From patchwork Wed Oct 28 14:46:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Simon Schippers X-Patchwork-Id: 5521 Return-Path: Delivered-To: patchwork@openvpn.net Received: by 2002:a05:7000:78dc:b0:8dc:5c83:a4ec with SMTP id e28csp1714102max; Wed, 28 Oct 2026 08:56:30 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBzdLwALfCMqqI2Dmw6H7K3NxkpZEP3yhDwspadaA8XoFUHX+adhQwkQR8VjwWQRIWKkk/gWQaYh5Cw=@openvpn.net X-Received: by 2002:a05:6870:830b:b0:494:b0db:4e0d with SMTP id 586e51a60fabf-4a8bb815d65mr2030527fac.7.1793202990722; Wed, 28 Oct 2026 08:56:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793202990; cv=none; d=google.com; s=arc-20260327; b=VNcCTwgcfKD0nrk3HMxDaCp1SFRQlqIYOXtRFLTin53h+6WlPrEILneeFTq4CBGFHi CZxtYVIGi4C7023yPorQgi8zZy5SjrPLeSlgRGMz9vuEaYtCuxSuzOVjHnRx5f4CjECT WkboTN9/Z5HRU8GXiT+2LG37MOlS0L66p5IGVLdzaTGmr+eV6oc75WpLIgUFmitc0WRD WuN36lT5WEFH6H21g8PcHPYb/tPp4anOv3oHvGwwqb1U0Ml0GQ52MVWbcQ9Otn1I3fc4 AEyZQH/IAUG1L2B2XSIxqEiJqfYYQp6enNtHlB/2X9Nn6GU7JzXJO/OVreYezrOZvPgD ElMg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=errors-to:content-transfer-encoding:list-subscribe:list-help :list-post:list-archive:list-unsubscribe:list-id:precedence:subject :mime-version:message-id:date:to:from:dkim-signature:dkim-signature :dkim-signature:dkim-signature; bh=kIIfmXCYXK3W4JAhZf5ND1WHxCxqnuAtAWho8gS61Sg=; fh=4NbAC/LsuMLI0S0hprUlLSLCiHwg6SCAifhH718Jh0Q=; b=ATKTyKfRuA3jJLqbd3hO9+gSokveLoKTFCfzhKZeHdhsxXYWq2RfkXHNeSpjHBYCL4 CH/RkgdJq3HK1yygGtG5H6pC+CO/j7o5ermFPUGSDaRGClWYWKejEhKjqB5neT3eUO1K JYBNN3yvehrBX7yJIajnnjUQfE2ZjlhvxL3MYYnvfUOEM1FsgdzNNu4wF2f4WpVYNkn5 Ni0UslMhaK7X6+W2YdQMSieSOak+nbsAqwU5m/OaoAEv2wFoYK8hKJER1Ag0nrptoG7p Yts/v6ag/VcT/gexT62voGwi80FIQbqt7q/JOcoOeoUqZ3a/zwq4iWY6dAoAiN1+kSwd dRQA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=KMKDBnOJ; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=O23qnMng; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=XLY3azZj; dkim=neutral (body hash did not verify) header.i=@tu-dortmund.de header.s=unimail header.b=kBmQuUa4; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=tu-dortmund.de Received: from lists.sourceforge.net (lists.sourceforge.net. [216.105.38.7]) by mx.google.com with ESMTPS id 586e51a60fabf-4a8b79be44asi4250987fac.263.2026.10.28.08.56.30 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 28 Oct 2026 08:56:30 -0700 (PDT) Received-SPF: pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) client-ip=216.105.38.7; Authentication-Results: mx.google.com; dkim=pass header.i=@lists.sourceforge.net header.s=beta header.b=KMKDBnOJ; dkim=neutral (body hash did not verify) header.i=@sourceforge.net header.s=x header.b=O23qnMng; dkim=neutral (body hash did not verify) header.i=@sf.net header.s=x header.b=XLY3azZj; dkim=neutral (body hash did not verify) header.i=@tu-dortmund.de header.s=unimail header.b=kBmQuUa4; spf=pass (google.com: domain of openvpn-devel-bounces@lists.sourceforge.net designates 216.105.38.7 as permitted sender) smtp.mailfrom=openvpn-devel-bounces@lists.sourceforge.net; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=tu-dortmund.de DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.sourceforge.net; s=beta; h=Content-Transfer-Encoding:Content-Type: List-Subscribe:List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id: Subject:MIME-Version:Message-ID:Date:To:From:Sender:Reply-To:Cc:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Unsubscribe-Post:List-Owner; bh=kIIfmXCYXK3W4JAhZf5ND1WHxCxqnuAtAWho8gS61Sg=; b=KMKDBnOJUaMPe8RFptR9heR0Ky jkCEeu1YkjAE+AFp1n3lVrXQcrmFzNWEY/SjmDLekgi8JqiOpbDhXiDj6z0VPZWAtyIWJZ592m12Y gB3+Sg2K2T/BeGbG/dn8EQqjD7WzytG9QUeoWv7B9YwdDG0hQqXeN+pyzd8OHkXNlhBk=; Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.100.1) (envelope-from ) id 1xM60p-000000001Ih-2fJC; Wed, 28 Oct 2026 15:56:27 +0000 Received: from [172.30.29.66] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.100.1) (envelope-from ) id 1xM60n-000000001IY-0fsF for openvpn-devel@lists.sourceforge.net; Wed, 28 Oct 