Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 602190 - net-misc/openvpn: openssl default aes performance too slow
Summary: net-misc/openvpn: openssl default aes performance too slow
Status: UNCONFIRMED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: William Hubbs
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-12-09 20:20 UTC by Martin Mokrejš
Modified: 2017-11-21 19:18 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
build.log.bz2 (build.log.bz2,35.57 KB, application/octet-stream)
2016-12-09 20:22 UTC, Martin Mokrejš
Details
openvpn-client-working-settings.conf (openvpn-client-settings.conf,388 bytes, text/plain)
2017-08-08 08:48 UTC, Martin Mokrejš
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Martin Mokrejš 2016-12-09 20:20:46 UTC
Hi,
  I tried to change openvpn settings to use AES-256-CBC cipher (https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux) and later realized openvpn eats all of my CPU.

  I went searching around and found one can specify "engine aesni" and "cipher AES-256-CBC" inside openvpn.cof file to switch to a faster engine. So we come to openssl now.

  It seems nowadays aes_ni should be enabled in >=openssl-1.0.1 by default. People seem to confirm this by benchmarks giving about same numbers (http://openssl.6102.n7.nabble.com/How-can-I-enable-aes-ni-in-openssl-on-Linux-td47582.html). That is not my case on i7-2640M.

# openssl speed -elapsed -evp aes-128-cbc 
You have chosen to measure elapsed time instead of user CPU time.
Doing aes-128-cbc for 3s on 16 size blocks: 6492354 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 64 size blocks: 1622463 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 256 size blocks: 410420 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 1024 size blocks: 102713 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 8192 size blocks: 12940 aes-128-cbc's in 3.00s
OpenSSL 1.0.2j  26 Sep 2016
built on: reproducible build, date unspecified
options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) 
compiler: x86_64-pc-linux-gnu-gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -O2 -pipe -maes -mpclmul -mpopcnt -mavx -march=native -fno-strict-aliasing -Wa,--noexecstack
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc      34625.89k    34612.54k    35022.51k    35059.37k    35334.83k
#


# OPENSSL_ia32cap="~0x200000200000000" openssl speed -elapsed -evp aes-128-cbc 
You have chosen to measure elapsed time instead of user CPU time.
Doing aes-128-cbc for 3s on 16 size blocks: 630939 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 64 size blocks: 154313 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 256 size blocks: 38918 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 1024 size blocks: 9669 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 8192 size blocks: 1246 aes-128-cbc's in 3.00s
OpenSSL 1.0.2j  26 Sep 2016
built on: reproducible build, date unspecified
options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) 
compiler: x86_64-pc-linux-gnu-gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -O2 -pipe -maes -mpclmul -mpopcnt -mavx -march=native -fno-strict-aliasing -Wa,--noexecstack
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc       3365.01k     3292.01k     3321.00k     3300.35k     3402.41k
#



I assume the OPENSSL_ia32cap="~0x200000200000000" part disables use of aesni inside openssl.



# openssl engine
(dynamic) Dynamic engine loading support
#

# openssl engine --help
140463411234456:error:25066067:DSO support routines:DLFCN_LOAD:could not load the shared library:dso_dlfcn.c:187:filename(/usr/lib64/engines/lib--help.so): /usr/lib64/engines/lib--help.so: cannot open shared object file: No such file or directory
140463411234456:error:25070067:DSO support routines:DSO_load:could not load the shared library:dso_lib.c:233:
140463411234456:error:260B6084:engine routines:DYNAMIC_LOAD:dso not found:eng_dyn.c:467:
140463411234456:error:2606A074:engine routines:ENGINE_by_id:no such engine:eng_list.c:390:id=--help
#


# cat /proc/cpuinfo | grep aes
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx lahf_lm epb tpr_shadow vnmi flexpriority ept vpid xsaveopt dtherm ida arat pln pts
flags           : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx lahf_lm epb tpr_shadow vnmi flexpriority ept vpid xsaveopt dtherm ida arat pln pts
#


