IrcMeetings

Basic info

Time: Wednesday 13 March 2024 at 13:00 CEST (11:00 UTC)
Place: #openvpn-meeting channel on LiberaChat IRC network

Topics

Current topics

New: topic from an OpenVPN Inc contributor to community (illia)
- Would like to discuss the --inactive option that disconnects a VPN when it is not sending/receiving more than the set seconds timeout.
- One part of it is that openvpn2 only counts outgoing packets and openvpn3 counts incoming and outgoing. Which is correct?
- Another part is the type of packets to count - this is all not so clear.
- For now, we are counting any packets and ICMP spam from the router resets inactive timeout very often for openvpn3 so it disconnects later than 2.
- Current proposal: count also incoming packets for openvpn2 and do not reset inactive timeout on ICMP packets for both ovpn3 and ovpn2.
- There was an argument made that "this is how it has been in openvpn2 forever and we had no complaints" but oddly the documentation claims incoming and outgoing is counted.
- After looking into this a bit some screwiness was found with tracking the data in openvpn2 that could use fixing, and illia will work on it.
- There is some voodoo happening in openvpn2 that skips inactive reset packets and similar magic is missing in ovpn3, so illia will work on that too.
New: breaking DCO changes, how to approach?
- During the upstreaming process to the Linux kernel, some alterations had to be made.
- This made the updated implementation different enough from ovpn-dco-v2 that OpenVPN 2.6 won't work with it anymore.
- The plan is to adjust OpenVPN 2.6 so it can support the ovpn-dco-v2 delivered as out-of-tree kernel module, and the in-tree new kernel module.
- We can then update the out-of-tree kernel module to work in the new way and have a graceful transition period.
- So when it goes upstream and is in the Linux kernel, or DCO is installed out-of-tree, it will work the same.
- We can later decide on when to drop the support for ovpn-dco-v2 old methods.
Updated: openvpn 2.6.10 release
- There are some Windows related issues to be resolved in this release.
- Was planned for this week - pushed to begin next week.
Updated: website release process
- Next week a website release is planned that will enable a new way for updating Community Downloads page.
- The new way has a much faster release method separate from the rest of the website's release schedule.
Server-side testing status and next meeting
- Mattock has created a PoC of --dev null "does a client connect" check.
  - Client config has --dev null and ifconfig-noexec.
  - Uses an "up" script to stop the parent (openvpn) process gracefully soon after connection initialization.
  - The "up" script almost certainly includes some Linux-specifics.
  - Example usage:
    - openvpn --config client.conf | grep "Initialization Sequence Completed"
  - Integration with make check, buildbot, etc. is still missing.
  - Next steps:
    - Integrate the PoC with make check.
    - Make the script portable.
    - Buildbot integration (if required separately).
- We want to continue on this topic once a bit more progress has been made.
Forums topics
- A new forum is under construction. But already spammers have found it.
- Suggestion is to give openvpn_inc user novaflash and Pippin_ full admin rights so they can help find a solution and help maintain the forums.
- To be discussed with ecrist.
- Layout and categories look ok?
- Access for Mod to delete users that put spam URL in profile and never post a message.
- Related to above, Access for Mod to edit user profiles (asks for AdminCP password).
- Mod guide, hard or soft delete (chuck board?), what to do with GDPR, etc. (write it down and actually make it available to mods, maybe a hidden topic).
- Access for mods to logs so one can see what others did.
- Email confirmation on register?
- Forgot password or user name? and Contact.
- Considering some existing platform to do discussions next to the forum.
Status of SBOM
- There was a discussion between MaxF and djpig and others.
- For OpenVPN2 / OpenVPN-NL, there is not much overlap, as OpenVPN2 doesn't ship much in terms of libraries, but OpenVPN-NL does.
- The interesting use-case for an SBOM is really the OpenVPN Windows GUI client.
Debian and Ubuntu snapshot packages and buildbot
- Cloudfront + S3 + aptly PoC is complete and seems to work fine.
- Cloudfront caches need to be invalidated when new packages are added or removed, or the apt repository will end up in an inconsistent state almost immediately.
- If we use swupdate.openvpn.net to publish the snapshots, we will have to deal with cloudfront + cloudflare.
- We can choose to just publish snapshots on build.openvpn.net. This seems the preferred option.
- Alternatively, a new S3 bucket + cloudfront can be done. Whatever people like best.
- Buildbot integration is missing, but should be fairly straightforward.
- This will probably have to wait until --dev null is done.
Status of trac/wiki
- No progress since the last meeting.
- This will probably have to wait until --dev null is done.
- Should have access controls so only approved members can edit.
Security mailing list procedure can stand improvement
- To be discussed in more detail later.
Community funding
- Ordex has an initiative he wants to bring up regarding dev resources to be added to the community.
- This may tie into the donations topic.
- In short, ordex convinced OTF (Open Tech Fund) to provide a "test FOSS funding scheme" to OpenVPN.
- This would, for example, allow paying for allocated hours for mattock and cron2 to work on OpenVPN community tasks.
- This is to be worked out more and in collaboration between OpenVPN Community, OpenVPN Inc., and OTF.
Donation collection
- What are the options?
Tunnelcrack progress TunnelCrack community wiki article
- Current status: when mitigations start appearing, we will mention them in meeting notes.
OpenVPN community meetup 2024
- Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it, as we want to encourage developers and those interested in contributing to feel welcome.
- Where: Karlsruhe, Germany. It is a relatively central location in Europe and is fairly easily reachable by train. A meeting location is yet to be arranged.
- When: At the moment tentatively set to 20-22 September 2024.
- Who: We'll do an open invitation to openvpn-devel mailing list, but also CC: specifically past attendees and people of interest.
- Shirts: There is plenty of time still to prepare a shirt design.
Static-key mini how-to is outdated.
- This page is outdated badly: Static Key Mini How-To
- The company will send this to a tech writer to redo based on GitHub doc info and also retain a link to that GitHub doc.
- Having a simple guide online will help adoption.
OpenVPN 2.6 performance results.
- Tests should cover: gre, ipsec, userland, dco.
- Linux, FreeBSD, Windows.
- Requires time to be dedicated to doing this, when time available will do it.
What's going on with new taskbar icons?
- Matt provided icons in GitHub Issue
- Last update: will be picked up by selva when he has time.
Software code signing topic
- The company switched EV code signing to cloudhsm, this is the same cert type we use for driver signing, is also suitable for binary signing.
- In the future, we could possibly switch the community to that same key. Saves having to maintain 2 different keys.
- Depends on how hard/easy it is to access the company key signing thing from community infrastructure.
- Also, no high priority at the moment, we have a working solution now.
Management interface documentation on the main website will be updated with info from doc/management-notes.txt
- Novaflash will pick this up at some point.