From patchwork Thu Aug 6 07:16:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marco Baffo X-Patchwork-Id: 5203 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:77c3:b0:87d:ab56:3700 with SMTP id r3csp7321490mau; Thu, 6 Aug 2026 00:17:12 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+Rrp3rJN/YB7rIrByePbbvaNNaFZnw9acfUJc8PgjQ1WYyzmBE1WX8zQ9TYoBDSOwlCmLUdQM+i8ov0=@openvpn.net X-Received: by 2002:a05:6820:4deb:b0:6aa:d599:7b18 with SMTP id 006d021491bc7-6ae96ec8cbfmr6273361eaf.21.1786000632074; Thu, 06 Aug 2026 00:17:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1786000632; cv=none; d=google.com; s=arc-20260327; b=YSPLxUyCONu7KtH5J5w8iLqP1TgfEkteYuKOeON/vcjf1P3Z/ftSGD5SCmw09qgfDn mhAdYFl7BXQbMgWR20uj+DcpWQnfl+MARG7qd8ZiT9j7EWuDPpj+1crITl13iVtbalps 5ioQ9u5RM9hRtm/WZ6dHCgZE29NPbSZqzw4+pTeNEpISRSvTjxgcVVBrW37G7SDGqzxi KeAWA+m7GORRgRa5jSgzvD/vuRmuZB81XUh4M6Y3uh9MZHx50oxNqlz4YSeUPefN5PkR 40omIIEdOd7DEDFw/t7wb8tlHXL7OzPzLrAx8dZS02sfuCXv0/R7HKo6lxKeDw0ClwBY 7H4Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:cc:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:message-id:date:to:from:dkim-signature:dkim-signature :dkim-signature:dkim-signature; bh=wAvfv2k+pDjgtcayINU24oMhSFKPqycmqfAYTBzK7dM=; fh=BsMg/B0Yb/hS/rzP5Npz4luh0IleZm8REk1XWiWRt2A=; b=CXYnmVKk0hvHuEmykamUTT7jfG4LeTK8XG1KzszYCJvuuvcwPbym9igZy6vF3QZX8N jgSEa21suHma5++M75qKhOplJ3cQFUMS1NRpU++KoPjggohhhI0TFobKZsnRn8eVZ6p6 GO1XPZkq7HhEnSZtlyOA/vm9pBeY/0dtyufnTI9aN/nYCrXojRD7oFA/B5wC22a+Vkel 6kL1nr93FAyW2zHMEmptXuyxy29Ydt6fnm/Q238QiZcfeaiQZ1DVwHv3WWSTQqZGG+O0 lvD2fNGKwFyz8WzrAXY5VmtNPoEvxRhM1DONaFqVyz+lDijvyI35fHd2dLEhzFKJDlK2 Q00w==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=SbbkXWtZ; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="B/+rGqJs"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=MpZ8co0E; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=VjjzyTz9; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 006d021491bc7-6ae94152526si5430852eaf.86.2026.08.06.00.17.11 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 06 Aug 2026 00:17:11 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=SbbkXWtZ; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b="B/+rGqJs"; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=MpZ8co0E; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=VjjzyTz9; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type:Cc: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:Message-ID:Date:To:From:Sender:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Owner; bh=wAvfv2k+pDjgtcayINU24oMhSFKPqycmqfAYTBzK7dM=; b=SbbkXWtZNLBUqEhb7XH5GXi1ZK 5A8KAd+IMtBc5EE3Lo3WZKDPqlTOit74+hzaNE+PCNkEknZbdiCLoQPJ6gkUVutRmktPyp2CM1ttj KAO3qicg52l5IzrYL/Q17QsG/tXkJXDaamNIr85H7wB6mnmtgaLrF0psPOMGBBVbiaek=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1wrsLd-0006UQ-E1; Thu, 06 Aug 2026 07:17:01 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1wrsLX-0006U8-I7 for openvpn-devel@lists.sourceforge.net; Thu, 06 Aug 2026 07:16:56 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=iENtAfb+ZLWYu4JSNz340TsPQdckajM2DDWvfp+ojaA=; b=B/+rGqJsPzrAoNVnnrcMmUGyrQ YCz992fEnPqoDuIzJQjJNY52y+nVQJF9dAO9Dgrb3CbG4m2FZVnRag48CYyXDZwcmBSV/xey/IFTc 2nFEBxgKhuEV2rjecGH19CXSt4NAkUaAWB7M8X6fMfIRLYpo9Y1aGi9UqLwXIFa4QBag=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:Message-ID:Date:Subject:Cc:To:From :Sender:Reply-To:Content-Type:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post: List-Owner:List-Archive; bh=iENtAfb+ZLWYu4JSNz340TsPQdckajM2DDWvfp+ojaA=; b=M pZ8co0Ef7r9pljAWp5cMKFj5nawpTLr48577azlnFtrkWmIXpX5+aBPUUOG7RhiFFbfJn3oohw4rf pJ12R2lXJ9eTMu75icWrEdx4kA+iFi8jjEUqGkjVBNfHUrTuMeti/cPnlvJh8SFDUUTbfvX1mPfqi JFuX7x47VeSPELc0=; Received: from [195.10.208.47] (helo=mout-b-107.mailbox.org) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1wrsLY-00016A-PM