Increase control channel packet size for faster handshakes

Instead of limiting the control channel TCP/UDP packet payload size at '100 bytes + real control channel overhead' (~140 bytes ethernet payload), increase the max TCP/UDP payload size to '1250 bytes - calculated overhead' (~1210 bytes ethernet payload).

Note that this patch does *not* yield an optimal solution, but it is a simple and rather safe change that will improve connection setup times significantly.

v2: use the mininum value of --link-mtu and 1250 to give the user a way to
reduce control packet size if really needed.

---
 src/openvpn/ssl.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

index bc17fd0..e61e0aa 100644
@@ -299,8 +299,9 @@ tls_init_control_channel_frame_parameters(const struct frame *data_channel_frame
   reliable_ack_adjust_frame_parameters (frame, CONTROL_SEND_ACK_MAX);
   frame_add_to_extra_frame (frame, SID_SIZE + sizeof (packet_id_type));
 
-  /* set dynamic link MTU to minimum value */
-  frame_set_mtu_dynamic (frame, 0, SET_MTU_TUN);
+  /* set dynamic link MTU to cap control channel packets at 1250 bytes */
+  ASSERT (TUN_LINK_DELTA (frame) < min_int (frame->link_mtu, 1250));
+  frame->link_mtu_dynamic = min_int (frame->link_mtu, 1250) - TUN_LINK_DELTA (frame);
 }
 
 void

2.1.4

It's been OFFLINE for a couple of days now ...

https://swupdate.openvpn.org/community/releases/openvpn-install-2.3.7-I602-x86_64.exe

hi,

Please do not hijack other people's threads by just replying to anything that just happens to come along the right mailing list. Reasonable mail readers thread mails, and your mail got attached to the MTU v2 patch from Steffan, which it does not have *anything* to do with - annoyance.

Besides that, I just tried the download (with Chrome), and it worked perfectly well...

("couple of days" is interesting, given that Samuli only released I602 about 44 hours ago...)

gert

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...

ACK.

Your patch has been applied to the master branch.

I intend to apply it to 2.3 as well, but want to give it a bit more beating - it looks good, but running in production for a few days should give us more data.

Added "trac #545" to the commit message.

(As you've noted, this is not yet perfect - there is still quite a bit of "small packet chatter" going on, even if both sides have the patch - and there seems to be an arbitrary delay of 2 seconds between "ok, TLS is good!" and "SENT CONTROL.*PUSH_REQUEST"... -> so, more investigation needed)

commit fc91d4b0071178e298052078431fb86f03be84fc (master)

Author: Steffan Karger
Date:   Tue Jun 30 21:44:56 2015 +0200

     Increase control channel packet size for faster handshakes

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/9841
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

Hi,

... and to release/2.3 as agreed on the last IRC meeting (and since this has seen quite a bit of testing by ValdikSS on his servers and lots of Android OpenVPN users, we consider this "safe enough" for 2.3).

commit 29b65ffdb2e7ed3d3b7bcac4048f6cd919ed13b3 (release/2.3)

gert

USENET is *not* the non-clickable part of WWW!
                                                           //www.muc.de/~gert/
Gert Doering - Munich, Germany                             [email protected]...
fax: +49-89-35655025                        [email protected]...