2026 15:56:25 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:Message-ID: Date:Subject:Cc:To:From:Sender:Reply-To:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Q4OPH8KQ+K6pMvRGArFhoDzGpxxpMxosJz+T9/1NiIE=; b=O23qnMngaOnaqiSTIu8G9DZyx3 qjAYxHtwEzSN4BIPVM77MCo9+0lsj71uV4WYBC3BTwPOU39bWeu5IWpD77sqdTO5qHPGaZwYU+hqu qf41bNVxW7fH4temn/Gbbcj3L/2aja8glTEEOPlmS1sgqNSTHQ4M5kjXDqYpwlJDjNxU=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:Message-ID:Date:Subject:Cc:To:From :Sender:Reply-To:Content-Type:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Id:List-Help:List-Unsubscribe:List-Unsubscribe-Post: List-Subscribe:List-Post:List-Owner:List-Archive; bh=Q4OPH8KQ+K6pMvRGArFhoDzGpxxpMxosJz+T9/1NiIE=; b=XLY3azZjOLB1/r+i+rjX5QCzsy RH+b18Txu+ZXGgEPIGNubPi1jFHndwlN3tje8Qp2haV4vIBI1mydzqX6630Yau3WCtP36M31I+XPN OQQF/iotznnXQEpyd9Xy0QTbHcnnFtWMmr3R/Ig42bFgEB0fThtvl3pneeAgVoDVkvog=; Received: from mx1.hrz.uni-dortmund.de ([129.217.128.51] helo=unimail.uni-dortmund.de) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.100.1) id 1xM60j-000000002ju-249T for openvpn-devel@lists.sourceforge.net; Wed, 28 Oct 2026 15:56:23 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tu-dortmund.de; s=unimail; t=1793198805; bh=Q4OPH8KQ+K6pMvRGArFhoDzGpxxpMxosJz+T9/1NiIE=; h=From:To:Cc:Subject:Date; b=kBmQuUa4aqctTqF6b9yBkdHU7kqJpvDgEknjyHcEa8RHA52lojjzismZyUoEPRzX0 WVHk5HJDqX0ca4wwV+4rxFwqGvOvCZ66Ua+Gp4KgTEjiayjUJMZ5YUfYM4Ott7EbZZ RPs14iYM8NFUwIVqQfdxX8F/ze70UWeGXp3UDX4w= Received: from simon-Latitude-5450.. (spider37.kn.e-technik.tu-dortmund.de [129.217.186.37]) (authenticated bits=0) by unimail.uni-dortmund.de (8.19.0.2/8.19.0.2) with ESMTPSA id 69SEkj5P012800 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 28 Oct 2026 15:46:45 +0100 (CET) From: Simon Schippers To: openvpn-devel@lists.sourceforge.net Date: Wed, 28 Oct 2026 15:46:43 +0100 Message-ID: <20261028144643.647448-1-simon.schippers@tu-dortmund.de> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "sfi-spamd-1.hosts.colo.sdot.me", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: When the internal ring of a TUN/TAP device is full, the kernel silently drops packets, bypassing any qdisc. TCP then sees loss, retransmits and shrinks its congestion window. My series "tun/tap & vhost-net: apply qdisc backpressure on full ptr_ring to reduce TX drops" [1] adds IFF_BACKPRESSURE in Linux 7.3 (commit d00c7369ef24 "tun/tap & vhost-net: stop tail-drop when IFF_ [...] Content analysis details: (-0.2 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 RCVD_IN_DNSWL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to DNSWL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#DnsBlocklists-dnsbl-block for more information. [129.217.128.51 listed in list.dnswl.org] -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain 0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3) [129.217.128.51 listed in wl.mailspike.net] 0.0 RCVD_IN_MSPIKE_WL Mailspike good senders X-Headers-End: 1xM60j-000000002ju-249T Subject: [Openvpn-devel] [PATCH] tun: add --tun-backpressure option for Linux X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox X-GMAIL-THRID: 1880309619544230386 X-GMAIL-MSGID: 1880309619544230386 When the internal ring of a TUN/TAP device is full, the kernel silently drops packets, bypassing any qdisc. TCP then sees loss, retransmits and shrinks its congestion window. My series "tun/tap & vhost-net: apply qdisc backpressure on full ptr_ring to reduce TX drops" [1] adds IFF_BACKPRESSURE in Linux 7.3 (commit d00c7369ef24 "tun/tap & vhost-net: stop tail-drop when IFF_BACKPRESSURE is set"). It stops the TX queue instead, so the qdisc holds the packets and applies its AQM and fairness. Our paper [2] evaluated this with OpenVPN: over a 120 ms RTT link between Germany and the USA, TCP throughput without the patch was up to 36% worse, and with it no retransmissions occurred. With higher latencies, throughput without the patch can be even worse. Unfortunately, stopping and waking