diff mbox series

[Openvpn-devel,v2] dco: stop fetching peer stats during client disconnect

Message ID 20260926200956.24545-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v2] dco: stop fetching peer stats during client disconnect |

Commit Message

Gert Doering Sept. 26, 2026, 8:09 p.m. UTC 
  From: Ralf Lici <ralf@mandelbit.com>

The disconnect path asks DCO for a fresh peer dump after the multi
instance has already been removed from the peer-id lookup table. For
kernel-initiated disconnects, the peer has also already been deleted by
the time its notification is processed. The reply therefore cannot
update the disconnecting instance.

Moreover, each disconnect dumps all surviving peers, causing avoidable
netlink traffic and repeated work when many clients disconnect at once.

During shutdown or restart, fetch a single final peer snapshot before
closing any instances, while all peers can still be mapped to their
userspace contexts.

For individual disconnects, use the cached counters directly. Kernels
that provide a final statistics snapshot in the deletion notification
can update them before the disconnect environment is prepared.

Change-Id: Ic535bb1f0da1739f87e9d6bef6fd1061247b05de
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Acked-by: Antonio Quartulli <antonio@mandelbit.com>
Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1952
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1952
This mail reflects revision 2 of this Change.

Acked-by according to Gerrit (reflected above):
Antonio Quartulli <antonio@mandelbit.com>
Razvan Cojocaru <razvanc@mailbox.org>
diff mbox series

Patch

diff --git a/dev-tools/cppcheck-suppression b/dev-tools/cppcheck-suppression
index 299d7a3..38ca062 100644
--- a/dev-tools/cppcheck-suppression
+++ b/dev-tools/cppcheck-suppression
@@ -26,7 +26,7 @@ 
 # FP: posix.cfg claims suseconds_t is unsigned for some reason
 unsignedLessThanZero:src/openvpn/otime.h:148
 # IGN: multi code does weird things with pointers to local variables...
-autoVariables:src/openvpn/multi.c:4242
+autoVariables:src/openvpn/multi.c:4240
 autoVariables:src/openvpn/multi_io.c:324
 # IGN: the code header = 0 | (OPCODE << P_OPCODE_SHIFT) is used intentionally
 badBitmaskCheck:src/openvpn/mudp.c
diff --git a/src/openvpn/multi.c b/src/openvpn/multi.c
index 3e72b92..b7085dc 100644
--- a/src/openvpn/multi.c
+++ b/src/openvpn/multi.c
@@ -496,37 +496,29 @@ 
 }
 
 static void
-setenv_stats(struct multi_context *m, struct context *c)
+setenv_stats(struct context *c)
 {
-    if (dco_enabled(&m->top.options))
-    {
-        if (dco_get_peer_stats_multi(&m->top.c1.tuntap->dco, false) < 0)
-        {
-            return;
-        }
-    }
-
     setenv_counter(c->c2.es, "bytes_received", c->c2.link_read_bytes + c->c2.dco_read_bytes);
     setenv_counter(c->c2.es, "bytes_sent", c->c2.link_write_bytes + c->c2.dco_write_bytes);
 }
 
 static void
-multi_client_disconnect_setenv(struct multi_context *m, struct multi_instance *mi)
+multi_client_disconnect_setenv(struct multi_instance *mi)
 {
     /* setenv client real IP address */
     setenv_trusted(mi->context.c2.es, get_link_socket_info(&mi->context));
 
     /* setenv stats */
-    setenv_stats(m, &mi->context);
+    setenv_stats(&mi->context);
 
     /* setenv connection duration */
     setenv_long_long(mi->context.c2.es, "time_duration", now - mi->created);
 }
 
 static void
-multi_client_disconnect_script(struct multi_context *m, struct multi_instance *mi)
+multi_client_disconnect_script(struct multi_instance *mi)
 {
-    multi_client_disconnect_setenv(m, mi);
+    multi_client_disconnect_setenv(mi);
 
     if (plugin_defined(mi->context.plugins, OPENVPN_PLUGIN_CLIENT_DISCONNECT))
     {
@@ -634,7 +626,7 @@ 
 
     if (mi->context.c2.tls_multi->multi_state >= CAS_CONNECT_DONE)
     {
-        multi_client_disconnect_script(m, mi);
+        multi_client_disconnect_script(mi);
     }
 
     close_context(&mi->context, SIGTERM, CC_GC_FREE);
@@ -659,6 +651,12 @@ 
 {
     if (m->hash)
     {
+        /* fetch final stats while all peers can still be mapped to their instances */
+        if (dco_enabled(&m->top.options))
+        {
+            dco_get_peer_stats_multi(&m->top.c1.tuntap->dco, false);
+        }
+
         for (uint32_t i = 0; i <= m->max_peerid; i++)
         {
             struct multi_instance *mi = m->instances[i];
@@ -2750,7 +2748,7 @@ 
          * did not fail */
         if (mi->context.c2.tls_multi->multi_state == CAS_PENDING_DEFERRED_PARTIAL)
         {
-            multi_client_disconnect_script(m, mi);
+            multi_client_disconnect_script(mi);
         }
 
         mi->context.c2.tls_multi->multi_state = CAS_FAILED;