Created attachment 259767 [details] connection log Afer runnung few tests on recent stable/14 (now it's 14.3-PRERELASE) I found that ovpn(4) cannot work when world and kernel have no support for legacy IP (WITHOUT_INET, nooptions INET). The ovpn(4) is loaded, but the output from ifconfig tun0 for world and kernel built without INET support reveals that tun(4) is used instead of ovpn(4): tun0: flags=1008043<UP,BROADCAST,RUNNING,MULTICAST,LOWER_UP> metric 0 mtu 1400 options=4080000<LINKSTATE,MEXTPG> inet6 2001:yyy:xxx:c2:2::1 prefixlen 64 inet6 fe80::1265:30ff:fe7a:9509%tun0 prefixlen 64 scopeid 0x4 groups: tun nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL> Opened by PID 2262 Client config file is 100% compatible with DCO and while running the same OpenVPN client config on system with dual-stack support enabled everything is fine and tun0 belongs to group:ovpn. For the test OpenVPN 2.6.14 version was used at both ends, installed from the same openvpn-2.6.14 package built in own poudriere.
It looks more like OpenVPN issue, not ovpn(4) module problem. For unknown reasons, Opnvpn disables DCO for the connection. Here's the difference between the sessions initiated from the dual-stack-capable kernel and an INET6-only kernel: 50c50 < tuntap_options.disable_dco = ENABLED --- > tuntap_options.disable_dco = DISABLED 107c107 < comp.flags = 24 --- > comp.flags = 152 298c298 < DCO version: FreeBSD 14.3-PRERELEASE #6 (...)MINTAKA6ONLY --- > DCO version: FreeBSD 14.3-PRERELEASE #24 (...)MINTAKA 335c335 < TUN/TAP device /dev/tun0 opened --- > DCO device tun0 opened 349,350d348 < Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key < Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 365c363 < Closing TUN/TAP interface --- > Closing DCO interface
The log file differences are not really conclusive - so I'd really like to see an openvpn log (verb 4) on the INET6-only system. There should be an indication in there why it's not using DCO (feel free to send this to me by mail).
Any updates?
Yeah, this is a bit nasty, especially as it has no logging at this point bool dco_available(msglvl_t msglevel) { ... fd = socket(AF_INET, SOCK_DGRAM | SOCK_CLOEXEC, 0); if (fd < 0) { return false; } ... this silently fails on a system built without INET, so the highlevel code gets "whoa, no DCO available" and falls back to userland - with no indication in the log why this happens. There's another AF_INET socket being opened in open_fd() - if I change both occurances to AF_INET6, DCO will work fine on a system without "options INET". Now, I'm reasonably sure this will break on a system with no INET6 - which is also not desirable. @kp: any suggestion how to fix this in a nice way? We can, of course, try AF_INET6 first, and if that fails, fall back to AF_INET, but that feels somewhat unelegant...
Perhaps for this check, we can use AF_LOCAL instead?
Created attachment 268237 [details] patch-src_openvpn_dco__freebsd.diff (In reply to Gert Doering from comment #4) Thanks for nailing this. Let me propose the patch - I hope it will not offend anyone. This patch fixed the issue for me. Tested with OpenVPN 2.8-devel (the patch was submitted on bug 293311 by Gert yesterday). Port builds fine, and in the runtime I see no regression for AF_INET.
Hmm, yeah, I think we can get away with just using AF_LOCAL. There's functionally no difference between AF_INET, AF_INET6 or AF_LOCAL for the calls we care about. They all pass through soo_ioctl(), which will call ifioctl() for any IOCGROUP(cmd) == 'i' (which is the ones we care about here), so that should just work, no matter what address families the kernel supports. Obviously openvpn over IPv4 won't work on a nooptions INET system, but that's kind of the point.
Created attachment 268247 [details] AF_LOCAL + msg() + explanatory commit message Hi, tested AF_LOCAL on a FreeBSD 14 system with "default config" (works). With the explanation from kp@ this looks like the most elegant way to solve things - thanks. http://gerrit.openvpn.net/c/openvpn/+/1551 gert
Not only the culprit but also the solution was found. Since the problem will be resolved upstream and the number of affected users is marginal, I am closing this PR. Thanks to everyone involved in identifying the problem and working on the resolution.
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=51f1036a07509a1e3eb50cf6e7904a88f55bb451 commit 51f1036a07509a1e3eb50cf6e7904a88f55bb451 Author: Matthias Andree <mandree@FreeBSD.org> AuthorDate: 2026-04-01 09:36:40 +0000 Commit: Daniel Engberg <diizzy@FreeBSD.org> CommitDate: 2026-04-05 20:00:05 +0000 security/openvpn: Update to 2.7.1 This changes installed scripts, openvpn-client.up and .down scripts are no longer installed into libexec/, but instead a dns-updown script is placed into libexec/openvpn/ (all under $PREFIX). Based on a patch provided by Marek Zarychta. Changelog: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.1 PR: 293138, 286263 UPDATING | 9 +++++++++ security/openvpn/Makefile | 4 +--- security/openvpn/distinfo | 6 +++--- security/openvpn/files/openvpn-client.in | 5 ++--- security/openvpn/files/patch-inotify (gone) | 11 ----------- security/openvpn/files/pkg-message.in | 17 ++++++++++++++--- security/openvpn/pkg-plist | 3 +-- 7 files changed, 30 insertions(+), 25 deletions(-)
A commit in branch 2026Q2 references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=1af78340d07c0fb3936ecb44e424faf9181dfc74 commit 1af78340d07c0fb3936ecb44e424faf9181dfc74 Author: Matthias Andree <mandree@FreeBSD.org> AuthorDate: 2026-04-01 09:36:40 +0000 Commit: Vladimir Druzenko <vvd@FreeBSD.org> CommitDate: 2026-07-01 20:16:46 +0000 security/openvpn: Update to 2.7.1 This changes installed scripts, openvpn-client.up and .down scripts are no longer installed into libexec/, but instead a dns-updown script is placed into libexec/openvpn/ (all under $PREFIX). Based on a patch provided by Marek Zarychta. Changelog: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.1 PR: 293138, 286263 (cherry picked from commit 51f1036a07509a1e3eb50cf6e7904a88f55bb451) UPDATING | 9 +++++++++ security/openvpn/Makefile | 4 +--- security/openvpn/distinfo | 6 +++--- security/openvpn/files/openvpn-client.in | 5 ++--- security/openvpn/files/pkg-message.in | 17 ++++++++++++++--- security/openvpn/pkg-plist | 3 +-- 6 files changed, 30 insertions(+), 14 deletions(-)