Hi, I tried to change openvpn settings to use AES-256-CBC cipher (https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux) and later realized openvpn eats all of my CPU. I went searching around and found one can specify "engine aesni" and "cipher AES-256-CBC" inside openvpn.cof file to switch to a faster engine. So we come to openssl now. It seems nowadays aes_ni should be enabled in >=openssl-1.0.1 by default. People seem to confirm this by benchmarks giving about same numbers (http://openssl.6102.n7.nabble.com/How-can-I-enable-aes-ni-in-openssl-on-Linux-td47582.html). That is not my case on i7-2640M. # openssl speed -elapsed -evp aes-128-cbc You have chosen to measure elapsed time instead of user CPU time. Doing aes-128-cbc for 3s on 16 size blocks: 6492354 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 64 size blocks: 1622463 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 256 size blocks: 410420 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 1024 size blocks: 102713 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 8192 size blocks: 12940 aes-128-cbc's in 3.00s OpenSSL 1.0.2j 26 Sep 2016 built on: reproducible build, date unspecified options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) compiler: x86_64-pc-linux-gnu-gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -O2 -pipe -maes -mpclmul -mpopcnt -mavx -march=native -fno-strict-aliasing -Wa,--noexecstack The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128-cbc 34625.89k 34612.54k 35022.51k 35059.37k 35334.83k # # OPENSSL_ia32cap="~0x200000200000000" openssl speed -elapsed -evp aes-128-cbc You have chosen to measure elapsed time instead of user CPU time. Doing aes-128-cbc for 3s on 16 size blocks: 630939 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 64 size blocks: 154313 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 256 size blocks: 38918 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 1024 size blocks: 9669 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 8192 size blocks: 1246 aes-128-cbc's in 3.00s OpenSSL 1.0.2j 26 Sep 2016 built on: reproducible build, date unspecified options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) compiler: x86_64-pc-linux-gnu-gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -O2 -pipe -maes -mpclmul -mpopcnt -mavx -march=native -fno-strict-aliasing -Wa,--noexecstack The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128-cbc 3365.01k 3292.01k 3321.00k 3300.35k 3402.41k # I assume the OPENSSL_ia32cap="~0x200000200000000" part disables use of aesni inside openssl. # openssl engine (dynamic) Dynamic engine loading support # # openssl engine --help 140463411234456:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:187:filename(/usr/lib64/engines/lib--help.so): /usr/lib64/engines/lib--help.so: cannot open shared object file: No such file or directory 140463411234456:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:233: 140463411234456:error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:467: 140463411234456:error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:390:id=--help # # cat /proc/cpuinfo | grep aes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx lahf_lm epb tpr_shadow vnmi flexpriority ept vpid xsaveopt dtherm ida arat pln pts flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx lahf_lm epb tpr_shadow vnmi flexpriority ept vpid xsaveopt dtherm ida arat pln pts # These should be irrelevant: # grep -i aes /usr/src/linux-4.8.12/.config # CONFIG_SND_MAESTRO3 is not set CONFIG_CRYPTO_AES=y CONFIG_CRYPTO_AES_X86_64=y CONFIG_CRYPTO_AES_NI_INTEL=y CONFIG_CRYPTO_CAMELLIA_AESNI_AVX_X86_64=y CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64=y # # emerge -pv =dev-libs/openssl-1.0.2j These are the packages that would be merged, in order: Calculating dependencies... done! [ebuild R ] dev-libs/openssl-1.0.2j::gentoo USE="asm bindist gmp sctp sslv3 tls-heartbeat zlib -kerberos -rfc3779 -sslv2 -static-libs {-test} -vanilla" ABI_X86="32 (64) (-x32)" CPU_FLAGS_X86="(sse2)" 0 KiB # emerge --info Portage 2.3.3 (python 2.7.12-final-0, default/linux/amd64/13.0, gcc-5.4.0, glibc-2.23-r3, 4.8.12-default-pciehp x86_64) ================================================================= System uname: Linux-4.8.12-default-pciehp-x86_64-Intel-R-_Core-TM-_i7-2640M_CPU_@_2.80GHz-with-gentoo-2.3 KiB Mem: 16375760 total, 10749320 free KiB Swap: 0 total, 0 free Timestamp of repository gentoo: Thu, 08 Dec 2016 11:30:01 +0000 sh bash 4.4_p5-r1 ld GNU ld (Gentoo 2.25.1 p1.1) 2.25.1 app-shells/bash: 4.4_p5-r1::gentoo dev-java/java-config: 2.2.0-r3::gentoo dev-lang/perl: 5.24.1_rc4::gentoo