These should be irrelevant:

# grep -i aes /usr/src/linux-4.8.12/.config
# CONFIG_SND_MAESTRO3 is not set
CONFIG_CRYPTO_AES=y
CONFIG_CRYPTO_AES_X86_64=y
CONFIG_CRYPTO_AES_NI_INTEL=y
CONFIG_CRYPTO_CAMELLIA_AESNI_AVX_X86_64=y
CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64=y
#


# emerge -pv =dev-libs/openssl-1.0.2j

These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild   R    ] dev-libs/openssl-1.0.2j::gentoo  USE="asm bindist gmp sctp sslv3 tls-heartbeat zlib -kerberos -rfc3779 -sslv2 -static-libs {-test} -vanilla" ABI_X86="32 (64) (-x32)" CPU_FLAGS_X86="(sse2)" 0 KiB


 # emerge --info
Portage 2.3.3 (python 2.7.12-final-0, default/linux/amd64/13.0, gcc-5.4.0, glibc-2.23-r3, 4.8.12-default-pciehp x86_64)
=================================================================
System uname: Linux-4.8.12-default-pciehp-x86_64-Intel-R-_Core-TM-_i7-2640M_CPU_@_2.80GHz-with-gentoo-2.3
KiB Mem:    16375760 total,  10749320 free
KiB Swap:          0 total,         0 free
Timestamp of repository gentoo: Thu, 08 Dec 2016 11:30:01 +0000
sh bash 4.4_p5-r1
ld GNU ld (Gentoo 2.25.1 p1.1) 2.25.1
app-shells/bash:          4.4_p5-r1::gentoo
dev-java/java-config:     2.2.0-r3::gentoo
dev-lang/perl:            5.24.1_rc4::gentoo
dev-lang/python:          2.7.12::gentoo, 3.4.5::gentoo, 3.5.2::gentoo
dev-util/cmake:           3.7.1::gentoo
dev-util/pkgconfig:       0.29.1::gentoo
sys-apps/baselayout:      2.3::gentoo
sys-apps/openrc:          0.22.4::gentoo
sys-apps/sandbox:         2.10-r2::gentoo
sys-devel/autoconf:       2.13::gentoo, 2.69-r2::gentoo
sys-devel/automake:       1.11.6-r2::gentoo, 1.12.6-r1::gentoo, 1.13.4-r1::gentoo, 1.14.1-r1::gentoo, 1.15-r2::gentoo
sys-devel/binutils:       2.25.1-r1::gentoo, 2.26.1::gentoo
sys-devel/gcc:            4.3.6-r1::gentoo, 4.4.7::gentoo, 4.6.4::gentoo, 4.7.4::gentoo, 4.8.5::gentoo, 4.9.3::gentoo, 5.3.0::gentoo, 5.4.0::gentoo, 6.2.0-r1::gentoo
sys-devel/gcc-config:     1.8-r1::gentoo
sys-devel/libtool:        2.4.6-r2::gentoo
sys-devel/make:           4.2.1::gentoo
sys-kernel/linux-headers: 4.8::gentoo (virtual/os-headers)
sys-libs/glibc:           2.23-r3::gentoo
Repositories:

gentoo
    location: /scratch/usr/portage
    sync-type: rsync
    sync-uri: rsync://rsync.gentoo.org/gentoo-portage
    priority: -1000

science
    location: /home/mmokrejs/proj/sci
    masters: gentoo
    priority: 0

x-portage
    location: /usr/local/portage
    masters: gentoo
    priority: 1

layman
    location: /var/lib/layman
    masters: gentoo
    priority: 2

haskell
    location: /var/lib/layman/haskell
    masters: gentoo
    priority: 50

