freebsd stable - Mar 2015 - 35-40% performance drop releng9 vs releng10 openvpn

On Mar 18 18:28, Mike Tancsa wrote:
>On 3/18/2015 5:14 PM, John-Mark Gurney wrote:
>>As I've never used OpenVPN before and their docs don't go into
saying
>>what it's using.. Is OpenVPN a kernel or userland VPN?  Do they use
>>IPSec in the kernel? or are they just using UDP or TCP for their
>>connections?
>
>All in userland.  I use UDP for the transport, and it uses OpenSSL in 
>the base for the crypto.  In this case, AES-128-CBC.  There is no 
>hardware assist on the APU either to offload the AES.
>
Isn't OpenSSL in the base on releng9 the 0.9.8 version whereas in 
releng10 it's the 1.0.1 version? This could make a significant 
difference. I've heard rumours before that the newer version is a lot 
slower but I've never had cause to believe it.

It could be worth installing OpenSSL from the ports system on the 
releng9 box and reinstalling OpenVPN so that it links against it. Then 
they will both be on 1.0.1. Could be an interesting test?

-- 
Matt

Dear all,
> On 18.03.2015, at 23:41, "Matt Smith" <fbsd at xtaz.co.uk>
wrote:
>
>> On Mar 18 18:28, Mike Tancsa wrote:
>>> On 3/18/2015 5:14 PM, John-Mark Gurney wrote:
>>> As I've never used OpenVPN before and their docs don't go
into saying
>>> what it's using.. Is OpenVPN a kernel or userland VPN?  Do they
use
>>> IPSec in the kernel? or are they just using UDP or TCP for their
>>> connections?
>>
>> All in userland.  I use UDP for the transport, and it uses OpenSSL in
the base for the crypto.  In this case, AES-128-CBC.  There is no hardware
assist on the APU either to offload the AES.
>
> Isn't OpenSSL in the base on releng9 the 0.9.8 version whereas in
releng10 it's the 1.0.1 version? This could make a significant difference.
I've heard rumours before that the newer version is a lot slower but
I've never had cause to believe it.
Quick search brought up

https://www.stunnel.org/pipermail/stunnel-users/2013-April/004176.html

so I'd second using same program versions and only change OS or vice versa
(so we aren't comparing apples to minced meat ;-)

Best regards,
Holger


__________________________________________________________

Holger Kipp
Diplom-Mathematiker
Senior Consultant

Tel. : +49 30 436 58 114
Fax. : +49 30 436 58 214
Mobil: +49 178 36 58 114
Email: holger.kipp at alogis.com

alogis AG
Alt-Moabit 90b
D-10559 Berlin

http://www.alogis.com
__________________________________________________________

alogis AG
Sitz/Registergericht: Berlin/AG Charlottenburg, HRB 71484
Vorstand: Arne Friedrichs, Joern Samuelson
Aufsichtsratsvorsitzender: Reinhard Mielke

On 3/18/2015 6:40 PM, Matt Smith wrote:
> Isn't OpenSSL in the base on releng9 the 0.9.8 version whereas in
> releng10 it's the 1.0.1 version? This could make a significant
> difference. I've heard rumours before that the newer version is a lot
> slower but I've never had cause to believe it.
>
  openssl speed aes-128-cbc

16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
20245.49k    21646.52k    22179.87k    55431.85k    55981.40k  R10
34178.77k    35559.29k    36305.70k    36481.34k    36495.49k  R9

R9 OpenSSL 0.9.8zd-freebsd 8 Jan 2015
R10 OpenSSL 1.0.1l-freebsd 15 Jan 2015

Interesting, its mixed based on size

	---Mike

-- 
-------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike at sentex.net
Providing Internet services since 1994 www.sentex.net
Cambridge, Ontario Canada   http://www.tancsa.com/
-------------- next part --------------

RELENG_10

0(alix_APU1c4)# openssl speed aes-128-cbc
Doing aes-128 cbc for 3s on 16 size blocks: 3884998 aes-128 cbc's in 3.07s
Doing aes-128 cbc for 3s on 64 size blocks: 1064886 aes-128 cbc's in 3.15s
Doing aes-128 cbc for 3s on 256 size blocks: 261951 aes-128 cbc's in 3.02s
Doing aes-128 cbc for 3s on 1024 size blocks: 162398 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 8192 size blocks: 20501 aes-128 cbc's in 3.00s
OpenSSL 1.0.1l-freebsd 15 Jan 2015
built on: date not available
options:bn(64,64) rc4(8x,int) des(idx,cisc,16,int) aes(partial) idea(int)
blowfish(idx)
compiler: clang
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128 cbc      20245.49k    21646.52k    22179.87k    55431.85k    55981.40k
0(alix_APU1c4)#

RELENG9

1{alix_APU1c4}# openssl speed aes-128-cbc
To get the most accurate results, try to run this
program when this computer is idle.
Doing aes-128 cbc for 3s on 16 size blocks: 6396101 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 64 size blocks: 1666730 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 256 size blocks: 425420 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 1024 size blocks: 106883 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 8192 size blocks: 13367 aes-128 cbc's in 3.00s
OpenSSL 0.9.8zd-freebsd 8 Jan 2015
built on: date not available
options:bn(64,64) md2(int) rc4(ptr,int) des(idx,cisc,16,int) aes(partial)
blowfish(idx)
compiler: cc
available timing options: USE_TOD HZ=128 [sysconf value]
timing function used: getrusage
The 'numbers' are in 1000s of bytes per second processed.
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128 cbc      34178.77k    35559.29k    36305.70k    36481.34k    36495.49k
0{alix_APU1c4}#