Home A - Z
Page Index

An Otter Wiki

IrcMeetings

Basic Info

  • Time: Wednesday 17 April 2024 at 13:00 CEST (11:00 UTC)
  • Place: #openvpn-meeting channel on LiberaChat IRC network

Topics

Current Topics

  • New: updated 2.6.10 with new MSI installers

    • There is a new Windows DCO driver that should handle coming back from hibernation better/faster, as it doesn't wait for keepalive timeout after hibernation.

  • New: --topology directive

    • We changed the default for this to be 'subnet' as this is the most commonly used setup and has been for ages (used to be net30).
    • This is however breaking things by default for peer to peer setups. We could limit the change to just --server mode.
    • djpig will propose a patch and it can be discussed further there.

  • Closed: live route update feature

    • In short, the ability to update routes, DNS, ifconfig options, live, without having to do a full reconnect.
    • After discussing last week seems like a path forward is clear.

  • Updated: Security mailing list procedure can stand improvement

    • company will improve process on picking up tasks from security mailing list in the next week or so.
    • The idea being that community guys will continue doing their thing as usual, and company guys monitor the list for company related items and follow up on those.
    • The idea of an NDA is also revived. But it was made clear internally that we need like a one-page simple NDA for community members, not the unnecessarily restrictive one originally suggested by legal guys.

  • Updated: DCO and Linux upstreaming, API change

    • Upstreaming DCO to Linux is proceeding, it is in review stage at the moment.
    • ordex will send a patchset v3 based on feedback received today.
    • There will be an API change that makes it incompatible with the current implementation.
    • A graceful solution to that was already discussed and in motion. giaan will be working on this.

  • Updated: donation collection

    • From earlier exploration it is clear that setting up a legal entity is not worth the expense at this point. We're just starting out with donations.
    • What we can do is start out with an existing company that can collect the money and puts it to good community use. ordex volunteers to take this on.
    • There are some options to consider. There may be existing solutions that we want to consider.
    • PayPal seems overly expensive with all their fees.
    • Stripe could be worth considering for credit card processing.
    • GitHub Sponsors was mentioned as a possible solution, this is worth investigating.
    • Open Collective was also mentioned, that needs some investigating how that exactly would work for us.

  • Updated: forums topics

    • ecrist still working on forums. waiting on ecrist to move things around.
    • Plan is to soon switch URLs so new forum is on forums.openvpn.net and old forums is on archive address.
    • email confirmation on registration was suggested.
    • mod guide, hard or soft delete (chuck board?), what to do with GDPR, etc. (write it down and actually make it available to mods, maybe a hidden topic)
    • access for mods to logs so one can see what others did

  • Updated: mattock topics

  • OpenVPN community meetup 2024

    • Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it.
    • Where: Karlsruhe, Germany. Meeting room location to be determined.
    • When: At the moment tentatively set to 20-22 September 2024.
    • Who: We'll do an open invitation to openvpn-devel mailing list, but also CC: specifically past attendees and people of interest.
    • Shirts: There is plenty of time still to prepare a shirt design.
    • There's a wiki page up now where we can coordinate: https://community.openvpn.net/openvpn/wiki/CommunityMeetup2024

  • Website release process

    • Waiting for faster way to update community downloads and security advisories on main site.
    • Again postponed due to issues. Now planned for this week. We'll see.

  • Status of SBOM

    • There was a discussion between MaxF and djpig and others.
    • For OpenVPN2 / OpenVPN-NL, there is not much overlap, as OpenVPN2 doesn't ship much in terms of libraries, but OpenVPN-NL does.
    • The interesting use-case for an SBOM is really the OpenVPN Windows GUI client.

  • Status of trac/wiki

    • No progress since last meeting.
    • This will probably have to wait until "--dev null" is done
    • Should have access controls so only approved members can edit.

  • Tunnelcrack progress TunnelCrack community wiki article

    • Current status: when mitigations start appearing we will mention them in meeting notes.

  • Static-key mini how-to is outdated.

  • OpenVPN 2.6 performance results.

    • tests should cover: gre, ipsec, userland, dco
    • linux, freebsd, windows
    • requires time to be dedicated to doing this, when time available will do it

  • What's going on with new taskbar icons?

  • Software code signing topic

    • company switched EV code signing to cloudhsm, this is same cert type we use for driver signing, is also suitable for binary signing.
    • in future we could possibly switch community to that same key. saves having to maintain 2 different keys.
    • depends on how hard/easy it is to access company key signing thingee from community infrastructure.
    • also no high priority at the moment, we have a working solution now.

  • Management interface documentation on main website will be updated with info from doc/management-notes.txt

    • novaflash will pick this up at some point

Mattock Topics

--dev null server testing

Latest status in ServerSideTestingImprovementPlan. Additional details in https://github.com/mattock/openvpn/blob/dev_null/doc/dev-null-test-suite.rst. Current PoC code is available in mattock's "dev_null" branch. A good starting point is t_server_null.sh.

Potential next steps:

  • Expand the test suite
  • Integrate into Buildbot (i.e. get to production)
  • Support multiple client versions (depends on Buildbot integration)

Git commit history needs to be cleaned up and there may be other small fixes / improvements here and there to be done:

  • Enable disabling the test suite (requires root so we can't run it by default)

Debian/Ubuntu snapshot publishing

  • In the last meeting we agreed to publish snapshot Debian/Ubuntu packages on build.openvpn.net
  • The tool to use to publish is aptly
  • Aptly does not have direct support for running commands (e.g. rsync, scp) after publishing packages, e.g. to a local filesystem on the buildmaster
    • Option 1 (hacky): use inotifywait with rsync or scp to copy the published repo to build.openvpn.net
    • Option 2 (less hacky): use NFS to publish "directly" to build.openvpn.net
    • Both options require a fair amount of tinkering
  • Mattock moved this forward a bit at the buildbot end (get the files out from workers)
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9