Toronto 2014 meetup: Difference between revisions

From Libreswan
Jump to navigation Jump to search
No edit summary
No edit summary
Line 8: Line 8:
Agenda items (raw)
Agenda items (raw)


* uncrustify discussion
* 3 uncrustify fixups
* state machine revisited
* 1 uncrustify fixips within the crypto boundary
* Simplifying the IKEv2 by expanding the state machine
* 1 refactoring to reduce crypto boundary
* refactoring to reduce crypto boundary
* 2 logging function sanity
* clang / coverity (add comments about false positives)
* 3 modularity of source files - directories
* [https://bugs.libreswan.org/show_bug.cgi?id=192 uniqueid handling]
 
* [https://bugs.libreswan.org/show_bug.cgi?id=194 modp group restrictions ]
* - Simplifying the IKEv2 by expanding the state machine
* OE IPsec, AUTH_NONE, left/rightauthby=, adns lookups
 
* CREATE_CHILD_SA
* 2 cppcheck (action Paul: daily output)
* logging function sanity
* 5 clang checks (action Paul: daily output)
* hostpair documentation / teachings  in code (and/or wiki)
* 2 coverity CHECKS (action Paul: daily output)
* relations between state and connection,  switching, instantiation - teaching
 
* CP payload (modeconfig for ikev2)
* 2 OE IPsec, AUTH_NONE, left/rightauthby=, adns lookups
* EAP (auth for IKEv2)
 
* NSS and some userland IKE algo support (AES_GCM, AES_CCM, AES_CTR)
* 2 CREATE_CHILD_SA
* Default proposal list (decouple v1/v2, update v2 ?)
* 3 CP payload (modeconfig for ikev2)
* SADB userland documentation / teachings
* 4 EAP (auth for IKEv2)
* ike=/esp= parser
 
* parser and generic restrictions (conflicting conns loading, etc)
* 0 hostpair documentation / teachings  in code (and/or wiki)
* CA chains
* 0 relations between state and connection,  switching, instantiation - teaching
* UNH certification
* 0 SADB userland documentation / teachings
* FIPS certification
* 0 teaching directory structure for refactoring/cleanup
* TAHI tests
* 0 false "can not start crypto helper: failed to find any available worker" and load (also force_busy)
* audit support and statsd
* 0 quick scan of bugtracker
* dynamic interfacing and whack --listen / NM / libevent select loop replacement
* 0.5 make rpm / deb daily packages
* ADNS helpers,eventloop -> libunbound,libevent
* 0.5 NSS and ipsec.secrets :RSA entries (obsolete, remove?)
* false "can not start crypto helper: failed to find any available worker" and load (also force_busy)
 
* decloning code
* 5 NSS and some userland IKE algo support (AES_GCM, AES_CCM, AES_CTR)
* Resolving "warning comments", markers like "paul ZZZ XXX TODO ???"
* 5 Default proposal list (decouple v1/v2, update v2 ?)
* cleanup/explain/delete/justify #if 0
* 5 ike=/esp= parser
* Fix known missing code and/or file finding missing code as a bug in the tracker. link comments and bug#
* 5 parser and generic restrictions (conflicting conns loading, etc)
* cleanup bug tracker
* 2 CA chains (action: Matt)
* retransmit timers, creating options, creating keywords, fuzzing sender/receiver, subsecond timers, retransmit fail parent state linger, 60s max?
* 3 UNH certification bugfixing (action: paul)
* fix retransmit=no, fix impair-retransmit and environment variable
* 4 FIPS certification bugfixing (action: paul)
* re-inventory of rekey margin/timing/fuzz/counter parameters (and others). Which should be removed from user config?
* 3 TAHI tests bugfixing (action: paul)
* when to release whack on failure (now after 20 minutes :)
* 2 audit support (action: paul)
* multicast ipsec - rgb has interest
* 1 statsd with xauth and traffic accounting (action paul/antony)
* ipsec failover (WIP at IETF)
* 5 dynamic interfacing and whack --listen / NM / libevent select loop replacement
* NSS CRL/OCSP, phasing out /etc/ipsec.d/cacerts/ (for matt)
* 1 dns helpers removal
* fips failure should install %hold then fail
* 3 ADNS dns helper -> libunbound with libevent
* make rpm / deb daily packages
* 4 decloning code
* modularity of source files - directories
* 4 Resolving "warning comments", XXX TODO ???  
* Makefile fixes for lib/ so "make programs" updates it properly
* 4 Fix known missing code and/or file finding missing code as a bug in the tracker
* Makefile fixes for "make programs" when whack.c is updated
* 4 cleanup bug tracker
* Makefile fixes for not updating man pages when xml files did not change (put all xml in one dir?)
* 3 retransmit timers, creating options, creating keywords, fuzzing sender/receivier, subsecond timers, retransmit fail parent state linger, 60s max? (action hugh)
* kvmplutotest vs containertest
* 1 fix retransitmit=no, fix impair-retransmit and environment variable (action hugh)
* KLIPS: what to do? namespace support? what minimal kernel version ?  (note OCF)
* 1 when to release whack on failure (now after 20 minutes :) (action:hugh)
* netkey uses pf_key, herbert wants us to stop that
* 5 multicast ipsec - (action: rgb)
* machine parsable propeties for test suite description
* 5 what features can be dropped or simplified?
* changing/updating testsuite for new requirements (fuzzing, nfs/9p, convert from beaker?)
* 5+ ipsec failover (WIP at IETF)
* IKEv1 / IKEv2 cleanup / separation ?
* 4 NSS CRL/OCSP, phasing out /etc/ipsec.d/cacerts/   (action: matt)
* NS and ipsec.secrets :RSA entries (obsolete, remove?)
* 5 fips failure should install %hold then fail
* 3 "ipsec eroute" / ip xfrm xxxx replacement requirements for enduser/admin (action paul/antony)
* 3 ipsec status "brief" command for enduser/admin (action paul/antony)
 
