diff -Nru network-manager-openvpn-1.10.0/debian/changelog network-manager-openvpn-1.10.0/debian/changelog
--- network-manager-openvpn-1.10.0/debian/changelog	2022-09-07 11:50:16.000000000 -0300
+++ network-manager-openvpn-1.10.0/debian/changelog	2022-10-04 13:47:52.000000000 -0300
@@ -1,3 +1,10 @@
+network-manager-openvpn (1.10.0-1ubuntu1) kinetic; urgency=medium
+
+  * patches/support-data-ciphers.patch: Adds support for OpenVPN's
+    --data-ciphers argument (LP: #1991493).
+
+ -- Nathan Pratta Teodosio <nathan.teodosio@canonical.com>  Tue, 04 Oct 2022 13:47:52 -0300
+
 network-manager-openvpn (1.10.0-1) unstable; urgency=medium
 
   * New upstream version 1.10.0
diff -Nru network-manager-openvpn-1.10.0/debian/control network-manager-openvpn-1.10.0/debian/control
--- network-manager-openvpn-1.10.0/debian/control	2022-09-07 11:50:16.000000000 -0300
+++ network-manager-openvpn-1.10.0/debian/control	2022-10-04 13:47:52.000000000 -0300
@@ -1,7 +1,8 @@
 Source: network-manager-openvpn
 Section: net
 Priority: optional
-Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>
+Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
+XSBC-Original-Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>
 Uploaders: Michael Biebl <biebl@debian.org>
 Build-Depends: debhelper-compat (= 13),
                gettext (>= 0.19),
diff -Nru network-manager-openvpn-1.10.0/debian/patches/series network-manager-openvpn-1.10.0/debian/patches/series
--- network-manager-openvpn-1.10.0/debian/patches/series	1969-12-31 21:00:00.000000000 -0300
+++ network-manager-openvpn-1.10.0/debian/patches/series	2022-10-04 13:46:23.000000000 -0300
@@ -0,0 +1 @@
+support-data-ciphers.patch
diff -Nru network-manager-openvpn-1.10.0/debian/patches/support-data-ciphers.patch network-manager-openvpn-1.10.0/debian/patches/support-data-ciphers.patch
--- network-manager-openvpn-1.10.0/debian/patches/support-data-ciphers.patch	1969-12-31 21:00:00.000000000 -0300
+++ network-manager-openvpn-1.10.0/debian/patches/support-data-ciphers.patch	2022-10-04 13:47:52.000000000 -0300
@@ -0,0 +1,249 @@
+From: Gard Spreemann <gspr@nonempty.org>
+From: Thomas Haller <thaller@redhat.com>
+Last-Update: Mon, 3 Oct 2022 21:29:22 +0200
+Origin: https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/-/merge_requests/46
+Forwarded: no
+Applied-Upstream: yes
+Subject: Add support for OpenVPN's --data-ciphers
+
+It used to be the case that OpenVPN added the cipher from --cipher to
+the ones provided by --data-ciphers. As of OpenVPN 2.6, that is no
+longer the case.
+
+This patch adds rudamentary support for OpenVPN's --data-ciphers. The
+argument is treated exactly like the "cipher" field in a connection's
+.data, and thus passes a "data-ciphers" field in .data directly on to
+OpenVPN's --data-ciphers. This may not be appropriate in a GUI/TUI, as
+--data-ciphers is a colon-separated list, but is here treated as an
+opaque string.
+
+The patch has only been lightly tested: It compiles and works with a
+connection that needed "data-ciphers = AES-128-CBC", and that was
+broken with only "cipher = AES-128-CBC" when upgrading to OpenVPN 2.6.