ACCEPT_KEYWORDS="amd64 ~amd64"
ACCEPT_LICENSE="* -@EULA dlj-1.1 sun-bcla-java-vm Oracle-BCLA-JavaSE IBM-J1.6 skype-eula Nero-EULA-US AdobeFlash-10.3 skype-4.0.0.7-copyright AdobeFlash-11.x OPERA-2014 RAR"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -maes -mpclmul -mpopcnt -mavx -march=native"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /etc/stunnel/stunnel.conf /usr/lib64/libreoffice/program/sofficerc /usr/share/easy-rsa /usr/share/gnupg/qualified.txt /usr/share/maven-bin-3.2/conf /var/bind /var/lib/hsqldb /var/spool/torque"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.6/ext-active/ /etc/php/cgi-php5.6/ext-active/ /etc/php/cli-php5.6/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-O2 -pipe -maes -mpclmul -mpopcnt -mavx -march=native"
DISTDIR="/scratch/usr/portage/distfiles"
FCFLAGS="-O2 -pipe"
FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news noclean nostrip parallel-fetch preserve-libs protect-owned sandbox sfperms splitdebug strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-O2 -pipe"
GENTOO_MIRRORS="http://gentoo.wheel.sk/ http://ftp.fi.muni.cz/pub/linux/gentoo/ http://gentoo.mirror.web4u.cz/ rsync://gentoo.mirror.dkm.cz/gentoo/ ftp://gentoo.mirror.web4u.cz/"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git"
PORTAGE_TMPDIR="/scratch/var/tmp"
USE="X acpi alsa amd64 amr apache apache2 apulse asm avx berkdb bindist bluetooth boost bzip2 cairo cgi cli coin consolekit cracklib crypt cryptlib cups cxx dbus device-mapper dhcp directfb dri drm dvd emboss encode fax fbcon ffmpeg flac fontconfig fortran gbm gcrypt gd gdbm geoip gimp glpk gmp gnutls gpm gtk hal hpijs hwdb iconv id3tag imaging innodb inotify java javafx javascript jce jpeg jpg js jscript keymap ladspa lapack laptop lcms libnotify lm_sensors lz4 mad matroska mmx mmxext modules mpi mpich2 multilib mysql ncurses nfs nls nptl nptlonly nscd nsplugin ntfsprogs ocr ogg opengl openmp pam parport pcre pdf perl php png policykit polkit ppds pppd python qt3support readline rendering resolvconf scanner sctp seccomp server session slideshow sndfile sqlite sse sse2 sse3 sse4_1 sse4_2 ssl ssse3 suexec svg syslog tcl tcpd threads tiff tk truetype udev unicode usb v4l v4l2 vim-syntax vnc wavpack wifi x11 xattr xcb xml xorg xrandr xv xvid xvmc zlib" ABI_X86="64 32" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="alias authz_host auth_basic auth_digest cgi cgid deflate dir env filter include info mem_cache mime mime_magic negotiation remoteip setenvif status userdir vhost_alias rewrite usertrack cache file_cache disk_cache charset_lite log_config log_forensic" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx mmx mmxext popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="pc" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" L10N="en-US en en-GB cs" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="en_US en_GB en cs" OFFICE_IMPLEMENTATION="libreoffice" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_5" RUBY_TARGETS="ruby21" USERLAND="GNU" VIDEO_CARDS="vesa vmware fbdev intel i915 i965" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
USE_PYTHON="2.7"
Unset:  CC, CPPFLAGS, CTARGET, CXX, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 1 Martin Mokrejš 2016-12-09 20:22:01 UTC
Created attachment 455698 [details]
build.log.bz2
Comment 2 SpanKY gentoo-dev 2016-12-10 17:07:20 UTC
seems to me that your openssl output shows that openssl is working correctly by default.  so what is it you're reporting exactly ?  that openvpn, in its default config, gets slow performance unless you change openvpn's conf file ?
Comment 3 Martin Mokrejš 2016-12-11 08:31:23 UTC
Regarding the "openssl speed" tests: why are the numbers so much different on my host? Other users in those URL's I posted reported roughly same numbers in both approaches.