 
* 1 enter bug - Makefile fixes for lib/ so "make programs" updates it properly
* 1 enter bug - Makefile fixes for "make programs" when whack.c is updated
* 1 enter bug - Makefile fixes for not updating man pages when xml files did not change (put all xml in one dir?)
* 5 kvmplutotest vs containertest
* 5 KLIPS: what to do? namespace support? what minimal kernel version ?  (note OCF) (action: rgb)
* 5 netkey uses pf_key, herbert wants us to stop that
* 2 machine parsable propeties for test suite description
* 4 changing/updating testsuite for new requirements (fuzzing, nfs/9p, convert from beaker?)
* 5 IKEv1 / IKEv2 cleanup / separation ?

Revision as of 20:24, 26 July 2014

This meetup will be held immediately after IETF-90 in Toronto.

It will be hosted by Paul Wouters

Scheduled to attend: Antony Antony, D. Hugh Redelmeier, Matt Rogers, Tuomo Soini, Kim Heino and Paul Wouters

Agenda items (raw)

  • 3 uncrustify fixups
  • 1 uncrustify fixips within the crypto boundary
  • 1 refactoring to reduce crypto boundary
  • 2 logging function sanity
  • 3 modularity of source files - directories
  • - Simplifying the IKEv2 by expanding the state machine
  • 2 cppcheck (action Paul: daily output)
  • 5 clang checks (action Paul: daily output)
  • 2 coverity CHECKS (action Paul: daily output)
  • 2 OE IPsec, AUTH_NONE, left/rightauthby=, adns lookups
  • 2 CREATE_CHILD_SA
  • 3 CP payload (modeconfig for ikev2)
  • 4 EAP (auth for IKEv2)
  • 0 hostpair documentation / teachings in code (and/or wiki)
  • 0 relations between state and connection, switching, instantiation - teaching
  • 0 SADB userland documentation / teachings
  • 0 teaching directory structure for refactoring/cleanup
  • 0 false "can not start crypto helper: failed to find any available worker" and load (also force_busy)
  • 0 quick scan of bugtracker
  • 0.5 make rpm / deb daily packages
  • 0.5 NSS and ipsec.secrets :RSA entries (obsolete, remove?)
  • 5 NSS and some userland IKE algo support (AES_GCM, AES_CCM, AES_CTR)
  • 5 Default proposal list (decouple v1/v2, update v2 ?)
  • 5 ike=/esp= parser
  • 5 parser and generic restrictions (conflicting conns loading, etc)
  • 2 CA chains (action: Matt)
  • 3 UNH certification bugfixing (action: paul)
  • 4 FIPS certification bugfixing (action: paul)
  • 3 TAHI tests bugfixing (action: paul)
  • 2 audit support (action: paul)
  • 1 statsd with xauth and traffic accounting (action paul/antony)
  • 5 dynamic interfacing and whack --listen / NM / libevent select loop replacement
  • 1 dns helpers removal
  • 3 ADNS dns helper -> libunbound with libevent
  • 4 decloning code
  • 4 Resolving "warning comments", XXX TODO ???
  • 4 Fix known missing code and/or file finding missing code as a bug in the tracker
  • 4 cleanup bug tracker
  • 3 retransmit timers, creating options, creating keywords, fuzzing sender/receivier, subsecond timers, retransmit fail parent state linger, 60s max? (action hugh)
  • 1 fix retransitmit=no, fix impair-retransmit and environment variable (action hugh)
  • 1 when to release whack on failure (now after 20 minutes :) (action:hugh)
  • 5 multicast ipsec - (action: rgb)
  • 5 what features can be dropped or simplified?
  • 5+ ipsec failover (WIP at IETF)
  • 4 NSS CRL/OCSP, phasing out /etc/ipsec.d/cacerts/ (action: matt)
  • 5 fips failure should install %hold then fail
  • 3 "ipsec eroute" / ip xfrm xxxx replacement requirements for enduser/admin (action paul/antony)
  • 3 ipsec status "brief" command for enduser/admin (action paul/antony)


  • 1 enter bug - Makefile fixes for lib/ so "make programs" updates it properly
  • 1 enter bug - Makefile fixes for "make programs" when whack.c is updated
  • 1 enter bug - Makefile fixes for not updating man pages when xml files did not change (put all xml in one dir?)
  • 5 kvmplutotest vs containertest
  • 5 KLIPS: what to do? namespace support? what minimal kernel version ? (note OCF) (action: rgb)
  • 5 netkey uses pf_key, herbert wants us to stop that
  • 2 machine parsable propeties for test suite description
  • 4 changing/updating testsuite for new requirements (fuzzing, nfs/9p, convert from beaker?)
  • 5 IKEv1 / IKEv2 cleanup / separation ?
Retrieved from "https://libreswan.org/wiki/index.php?title=Toronto_2014_meetup&oldid=20273"