Release 2.7.0

Release 2.6.0 discussion has been closed
<https://forum.jogamp.org/Release-2-6-0-td4042889.html>

+++

After the release is before the next release ;-)

Open to discuss the next release here.

Related Gamp & GraphUI discussion best in its own thread
<https://forum.jogamp.org/Next-Steps-for-GraphUI-in-JogAmp-amp-Gamp-I-td4043906.html>

Updated jogl/www page's apps, libs and cleared out old and discontinued
<https://jogamp.org/jogl/www/>

If you have additions and/or corrections/suggestions, please say so.

As of writing, is jogamp.org not responding for anyone else?

yeah, server was under some sort of an attack again :(

I have restarted a few times and just reduced certain https resources for bugzilla,
let's see. Otherwise we were treated kindly last few weeks.

Status update

Source
- Harvey's Applet removal branch locally merged (will be pushed soon)
- Removal of `Security Manager` utilization and its GlueGen wrapper (to be pushed soon)
- One MacOS/AWT fix merged
- Needs more testing

Machines
- Consolidation of 2 test nodes (linux + windows) to one new machine
  - Windows 10 running under kvm/qemu w/ Mesa3D soft (build & test)
    - Simplifies maintenance using qcow2 disk images
  - Native linux x86_64 (builds & test)
  - Linux arm 32 + 64 bit builds
  - Android 64bit builds
  - If working, I may upgrade this node (more cores + ram) to
    move other nodes to it (incl. the FreeBSD virtual machine node).

- Server stability (against DoS, ...)
  - cgit patches
  - various fine tuning kernel/apache/..
  - we may need a more powerful machine due to incr load(?)

I've been running locally with my Applet removal patches, happy to put out a test version for the jaamsim community to get a few more miles on the updated version if that is helpful.

Harvey

For context, my patches were to remove Applet use in NewtCanavsAWT which will fail on Java 26 and later as the Applet classes have been entirely removed, not just deprecated.

Sven Gothel wrote

Machines

- Server stability (against DoS, ...)
  - cgit patches
  - various fine tuning kernel/apache/..
  - we may need a more powerful machine due to incr load(?)

Last week we had a harddisk failure.
Since we use ZFS, nothing was lost, disk has been replaced
and I could resilver it.

I took the chance to cleanup the mem-swap setup
- disabled zfs vdev swap (buggy)
- added native swap partition
See <https://jausoft.com/cgit/jaunotes.git/about/config/misc/linux-boot-uefi_dual-or-single.md>

Further I updated the ZFS backup,
pulling from remote to my local server via
<https://jausoft.com/cgit/openzfs/openzfs_build_env.git/tree/scenarios/backup/zsync-poolFromRemote.sh>.
This has also been done and I will do it regularly again w/ incremental snapshots.

Then I hacked cgit and added a cgit-reaper for reasons described
<https://jausoft.com/cgit/cgit-reaper.git/about/#goals>

Last but not least, I updated our iptables setup
as a final attempt to get rid of the DoS attacks
<https://jausoft.com/cgit/jaunotes.git/tree/config/server/02-firewall/etc/iptables/ip4tables_bad_fwdmz_good-secure#n264>
It features for ipv4 and ipv6
- better syn-flood protection, now limited to 50/s
- same IP http(s) rate-limit to 10 (15) per second
- same ip max-concurrent http(s) connections to 10 (30) per second

So far it shows we got hit a lot by
- syn-flood (wasn't handled properly by kernel)
- http(s) rate-limit

Hope it makes the server more accessible again.
At least I can lower the connection rate per IP
in case this is not enough ...

Cheers

~Sven

EDIT: If interested, I use this script to monitor the filtering results via 'watch -n 2 print-network-stats.sh`
<https://jausoft.com/cgit/jaunotes.git/tree/config/server/xx-attack/scripts/print-network-stats.sh>

hharrison wrote

For context, my patches were to remove Applet use in NewtCanavsAWT which will fail on Java 26 and later as the Applet classes have been entirely removed, not just deprecated.

I have locally merged your work (accepted of course) - thank you.

One Jenkins run was done w/ the new test node setup
and updated jenkins.

Having done some other maintenance work,
I will see to make the new test nodes behave well
and then push the changes.

EDIT: I also started working on
- removal of the security manager
- probing default GL driver and falling back to software

Sven Gothel wrote

It features for ipv4 and ipv6
- better syn-flood protection, now limited to 50/s
- same IP http(s) rate-limit to 10 (15) per second
- same ip max-concurrent http(s) connections to 10 (30) per second

So far it shows we got hit a lot by
- syn-flood (wasn't handled properly by kernel)
- http(s) rate-limit

Hope it makes the server more accessible again.
At least I can lower the connection rate per IP
in case this is not enough ...

I have tightened the limits:

    Per Client IP
        New Connections (syn-flooding)
            5/s http   *drop*
            8/s https  *drop*
            10/s total *drop*
        Concurrent Connections
            5 http
            10 https

Further the following new-connection limits per IP are counted
    2/s total
    6/s total
    10/s total *drop*

See <http://jordan.goethel.localnet/cgit/jaunotes.git/about/config/server/xx-attack/DoS-Mitigation.md>

Quite a few offenders are dropped
- bursting w/ multiple new connections >8
- attempting to maintain more than 10 concurrent connections

Will see how it fares ..

If you experience issues with service, like our maven (https) please say so.