DCO on PFSense CE

fmroeira86

Hello,

Out of curiosity, what's the differences between Plus vs CE in terms of OpenVPN DCO?

Running a openvpn --version I get this:

openvpn --version
OpenVPN 2.6.8 amd64-portbld-freebsd14.0 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] [DCO]
library versions: OpenSSL 3.0.12 24 Oct 2023, LZO 2.10
DCO version: FreeBSD 14.0-CURRENT amd64 1400094 #1 RELENG_2_7_2-n255948-8d2b56da39c: Wed Dec 6 20:45:47 UTC 2023 root@freebsd:/var/jenkins/workspace/pfSense-CE-snapshots-2_7_2-main/obj/amd64/StdASW5b/var/jenkins/workspace/pfSense-CE-snapshots-2_7_2-main/sources/F
Originally developed by James Yonan
Copyright (C) 2002-2023 OpenVPN Inc sales@openvpn.net
Compile time defines: enable_async_push=yes enable_comp_stub=no enable_crypto_ofb_cfb=yes enable_dco=yes enable_dco_arg=yes enable_debug=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_iproute2=no enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_management=yes enable_pam_dlopen=no enable_pedantic=no enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_shared=yes enable_shared_with_static_runtimes=no enable_silent_rules=no enable_small=no enable_static=yes enable_strict=yes enable_strict_options=no enable_systemd=no enable_unit_tests=no enable_werror=no enable_win32_dll=yes enable_wolfssl_options_h=yes enable_x509_alt_username=yes with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_openssl_engine=auto with_sysroot=no

So really, what are the differences between those versions?

SteveITS

@fmroeira86 it may be disabled in code? It’s supposed to be Plus only:
https://docs.netgate.com/pfsense/en/latest/general/plus.html#cryptography-and-vpn-acceleration

fmroeira86

@SteveITS sure.

Question is... What are the differences as It seems CE openvpn server was compiled with DCO

fmroeira86

if_ovpn.ko module is not present on CE...

fmroeira86

I little bump.

Any technical reason to not include DCO in PFSense CE?

Gertjan

@fmroeira86

The second paragraph here :

OpenVPN Data Channel Offload (DCO)

Netgate worked with OpenVPN to develop and integrate support for OpenVPN Data Channel Offload (DCO) into FreeBSD and pfSense Plus software version 22.05 and later.

So, maybe like Microsoft : there is a home version and Pro.
Why the difference ? Your guesses are as good as mine ;)

michmoor

@Gertjan
Thinking the same. I think the code for DCO is in CE but the keys to build the platform are held by Netgate. You cant compile pfSense yourself.
That said, they are probably keeping it as a value add for their business customers hence why its only on Plus.

fmroeira86

@michmoor Yep. :)

It's a shame.

Business customers exist because, somewhere along this path, there were non-business customers who contributed to the project.

Stripping CE of this kind of functionality will do nothing more than make people consider other alternative projects.