From patchwork Wed Sep 16 08:35:11 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ralf Lici X-Patchwork-Id: 5363 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:6446:b0:8a0:ea1f:253a with SMTP id n6csp5930389mag; Wed, 16 Sep 2026 01:36:12 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBwCq3CWVwMVmokarGbT4TThhD6XL8WoHt8BBTkWguW/XdskNIjZMi6Z3kgCOTy/TD81kNyi++BXVRQ=@openvpn.net X-Received: by 2002:a05:6871:2b2a:b0:475:a153:2dcb with SMTP id 586e51a60fabf-48478060dc9mr1191773fac.33.1789547772625; Wed, 16 Sep 2026 01:36:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1789547772; cv=none; d=google.com; s=arc-20260327; b=ZkjX9j7bc5oyONGSDECV2B5Mf5pA5Aar2vG4NE7m+iBCGt9d45m9Onm0zdQUJwTFQ+ TMJgyHErjcCjJhdY9TAI8/6gHgo411HjQMfzp0Rd2lf5mwyvVY7Oe1LCT9x6t4gHgqjR nTkPn/yXSqRTqbbFCvmENJwVnUtK2EG9aARCo+gOcvNk2DoFbrRLpQKkrlhuvjhSNfUj ikx+FObDSp3L5N+W3O7CY/HtPXSB9hgdIy44TVc5Bu2tj37baq9snXm/9EQEdUp34Rai tLfwu+uKDghAwjCtvByipRTjRmVlfzqHIcxH3q0cQvAhwUz5m6LkAGpdqH2pjYCUaDki qScw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:references:in-reply-to:message-id:date:to:from :dkim-signature:dkim-signature:dkim-signature:dkim-signature; bh=iNaR5O1n2IhtDuUcLh3rSvj3kLbfBdlV/vXw1DShTYc=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=Vn9rIIQTAQCXH2pwITwmKYL7PTk+wQZ72e+ANas7J1ESuAweqRb5C52Oas9fLJ2LIH qjcFt6O9IuHSmfDsSuV/3liNz4TJH+UyTz/FvizeHCzTHLoWkhtlqMvpLIJkFxvTbvSf BcpKorKZJbqjYwCVGFHtgiiNJst5U/GThOa5pe3C2GRfF8WeY523FEbhWoY4YtdJRH6/ W4N+y4wNMb3W+/7ckxPLTvwa6KN98ySLkRHZ3pcaudQ/sFpjX534fTDMNkP3ocBuJh24 7cqGlsV1+qfXkbuI5Qfh8K66bQm7JFCjyHmwcgYO0IV3QEjFVVO1nrrN90vMwmS64p2O Kjkg==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="inve/kHG"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=RuqRmo98; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=I5PLNdZ0; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=Cz1tPqhK; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-48429cd0981si2313846fac.70.2026.09.16.01.36.12 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 16 Sep 2026 01:36:12 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b="inve/kHG"; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=RuqRmo98; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=I5PLNdZ0; dkim=neutral (body hash did not verify) header.i=@mandelbit.com header.s=MBO0001 header.b=Cz1tPqhK; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:References:In-Reply-To:Message-ID:Date:To:From:Sender: Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=iNaR5O1n2IhtDuUcLh3rSvj3kLbfBdlV/vXw1DShTYc=; b=inve/kHGtK/crmymfkSNTGc453 vLJdm2TMpvJOVTU2f3S026/A83O7MGI0hr0+UaZByitQqN9OBW+9fxWf5SPswoIM1waHp7SckQlQr xOG5GWX/BSCqGAvCwhSWITeyL+Ut8HoMu/kShH9ExSKlJ0pXfyVz17X+k5gXl71NfWk4=; Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.95) (envelope-from ) id 1x6l7k-0004jN-GQ; Wed, 16 Sep 2026 08:36:10 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from ) id 1x6l7H-0004a8-Gw for openvpn-devel@lists.sourceforge.net; Wed, 16 Sep 2026 08:35:41 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=/EAaRb2p1+Wq/jWP26wAYJvUx90Q98xdAczu55sYetk=; b=RuqRmo983AsSFVLxqLpMfnjogm H7KqWcTcfayVgTgPXOL46Guakd81X2OdHPo7lm97tsct5X9BFZa2mgdUJVdK0tUHZEOJacvC2eOXk wG5yL7EzWJQeVLe2ffiBGGLq0/CyLX4S3yAu3jlbs3nqrvvcbY230GYgkW4MB8v34QA8=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-ID: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=/EAaRb2p1+Wq/jWP26wAYJvUx90Q98xdAczu55sYetk=; b=I5PLNdZ0pYxwumK5FhXbZPJCGj orQKjQjhIKj800CuOTwzZwtv41VBA/STu8/ErA4402jkmEE3HELIekqcvLGelPDPqaBP8G06YGd9E LOZHddaPWbEbl3nbd1wJmNCu1a2V7zFSEeU/S2m1OAmT7y0Hjmcqnchg34hBr0PNAEPM=; Received: from mout-b-106.mailbox.org ([195.10.208.46]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.95) id 1x6l7C-00053E-2D for openvpn-devel@lists.sourceforge.net; Wed, 16 Sep 2026 08:35:40 +0000 Received: from smtp2.mailbox.org (smtp2.mailbox.org [IPv6:2001:67c:2050:b231:465::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-b-106.mailbox.org (Postfix) with ESMTPS id 4hlBzQ1djhzNlt8 for ; Wed, 16 Sep 2026 10:35:30 