dev-lang/python: 2.7.12::gentoo, 3.4.5::gentoo, 3.5.2::gentoo dev-util/cmake: 3.7.1::gentoo dev-util/pkgconfig: 0.29.1::gentoo sys-apps/baselayout: 2.3::gentoo sys-apps/openrc: 0.22.4::gentoo sys-apps/sandbox: 2.10-r2::gentoo sys-devel/autoconf: 2.13::gentoo, 2.69-r2::gentoo sys-devel/automake: 1.11.6-r2::gentoo, 1.12.6-r1::gentoo, 1.13.4-r1::gentoo, 1.14.1-r1::gentoo, 1.15-r2::gentoo sys-devel/binutils: 2.25.1-r1::gentoo, 2.26.1::gentoo sys-devel/gcc: 4.3.6-r1::gentoo, 4.4.7::gentoo, 4.6.4::gentoo, 4.7.4::gentoo, 4.8.5::gentoo, 4.9.3::gentoo, 5.3.0::gentoo, 5.4.0::gentoo, 6.2.0-r1::gentoo sys-devel/gcc-config: 1.8-r1::gentoo sys-devel/libtool: 2.4.6-r2::gentoo sys-devel/make: 4.2.1::gentoo sys-kernel/linux-headers: 4.8::gentoo (virtual/os-headers) sys-libs/glibc: 2.23-r3::gentoo Repositories: gentoo location: /scratch/usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 science location: /home/mmokrejs/proj/sci masters: gentoo priority: 0 x-portage location: /usr/local/portage masters: gentoo priority: 1 layman location: /var/lib/layman masters: gentoo priority: 2 haskell location: /var/lib/layman/haskell masters: gentoo priority: 50 ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="* -@EULA dlj-1.1 sun-bcla-java-vm Oracle-BCLA-JavaSE IBM-J1.6 skype-eula Nero-EULA-US AdobeFlash-10.3 skype-4.0.0.7-copyright AdobeFlash-11.x OPERA-2014 RAR" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -pipe -maes -mpclmul -mpopcnt -mavx -march=native" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /etc/stunnel/stunnel.conf /usr/lib64/libreoffice/program/sofficerc /usr/share/easy-rsa /usr/share/gnupg/qualified.txt /usr/share/maven-bin-3.2/conf /var/bind /var/lib/hsqldb /var/spool/torque" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.6/ext-active/ /etc/php/cgi-php5.6/ext-active/ /etc/php/cli-php5.6/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="-O2 -pipe -maes -mpclmul -mpopcnt -mavx -march=native" DISTDIR="/scratch/usr/portage/distfiles" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news noclean nostrip parallel-fetch preserve-libs protect-owned sandbox sfperms splitdebug strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://gentoo.wheel.sk/ http://ftp.fi.muni.cz/pub/linux/gentoo/ http://gentoo.mirror.web4u.cz/ rsync://gentoo.mirror.dkm.cz/gentoo/ ftp://gentoo.mirror.web4u.cz/" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j2" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/scratch/var/tmp" USE="X acpi alsa amd64 amr apache apache2 apulse asm avx berkdb bindist bluetooth boost bzip2 cairo cgi cli coin consolekit cracklib crypt cryptlib cups cxx dbus device-mapper dhcp directfb dri drm dvd emboss encode fax fbcon ffmpeg flac fontconfig fortran gbm gcrypt gd gdbm geoip gimp glpk gmp gnutls gpm gtk hal hpijs hwdb iconv id3tag imaging innodb inotify java javafx javascript jce jpeg jpg js jscript keymap ladspa lapack laptop lcms libnotify lm_sensors lz4 mad matroska mmx mmxext modules mpi mpich2 multilib mysql ncurses nfs nls nptl nptlonly nscd nsplugin ntfsprogs ocr ogg opengl openmp pam parport pcre pdf perl php png policykit polkit ppds pppd python qt3support readline rendering resolvconf scanner sctp seccomp server session slideshow sndfile sqlite sse sse2 sse3 sse4_1 sse4_2 ssl ssse3 suexec svg syslog tcl tcpd threads tiff tk truetype udev unicode usb v4l v4l2 vim-syntax vnc wavpack wifi x11 xattr xcb xml xorg xrandr xv xvid xvmc zlib" ABI_X86="64 32" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="alias authz_host auth_basic auth_digest cgi cgid deflate dir env filter include info mem_cache mime mime_magic negotiation remoteip setenvif status userdir vhost_alias rewrite usertrack cache file_cache disk_cache charset_lite log_config log_forensic" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx mmx mmxext popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="pc" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" L10N="en-US en en-GB cs" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="en_US en_GB en cs" OFFICE_IMPLEMENTATION="libreoffice" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_5" RUBY_TARGETS="ruby21" USERLAND="GNU" VIDEO_CARDS="vesa vmware fbdev intel i915 i965" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" USE_PYTHON="2.7" Unset: CC, CPPFLAGS, CTARGET, CXX, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Created attachment 455698 [details] build.log.bz2
seems to me that your openssl output shows that openssl is working correctly by default. so what is it you're reporting exactly ? that openvpn, in its default config, gets slow performance unless you change openvpn's conf file ?
