Toronto 2014 meetup

From Swan
Jump to: navigation, search

This meetup will be held immediately after IETF-90 in Toronto.

It was hosted by Paul Wouters.

Attenders: Antony Antony, D. Hugh Redelmeier, Matt Rogers, Tuomo Soini, Kim Heino and Paul Wouters


Agenda items

Meetup day sessions

  • hostpair documentation / teachings in code (and/or wiki)
  • relations between state and connection, switching, instantiation - teaching
  • SADB userland documentation / teachings
  • teaching directory structure for refactoring/cleanup

Important tasks discussed

  • false "can not start crypto helper: failed to find any available worker" and load (also force_busy)
  • quick scan of bugtracker
  • make rpm / deb daily packages
  • NSS and ipsec.secrets :RSA entries (obsolete, remove?)


Work items in priority order

Coding style and refactoring

  • 1 uncrustify fixups within the crypto boundary
  • 1 refactoring to reduce crypto boundary
  • 2 logging function sanity
  • 3 coding style fixups after uncrustify
  • 3 modularity of source files - directories
  • - Simplifying the IKEv2 by expanding the state machine
  • - or Rewriting IKEv1 state machine the same way as IKEv2?
  • 2 cppcheck (action Paul: daily output)
  • 2 coverity CHECKS (action Paul: daily output)
  • 5 clang checks (action Paul: daily output)
  • 2 OE IPsec, AUTH_NONE, left/rightauthby=, adns lookups
  • 2 CREATE_CHILD_SA
  • 3 CP payload (modeconfig for ikev2)
  • 4 EAP (auth for IKEv2)
  • 1 statsd with xauth and traffic accounting (action paul/antony)
  • 1 dns helpers removal
  • 1 fix retransitmit=no, fix impair-retransmit and environment variable (action hugh)
  • 1 when to release whack on failure (now after 20 minutes :) (action:hugh)
  • 2 CA chains (action: Matt)
  • 2 audit support (action: paul)
  • 3 UNH certification bugfixing (action: paul)
  • 3 TAHI tests bugfixing (action: paul)
  • 3 ADNS dns helper -> libunbound with libevent
  • 3 retransmit timers, creating options, creating keywords, fuzzing sender/receivier, subsecond timers, retransmit fail parent state linger, 60s max? (action hugh)
  • 3 "ipsec eroute" / ip xfrm xxxx replacement requirements for enduser/admin (action paul/antony)
  • 3 ipsec status "brief" command for enduser/admin (action paul/antony)
  • 4 FIPS certification bugfixing (action: paul)
  • 4 decloning code
  • 4 Resolving "warning comments", XXX TODO ???
  • 4 Fix known missing code and/or file finding missing code as a bug in the tracker
  • 4 cleanup bug tracker
  • 4 NSS CRL/OCSP, phasing out /etc/ipsec.d/cacerts/ (action: matt)
  • 5 dynamic interfacing and whack --listen / NM / libevent select loop replacement
  • 5 fips failure should install %hold then fail
  • 5 NSS and some userland IKE algo support (AES_GCM, AES_CCM, AES_CTR)
  • 5 Default proposal list (decouple v1/v2, update v2 ?)
  • 5 ike=/esp= parser
  • 5 parser and generic restrictions (conflicting conns loading, etc)
  • 5 multicast ipsec - (action: rgb)
  • 5 what features can be dropped or simplified?
  • 5+ ipsec failover (WIP at IETF)
  • 1 enter bug - Makefile fixes for lib/ so "make programs" updates it properly
  • 1 enter bug - Makefile fixes for "make programs" when whack.c is updated
  • 1 enter bug - Makefile fixes for not updating man pages when xml files did not change (put all xml in one dir?)
  • 5 kvmplutotest vs containertest
  • 5 KLIPS: what to do? namespace support? what minimal kernel version ? (note OCF) (action: rgb)
  • 5 netkey uses pf_key, herbert wants us to stop that
  • 2 machine parsable propeties for test suite description
  • 4 changing/updating testsuite for new requirements (fuzzing, nfs/9p, convert from beaker?)
  • 5 IKEv1 / IKEv2 cleanup / separation ?