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mandelbit.com; s=MBO0001; t=1789547730; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/EAaRb2p1+Wq/jWP26wAYJvUx90Q98xdAczu55sYetk=; b=Cz1tPqhKwNis+faAg0+qsHVcqN4bo345xW98NUTzlABJ789PoVY0iX9RUyxDIvcItpWxCo QFRckzLBAXblMt/+ztLd/1EDNY6c3/mTNWTFp5LzVaDHn7gBCxJ7xpnRKRi9rKpmnmL9e3 UchlkmWQrMszmQElPE6GQ9B1K1ZZZPJCoEnqre8gj2qyOFQnQf5bTWePqcMPg4DAdh0mXq U+HPoZyeiy5zOcYy3zuP/8xUE1Rlh9OLvFI6XECGw4iA9TFHXOOA4vGxM8wRPrFjbb2SbY A9MCLcMFiauNYAQR5Sk6g2Y0N2Q08JaT6d0R7Sc+yVlsA4wgKIVnHVDhXB/KCQ== Authentication-Results: outgoing_mbo_mout; dkim=none; spf=pass (outgoing_mbo_mout: domain of ralf@mandelbit.com designates 2001:67c:2050:b231:465::2 as permitted sender) smtp.mailfrom=ralf@mandelbit.com From: Ralf Lici To: openvpn-devel@lists.sourceforge.net Date: Wed, 16 Sep 2026 10:35:11 +0200 Message-ID: <5baa1d94e29e7b109ffd412b4f1d5d113a319389.1789546917.git.ralf@mandelbit.com> In-Reply-To: References: MIME-Version: 1.0 X-Rspamd-Queue-Id: 4hlBzQ1djhzNlt8 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-2.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: Forwarded TCP traffic can be coalesced into SKB_GSO_FRAGLIST when the receiving host has no local TCP socket for the flow. Although ovpn segments every GSO input itself, it does not advertise NETIF_F_ [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain X-Headers-End: 1x6l7C-00053E-2D Subject: [Openvpn-devel] [RFC ovpn net-next v3 2/9] ovpn: accept frag-list GSO input X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1876476845528160971 X-GMAIL-MSGID: 1876476845528160971 Forwarded TCP traffic can be coalesced into SKB_GSO_FRAGLIST when the receiving host has no local TCP socket for the flow. Although ovpn segments every GSO input itself, it does not advertise NETIF_F_FRAGLIST, so generic transmit validation segments these aggregates before calling ovpn_net_xmit. That segmentation is functionally correct, but causes ovpn_net_xmit to be invoked separately for every resulting packet. Advertise frag-list storage so ovpn receives the aggregate intact and performs protocol validation and destination-to-peer lookup once before segmenting it. Frag-list GSO segmentation recovers the complete child skbs, which can then be encrypted in place and transmitted independently. Rebuilding those children into a replacement UDP GSO aggregate was found to add cost rather than improve throughput. The feature also admits non-GSO frag lists, which describe one packet split across several skbs. Let skb_cow_data preserve small lists directly. If a list exceeds the AEAD scatterlist limit, linearize it and continue rather than rejecting an otherwise valid packet. Signed-off-by: Ralf Lici --- No changes since v2 https://lore.kernel.org/openvpn-devel/5baa1d94e29e7b109ffd412b4f1d5d113a319389.1789540779.git.ralf@mandelbit.com/ No changes since v1 https://lore.kernel.org/openvpn-devel/5baa1d94e29e7b109ffd412b4f1d5d113a319389.1789485693.git.ralf@mandelbit.com/ drivers/net/ovpn/crypto_aead.c | 8 ++++++-- drivers/net/ovpn/main.c | 3 ++- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/net/ovpn/crypto_aead.c b/drivers/net/ovpn/crypto_aead.c index 74eaf6fac2f5..2af493fd5735 100644 --- a/drivers/net/ovpn/crypto_aead.c +++ b/drivers/net/ovpn/crypto_aead.c @@ -168,8 +168,12 @@ int ovpn_aead_encrypt(struct ovpn_peer *peer, struct ovpn_crypto_key_slot *ks, if (unlikely(nfrags < 0)) return nfrags; - if (unlikely(nfrags + 2 > (MAX_SKB_FRAGS + 2))) - return -ENOSPC; + if (unlikely(nfrags > MAX_SKB_FRAGS)) { + ret = skb_linearize(skb); + if (unlikely(ret)) + return ret; + nfrags = 1; + } /* allocate temporary memory for iv, sg and req */ tmp = kmalloc(ovpn_aead_crypto_tmp_size(ks->encrypt, nfrags), diff --git a/drivers/net/ovpn/main.c b/drivers/net/ovpn/main.c index 28e1eb06e127..ac4e0d85e215 100644 --- a/drivers/net/ovpn/main.c +++ b/drivers/net/ovpn/main.c @@ -158,7 +158,8 @@ static const struct ethtool_ops ovpn_ethtool_ops = { static void ovpn_setup(struct net_device *dev) { netdev_features_t feat = NETIF_F_HW_CSUM | NETIF_F_SG | NETIF_F_GSO | - NETIF_F_GSO_SOFTWARE | NETIF_F_HIGHDMA; + NETIF_F_GSO_SOFTWARE | NETIF_F_FRAGLIST | + NETIF_F_HIGHDMA; dev->needs_free_netdev = true;