the queue can reduce throughput with many parallel senders: in a synthetic test with eight iperf3 senders, throughput dropped from 13.5 to 9.13 Gbit/s [3]. The flag is therefore disabled by default and can be enabled with the new --tun-backpressure option. The option is only available when the headers define IFF_BACKPRESSURE, and older kernels ignore the flag. The DCO path uses no TUN device and is unaffected. Tested on Linux 7.3-rc3: with --tun-backpressure, /sys/class/net//tun_flags has IFF_BACKPRESSURE set, without it the flag stays clear. Builds without warnings with and without IFF_BACKPRESSURE in the headers, and make check passes. [1] https://lore.kernel.org/netdev/20260803183641.96882-1-simon.schippers@tu-dortmund.de/T/#u [2] https://cni.etit.tu-dortmund.de/storages/cni-etit/r/Research/Publications/2025/Gebauer_2025_VTCFall/Gebauer_VTCFall2025_AuthorsVersion.pdf [3] https://lore.kernel.org/netdev/akVnoOYQOrt8k-Gu@karahi.librecast.net/ Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Simon Schippers --- doc/man-sections/advanced-options.rst | 7 +++++++ src/openvpn/options.c | 12 ++++++++++++ src/openvpn/tun.c | 7 +++++++ src/openvpn/tun.h | 1 + 4 files changed, 27 insertions(+) diff --git a/doc/man-sections/advanced-options.rst b/doc/man-sections/advanced-options.rst index 32008d58f..c578a5c2c 100644 --- a/doc/man-sections/advanced-options.rst +++ b/doc/man-sections/advanced-options.rst @@ -100,6 +100,13 @@ used when debugging or testing out special usage scenarios. *(Linux only)* Set the TX queue length on the TUN/TAP interface. Currently defaults to operating system default. +--tun-backpressure + *(Linux only)* Set :code:`IFF_BACKPRESSURE` on the TUN/TAP interface. + When OpenVPN falls behind reading from the interface, the kernel then + stops the TX queue instead of dropping packets, so the attached qdisc + can apply its queue management. This can reduce throughput with many + parallel senders. Requires Linux 7.3 or later; older kernels ignore it. + --disable-dco Disables the opportunistic use of data channel offloading if available. Without this option, OpenVPN will opportunistically use DCO mode if diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 8e0c6029e..241f3891c 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -333,6 +333,8 @@ static const char usage_message[] = " via a VRF present on the system.\n" #endif "--txqueuelen n : Set the tun/tap TX queue length to n (Linux only).\n" + "--tun-backpressure : Apply qdisc backpressure instead of dropping packets\n" + " on the tun/tap device (Linux only).\n" "--mlock : Disable Paging -- ensures key material and tunnel\n" " data will never be written to disk.\n" "--up cmd : Run command cmd after successful tun device open.\n" @@ -5129,6 +5131,16 @@ add_option(struct options *options, char *p[], bool is_inline, const char *file, #else msg(msglevel, "--txqueuelen not supported on this OS"); goto err; +#endif + } + else if (streq(p[0], "tun-backpressure") && !p[1]) + { + VERIFY_PERMISSION(OPT_P_GENERAL); +#if defined(TARGET_LINUX) && defined(IFF_BACKPRESSURE) + options->tuntap_options.backpressure = true; +#else + msg(msglevel, "--tun-backpressure not supported on this platform"); + goto err; #endif } else if (streq(p[0], "shaper") && p[1] && !p[2]) diff --git a/src/openvpn/tun.c b/src/openvpn/tun.c index fdd13ae7e..5d6184e55 100644 --- a/src/openvpn/tun.c +++ b/src/openvpn/tun.c @@ -2100,6 +2100,13 @@ open_tun(const char *dev, const char *dev_type, const char *dev_node, struct tun ifr.ifr_flags |= IFF_ONE_QUEUE; #endif +#ifdef IFF_BACKPRESSURE + if (tt->options.backpressure) + { + ifr.ifr_flags |= IFF_BACKPRESSURE; + } +#endif + /* * Figure out if tun or tap device */ diff --git a/src/openvpn/tun.h b/src/openvpn/tun.h index 61fe943b0..bd2107a78 100644 --- a/src/openvpn/tun.h +++ b/src/openvpn/tun.h @@ -150,6 +150,7 @@ struct tuntap_options struct tuntap_options { int txqueuelen; + bool backpressure; }; #else /* if defined(_WIN32) || defined(TARGET_ANDROID) */