From patchwork Mon Nov 2 16:43:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5556 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:6022:3119:b0:118:2077:975e with SMTP id e25csp5673322laa; Mon, 2 Nov 2026 08:44:21 -0800 (PST) X-Forwarded-Encrypted: i=2; AKwUvBxWutjDLn6Qyo+flMGqXz6+HNQIQuS0dVfbChItLQa6Cem8PIEtM/lYzlb/XTG/y4xEUjH7Ej+ujRA=@openvpn.net X-Received: by 2002:a05:7300:8e:b0:36a:119d:a099 with SMTP id 5a478bee46e88-36a422062f9mr17864516eec.5.1793637860694; Mon, 02 Nov 2026 08:44:20 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1793637860; cv=none; d=google.com; s=arc-20260327; b=boLXJL00oxLzqZDYFgTUoBkq4Ldd9M4DuM77vX56tKNNVVtsyDsgUS2UVJAgy+2neF TvSjQ8U22yH4Bzj1+nCKpgPm03S8rwLHdhJX8J/vxPA5IXHsQrEIhrjActd8t+rNI68U kr2vMryVM3hPG2TqmxPVYnXkRYDAwL0OaJbg+FmsLAnZd1J1ZE7ywcGR33zRKCQ/YmA8 SBzb4dQLfqzztimqdhFDYgLUiK5CqoDfyevV0xnxQS7HePYgcKOMkpNUETCS3TlvULby nzAnSmntKukkH2GSkMm0VHjTtx4rbiwJbUaUXOTSicTvnWvL0tnjonWknIbtEG+wDEyT /yvw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=wrWCMErb07Ah3a6eodUA9EOj2e9RsiEKOj+1s67K2t8=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=g+6FuTac56jm2mKroGjppCDx9q1cjmZX4lBPPNRNgM0Yj11toVx2KurDI2rS+VyM1L JjxNAwJ6uW6Y3ja7XIHrgYuDSMTlewEf1AhHrkp93ip3z7kuTPRt8hiTCiNxJDdo59C0 cZ0Bs1UAYyaT1PCT/5Qy2Szh9gm4MIYuo4khuW3H/3mN8VuRs9/w4MA4CSgbU7C4oAvC HSi3gDezdYARYAXRlpYaisu2xCLb7yIfjcjoTdth2V4kdJxt3oSfFvrrYwVwihaXd5Q/ DD38cIlcTEnVRLnp9Xv3krzcdqad1Rv7VLpKfcLqJbwXZZsfWRsvXsL8S31zBBGKfRk1 L9xA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=TS7trACD; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ZExlec54; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=OMVvfGxc; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=UBdGMbGV; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 5a478bee46e88-36a42a8d28esi31082336eec.15.2026.11.02.08.44.20 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 02 Nov 2026 08:44:20 -0800 (PST) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=TS7trACD; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=ZExlec54; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=OMVvfGxc; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=UBdGMbGV; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Unsubscribe-Post: List-Owner; bh=wrWCMErb07Ah3a6eodUA9EOj2e9RsiEKOj+1s67K2t8=; b=TS7trACDcIvKGS JFVX5VBh5bUCWwffc+3SCqsAZYrTeDL3bJgRzNvAfmaF5eLKOKdAHNLJUJ83Qr4lSUIfWx5wGD2nq iF0tM9csTEcTsqykTpqu6IfaIpuh3Y7/syHBXrfR6e7dmXFC/eJIi+4aOIIBDzWG/Rg+Qy7VxBuiC cbQ=; Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xNv8s-000000000ai-3gy7; Mon, 02 Nov 2026 16:44:18 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xNv8i-000000000Zs-3VRj for openvpn-devel@lists.sourceforge.net; Mon, 02 Nov 2026 16:44:09 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=0ZH6lSFiR2jzEaIKqoSfpd/68ydb0IEIWJnWLxiWFD8=; b=ZExlec54Yoh4Ae2GqgfBSrzX5j 0ixsxhrOWwUVd1QhijxSLyLfmTn5+iqkdzyc7Hg0UfO3BbrGfkgyRA+grfBTxO0YU1qUDn0VeJeh9 gxQsBHLWNKB9I0GKx2HGW+D36WKWw2RLTSUFafE6W68qTn95ky9sOWqsurEi+LvSr0ms=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=0ZH6lSFiR2jzEaIKqoSfpd/68ydb0IEIWJnWLxiWFD8=; b=OMVvfGxcjzSAxW2evc6vl7Allw ed2sBskk9HVLielPrGI8Rb3iDWJyLRiSiEDlKWrGKZ7l4CzKCPGMx9qnJOV7oz0k2g3YonHKgjRa1 T4zJ1UZ/IZ/MPRfF43f62sAklB1pdGyRXzIYfNFRxkYhY6fJhdTZAiBJ6IlrNO/+aS0U=; Received: from mout-b-202.mailbox.org ([195.10.208.62]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xNv8h-000000005hM-2ibq for openvpn-devel@lists.sourceforge.net; Mon, 02 Nov 2026 16:44:08 +0000 Received: from smtp102.mailbox.org (smtp102.mailbox.org [IPv6:2001:67c:2050:b231:465::102]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519MLKEM768 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-202.mailbox.org (Postfix) with ESMTPS id 4jJHbL3px7zKn5v for ; Mon, 02 Nov 2026 17:43:58 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1793637838; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0ZH6lSFiR2jzEaIKqoSfpd/68ydb0IEIWJnWLxiWFD8=; b=UBdGMbGVw4/91a+ZYPENlIAH5/sr3EbE3d6s7VUDSTqJjBXRskXhXRV++ZwAvd9hCFThvD 