My real problem is that openvpn VLAN connection takes almost whole cpu core. Initially openvpn was pesking me about my connection being insecure so I added these values (notably shifted away from Blowfish to AES-256-CBC as the message suggested):

# https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
tun-mtu 9000
mssfix 0
fragment 0

# INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
;cipher BF-CBC        # Blowfish 
cipher AES-256-CBC


The message from openvpn was logged via syslogd. I believe the default on Gentoo was that Blowfish was selected as the cipher. Sounds all users should change now.


I recompiled openssl and openvpn before reporting this, still no change. Here are my openvpn USE flags.


[ebuild   R    ] net-misc/openvpn-2.4_rc1-r1::gentoo  USE="inotify lzo pam plugins ssl -down-root -examples -iproute2 -libressl -lz4 -mbedtls -pkcs11 (-polarssl) (-selinux) -static -systemd {-test}" 0 KiB
Comment 4 SpanKY gentoo-dev 2016-12-12 05:09:58 UTC
(In reply to Martin Mokrejš from comment #3)

that ia32cap value explicitly disables AES-NI & PCLMULQDQ support.  so if the code was using them automatically, doesn't seem surprising that disabling them made things run slower.  i won't speculate to the setups of random forum posters.  the fact that your system is running faster when those aren't disabled suggests that openssl is working correctly and using them automatically.
Comment 5 Martin Mokrejš 2017-08-08 08:40:16 UTC
Hi,
  I should have posted an update meanwhile. I got somehow around with repeated re-emerges of many parts of the system and the issue went away. Due to large volume of packages recompiled/upgraded I did not bother to figure out possible candidates, maybe selected by the 'deep' depends of "emerge -uND". It took me a few days of trickery.

  Current values are:

# openssl speed -elapsed -evp aes-128-cbc 
You have chosen to measure elapsed time instead of user CPU time.
Doing aes-128-cbc for 3s on 16 size blocks: 95037710 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 64 size blocks: 25313067 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 256 size blocks: 6330206 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 1024 size blocks: 1595696 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 8192 size blocks: 200527 aes-128-cbc's in 3.00s
OpenSSL 1.0.2l  25 May 2017
built on: reproducible build, date unspecified
options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) 
compiler: x86_64-pc-linux-gnu-gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -O2 -pipe -mpclmul -mpopcnt -march=native -ftree-vectorize -fno-strict-aliasing -Wa,--noexecstack
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc     506867.79k   540012.10k   540177.58k   544664.23k   547572.39k
#

# OPENSSL_ia32cap="~0x200000200000000" openssl speed -elapsed -evp aes-128-cbc 
You have chosen to measure elapsed time instead of user CPU time.
Doing aes-128-cbc for 3s on 16 size blocks: 46307488 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 64 size blocks: 12825727 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 256 size blocks: 3272819 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 1024 size blocks: 832982 aes-128-cbc's in 3.00s
Doing aes-128-cbc for 3s on 8192 size blocks: 104271 aes-128-cbc's in 3.00s
OpenSSL 1.0.2l  25 May 2017
built on: reproducible build, date unspecified
options:bn(64,64) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) 
compiler: x86_64-pc-linux-gnu-gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DL_ENDIAN -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -O2 -pipe -mpclmul -mpopcnt -march=native -ftree-vectorize -fno-strict-aliasing -Wa,--noexecstack
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc     246973.27k   273615.51k   279280.55k   284324.52k   284729.34k
#


# uname -a
Linux vostro 4.4.76-default-pciehp #3 SMP Fri Jul 21 15:18:25 CEST 2017 x86_64 Intel(R) Core(TM) i7-2640M CPU @ 2.80GHz GenuineIntel GNU/Linux
#