for openvpn-devel@lists.sourceforge.net; Thu, 06 Aug 2026 07:16:55 +0000 Received: from smtp202.mailbox.org (smtp202.mailbox.org [IPv6:2001:67c:2050:b231:465::202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-107.mailbox.org (Postfix) with ESMTPS id 4hFz9T46TDz3y4H; Thu, 06 Aug 2026 09:16:45 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1786000605; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=iENtAfb+ZLWYu4JSNz340TsPQdckajM2DDWvfp+ojaA=; b=VjjzyTz9Wb78ezCmckiVIVU0Jlb5CQv7t0GEcjT/pTOGfbh7fEhsBX/wwEM/Mwy2/dl8KG gAZRGKlIyFroSIuwhyqkmBaCKrX5m9WplJHULqabUkPjqd7wrrzMBTWNvKTuxDG65w8LeS UDG3tGQD3KzIGnib3SaAK+FoMcyHM5JJERsz95xtFjzEu1SfYkeUs9cTTdbUTmPoMmIspi eGShNMctG12i28pWWFd+wEoM6MP2Uns8ROGIE+SVtjXgkatxr52+O3GoPy7vekaGfZgTWD uooX3gx0OLv4ZPKzOlC/UwA+kDjOrQh5O7H0mFI65LNZYGAXs05sXbYuOU6+zA== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of marco@mandelbit.com designates 2001:67c:2050:b231:465::202 as permitted sender) smtp.mailfrom=marco@mandelbit.com From: Marco Baffo To: openvpn-devel@lists.sourceforge.net Date: Thu, 6 Aug 2026 09:16:36 +0200 Message-ID: <20260806071636.621632-1-marco@mandelbit.com> MIME-Version: 1.0 X-Rspamd-Queue-Id: 4hFz9T46TDz3y4H X-Spam-Score: 1.1 (+) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Userspace now enables TCP_NODELAY by default. Enable it for ovpn-cli's TCP sockets too. The TCP peer ID capture assumes that every TCP segment starts with an ovpn length prefix followed by a data header. TCP does not preserve record boundaries, and enabling TCP_NODELAY makes this check u [...] Content analysis details: (1.1 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS X-Headers-End: 1wrsLY-00016A-PM Subject: [Openvpn-devel] [PATCH ovpn net-next] selftests: ovpn: enable TCP_NODELAY on TCP sockets X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Antonio Quartulli Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1872757398987757603 X-GMAIL-MSGID: 1872757398987757603 Userspace now enables TCP_NODELAY by default. Enable it for ovpn-cli's TCP sockets too. The TCP peer ID capture assumes that every TCP segment starts with an ovpn length prefix followed by a data header. TCP does not preserve record boundaries, and enabling TCP_NODELAY makes this check unreliable. Restrict the capture-based peer ID check to UDP. Signed-off-by: Marco Baffo --- tools/testing/selftests/net/ovpn/common.sh | 20 +++----- tools/testing/selftests/net/ovpn/ovpn-cli.c | 22 +++++++++ tools/testing/selftests/net/ovpn/test.sh | 54 ++++++++++----------- 3 files changed, 56 insertions(+), 40 deletions(-) diff --git a/tools/testing/selftests/net/ovpn/common.sh b/tools/testing/selftests/net/ovpn/common.sh index 2d844eb3aa6e..de96d333ee2b 100644 --- a/tools/testing/selftests/net/ovpn/common.sh +++ b/tools/testing/selftests/net/ovpn/common.sh @@ -178,20 +178,14 @@ ovpn_setup_ns() { ovpn_build_capture_filter() { # match the first four bytes of the openvpn data payload - if [ "${OVPN_PROTO}" == "UDP" ]; then - # For UDP, libpcap transport indexing only works for IPv4, so - # use an explicit IPv4 or IPv6 expression based on the peer - # address. The IPv6 branch assumes there are no extension - # headers in the outer packet. - if [[ "${2}" == *:* ]]; then - printf "ip6 and ip6[6] = 17 and ip6[48:4] = %s" "${1}" - else - printf "ip and udp[8:4] = %s" "${1}" - fi + # For UDP, libpcap transport indexing only works for IPv4, so + # use an explicit IPv4 or IPv6 expression based on the peer + # address. The IPv6 branch assumes there are no extension + # headers in the outer packet. + if [[ "${2}" == *:* ]]; then + printf "ip6 and ip6[6] = 17 and ip6[48:4] = %s" "${1}" else - # openvpn over TCP prepends a 2-byte packet length ahead of the - # DATA_V2 opcode, so skip it before matching the payload header - printf "ip and tcp[(((tcp[12] & 