OpenVPN Release 2.7_rc4

OpenVPN Release 2.7_rc4

version.m4, ChangeLog, Changes.rst

Changes.rst has not received an "2.7_rc4" section - it has the
"highlevel" overview of what is new in 2.7, but for alpha/beta/rc*
releases it's better to look at git log to see what has been added/fixed.

Notable changes rc3 -> rc4 are:
    - Windows interactive service: do not configure adapter DNS if
      there are no search-domains but there are resolve-domains (which
      get resolved via NRPT rules) - GH: OpenVPN/openvpn#473
    - improve documentation and error messages for a number of deprecated
      options
    - improve documentation for not-really-deprecated-yet ``--ns-cert-type``
    - Windows IPv4 configuration with netsh.exe: ensure addresses are added
      with "store=active" (ensure proper cleanup) - GH: OpenVPN/openvpn#915
    - Windows: set UTF8 code page in openvpn.exe manifest, to make cert/key
      loading work again for files with non-ASCII characters in their file
      name (GH: OpenVPN/openvpn#920)
    - tun.c: unify read_tun()/write_tun() functions for all BSD platforms
    - more type conversion related cleanups
    - add NULL check before freeaddrinfo() call, which might lead to a
      crash on OpenBSD (GH: OpenVPN/openvpn#930)
    - add NULL check to mbedtls handling of external and inline certificates
    - add check for auth none / cipher none on FreeBSD DCO
    - add CAP_SYS_NICE to positive list in Linux systemd unit files
      (GH: OpenVPN/openvpn#834)
    - drop mbedtls 2.x support  (which is end of life, and work on mbedtls 4
      is much simplified by not having to take care of 2.x compat as well)
    - PUSH_UPDATE: bugfix for the client side where split/continued messages
      (due to large number of "route" statements) would not correctly handle
      the full set of routes.  Add unit test.  (GH: OpenVPN/openvpn#925)
    - new unit test module for mbuf handling
    - deprecate --fast-io option (it got partially broken by the multisocket
      implementation, and the benefits of the existing implementation did
      not outweigh the extra code complexity to make it work again)
    - change the ssl_ctx in struct tls_options to be a pointer - this is
      a shared data structure between various contexts, but previously it
      was shallow-copied, leading to needless CRL reloading - and when
      working on implementing the new OpenSSL CRL API, to segfaults
      (the existing code works, as these new APIs are not used yet).

Signed-off-by: Gert Doering <gert@greenie.muc.de>