# emerge -pv openssl openvpn

[ebuild   R    ] dev-libs/openssl-1.0.2l::gentoo  USE="asm bindist gmp sctp sslv3 tls-heartbeat zlib -kerberos -rfc3779 -sslv2 -static-libs {-test} -vanilla" ABI_X86="32 (64) (-x32)" CPU_FLAGS_X86="(sse2)" 0 KiB
[ebuild   R    ] net-vpn/openvpn-2.4.3::gentoo  USE="inotify lzo pam plugins ssl -down-root -examples -iproute2 -libressl -lz4 -mbedtls -pkcs11 (-selinux) -static -systemd {-test}" 0 KiB


# emerge --info
Portage 2.3.6 (python 2.7.13-final-0, default/linux/amd64/13.0, gcc-4.9.4, glibc-2.24-r3, 4.4.76-default-pciehp x86_64)
=================================================================
System uname: Linux-4.4.76-default-pciehp-x86_64-Intel-R-_Core-TM-_i7-2640M_CPU_@_2.80GHz-with-gentoo-2.4.1
KiB Mem:    16375324 total,   8642324 free
KiB Swap:          0 total,         0 free
Timestamp of repository gentoo: Mon, 07 Aug 2017 08:00:01 +0000
sh bash 4.4_p12
ld GNU ld (Gentoo 2.27 p1.1) 2.27
app-shells/bash:          4.4_p12::gentoo
dev-java/java-config:     2.2.0-r3::gentoo
dev-lang/perl:            5.24.2::gentoo
dev-lang/python:          2.7.13::gentoo, 3.4.5::gentoo, 3.5.3::gentoo, 3.6.1-r1::gentoo
dev-util/cmake:           3.9.0::gentoo
dev-util/pkgconfig:       0.29.2::gentoo
sys-apps/baselayout:      2.4.1::gentoo
sys-apps/openrc:          0.28::gentoo
sys-apps/sandbox:         2.10-r4::gentoo
sys-devel/autoconf:       2.13::gentoo, 2.69-r3::gentoo
sys-devel/automake:       1.11.6-r2::gentoo, 1.12.6-r1::gentoo, 1.13.4-r1::gentoo, 1.14.1-r1::gentoo, 1.15.1::gentoo
sys-devel/binutils:       2.25.1-r1::gentoo, 2.26.1::gentoo, 2.27-r1::gentoo, 2.28-r2::gentoo
sys-devel/gcc:            4.3.6-r1::gentoo, 4.4.7::gentoo, 4.6.4::gentoo, 4.7.4::gentoo, 4.8.5::gentoo, 4.9.4::gentoo, 5.3.0::gentoo, 5.4.0-r3::gentoo, 6.2.0-r1::gentoo, 6.3.0::gentoo, 7.1.0-r1::gentoo
sys-devel/gcc-config:     1.8-r1::gentoo
sys-devel/libtool:        2.4.6-r4::gentoo
sys-devel/make:           4.2.1-r1::gentoo
sys-kernel/linux-headers: 4.10::gentoo (virtual/os-headers)
sys-libs/glibc:           2.24-r3::gentoo
Repositories:

gentoo
    location: /scratch/usr/portage
    sync-type: rsync
    sync-uri: rsync://rsync.gentoo.org/gentoo-portage
    priority: -1000

science
    location: /scratch/mmokrejs/proj/sci
    masters: gentoo
    priority: 0

layman
    location: /var/lib/layman
    masters: gentoo
    priority: 1

haskell
    location: /var/lib/layman/haskell
    masters: gentoo
    priority: 50

