Changes between Version 2 and Version 3 of StatusOfOpenvpn26

Timestamp:

11/06/21 10:20:58 (2 years ago)

Author:

Gert Döring

Comment:

discussions at hackathon incorporated

StatusOfOpenvpn26

@@ -5 +5 @@
 = Schedule =
 
-Too early to say, but we hope to get this done quicker than 2.4 and 2.5 - so, tentatively, "August 2021"
+Too early to say, but we hope to get this done quicker than 2.4 and 2.5 - so, tentatively, "March 2022"
 
 = Features/fixes to include =
@@ -12 +12 @@
 
 ||'''Task description'''||'''Assigned to'''||'''Status'''||'''Ticket'''||
-|| DCO (on Linux) || ordex, plaisthos || alpha release || - ||
+|| DCO (on Linux) || ordex, plaisthos, cron2 || alpha release || - ||
 || DCO (on Windows) || lev__, d12fk, plaisthos || wip || - ||
-|| DCO (on FreBSD) || ? || ? || - ||
 || update auth-user-pass docs || mattock ||not started, discussion [https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg12835.html here]||
 || polish auth-token / auth-gen-token corner cases (not sending token after explicit-exit-notify from server, etc.) || cron2, plaisthos || pending || - ||
+|| frame/buffer size handling || plaisthos || TBD || - ||
+|| OpenSSL 3.0.0 support || plaisthos  || wip || - ||
+|| OpenSSL 3.0.0 xkey || selva || PR sent || - ||
+|| TLS handshake replay protection (up for discussion) || plaisthos || not started || - ||
+|| DDoS reflection hardening (rate-limiting) || plaisthos, cron2 || wip || - ||
+|| DNS option rework (split DNS) - new option parsing || d12fk || concept being written ||
 
-== nice to have ==
+
+== nice to have / wild ideas ==
 ||'''Task description'''||'''Assigned to'''||'''Status'''||'''Ticket'''||
-|| support for multiple-protocol sockets (UDP/TCP) || ordex || wip ||
-|| Support for multiple sockets (multi-port/multi-IP) || ordex || pending review ||#556||
+|| implement kqueue on MacOS || plaisthos || not started || - ||
+|| DNS option rework (split DNS) - windows backend || lev, d12fk || - || 
+|| support TLS alerts || plaisthos || ??? || - ||
+|| AUTH_TEMP_FAIL ("I can not handle you *now*, but please come back later") [auth-retry noninteract -> something for 3.x mostly, but 2.x **must handle gracefully** ] || ? || ? || - ||
+|| test server that does --auth-user-pass and/or challenge stuff ||cron2 (snair)||--auth-user-pass done, challenge missing|| ||
+|| Update OpenVPN PRF (move away from SHA1/MD5) || syzzer/plaisthos || done(?) || ||
+|| maybe: fix radius-plugin - plugin is useful but not maintained very well  || ??? || ??? || ||
+|| DCO (on FreBSD) || ? || ? || - ||
+|| test framework improvements (local "make check" crypto tests) || syzzer || - || - ||
+
+
+== unlikely to happen, keeping the list ==
+|| inner VRF support? || ?? || ?? || ?? ||
+|| route monitoring (enable clients to react to network changes) || cron2 || not started || - ||
+|| maybe: add PRF plugin interface || ??? || ??? || ||
+|| maybe: add key exchange plugin interface (allows easily doing .e.g post quantum kex) || ??? || ??? || ||
+|| maybe: add data channel separation (or, move to ovpn3, which already has this?) || ??? || ??? || ||
 || Dynamic routes ('route in ccd-file'), depends on netlink support || ??? || ??? || ||
 || transport plugin (primary use case: obfuscation) || ordex || wip || ||
 || [http://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg10511.html tftp/wpad patch] || jjk ||patch on list, needs review and merge|| ||
 || support TLS record splitting (like ovpn3) || syzzer ||(started, but no patches available yet) ||#554||
-|| test server that does --auth-user-pass and/or challenge stuff ||cron2 (snair)||--auth-user-pass done, challenge missing|| ||
-|| Update OpenVPN PRF (move away from SHA1/MD5) || syzzer/plaisthos || done(?) || ||
-|| maybe: add PRF plugin interface || ??? || ??? || ||
-|| maybe: add key exchange plugin interface (allows easily doing .e.g post quantum kex) || ??? || ??? || ||
-|| maybe: add data channel separation (or, move to ovpn3, which already has this?) || ??? || ??? || ||
-|| maybe: fix radius-plugin - plugin is useful but not maintained very well  || ??? || ??? || ||
-|| improve control channel performance || syzzer || ??? || ||
-|| inner VRF support? || ?? || ?? || ?? ||
-|| route monitoring (enable clients to react to network changes) || cron2 || not started || - ||
+|| support for multiple-protocol sockets (UDP/TCP) || ordex || wip || - ||
+|| Support for multiple sockets (multi-port/multi-IP) || ordex || pending review ||#556||
+|| improve control channel performance (further) - redo reliability layer, introduce windowing / scaling || syzzer || ??? || ||
+
+