Home A - Z
Page Index

An Otter Wiki

Blame

6f02e7 Samuli Seppänen 2025-01-29 06:40:08 1 
# IrcMeetings
2
3
## Basic info
4
5
- **Time:** Wednesday 20 March 2024 at 13:00 CEST (11:00 UTC)
6
- **Place:** #openvpn-meeting channel on LiberaChat IRC network
7
8
## Topics
9
10
### Current topics
11
12
- **Updated: openvpn 2.6.10 release**
13
- _This release should go out today._
14
- _It contains a number of security fixes focused on Windows._
15
16
- **OpenVPN 2.5.10 release**
17
- _According to our SupportedVersions guidelines we should do a release with the CVE fixes from 2.6._
18
- _But we don't promise Windows installers there. Given that these issues are all focused around Windows, we will do a best effort attempt to deliver it anyway._
19
- _This is something we'll pick up right after 2.6.10._
20
21
- **New: tunnelblick and sophos UTM**
22
- _Need to investigate this issue. Possibly a client side fix._
23
24
- **Updated: website release process**
25
- _This week a website release is planned that will enable a new way for updating Community Downloads page._
26
- _The new way has a much faster release method separate from the rest of the website's release schedule._
27
- _For today's release however the usual annoying method will be used to get it published on the main site._
28
29
- **Updated: forums topics**
30
- _ecrist has gone ahead and launched the new forums and locked the old forums._
31
- _The idea is that people and conversations migrate over to the new forums._
32
- _There are still some issues with the new forums that should be resolved._
33
- _The current situation is that old forums is new topics locked, and new forums has issues._
34
- _Discussed and agreed to ask ecrist to either fix new forums quickly or unlock new topics on old forums until we fix things._
35
- _email delivery seems not to be working. Email confirmation on registration was suggested._
36
- _Spammers found the new forums - but an anti-spam module was installed so that should solve this in theory._
37
- _Access to admin interface seems broken. Have to find out where the problem is exactly and solve it._
38
- _We still need to work on having some other people with some admin or high mod access._
39
- _Mod guide, hard or soft delete (chuck board?), what to do with GDPR, etc. (write it down and actually make it available to mods, maybe a hidden topic)_
40
- _Access for mods to logs so one can see what others did_
41
42
- **Updated: Security mailing list procedure can stand improvement**
43
- _dazo and novaflash will start discussing this internally in openvpn inc._
44
- _Goal of discussions is to work out a better internal procedure to connect security mailing list better with company product responsible people._
45
46
- **Updated: mattock topics**
47
- _Talked about mattock's --dev null server testing implementation._
48
- _Agreed that testing TCP and UDP servers and matching clients is a good start._
49
- _Mattock will also check if t_client.sh could be used and/or adapted to do the client-side of this equation._
50
51
- **community funding**
52
- _ordex has an initiative he wants to bring up regarding dev resources to be added to community._
53
- _This may tie into the donations topic._
54
- _In short ordex convinced OTF (Open Tech Fund) to provide a "test FOSS funding scheme" to OpenVPN._
55
- _This would for example allow to pay for allocated hours for mattock and cron2 to work on OpenVPN community tasks._
56
- _This is to be worked out more and in collaboration between OpenVPN Community, OpenVPN Inc., and OTF._
57
58
- **Updated: donation collection**
59
- _ordex consulted an expert and it looks like doing a legal entity does not make sense when you're just starting out._
60
- _The tricky part here is that only if we get a lot of donations and a lot of money does it make sense to have that kind of overhead._
61
- _What we can do is start out with a company that collects the money and puts it to good community use. ordex volunteers to take this on._
62
- _We want the donations to be collected in one place, and expenses made from that one place, so we are accountable._
63
- _We need to figure out how to deal with that legally, and what payment methods to accept and how._
64
- _Probably credit card is a must. Maybe PayPal as well. Bitcoin seems to encounter some resistance in the discussions._
65
- _And a reminder; we definitely do not want the donation thing to be forced - have a mechanism to do it, but keep it out of the way._
66
67
- **inactive setting data counter in openvpn2 and openvpn3**
68
- _It looks like openvpn2 and openvpn3 handle the counting of traffic for this differently._
69
- _After some discussion it was decided illia will submit some suggested fixes._
70
71
- **Status of SBOM**
72
- _There was a discussion between MaxF and djpig and others._
73
- _For OpenVPN2 / OpenVPN-NL, there is not much overlap, as OpenVPN2 doesn't ship much in terms of libraries, but OpenVPN-NL does._
74
- _The interesting use-case for an SBOM is really the OpenVPN Windows GUI client._
