Changes between Version 4 and Version 5 of DataChannelOffload

Timestamp:

01/16/22 15:25:58 (2 years ago)

Author:

Antonio Quartulli

Comment:

--

DataChannelOffload

@@ -34 +34 @@
 OpenVPN in userspace is still in charge of handling the control channel, where all the complex and less throughput-critical operations take place. This is considered an advantage as it allowed to keep the complexity of the ovpn-dco kernel module to the minimum and thus reduce the attack surface.
 
+Please note that **OpenVPN 2.6 or greater** is required in order to use ovpn-dco.
+
+The ovpn-dco source code for Linux is currently available at the following repository: https://github.com/OpenVPN/ovpn-dco
+
 === DCO on Windows
-A similar kernel module has also been developed for Windows, namely ''ovpn-dco-win''.
-It is a device driver implemented in kernelspace that substitutes all previous drivers used by OpenVPN (i.e. 
+A kernel module has also been developed for Windows, namely ''ovpn-dco-win''.
+It is a device driver implemented in kernelspace that substitutes all previous drivers used by OpenVPN (i.e. tap-windows6, wintun, etc..). Differently from the other drivers, ovpn-dco-win uses the Windows Kernel API to also implement crypto operations, thus allowing to process data packets entirely in kernelspace, similarly to ovpn-dco for Linux.
+The main limitation of ovpn-dco-win is that it only supports client/p2p mode, while server mode is not available. This decision was made due to the fact that there is less and less demand for running OpenVPN server on Windows.
+
+The ovpn-dco-win source code is currently available at the following repository: https://github.com/OpenVPN/ovpn-dco-win
+
+=== Expected limitations
+Not all functionalities available in OpenVPN have been implemented in ovpn-dco(-win). The reasons for this decision are mainly:
+1. avoid unneeded complexity in a critical component like a kernel module;
+1. take the chance to give a clear cut with legacy features that OpenVPN has carried around for a while.
+
+In particular, this is a list (mayb not be complete) of features that are **not** available when using ovpn-dco:
+* ciphers other than AES-GCM and CHACHA20-POLY1305 (the latter is not yet available in ovpn-dco-win);
+* compression or compression framing;
+* fragmentation;
+* TAP/Ethernet mode;
+* topologies other than ''subnet'';
+* no traffic shaping or any other sort of data packets manipulation (system tools should be used when available).
+
+=== Some experiments
+
+...