8bOrCyXgP/hCiYL2dSfnpKFV9scqTeXcw8DGXa5Reips4V+O3FYwBVnrUaJqJy6XEOWit+ p4+pIEarRt1kwa77BMaTWDpFmPpU304hxNzZ6sVI42mTt7mDXxtcISUpcdtiLY3W9+VkpS zFOYpr/vyw6dxHmUgsdYpxpTm7FqQCdTwhkKlA6rVLFXKTjoLiphlo7OVieNw3lBkpmFpH 23Wr0yA2fY7/NeUdTkbzHOk8M1Rjb4IDsBmcGENv9Xf2cX0goUieLb5ImNlJwA== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of ralf@mandelbit.com designates 2001:67c:2050:b231:465::102 as permitted sender) smtp.mailfrom=ralf@mandelbit.com From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Mon, 2 Nov 2026 17:43:44 +0100 Message-ID: <20261102164353.459969-3-ralf@mandelbit.com> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261102164353.459969-1-ralf@mandelbit.com> References: <20261102164353.459969-1-ralf@mandelbit.com> MIME-Version: 1.0 X-Rspamd-Queue-Id: 4jJHbL3px7zKn5v X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Forwarded TCP traffic can be coalesced into SKB_GSO_FRAGLIST when the receiving host has no local TCP socket for the flow. Although ovpn segments every GSO input itself, it does not advertise NETIF_F_ [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain X-Headers-End: 1xNv8h-000000005hM-2ibq Subject: [Openvpn-devel] [PATCH ovpn net-next v2 2/9] ovpn: accept frag-list GSO input X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880765613075278882 X-GMAIL-MSGID: 1880765613075278882 Forwarded TCP traffic can be coalesced into SKB_GSO_FRAGLIST when the receiving host has no local TCP socket for the flow. Although ovpn segments every GSO input itself, it does not advertise NETIF_F_FRAGLIST, so generic transmit validation segments these aggregates before calling ovpn_net_xmit. That segmentation is functionally correct, but causes ovpn_net_xmit to be invoked separately for every resulting packet. Advertise frag-list storage so ovpn receives the aggregate intact and performs protocol validation and destination-to-peer lookup once before segmenting it. Frag-list GSO segmentation recovers the complete child skbs, which can then be encrypted in place and transmitted independently. Rebuilding those children into a replacement UDP GSO aggregate was found to add cost rather than improve throughput. The feature also admits non-GSO frag lists, which describe one packet split across several skbs. Let skb_cow_data preserve small lists directly. If a list exceeds the AEAD scatterlist limit, linearize it and continue rather than rejecting an otherwise valid packet. Signed-off-by: Ralf Lici --- No changes since v1 https://lore.kernel.org/openvpn-devel/5baa1d94e29e7b109ffd412b4f1d5d113a319389.1790843153.git.ralf@mandelbit.com/ drivers/net/ovpn/crypto_aead.c | 8 ++++++-- drivers/net/ovpn/main.c | 3 ++- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/net/ovpn/crypto_aead.c b/drivers/net/ovpn/crypto_aead.c index 74eaf6fac2f5..2af493fd5735 100644 --- a/drivers/net/ovpn/crypto_aead.c +++ b/drivers/net/ovpn/crypto_aead.c @@ -168,8 +168,12 @@ int ovpn_aead_encrypt(struct ovpn_peer *peer, struct ovpn_crypto_key_slot *ks, if (unlikely(nfrags < 0)) return nfrags; - if (unlikely(nfrags + 2 > (MAX_SKB_FRAGS + 2))) - return -ENOSPC; + if (unlikely(nfrags > MAX_SKB_FRAGS)) { + ret = skb_linearize(skb); + if (unlikely(ret)) + return ret; + nfrags = 1; + } /* allocate temporary memory for iv, sg and req */ tmp = kmalloc(ovpn_aead_crypto_tmp_size(ks->encrypt, nfrags), diff --git a/drivers/net/ovpn/main.c b/drivers/net/ovpn/main.c index 28e1eb06e127..ac4e0d85e215 100644 --- a/drivers/net/ovpn/main.c +++ b/drivers/net/ovpn/main.c @@ -158,7 +158,8 @@ static const struct ethtool_ops ovpn_ethtool_ops = { static void ovpn_setup(struct net_device *dev) { netdev_features_t feat = NETIF_F_HW_CSUM | NETIF_F_SG | NETIF_F_GSO | - NETIF_F_GSO_SOFTWARE | NETIF_F_HIGHDMA; + NETIF_F_GSO_SOFTWARE | NETIF_F_FRAGLIST | + NETIF_F_HIGHDMA; dev->needs_free_netdev = true;