Home A - Z
Page Index

An Otter Wiki

Basic Info

  • Time: Wed 14th April 2021 14:00 CET (12:30 UTC)
  • Place: #openvpn-meeting channel on Freenode IRC network + Jitsi Meet

Topics

1. Sync up on OpenVPN 2.5 and 2.6

  • 2.5: next Tuesday.
    • patches pending:
      • route lookup
      • compress-restore-on-SIGUSR1
      • 1666+1667 (fix client with --bind)
  • 2.6:
    • please get ACKed patches in!
    • configure.ac coming
    • DCOoooooh :-)

2. --key and --chroot (with and without --persist-key)

  • (Ordex, MaxF21, patches on the list)
  • Key reloading on SIGUSR1 fails in chroot (it works with persist-key)
  • Consensus: we remove the "no-persist-key" path, make the feature always-on and the option a no-op

3. Option to set http-proxy on Android

  • Suggestion: "dhcp-option HTTP-PROXY IP PORT"
    • This is for programs using the VPN, and they should use this proxy. Configured via the VPN API. Not "for OpenVPN" but "for everyone else". Check with 3 clients on iOS what that one uses.

4. Lev: dco-win Driver in Windows installer

  • How do we want to do this?
    • msm package inside msi? (like for tap+wintun)
      • Wintun created msm approach but uses different approach now
    • Connect client brings tap binary + tapinstall.exe, no msm for tap-windows6
    • Cron2 and mattock seem to recall "msm works better for driver upgrades than the old NSIS approach" but nobody knew for sure
    • Mattock is talking to MS about arm64 support, we can ask the experts
    • Ask Simon :-)

5. --cipher in 2.6

  • Currently, this always adds that likely non-AEAD cipher to the data-ciphers list. This is bad for DCO.
  • We have to pick one:
    • Make DCO work without having user to reconfigure --cipher/--data-ciphers
      • Requires modifying config if you still want to connect to a 2.3 server, allow 2.3 clients
    • Keep configuration compatibility with non-NCP server/clients
      • Requires configuration changes to allow DCO
      • Windows OpenVPN 2.x with ovpn-dco-win will refuse to start with most configs
      • The complex interaction between data-ciphers, cipher and data-ciphers-fallback is still there.
      • Need to add an option like 'occ-cipher' to avoid OCC warnings with 2.4/2.5 clients/server.
    • Make behaviour of OpenVPN dependent on selected driver
      • Only interims solution. With 2.7 we still have to decide if we want to go one of the other options
      • Will create a lot of confusion.
      • Breaks opportunistic approach of allowing OpenVPN to automatically enable DCO if the config is DCO compatible
    • Introduce "--compat-mode"
      • OpenVPN will behave like first option without option
      • Also increase TLS min version to 1.2 by default
      • Default to --nobind when --pull is active