Re: OpenVPN 2.x with kernel acceleration

[David Sommerseth]

On 03/02/2022 05:52, Demi Marie Obenour wrote:
>  On 2/2/22 13:34, David Sommerseth wrote:
> >
> > Hi,
> >
> > An OpenVPN colleague of me, Antonio Quartulli (on Cc), has been working
> > on a kernel acceleration module for OpenVPN for quite some time.  We
> > call this OpenVPN Data Channel Offload (DCO).  This moves the tunnelled
> > network traffic to a new kernel module (ovpn-dco) and keep only the
> > control channel (authentication, VPN IP configuration, etc) in
> > user-space.  This is gives a noticeable improved performance.
>
>  Do you plan to submit this kernel module to upstream Linux?  Fedora
>  does not ship out-of-tree kernel modules last I checked. 
Yes, we do plan for that.  But before we're ready to do so, we'd like to
see more broader testing of this module.  This comes in addition to have
OpenVPN packages available with DCO support.

We use Fedora Copr for the time being to make the availability of both
kmod-ovpn-dco and OpenVPN builds with DCO support more
 easily available
for more testers.

These builds and repository is currently fully supported by the OpenVPN
community, with the standard clause that this is development builds
which may contain bugs and not necessarily be as stable as ordinary
releases.


Going forward ...

We plan to release OpenVPN 2.6 later this year, which will be DCO
capable.  This will be available in the existing Fedora repositories, as
well as Fedora Copr for releases (like EPEL 7 and 8) where we cannot
upgrade easily.

As long as RHEL-9 is in Beta, we are considering to move to OpenVPN 2.6
in the EPEL-9 repositories.  Depending on the community testing of the
Copr repos announced now, we might also provide similar snapshots in
default EPEL-9 repos instead of OpenVPN 2.5.z until OpenVPN 2.6 is
officially released.

Basically: If you want to see OpenVPN 2.6 in EPEL-9, please test our
EPEL-9 builds in the openvpn-dco Copr repo and provide feedback ASAP.
If we get confidence t
his works well, we will start preparing for
pre-releases in EPEL-9 sooner than later.


OpenVPN 2.6 and the openvpn-dco Copr builds should also work even if
kmod-ovpn-dco is not available.  And we will provide and support the
kmod-ovpn-dco via the openvpn3 Copr repository until we can get it into
the far more common Fedora repositories.


--
kind regards,

David Sommerseth
OpenVPN Inc