0xf0) >> 2) + 2):4] = %s" "${1}" + printf "ip and udp[8:4] = %s" "${1}" fi } diff --git a/tools/testing/selftests/net/ovpn/ovpn-cli.c b/tools/testing/selftests/net/ovpn/ovpn-cli.c index f4effa7580c0..6b458a654a33 100644 --- a/tools/testing/selftests/net/ovpn/ovpn-cli.c +++ b/tools/testing/selftests/net/ovpn/ovpn-cli.c @@ -470,6 +470,18 @@ static int ovpn_parse_key_direction(const char *dir, struct ovpn_ctx *ctx) return 0; } +static int ovpn_tcp_nodelay(int socket) +{ + int opt = 1; + int ret; + + ret = setsockopt(socket, IPPROTO_TCP, TCP_NODELAY, &opt, sizeof(opt)); + if (ret < 0) + perror("setsockopt for TCP_NODELAY"); + + return ret; +} + static int ovpn_socket(struct ovpn_ctx *ctx, sa_family_t family, int proto) { struct sockaddr_storage local_sock = { 0 }; @@ -606,6 +618,12 @@ static int ovpn_accept(struct ovpn_ctx *ctx) goto err; } + if (ovpn_tcp_nodelay(ret) < 0) { + close(ret); + ret = -1; + goto err; + } + return ret; err: close(ctx->socket); @@ -623,6 +641,10 @@ static int ovpn_connect(struct ovpn_ctx *ovpn) return -1; } + ret = ovpn_tcp_nodelay(s); + if (ret < 0) + goto err; + switch (ovpn->remote.in4.sin_family) { case AF_INET: socklen = sizeof(struct sockaddr_in); diff --git a/tools/testing/selftests/net/ovpn/test.sh b/tools/testing/selftests/net/ovpn/test.sh index 9b5610837032..d744c1a97d5f 100755 --- a/tools/testing/selftests/net/ovpn/test.sh +++ b/tools/testing/selftests/net/ovpn/test.sh @@ -67,35 +67,33 @@ ovpn_run_basic_traffic() { local tcpdump_timeout="1.5s" for p in $(seq 1 ${OVPN_NUM_PEERS}); do - # The first part of the data packet header consists of: - # - TCP only: 2 bytes for the packet length - # - 5 bits for opcode ("9" for DATA_V2) - # - 3 bits for key-id ("0" at this point) - # - 12 bytes for peer-id: - # - with asymmetric ID: "${p}" one way and "${p} + 9" the - # other way - # - with symmetric ID: "${p}" both ways - header1=$(printf "0x4800000%x" ${p}) - header2=$(printf "0x4800000%x" $((p + OVPN_ID_OFFSET))) - raddr="" if [ "${OVPN_PROTO}" == "UDP" ]; then + # The first part of the data packet header consists of: + # - 5 bits for opcode ("9" for DATA_V2) + # - 3 bits for key-id ("0" at this point) + # - 3 bytes for peer-id: + # - with asymmetric ID: "${p}" one way and "${p} + 9" the + # other way + # - with symmetric ID: "${p}" both ways + header1=$(printf "0x4800000%x" ${p}) + header2=$(printf "0x4800000%x" $((p + OVPN_ID_OFFSET))) raddr=$(awk "NR == ${p} {print \$3}" \ "${OVPN_UDP_PEERS_FILE}") + peer_ns="ovpn_peer${p}" + + timeout ${tcpdump_timeout} ip netns exec "${peer_ns}" \ + tcpdump --immediate-mode -p -ni veth${p} -c 1 \ + "$(ovpn_build_capture_filter "${header1}" "${raddr}")" \ + >/dev/null 2>&1 & + tcpdump_pid1=$! + timeout ${tcpdump_timeout} ip netns exec "${peer_ns}" \ + tcpdump --immediate-mode -p -ni veth${p} -c 1 \ + "$(ovpn_build_capture_filter "${header2}" "${raddr}")" \ + >/dev/null 2>&1 & + tcpdump_pid2=$! + + sleep 0.3 fi - peer_ns="ovpn_peer${p}" - - timeout ${tcpdump_timeout} ip netns exec "${peer_ns}" \ - tcpdump --immediate-mode -p -ni veth${p} -c 1 \ - "$(ovpn_build_capture_filter "${header1}" "${raddr}")" \ - >/dev/null 2>&1 & - tcpdump_pid1=$! - timeout ${tcpdump_timeout} ip netns exec "${peer_ns}" \ - tcpdump --immediate-mode -p -ni veth${p} -c 1 \ - "$(ovpn_build_capture_filter "${header2}" "${raddr}")" \ - >/dev/null 2>&1 & - tcpdump_pid2=$! - - sleep 0.3 ovpn_cmd_ok "send baseline traffic to peer ${p}" \ ip netns exec ovpn_peer0 \ ping -qfc 100 -w 3 5.5.5.$((p + 1)) @@ -103,8 +101,10 @@ ovpn_run_basic_traffic() { ip netns exec ovpn_peer0 \ ping -qfc 100 -s 3000 -w 3 5.5.5.$((p + 1)) - wait "${tcpdump_pid1}" || return 1 - wait "${tcpdump_pid2}" || return 1 + if [ "${OVPN_PROTO}" == "UDP" ]; then + wait "${tcpdump_pid1}" || return 1 + wait "${tcpdump_pid2}" || return 1 + fi done }