Regarding the "openssl speed" tests: why are the numbers so much different on my host? Other users in those URL's I posted reported roughly same numbers in both approaches. My real problem is that openvpn VLAN connection takes almost whole cpu core. Initially openvpn was pesking me about my connection being insecure so I added these values (notably shifted away from Blowfish to AES-256-CBC as the message suggested): # https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux tun-mtu 9000 mssfix 0 fragment 0 # INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC). ;cipher BF-CBC # Blowfish cipher AES-256-CBC The message from openvpn was logged via syslogd. I believe the default on Gentoo was that Blowfish was selected as the cipher. Sounds all users should change now. I recompiled openssl and openvpn before reporting this, still no change. Here are my openvpn USE flags. [ebuild R ] net-misc/openvpn-2.4_rc1-r1::gentoo USE="inotify lzo pam plugins ssl -down-root -examples -iproute2 -libressl -lz4 -mbedtls -pkcs11 (-polarssl) (-selinux) -static -systemd {-test}" 0 KiB
(In reply to Martin Mokrejš from comment #3) that ia32cap value explicitly disables AES-NI & PCLMULQDQ support. so if the code was using them automatically, doesn't seem surprising that disabling them made things run slower. i won't speculate to the setups of random forum posters. the fact that your system is running faster when those aren't disabled suggests that openssl is working correctly and using them automatically.
Hi, I should have posted an update meanwhile. I got somehow around with repeated re-emerges of many parts of the system and the issue went away. Due to large volume of packages recompiled/upgraded I did not bother to figure out possible candidates, maybe selected by the 'deep' depends of "emerge -uND". It took me a few days of trickery. Current values are: # openssl speed -elapsed -evp aes-128-cbc You have chosen to measure elapsed time instead of user CPU time. Doing aes-128-cbc for 3s on 16 size blocks: 95037710 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 64 size blocks: 25313067 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 256 size blocks: 6330206 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 1024 size blocks: 1595696 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 8192 size blocks: 200527 aes-128-cbc's in 3.00s OpenSSL 1.0.2l 25 May 2017 built on: reproducible build, date unspecified options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) compiler: x86_64-pc-linux-gnu-gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -O2 -pipe -mpclmul -mpopcnt -march=native -ftree-vectorize -fno-strict-aliasing -Wa,--noexecstack The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128-cbc 506867.79k 540012.10k 540177.58k 544664.23k 547572.39k # # OPENSSL_ia32cap="~0x200000200000000" openssl speed -elapsed -evp aes-128-cbc You have chosen to measure elapsed time instead of user CPU time. Doing aes-128-cbc for 3s on 16 size blocks: 46307488 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 64 size blocks: 12825727 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 256 size blocks: 3272819 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 1024 size blocks: 832982 aes-128-cbc's in 3.00s Doing aes-128-cbc for 3s on 8192 size blocks: 104271 aes-128-cbc's in 3.00s OpenSSL 1.0.2l 25 May 2017 built on: reproducible build, date unspecified options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) compiler: x86_64-pc-linux-gnu-gcc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -O2 -pipe -mpclmul -mpopcnt -march=native -ftree-vectorize -fno-strict-aliasing -Wa,--noexecstack The 'numbers' are in 1000s of bytes per second processed. type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes aes-128-cbc 246973.27k 273615.51k 279280.55k 284324.52k 284729.34k # # uname -a Linux vostro 4.4.76-default-pciehp #3 SMP Fri Jul 21 15:18:25 CEST 2017 x86_64 Intel(R) Core(TM) i7-2640M CPU @ 2.80GHz GenuineIntel GNU/Linux # # emerge -pv openssl openvpn [ebuild R ] dev-libs/openssl-1.0.2l::gentoo USE="asm bindist gmp sctp sslv3 tls-heartbeat zlib -kerberos -rfc3779 -sslv2 -static-libs {-test} -vanilla" ABI_X86="32 (64) (-x32)" CPU_FLAGS_X86="(sse2)" 0 KiB [ebuild R ] net-vpn/openvpn-2.4.3::gentoo USE="inotify lzo pam plugins ssl -down-root -examples -iproute2 -libressl -lz4 -mbedtls -pkcs11 (-selinux) -static -systemd {-test}" 0 KiB # emerge --info Portage 2.3.6 (python 2.7.13-final-0, default/linux/amd64/13.0, gcc-4.9.4, glibc-2.24-r3, 4.4.76-default-pciehp x86_64) ================================================================= System uname: Linux-4.4.76-default-pciehp-x86_64-Intel-R-_Core-TM-_i7-2640M_CPU_@_2.80GHz-with-gentoo-2.4.1 KiB Mem: 16375324 total, 8642324 free KiB Swap: 0 total, 0 free Timestamp of repository gentoo: Mon, 07 Aug 2017 08:00:01 +0000 sh bash 4.4_p12 ld GNU ld (Gentoo 2.27 p1.1) 2.27 app-shells/bash: 4.4_p12::gentoo dev-java/java-config: 2.2.0-r3::gentoo dev-lang/perl: 5.24.2::gentoo dev-lang/python: 2.7.13::gentoo, 3.4.5::gentoo, 3.5.3::gentoo, 3.6.1-r1::gentoo dev-util/cmake: 3.9.0::gentoo dev-util/pkgconfig: 0.29.2::gentoo sys-apps/baselayout: 2.4.1::gentoo sys-apps/openrc: 0.28::gentoo sys-apps/sandbox: 2.10-r4::gentoo sys-devel/autoconf: 2.13::gentoo, 2.69-r3::gentoo sys-devel/automake: 1.11.6-r2::gentoo, 1.12.6-r1::gentoo, 1.13.4-r1::gentoo, 1.14.1-r1::gentoo, 1.15.1::gentoo sys-devel/binutils: 2.25.1-r1::gentoo, 2.26.1::gentoo, 2.27-r1::gentoo, 2.28-r2::gentoo sys-devel/gcc: 4.3.6-r1::gentoo, 4.4.7::gentoo, 4.6.4::gentoo, 4.7.4::gentoo, 4.8.5::gentoo, 4.9.4::gentoo, 5.3.0::gentoo, 5.4.0-r3::gentoo, 6.2.0-r1::gentoo, 6.3.0::gentoo, 7.1.0-r1::gentoo sys-devel/gcc-config: 1.8-r1::gentoo sys-devel/libtool: 2.4.6-r4::gentoo sys-devel/make: 4.2.1-r1::gentoo sys-kernel/linux-headers: 4.10::gentoo (virtual/os-headers) sys-libs/glibc: 2.24-r3::gentoo Repositories: gentoo location: /scratch/usr/portage sync-type: rsync sync-uri: rsync://rsync.gentoo.org/gentoo-portage priority: -1000 science location: /scratch/mmokrejs/proj/sci masters: gentoo priority: 0 layman location: /var/lib/layman masters: gentoo priority: 1 haskell location: /var/lib/layman/haskell masters: gentoo priority: 50 vmware location: /var/lib/layman/vmware masters: gentoo priority: 50 ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="* -@EULA dlj-1.1 sun-bcla-java-vm Oracle-BCLA-JavaSE IBM-J1.6 skype-eula Nero-EULA-US AdobeFlash-10.3 skype-4.0.0.7-copyright AdobeFlash-11.x OPERA-2014 RAR Intel-SDP" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -pipe -mpclmul -mpopcnt -march=native -ftree-vectorize" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /etc/stunnel/stunnel.conf /usr/lib64/libreoffice/program/sofficerc /usr/share/easy-rsa /usr/share/gnupg/qualified.txt /usr/share/maven-bin-3.2/conf /usr/share/maven-bin-3.3/conf /var/bind /var/lib/hsqldb /var/spool/torque" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.6/ext-active/ /etc/php/apache2-php7.1/ext-active/ /etc/php/cgi-php5.6/ext-active/ /etc/php/cgi-php7.1/ext-active/ /etc/php/cli-php5.6/ext-active/ /etc/php/cli-php7.1/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="-O2 -pipe -mpclmul -mpopcnt -march=native -ftree-vectorize" DISTDIR="/scratch/usr/portage/distfiles" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news nostrip parallel-fetch preserve-libs protect-owned sandbox sfperms splitdebug strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://gentoo.wheel.sk/ http://ftp.fi.muni.cz/pub/linux/gentoo/ http://gentoo.mirror.web4u.cz/ rsync://gentoo.mirror.dkm.cz/gentoo/ ftp://gentoo.mirror.web4u.cz/" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j2" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/scratch/var/tmp" USE="R X acpi alsa amd64 amr apache apache2 apulse asm avx berkdb bindist bluetooth boost bzip2 cairo cgi cli coin consolekit cracklib crypt cryptlib cryptsetup cups cxx dbus device-mapper dhcp directfb dri drm dvd emboss encode fax fbcon ffmpeg flac fontconfig fortran gbm gcrypt gd gdbm geoip geolocation gimp glpk gmp gnutls gpm gtk hal hpijs hwdb iconv id3tag imaging innodb inotify java javafx javascript jce jpeg jpg js jscript keymap ladspa lapack laptop lcms libnotify lm_sensors mad matroska mmx modemmanager modules multicore multilib multimedia mysql ncurses networkmanager nfs nls nptl nptlonly nscd ntfs ntfsdecrypt ntfsprogs objc ocr ogg opengl openmp pam parport pcre pdf pdfimport pdl perl php plplot png policykit polkit postproc postscript ppds ppp pppd pptx python qt3support qt4 qt5 readline rendering resolvconf samba scanner sctp seccomp server session sha512 slideshow sna sndfile sqlite sse sse2 sse3 sse4_1 sse4_2 ssh ssh-agent ssl ssse3 startup-notification suexec svg syslog tcl tcpd threads tiff tk truetype udev unicode upower usb v4l v4l2 vim-syntax vnc wavpack wifi x11 xattr xcb xml xorg xrandr xv xvid xvmc zlib" ABI_X86="64 32" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="alias authz_host auth_basic auth_digest cgi cgid deflate dir env filter include info mem_cache mime mime_magic negotiation remoteip setenvif status userdir vhost_alias rewrite usertrack cache file_cache disk_cache charset_lite log_config log_forensic" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx mmx mmxext popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="pc" INPUT_DEVICES="libinput keyboard mouse" KERNEL="linux" L10N="en-US en en-GB cs" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="en_US en_GB en cs" OFFICE_IMPLEMENTATION="libreoffice" POSTGRES_TARGETS="postgres9_5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_5" RUBY_TARGETS="ruby20 ruby21 ruby23 ruby24" USERLAND="GNU" VIDEO_CARDS="vesa vmware fbdev intel i915 i965" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" USE_PYTHON="2.7" Unset: CC, CPPFLAGS, CTARGET, CXX, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS #
Created attachment 488270 [details] openvpn-client-working-settings.conf No changes since I had the issue but let's recap what works for me at least.
I am not sure if it still makes sense to keep this issue open. OpenVPN nowadays will always try to use AES-256-GCM by default, unless instructed differently. On x86 this is the recommended choice also because this cipher gets accelerated via AES-NI (or whatever the name is on AMD) automatically. There is no need for any extra flag in the openvpn configuration file.
(In reply to Antonio Quartulli from comment #7) > I am not sure if it still makes sense to keep this issue open. > > OpenVPN nowadays will always try to use AES-256-GCM by default, unless > instructed differently. > > On x86 this is the recommended choice also because this cipher gets > accelerated via AES-NI (or whatever the name is on AMD) automatically. There > is no need for any extra flag in the openvpn configuration file. Thanks.