vmware
    location: /var/lib/layman/vmware
    masters: gentoo
    priority: 50

ACCEPT_KEYWORDS="amd64 ~amd64"
ACCEPT_LICENSE="* -@EULA dlj-1.1 sun-bcla-java-vm Oracle-BCLA-JavaSE IBM-J1.6 skype-eula Nero-EULA-US AdobeFlash-10.3 skype-4.0.0.7-copyright AdobeFlash-11.x OPERA-2014 RAR Intel-SDP"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -mpclmul -mpopcnt -march=native -ftree-vectorize"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /etc/stunnel/stunnel.conf /usr/lib64/libreoffice/program/sofficerc /usr/share/easy-rsa /usr/share/gnupg/qualified.txt /usr/share/maven-bin-3.2/conf /usr/share/maven-bin-3.3/conf /var/bind /var/lib/hsqldb /var/spool/torque"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.6/ext-active/ /etc/php/apache2-php7.1/ext-active/ /etc/php/cgi-php5.6/ext-active/ /etc/php/cgi-php7.1/ext-active/ /etc/php/cli-php5.6/ext-active/ /etc/php/cli-php7.1/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-O2 -pipe -mpclmul -mpopcnt -march=native -ftree-vectorize"
DISTDIR="/scratch/usr/portage/distfiles"
FCFLAGS="-O2 -pipe"
FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news nostrip parallel-fetch preserve-libs protect-owned sandbox sfperms splitdebug strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-O2 -pipe"
GENTOO_MIRRORS="http://gentoo.wheel.sk/ http://ftp.fi.muni.cz/pub/linux/gentoo/ http://gentoo.mirror.web4u.cz/ rsync://gentoo.mirror.dkm.cz/gentoo/ ftp://gentoo.mirror.web4u.cz/"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git"
PORTAGE_TMPDIR="/scratch/var/tmp"
USE="R X acpi alsa amd64 amr apache apache2 apulse asm avx berkdb bindist bluetooth boost bzip2 cairo cgi cli coin consolekit cracklib crypt cryptlib cryptsetup cups cxx dbus device-mapper dhcp directfb dri drm dvd emboss encode fax fbcon ffmpeg flac fontconfig fortran gbm gcrypt gd gdbm geoip geolocation gimp glpk gmp gnutls gpm gtk hal hpijs hwdb iconv id3tag imaging innodb inotify java javafx javascript jce jpeg jpg js jscript keymap ladspa lapack laptop lcms libnotify lm_sensors mad matroska mmx modemmanager modules multicore multilib multimedia mysql ncurses networkmanager nfs nls nptl nptlonly nscd ntfs ntfsdecrypt ntfsprogs objc ocr ogg opengl openmp pam parport pcre pdf pdfimport pdl perl php plplot png policykit polkit postproc postscript ppds ppp pppd pptx python qt3support qt4 qt5 readline rendering resolvconf samba scanner sctp seccomp server session sha512 slideshow sna sndfile sqlite sse sse2 sse3 sse4_1 sse4_2 ssh ssh-agent ssl ssse3 startup-notification suexec svg syslog tcl tcpd threads tiff tk truetype udev unicode upower usb v4l v4l2 vim-syntax vnc wavpack wifi x11 xattr xcb xml xorg xrandr xv xvid xvmc zlib" ABI_X86="64 32" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="alias authz_host auth_basic auth_digest cgi cgid deflate dir env filter include info mem_cache mime mime_magic negotiation remoteip setenvif status userdir vhost_alias rewrite usertrack cache file_cache disk_cache charset_lite log_config log_forensic" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx mmx mmxext popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="pc" INPUT_DEVICES="libinput keyboard mouse" KERNEL="linux" L10N="en-US en en-GB cs" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="en_US en_GB en cs" OFFICE_IMPLEMENTATION="libreoffice" POSTGRES_TARGETS="postgres9_5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_5" RUBY_TARGETS="ruby20 ruby21 ruby23 ruby24" USERLAND="GNU" VIDEO_CARDS="vesa vmware fbdev intel i915 i965" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
USE_PYTHON="2.7"
Unset:  CC, CPPFLAGS, CTARGET, CXX, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
#
Comment 6 Martin Mokrejš 2017-08-08 08:48:12 UTC
Created attachment 488270 [details]
openvpn-client-working-settings.conf

No changes since I had the issue but let's recap what works for me at least.