75
76
- **status of trac/wiki**
77
- _No progress since last meeting._
78
- _This will probably have to wait until "--dev null" is done_
79
- _Should have access controls so only approved members can edit._
80
81
- **Tunnelcrack progress**
82
- _Current status: when mitigations start appearing we will mention them in meeting notes._
83
84
- **OpenVPN community meetup 2024**
85
- _Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it, as we want to encourage developers and those interested in contributing to feel welcome._
86
- _Where: Karlsruhe, Germany. It is a relatively central location in Europe and is fairly easily reachable by train. A meeting location is yet to be arranged._
87
- _When: At the moment tentatively set to 20-22 September 2024._
88
- _Who: We'll do an open invitation to openvpn-devel mailing list, but also CC: specifically past attendees and people of interest._
89
- _Shirts: There is plenty of time still to prepare a shirt design._
90
91
- **Static-key mini how-to is outdated.**
92
- _This page is outdated badly: [Static-key Mini How-to](https://openvpn.net/community-resources/static-key-mini-howto/)_
93
- _The company will send this to tech writer to redo based on [Example Fingerprint doc on GitHub](https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/example-fingerprint.rst) and also retain a link to that GitHub doc._
94
- _Having a simple guide online will help adoption._
95
96
- **OpenVPN 2.6 performance results.**
97
- _Tests should cover: GRE, IPSec, userland, DCO_
98
- _Linux, FreeBSD, Windows_
99
- _Requires time to be dedicated to doing this, when time available will do it._
100
101
- **What's going on with new taskbar icons?**
102
- _Matt provided icons in [OpenVPN GUI Issue #595](https://github.com/OpenVPN/openvpn-gui/issues/595)_
103
- _Last update: will be picked up by Selva when he has time._
104
105
- **Software code signing topic**
106
- _The company switched EV code signing to cloudHSM, this is the same cert type we use for driver signing, is also suitable for binary signing._
107
- _In future we could possibly switch community to that same key. Saves having to maintain 2 different keys._
108
- _Depends on how hard/easy it is to access the company key signing thing from community infrastructure._
109
- _Also no high priority at the moment, we have a working solution now._
110
111
- **Management interface documentation on main website will be updated with info from doc/management-notes.txt**
112
- _Novaflash will pick this up at some point._
113
114
### Mattock topics
115
116
#### --dev null server testing
117
118
Mattock has implemented the first version of the so-called "--dev null server testing" and integrated it with "make check". The features are:
119
120
- Does what it says on the tin (more on that later)
121
- Mostly operating system agnostic
122
- Should be POSIX shell compliant
123
- Uses the sample certificates and keys
124
- Supports running directly as root and with sudo
125
- Supports using different OpenVPN client versions
126
- The "current" (just compiled) version
127
- Any other OpenVPN versions (must be present on the filesystem)
128
- Support testing for success as well as failure
129
- Server configuration is currently static (i.e. no support for multiple server configurations yet)
130
131
Here's how it works:
132
133
1. **make check**
134
1. **t_server_null.sh**
135
1. **t_server_null_server.sh**
136
- Launches the compiled OpenVPN as root (if necessary with sudo)
137
- OpenVPN server exits when all clients have been disconnected for ten seconds, based on its status file
138
1. **t_server_null_client.sh**
139
- Launches each individual client test
140
- Client kills itself after some delay using an "--up" script
141
142
Current PoC code is available in mattock's "dev_null" branch. A good starting point is [t_server_null.sh](https://github.com/mattock/openvpn/blob/dev_null/tests/t_server_null.sh).
143
144
What should be the next steps?
145
146
- Basic approach ok?
147
- Is starting with a single server configuration ok?
148
- Which server configurations should we test against?
149
- Which client configurations should we test (success or failure)?
150
- Which operating systems do we want to support in this context? Linux and BSDs? Something more esoteric?
151
- Which OpenVPN client versions should we run?
152
153
#### Debian/Ubuntu snapshot publishing
154
155
- In the last meeting we agreed to publish snapshot Debian/Ubuntu packages on *build.openvpn.net*
156
- The tool to use to publish is [aptly](https://www.aptly.info/)
157
- aptly does not have direct support for running commands (e.g. rsync, scp) after publishing packages, e.g. to a local filesystem on the buildmaster
158
- _Option 1 (hacky):_ use _inotifywait_ with _rsync_ or _scp_ to copy the published repo to build.openvpn.net
159
- _Option 2 (less hacky):_ use _NFS_ to publish "directly" to build.openvpn.net
160
- Both options require a fair amount of tinkering