+
+https://gitlab.gnome.org/GNOME/NetworkManager-openvpn/-/merge_requests/46
+
+diff --git a/properties/import-export.c b/properties/import-export.c
+index db453e9..9659cb8 100644
+--- a/properties/import-export.c
++++ b/properties/import-export.c
+@@ -1363,6 +1363,15 @@ do_import (const char *path, const char *contents, gsize contents_len, GError **
+ 			continue;
+ 		}
+ 
++		if (NM_IN_STRSET (params[0], NMV_OVPN_TAG_DATA_CIPHERS)) {
++			if (!args_params_check_nargs_n (params, 1, &line_error))
++				goto handle_line_error;
++			if (!args_params_check_arg_utf8 (params, 1, NULL, &line_error))
++				goto handle_line_error;
++			setting_vpn_add_data_item (s_vpn, NM_OPENVPN_KEY_DATA_CIPHERS, params[1]);
++			continue;
++		}
++
+ 		if (NM_IN_STRSET (params[0], NMV_OVPN_TAG_TLS_CIPHER)) {
+ 			if (!args_params_check_nargs_n (params, 1, &line_error))
+ 				goto handle_line_error;
+@@ -2106,6 +2115,8 @@ do_export_create (NMConnection *connection, const char *path, GError **error)
+ 
+ 	args_write_line_setting_value (f, NMV_OVPN_TAG_CIPHER, s_vpn, NM_OPENVPN_KEY_CIPHER);
+ 
++	args_write_line_setting_value (f, NMV_OVPN_TAG_DATA_CIPHERS, s_vpn, NM_OPENVPN_KEY_DATA_CIPHERS);
++
+ 	args_write_line_setting_value (f, NMV_OVPN_TAG_TLS_CIPHER, s_vpn, NM_OPENVPN_KEY_TLS_CIPHER);
+ 
+ 	args_write_line_setting_value_int (f, NMV_OVPN_TAG_KEYSIZE, s_vpn, NM_OPENVPN_KEY_KEYSIZE);
+diff --git a/properties/tests/test-import-export.c b/properties/tests/test-import-export.c
+index 7f585d0..fc7cd72 100644
+--- a/properties/tests/test-import-export.c
++++ b/properties/tests/test-import-export.c
+@@ -221,6 +221,7 @@ test_password_import (void)
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_TA, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_TA_DIR, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_CIPHER, "AES-256-CBC");
++	_check_item (s_vpn, NM_OPENVPN_KEY_DATA_CIPHERS, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_LOCAL_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_REMOTE_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_AUTH, NULL);
+@@ -314,6 +315,7 @@ test_tls_import (void)
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_STATIC_KEY, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_STATIC_KEY_DIRECTION, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_CIPHER, NULL);
++	_check_item (s_vpn, NM_OPENVPN_KEY_DATA_CIPHERS, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_LOCAL_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_REMOTE_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_AUTH, NULL);
+@@ -361,6 +363,7 @@ test_tls_import_2 (void)
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_STATIC_KEY, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_STATIC_KEY_DIRECTION, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_CIPHER, NULL);
++	_check_item (s_vpn, NM_OPENVPN_KEY_DATA_CIPHERS, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_LOCAL_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_REMOTE_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_AUTH, NULL);
+@@ -405,6 +408,7 @@ test_tls_import_3 (void)
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_STATIC_KEY, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_STATIC_KEY_DIRECTION, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_CIPHER, NULL);
++	_check_item (s_vpn, NM_OPENVPN_KEY_DATA_CIPHERS, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_LOCAL_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_REMOTE_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_AUTH, NULL);
+@@ -453,6 +457,7 @@ test_tls_import_4 (void)
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_STATIC_KEY, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_STATIC_KEY_DIRECTION, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_CIPHER, NULL);
