Re: Kernel 6.18 fist tests...

[ummeegge <ummeegge@ipfire.org>]

As a side note, the new kernel delivers also the OpenVPN data channel
offload modul

`
$ lsmod | grep ovpn                             
ovpn                   98304  0
ip6_udp_tunnel         16384  2 ovpn,wireguard
udp_tunnel             36864  2 ovpn,wireguard
`

`
$ modinfo ovpn                                  
filename:       /lib/modules/6.18.1-
ipfire/kernel/drivers/net/ovpn/ovpn.ko.xz
license:        GPL
author:         Antonio Quartulli <antonio@openvpn.net>
description:    OpenVPN data channel offload (ovpn)
alias:          net-pf-16-proto-16-family-ovpn
srcversion:     3489B2E6A6AC611BFA9C567
depends:        udp_tunnel,ip6_udp_tunnel
intree:         Y
name:           ovpn
retpoline:      Y
vermagic:       6.18.1-ipfire SMP preempt mod_unload modversions 
sig_id:         PKCS#7
signer:         Build time autogenerated kernel key
sig_key:       
4F:44:D3:C8:7A:2F:B2:87:6F:B1:98:F4:9A:B1:B1:DA:88:EB:66:AF
sig_hashalgo:   sha512
signature:     
30:65:02:31:00:D1:C5:0C:D6:00:BC:87:04:27:7F:11:BB:39:5F:B3:
		65:10:81:AB:09:76:7D:8D:12:17:34:E9:20:EF:21:E3:FD:85:
3F:DB:
		C1:DA:60:8D:1B:62:1F:C7:24:4B:EF:DC:4B:02:30:73:8B:EB:
1A:88:
		7A:D9:2F:44:6D:73:1D:07:14:29:83:0F:91:EF:44:E2:88:97:
02:2D:
		EB:8D:1C:0A:D7:00:19:50:01:F9:55:78:B4:F1:96:05:56:95:
BF:83:
		FA:8E:62
`

https://blog.openvpn.net/openvpn-dco-added-to-linux-kernel-2025 . The
new openvpn-2.7_rc3 version supports now also the new ovpn DCO Linux
kernel module
https://community.openvpn.net/Downloads#openvpn-27_rc3-released-28-november-2025
which is native in  which works good after a first look over.
There was the need to delete the `--enable-iproute2` and add the `--
enable-dco` compiletime options. There is also the need to Remove or
change the `--data-ciphers-fallback` flag to an AEAD cipher in
server.conf , after that:
- Server starts with DCO
  - Logs show explicit DCO activation:
    "net_iface_new: add tun0 type ovpn"
    "DCO device tun0 opened"
    "ovpn-dco device [tun0] opened"
    "dco_new_peer", "dco_install_key", "dco_set_peer"
  - Data channel uses AES-256-GCM in kernel mode
  - Server-side DCO active even with 2.6 client

Some more infos.

Erik

P.S.: OpenVPN-2.7 uses now

`Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer
certificate: 4096 bits RSA, signature: RSA-SHA256, peer temporary key:
768 bits X25519MLKEM768, peer signing digest/type: rsa_pss_rsae_sha256
RSASSA-PSS, key agreement: X25519MLKEM768`

so with default config, hybrid post-quantum key exchange
(X25519MLKEM768 = X25519 + Kyber-768/ML-KEM-768) is available :-) .