Home A - Z
Page Index

An Otter Wiki

Blame

a75bb0 Samuli Seppänen 2025-01-29 07:33:21 1 
# OpenVPN Hackathon 2023
2
3
This year's hackathon is organized by Lev Stipakov. For the most part.
4
5
## Dates
6
7
October 6-8, 2023
8
9
## Venue
10
11
The venue for the hackathon is at [Scandinavian School Costa Blanca](https://skandinaviskaskolan.com/), which is in Orihuela Costa, Alicante province, Valencian Community, Spain.
12
13
[Address](https://goo.gl/maps/UGVHcnQyWAN2cUfNA?coh=178572&entry=tt):
14
15
```
16
C. Pablo Picasso, 5
17
Bloque 6, 3ª Planta
18
03189 Orihuela, Alicante
19
```
20
21
The closest airport is [Alicante Elche](https://www.aena.es/en/alicante-elche-miguel-hernandez.html). From there it takes 50min by taxi to arrive at Orihuela Costa. Note that the venue located about 8km from Torrevieja center, so you probably don't want to book a hotel there.
22
23
Hotels close-by:
24
- [Hotel Servigroup La Zenia - Orihuela](https://www.servigroup.com/en/la-zenia-hotel-orihuela-costa/)
25
26
## Who is coming?
27
28
| **Name** | **Topics** | **Arrival** | **Departure** | **Hotel** | **T-shirt size** |
29
|-------------------|----------------------------------------|------------------------------|-----------------------------|----------------|------------------|
30
| Lev Stipakov | DCO, new TAP driver | already there | 08.10 late evening | TBD | M |
31
| Gert Döring | triage open issues, Tunnelcrack | Thu. Oct. 5 16:20 at ALC | Sun Oct. 8 flight at 12:30 | Servigroup | XL |
32
| Arne Schwabe | things | Tur late (19:00 at ALC) | Sun afternoon (flight at 18:50) | TBD | XXL |
33
| Johan Draaisma | gerrit | Thu. Oct. 5. 16:30 | Sa. Oct. 14. 17:20 | una casa cerca de la escuela | XL |
34
| Frank Lichtenheld | gerrit | Thu. Oct. 5. 16:45 | So. Oct. 8. 18:10 | Servigroup | XL |
35
| Heiko Hund | future of --dhcp-options | Thu. Oct. 5. 16:25 | Sa. Oct. 14. 15:00 | una casa cerca de la escuela | XXL |
36
| Max Fillinger | TBD | Thu. 16:30 at ALC | Mon. 13:00 | Orihuela Costa Resort | XL |
37
| Antonio Quartulli | i just want a shirt kthxbye | not attending | not attending | not attending | M |
38
| James Yonan | unable to attend | not attending | not attending | not attending | XL |
39
| Samuli Seppänen | | not attending | not attending | not attending | |
40
41
## Meeting summary
42
43
- **TunnelCrack vulnerabilities**
44
- Published a statement on the community wiki regarding TunnelCrack. A security advisory on the main site is to follow a bit later.
45
- Planned future mitigation steps to counter these vulnerabilities. Out of necessity the mitigations will be different per platform.
46
- **Windows:** Rework `--redirect-gateway block-local` to use Windows Filtering Platform - precedent for using WFP in `--block-outside-dns`.
47
- **macOS:** Look at the VPN API and maybe PF for a solution to block the unwanted traffic paths.
48
- **Linux:** Implement a separate routing table and set up a routing policy. Add options to control this.
49
- **BSD OSes:** Provide an `--up script` example and documentation to block unwanted traffic paths.
50
- **Android:** Has traffic isolation out of the box and is not affected by these vulnerabilities.
51
- **iOS:** Currently only implemented in OpenVPN Connect, so OpenVPN Inc. will look into a fix.
52
53
- **Change default for topology directive**
54
- Change the default from net30 topology to subnet topology planned for OpenVPN 2.7.
55
56
- **DNS implementation on Windows**
57
- Implement new split-DNS functionality using the new `--dns` directive.
58
- Deduplicate DNS and route handling code in the privileged interactive service.
59
60
- **DNS implementation on Linux**
61
- Provide a script with OpenVPN 2.7 on Linux that supports resolved and resolvconf out-of-the-box.
62
63
- **Windows GUI update mechanism**
64
- Consider adding a software update mechanism, possibly using Sparkle or another existing solution.
65
66
- **Future of dhcp-option directive**
67
- Evaluate all the dhcp-option directive options and see if any can be separated into its own directive.
68
69
- **Planned deprecation of NTLM proxy authentication methods**
70
- NTLMv1 is already deprecated and will be removed from OpenVPN 2.7. NTLMv2 will become marked as deprecated but still work in OpenVPN 2.7.
71
72
- **Planned deprecation of `--secret` static key directive**
73
- Begin deprecation in OpenVPN 2.7, and removal in OpenVPN 2.8.
74
75
- **Multiple authentication plugins support**
76
- Planned for OpenVPN 2.7.
77
78
- **Improve OpenVPN2 and network-manager integration**
79
- Implement changes in master intended for 2.7 and if non-disruptive backport to 2.6.
80
81
- **Multi-socket support**
82
- Implement the ability for OpenVPN2 to listen on multiple sockets at the same time in OpenVPN 2.7.
83
84
- **Live route updates**
85
- Support updating routes live on the client side without having to force a reconnect in OpenVPN 2.7.
86
87
- **Custom control channel packets**
88
- Implement a new control channel message for arbitrary messages in OpenVPN 2.7.
89
90
- **mbedTLS updates**
91
- Final stages of updating the licensing of OpenVPN2 to resolve this, allowing updates to newer mbedTLS versions.
92
93
- **Remove OpenSSL 1.0.2 support**
94
- Planned for OpenVPN 2.7.
95
96
- **2.6 client with DCO connecting to 2.4 server silent failure**
97
- Add a notification for this issue and advise upgrading to newer versions to solve it.
98
99
- **Incoming patchset for DCO-win**
100
- Lev will help with splitting the huge patchset into manageable related pieces and work on merging it.