++	_check_item (s_vpn, NM_OPENVPN_KEY_DATA_CIPHERS, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_LOCAL_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_REMOTE_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_AUTH, NULL);
+@@ -525,6 +530,7 @@ test_tls_inline_import (void)
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_STATIC_KEY, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_STATIC_KEY_DIRECTION, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_CIPHER, NULL);
++	_check_item (s_vpn, NM_OPENVPN_KEY_DATA_CIPHERS, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_LOCAL_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_REMOTE_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_AUTH, NULL);
+@@ -577,6 +583,7 @@ test_pkcs12_import (void)
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_STATIC_KEY, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_STATIC_KEY_DIRECTION, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_CIPHER, NULL);
++	_check_item (s_vpn, NM_OPENVPN_KEY_DATA_CIPHERS, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_LOCAL_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_REMOTE_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_AUTH, NULL);
+@@ -618,6 +625,7 @@ test_pkcs12_with_ca_import (void)
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_STATIC_KEY, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_STATIC_KEY_DIRECTION, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_CIPHER, NULL);
++	_check_item (s_vpn, NM_OPENVPN_KEY_DATA_CIPHERS, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_LOCAL_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_REMOTE_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_AUTH, NULL);
+@@ -686,6 +694,7 @@ test_static_key_import (gconstpointer test_data)
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_TA, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_TA_DIR, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_CIPHER, NULL);
++	_check_item (s_vpn, NM_OPENVPN_KEY_DATA_CIPHERS, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_LOCAL_IP, "10.8.0.2");
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_REMOTE_IP, "10.8.0.1");
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_AUTH, NULL);
+@@ -797,6 +806,7 @@ test_proxy_http_import (void)
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_TA, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_TA_DIR, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_CIPHER, "AES-256-CBC");
++	_check_item (s_vpn, NM_OPENVPN_KEY_DATA_CIPHERS, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_LOCAL_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_REMOTE_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_AUTH, NULL);
+@@ -861,6 +871,7 @@ test_proxy_http_with_auth_import (void)
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_TA, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_TA_DIR, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_CIPHER, "AES-256-CBC");
++	_check_item (s_vpn, NM_OPENVPN_KEY_DATA_CIPHERS, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_LOCAL_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_REMOTE_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_AUTH, NULL);
+@@ -899,6 +910,7 @@ test_proxy_socks_import (void)
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_TA, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_TA_DIR, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_CIPHER, "AES-256-CBC");
++	_check_item (s_vpn, NM_OPENVPN_KEY_DATA_CIPHERS, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_LOCAL_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_REMOTE_IP, NULL);
+ 	_check_item (s_vpn, NM_OPENVPN_KEY_AUTH, NULL);
+diff --git a/shared/nm-service-defines.h b/shared/nm-service-defines.h
+index c63c255..5055fc2 100644
+--- a/shared/nm-service-defines.h
++++ b/shared/nm-service-defines.h
+@@ -41,6 +41,7 @@
+ #define NM_OPENVPN_KEY_CONNECT_TIMEOUT           "connect-timeout"
+ #define NM_OPENVPN_KEY_CRL_VERIFY_FILE           "crl-verify-file"
