# IrcMeetings ## Basic Info - **Time**: Wednesday 17 April 2024 at 13:00 CEST (11:00 UTC) - **Place**: #openvpn-meeting channel on LiberaChat IRC network ## Topics ### Current Topics - **New: updated 2.6.10 with new MSI installers** - _There is a new Windows DCO driver that should handle coming back from hibernation better/faster, as it doesn't wait for keepalive timeout after hibernation._ - **New: --topology directive** - _We changed the default for this to be 'subnet' as this is the most commonly used setup and has been for ages (used to be net30)._ - _This is however breaking things by default for peer to peer setups. We could limit the change to just --server mode._ - _djpig will propose a patch and it can be discussed further there._ - **Closed: live route update feature** - _In short, the ability to update routes, DNS, ifconfig options, live, without having to do a full reconnect._ - _After discussing last week seems like a path forward is clear._ - **Updated: Security mailing list procedure can stand improvement** - _company will improve process on picking up tasks from security mailing list in the next week or so._ - _The idea being that community guys will continue doing their thing as usual, and company guys monitor the list for company related items and follow up on those._ - _The idea of an NDA is also revived. But it was made clear internally that we need like a one-page simple NDA for community members, not the unnecessarily restrictive one originally suggested by legal guys._ - **Updated: DCO and Linux upstreaming, API change** - _Upstreaming DCO to Linux is proceeding, it is in review stage at the moment._ - _ordex will send a patchset v3 based on feedback received today._ - _There will be an API change that makes it incompatible with the current implementation._ - _A graceful solution to that was already discussed and in motion. giaan will be working on this._ - **Updated: donation collection** - _From earlier exploration it is clear that setting up a legal entity is not worth the expense at this point. We're just starting out with donations._ - _What we can do is start out with an existing company that can collect the money and puts it to good community use. ordex volunteers to take this on._ - _There are some options to consider. There may be existing solutions that we want to consider._ - _PayPal seems overly expensive with all their fees._ - _Stripe could be worth considering for credit card processing._ - _GitHub Sponsors was mentioned as a possible solution, this is worth investigating._ - _Open Collective was also mentioned, that needs some investigating how that exactly would work for us._ - **Updated: forums topics** - _ecrist still working on forums. waiting on ecrist to move things around._ - _Plan is to soon switch URLs so new forum is on forums.openvpn.net and old forums is on archive address._ - _email confirmation on registration was suggested._ - _mod guide, hard or soft delete (chuck board?), what to do with GDPR, etc. (write it down and actually make it available to mods, maybe a hidden topic)_ - _access for mods to logs so one can see what others did_ - **Updated: mattock topics** - _Managed to make tests run reliably now, the occassional failures seem resolved now._ - _Documentation here: [https://github.com/mattock/openvpn/blob/dev_null/doc/dev-null-test-suite.rst](https://github.com/mattock/openvpn/blob/dev_null/doc/dev-null-test-suite.rst)_ - _Will submit a patch soon._ - **OpenVPN community meetup 2024** - _Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it._ - _Where: Karlsruhe, Germany. Meeting room location to be determined._ - _When: At the moment tentatively set to 20-22 September 2024._ - _Who: We'll do an open invitation to openvpn-devel mailing list, but also CC: specifically past attendees and people of interest._ - _Shirts: There is plenty of time still to prepare a shirt design._ - _There's a wiki page up now where we can coordinate: [https://community.openvpn.net/openvpn/wiki/CommunityMeetup2024](https://community.openvpn.net/openvpn/wiki/CommunityMeetup2024)_ - **Website release process** - _Waiting for faster way to update community downloads and security advisories on main site._ - _Again postponed due to issues. Now planned for this week. We'll see._ - **Status of SBOM** - _There was a discussion between MaxF and djpig and others._ - _For OpenVPN2 / OpenVPN-NL, there is not much overlap, as OpenVPN2 doesn't ship much in terms of libraries, but OpenVPN-NL does._ - _The interesting use-case for an SBOM is really the OpenVPN Windows GUI client._ - **Status of trac/wiki** - _No progress since last meeting._ - _This will probably have to wait until "--dev null" is done_ - _Should have access controls so only approved members can edit._ - **Tunnelcrack progress [TunnelCrack community wiki article](https://community.openvpn.net/openvpn/wiki/TunnelCrack)** - _Current status: when mitigations start appearing we will mention them in meeting notes._ - **Static-key mini how-to is outdated.** - _This page is outdated badly: [https://openvpn.net/community-resources/static-key-mini-howto/](https://openvpn.net/community-resources/static-key-mini-howto/)_ - _company will send this to tech writer to redo based on [https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/example-fingerprint.rst](https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/example-fingerprint.rst) info and also retain a link to that github doc._ - _having a simple guide online will help adoption_ - **OpenVPN 2.6 performance results.** - _tests should cover: gre, ipsec, userland, dco_ - _linux, freebsd, windows_ - _requires time to be dedicated to doing this, when time available will do it_ - **What's going on with new taskbar icons?** - _matt provided icons in [https://github.com/OpenVPN/openvpn-gui/issues/595](https://github.com/OpenVPN/openvpn-gui/issues/595)_ - _last update: will be picked up by selva when he has time_ - **Software code signing topic** - _company switched EV code signing to cloudhsm, this is same cert type we use for driver signing, is also suitable for binary signing._ - _in future we could possibly switch community to that same key. saves having to maintain 2 different keys._ - _depends on how hard/easy it is to access company key signing thingee from community infrastructure._ - _also no high priority at the moment, we have a working solution now._ - **Management interface documentation on main website will be updated with info from doc/management-notes.txt** - _novaflash will pick this up at some point_ ## Mattock Topics ### --dev null server testing Latest status in [ServerSideTestingImprovementPlan](https://github.com/mattock/openvpn/blob/dev_null/doc/server-side-testing-improvement-plan.rst). Additional details in [https://github.com/mattock/openvpn/blob/dev_null/doc/dev-null-test-suite.rst](https://github.com/mattock/openvpn/blob/dev_null/doc/dev-null-test-suite.rst). Current PoC code is available in mattock's "dev_null" branch. A good starting point is [t_server_null.sh](https://github.com/mattock/openvpn/blob/dev_null/tests/t_server_null.sh). Potential next steps: - Expand the test suite - Integrate into Buildbot (i.e. get to production) - Support multiple client versions (depends on Buildbot integration) Git commit history needs to be cleaned up and there may be other small fixes / improvements here and there to be done: - Enable disabling the test suite (requires root so we can't run it by default) ### Debian/Ubuntu snapshot publishing - In the last meeting we agreed to publish snapshot Debian/Ubuntu packages on *build.openvpn.net* - The tool to use to publish is [aptly](https://www.aptly.info/) - Aptly does not have direct support for running commands (e.g. rsync, scp) after publishing packages, e.g. to a local filesystem on the buildmaster - **Option 1 (hacky)**: use **inotifywait** with **rsync** or **scp** to copy the published repo to build.openvpn.net - **Option 2 (less hacky)**: use **NFS** to publish "directly" to build.openvpn.net - Both options require a fair amount of tinkering - Mattock moved this forward a bit at the buildbot end (get the files out from workers)