is pushed to the client, and when --remote-random is used under certain circumstances.
Fixes misleading language in window that requests a username/password for the VPN.
Fixes a bug which caused "Details" window to stay on top of all other windows if it was opened within 3 seconds of starting Tunnelblick.
Fixes a bug which caused config file changes to be ignored under certain circumstances.
Fixes a bug which interferes with saving a username/password combination or a passphrase to the Keychain when there is more than one simultaneous connection.
Fixes a bug which causes a (quitable) infinite loop if an error occurred while changing ownerships and/or permissions.
Fixes a bug which sometimes causes non-English text of buttons or checkboxes to be truncated or clipped.
Makes changes to ownership and permissions of parts of Tunnelblick.app for better security.
Adds support for WINS configurations from the server when using the standard up/down scripts (i.e., when the "Set nameserver" checkbox is checked).
Warns about multiple simultaneous connections, with a checkbox to suppress such warnings.
Displays duration times only for connected tunnels.
Updated to UKKQueue 0.5 and LZO 2.03
Adds Spanish localization (thanks to Diego Rivera).

Known Issues:

Does not work under Snow Leopard when booted into 64-bit mode. (Works when booted into 32-bit mode.)
The "--redirect-gateway" OpenVPN option fails silently, causing incorrect routing, if no flags are specified (which is a syntax error). Previously, a flag of "def1" was assumed.
Localization is not complete for French, German, Japanese, Korean, Norwegian, or Spanish.
The standard scripts that "Set nameserver" uses handle DNS for most common setups. You must use custom scripts to do anything else. See Using Tunnelblick for details.

3.0b16 (2009-08-22)

Upgraded to OpenVPN version 2.1_rc19
Additional French translations (contributed by Oliver Hill)
An entry is appended to the "Details" window if OpenVPN returns with an error code. (This typically happens when there is an error in the configuration file.)

Known Issues:

Home folders cannot reside on remote volumes (AFS, NFS, etc.)
Japanese and Norwegian localization is not complete.
The standard scripts that "Set nameserver" uses handle DNS for the most common DHCP setups. You must use custom scripts to do anything else. The standard scripts:
- Do not support multiple simultaneous connections
- Do not support multiple nameservers for multiple domains (e.g., local nameserver and remote nameserver simultaneously)
- Do not remove manual DNS entries (i.e., the manual nameserver will continue to be used even when the tunnel is open even if the OpenVPN "redirect-gateway" option is specified)

3.0b14 (2009-08-10)

Fixed issues where DNS settings were not saved properly, and when DHCP is renewed (contributed by Diego Rivera)
Added support for PKCS#11 and Security Tokens, e.g. Aladdin eToken (contributed by Xaver Loppenstedt)
Additional Korean and German translations (contributed by Markus Schneider and Kyoungmin Kim)
Animation improvements, including the ability to have "icon sets" (contributed by Raal Goff). Note: the user interface for this feature is not included yet
Fixed issue with "Set nameserver" and "Auto connect on launch" checkboxes being cleared on quit if the "Details" window was never displayed
Fixed issue which caused disconnects when any file in ~/Library/openvpn was accessed (for example, by backup software). (Note that changing, adding, or deleting any configuration files will close all open connections)
Fixed issue with failed authentication: now handled gracefully: allows cancel or retry. If credentials are stored in the Keychain, also allows retry with new credentials (by deleting the old credentials before the retry)
Fixed issue with multiple connections with same username; separate passwords are now kept for each username
Fixed issue in dialog about configuration files - the correct path is now shown: "~/Library" instead of "/Library"
Command-C, Command-X, Command-V (copy, cut, paste) and Command-A, Command-M, Command-W, and Command-Q (select all, minimize to the Dock, close window, and quit Tunnelblick) now work properly from the "Details" window
Fixed issue which caused invalid dates/times to appear in the OpenVPN Log
Shows connection duration in "Details" window's tabs
Fixed issue which caused the "Details" window to remain underneath other windows when the "Details" menu item is clicked
Added date/time and Tunnelblick and OpenVPN version info at the beginning of the OpenVPN Log and whenever it is cleared
Saves and restores "Details" window size and position
Internationalized date/time displayed in the OpenVPN Log, including seconds
Fixed bug which caused Japanese localization to fail
Displays tab for the left-most established connection when the "Details" window is first displayed. If no established connection exists, displays the left-most tab
Added the "Using Tunnelblick.html" document to the installation disk image
Added preference, "doNotMonitorConfigurationFolder" (default = False) to disable monitoring of the configuration folder for changes to the configuration files
Added preference, "placeIconInStandardPositionInStatusBar" (default = False) to have the Tunnelblick icon placed normally in the Status Bar — to the left of other items (contributed by Raal Goff and Michael Schloh von Bennewitz)
Added an "About" window that displays a link to the website, Tunnelblick version and build numbers, and the OpenVPN version number, which is dynamically extracted from the openvpn program (and thus always reports the version of OpenVPN which is actually being used).
Fixed issue which caused Tunnelblick to pass the "script-security 2" arguments to OpenVPN even if a version of OpenVPN which doesn't support that argument is being used
openvpnstart enhancements:
- The "Set nameserver" argument is now optional and defaults to 0 (NO)
- Optional argument skips passing the "script-security 2" arguments to OpenVPN.
- Improved error checking and reporting
- Displays usage instructions if invoked with no arguments
- Fixed program crashes caused by improper syntax
- "killall" command shows # of openvpn processes killed if non-zero

Known Issues:

Home folders cannot reside on remote volumes (AFS, NFS, etc.)
French, Japanese, and Norwegian localization is not complete.
The standard scripts that "Set nameserver" uses handle DNS for the most common DHCP setups. You must use custom scripts to do anything else. The standard scripts:
- Do not support multiple simultaneous connections
- Do not support multiple nameservers for multiple domains (e.g., local nameserver and remote nameserver simultaneously)
- Do not remove manual DNS entries (i.e., the manual nameserver will continue to be used even when the tunnel is open even if the OpenVPN "redirect-gateway" option is specified)

3.0b10 (2008-11-20)

fix linking problem that resulted in lzo compression not working on PowerPC
prevent user from launching tunnelblick directly from the dmg
remove experimental status from 'Set Nameserver' and make it the default
upgrade to OpenVPN 2.1_rc15
let buffered openvpn log messages appear in the GUI log
possible fix for the crash if password is mistyped when using username/password authentication
add version number to plist file
don't restart connections onNetworkDidChange notification. fixes issue where existing connections would be reset when starting multiple simultaneous vpn connections.
always use --script-security 2 so users are allowed to supply custom up/down scripts. needed for OpenVPN 2.1
add missing example config file
properly escape special chars in username or password/passphrase before passing them over to the management interface. fixes issue where the password/passphrase was not accepted when it contained backslashes or " chars.
use NSStatusWindowLevel for notification windows. fixes issue that Tunnelblick icon remained visible in spaces or fullscreen mode of some apps.
increase robustness when killing openvpn children by explicitly sending the SIGTERM to the process id instead of just sending "signal SIGTERM" over the management socket
kill all openvpn processes on quit. fixes a rare condition where openvpn processes would be left over on Tunnelblick quit
Add German, French, Japanese, Korean and Norwegian translations

3.0b9 (2008-07-24)

Fixed the crash on Leopard
Fixes the slow shutdown issue
Updated to the new tun/tap drivers
Auto-Update Capability using Sparkle