+ #define NM_OPENVPN_KEY_CRL_VERIFY_DIR            "crl-verify-dir"
++#define NM_OPENVPN_KEY_DATA_CIPHERS              "data-ciphers"
+ #define NM_OPENVPN_KEY_DEV                       "dev"
+ #define NM_OPENVPN_KEY_DEV_TYPE                  "dev-type"
+ #define NM_OPENVPN_KEY_EXTRA_CERTS               "extra-certs"
+diff --git a/shared/utils.h b/shared/utils.h
+index 216b708..d5a33ea 100644
+--- a/shared/utils.h
++++ b/shared/utils.h
+@@ -37,6 +37,7 @@
+ #define NMV_OVPN_TAG_COMPRESS               "compress"
+ #define NMV_OVPN_TAG_CONNECT_TIMEOUT        "connect-timeout"
+ #define NMV_OVPN_TAG_CRL_VERIFY             "crl-verify"
++#define NMV_OVPN_TAG_DATA_CIPHERS           "data-ciphers"
+ #define NMV_OVPN_TAG_DEV                    "dev"
+ #define NMV_OVPN_TAG_DEV_TYPE               "dev-type"
+ #define NMV_OVPN_TAG_EXTRA_CERTS            "extra-certs"
+@@ -144,4 +145,30 @@ void nmovpn_compression_to_options (NMOvpnComp comp,
+                                     const char **comp_lzo,
+                                     const char **compress);
+ 
++/*****************************************************************************/
++
++#define NMOVPN_VERSION_MAX     999999u
++#define NMOVPN_VERSION_UNKNOWN (NMOVPN_VERSION_MAX+1u)
++#define NMOVPN_VERSION_INVALID (NMOVPN_VERSION_MAX+2u)
++
++static inline guint
++nmovpn_version_encode (guint x, guint y, guint z)
++{
++	nm_assert(x <= 99);
++	nm_assert(y <= 99);
++	nm_assert(z <= 99);
++
++	return ((x * 100u + y) * 100u) + z;
++}
++
++static inline void
++nmovpn_version_decode (guint version, guint *out_x, guint *out_y, guint *out_z)
++{
++	*out_x = (version / 10000u);
++	*out_y = (version / 100u) % 100u;
++	*out_z = (version % 100u);
++}
++
++guint nmovpn_version_parse (const char *version_str);
++
+ #endif  /* UTILS_H */
+diff --git a/src/nm-openvpn-service.c b/src/nm-openvpn-service.c
+index aeb0cdb..7fac66b 100644
+--- a/src/nm-openvpn-service.c
++++ b/src/nm-openvpn-service.c
+@@ -144,6 +144,7 @@ static const ValidProperty valid_properties[] = {
+ 	{ NM_OPENVPN_KEY_CONNECTION_TYPE,           G_TYPE_STRING, 0, 0, FALSE },
+ 	{ NM_OPENVPN_KEY_CRL_VERIFY_FILE,           G_TYPE_STRING, 0, 0, FALSE },
+ 	{ NM_OPENVPN_KEY_CRL_VERIFY_DIR,            G_TYPE_STRING, 0, 0, FALSE },
++	{ NM_OPENVPN_KEY_DATA_CIPHERS,              G_TYPE_STRING, 0, 0, FALSE },
+ 	{ NM_OPENVPN_KEY_EXTRA_CERTS,               G_TYPE_STRING, 0, 0, FALSE },
+ 	{ NM_OPENVPN_KEY_FLOAT,                     G_TYPE_BOOLEAN, 0, 0, FALSE },
+ 	{ NM_OPENVPN_KEY_NCP_DISABLE,               G_TYPE_BOOLEAN, 0, 0, FALSE },
+@@ -1673,6 +1674,24 @@ nm_openvpn_start_openvpn_binary (NMOpenvpnPlugin *plugin,
+ 
+ 	args_add_vpn_data (args, s_vpn, NM_OPENVPN_KEY_CIPHER, "--cipher");
+ 
++	args_add_vpn_data (args, s_vpn, NM_OPENVPN_KEY_DATA_CIPHERS, "--data-ciphers");
++
++	if (nm_setting_vpn_get_data_item (s_vpn, NM_OPENVPN_KEY_CIPHER) &&
++	    !nm_setting_vpn_get_data_item (s_vpn, NM_OPENVPN_KEY_DATA_CIPHERS) &&
++	    openvpn_binary_detect_version_cached (openvpn_binary, &openvpn_binary_version) >=
++	        nmovpn_version_encode (2, 5, 0)) {
++		/* Since 2.5, openvpn will warn if "cipher" is set but "data-ciphers" doesn't
++		 * contain the cipher. It still used to automatically add the cipher.
++		 * Since 2.6, the cipher is no longer automatically added, which is unlikely
++		 * what the user wants.
++		 *
++		 * We automatically add it, so if the user only sets cipher (e.g. when
++		 * having an old profile or targeting 2.4) it still works. So ciphers
++		 * means something slightly different for the plugin, unless you set
++		 * data-ciphers to anything. */
++		args_add_vpn_data (args, s_vpn, NM_OPENVPN_KEY_CIPHER, "--data-ciphers");
++	}
++
+ 	args_add_vpn_data (args, s_vpn, NM_OPENVPN_KEY_TLS_CIPHER, "--tls-cipher");
+ 
+ 	tmp = nm_setting_vpn_get_data_item (s_vpn, NM_OPENVPN_KEY_KEYSIZE);
+-- 
+GitLab
+
