Basic Info

• Time: Wednesday 25 October 2023 at 13:00 CEST (11:00 UTC)
• Place: #openvpn-meeting channel on LiberaChat IRC network

Topics

Current Topics

• Updated: Publish security assessment of OpenVPN2 codebase on main website.

  • Approvals and preparations are done for this.
  • Marketing decided to make it a larger topic and include past security assessments.
  • Expected to be published within the next 3 weeks.

• Updated: License amendment for OpenVPN2 to solve openssl/mbedtls licensing issues

  • The OpenSSL James Bottomley stuff is resolved now.
  • The --tls-export-cert feature needs to be removed by dazo and reimplemented by plaisthos.
  • Then it is up to dazo to review things so we can work on finalizing this.
  • One of the tasks is reviewing if remaining items are trivial patches, and maybe get legal advice on those if necessary.
  • For new contributions the new license already applies so maxf is unblocked to implement mbedtls3 support on master.
  • maxf mentioned he will look into how much work it is to backport mbedtls3 to 2.6.

• Updated: OpenVPN 2.6.7 release

  • CMake backport is in.
  • We are working on some outstanding patches that we are working to get in.
  • Also there is a div-by-zero bug we want to get out soon so we're waiting until that is in.

• Tunnelcrack published now https://tunnelcrack.mathyvanhoef.com

  • A post was published at TunnelCrack community wiki article
  • More details are in the Hackathon2023 meeting summary.

• OpenVPN community meetup 2024

  • Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it, as we want to encourage developers and those interested in contributing to feel welcome.
  • Where: Karlsruhe, Germany. It is a relatively central location in Europe and is fairly easily reachable by train. A meeting location is yet to be arranged.
  • When: At the moment tentatively set to 20-22 September 2024.
  • Who: We'll do an open invitation to openvpn-devel mailing list, but also CC: specifically past attendees and people of interest.
  • Shirts: There is plenty of time still to prepare a shirt design.

• Website release process woes

  • There is actual movement on this now, they're moving the Community Downloads content now to another CMS.
  • They will also move Security Advisories to this other CMS as well so both can be updated independently from website updates.

• Static-key mini how-to is outdated.

  • This page is outdated badly: https://openvpn.net/community-resources/static-key-mini-howto/
  • Company will send this to tech writer to redo based on https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/example-fingerprint.rst info and also retain a link to that GitHub doc.
  • Having a simple guide online will help adoption.

• OpenVPN release process topics

  • There was a request in https://github.com/OpenVPN/openvpn/issues/397 to have releases on GitHub as well.
  • Djpig seems to think it would be fairly doable to copy/paste that info to GitHub as well.
  • We could do this during a next release.

• OpenVPN 2.6 performance results.

  • Tests should cover: GRE, IPSec, userland, DCO
  • Platforms: Linux, FreeBSD, Windows
  • Requires time to be dedicated to doing this
  • When time available will do it.

• What's going on with new taskbar icons?

  • Matt provided icons in https://github.com/OpenVPN/openvpn-gui/issues/595
  • Update: will be picked up by Selva when he has time.

• security@openvpn.net mailing list

  • Company is trying to get to SOC2 compliance.
  • Probably will need a simple NDA to be signed by recipients of emails to security@openvpn.net
  • Company guy took standard NDA we use for contractors, suggests using that.
  • Novaflash thinks we should review that first to see if it's really suitable or not, community members are not contractors after all.

• Another key signing topic

  • Company switched EV code signing to CloudHSM, this is the same cert type we use for driver signing, is also suitable for binary signing.
  • In future, we could possibly switch community to that same key. Saves having to maintain 2 different keys.
  • Depends on how hard/easy it is to access company key signing thingee from community infrastructure.
  • Also no high priority at the moment, we have a working solution now.

• SBOM topic

  • Cron2 was asked if OpenVPN has a software bill of materials. Answer was no.
  • Coincidentally, in OpenVPN Inc a security requirement is to have an SBOM so this is on our list of things to do
  • When we pick up this task we can coordinate on it.

• Forums machine on community infrastructure is only non-Linux system.

  • Mattock made a new forums system that runs on Rocky Linux 8 as agreed with ecrist.
  • Ecrist has looked at it but the current state of the migration is unknown.

• Management interface documentation on main website will be updated with info from doc/management-notes.txt

  • Novaflash will pick this up at some point.