tinc - Jan 2018 - Windows TAP driver issues

While I'm aware that tinc is known to have problems with the latest
Windows TAP driver (NDIS 6), we want to run tinc on Windows server
2016 which doesn't support NDIS 5 drivers.  Since using the old
version of the TAP driver is not an option, I'd like to better
understand the issues with tinc and the NDIS 6 TAP driver.

Can anyone point me to a discussion of the known issues?  From
experience it seems like the driver has problems immediately after
tinc is started and sometimes falls over when there is a lot of
traffic.  The suggestions from the OpenVPN folks are generally
things like increasing the MTU but this has not had much effect in
my testing.

I'm planning to familiarize myself with NDIS drivers so I can try
and improve the current state of affairs but I don't have prior
experience writing NDIS drivers.

Thanks!

 - todd

Hi Todd,

I did some tests with NDIS 6 TAP-Windows about three years ago. The outcome
of that was https://github.com/gsliepen/tinc/pull/73/commits/
0c010ff9fe50b4046b5c7977bafac3e74037f075

It was a long time ago and I don't remember the details, but I remember I
was quite confused because I couldn't explain why OpenVPN did not seem to
exhibit any performance issues on the same driver, even though the code
paths around device I/O looked very similar. In the end I gave up because
I'm not familiar enough with Windows driver development to investigate any
further.

Note that in order to make the NDIS 6 drivers work reliably with tinc, I
first had to mess with tinc a bit, see https://github.com/gsliepen/
tinc/pull/71 - I'm not sure these patches made it to the 1.0 branch, so you
might want to stick to tinc 1.1 for your testing. Even with these fixes, as
I explain above the performance is still problematic.

On 16 January 2018 at 17:34, Todd C. Miller <Todd.Miller at sudo.ws>
wrote:
> While I'm aware that tinc is known to have problems with the latest
> Windows TAP driver (NDIS 6), we want to run tinc on Windows server
> 2016 which doesn't support NDIS 5 drivers.  Since using the old
> version of the TAP driver is not an option, I'd like to better
> understand the issues with tinc and the NDIS 6 TAP driver.
>
> Can anyone point me to a discussion of the known issues?  From
> experience it seems like the driver has problems immediately after
> tinc is started and sometimes falls over when there is a lot of
> traffic.  The suggestions from the OpenVPN folks are generally
> things like increasing the MTU but this has not had much effect in
> my testing.
>
> I'm planning to familiarize myself with NDIS drivers so I can try
> and improve the current state of affairs but I don't have prior
> experience writing NDIS drivers.
>
> Thanks!
>
>  - todd
> _______________________________________________
> tinc mailing list
> tinc at tinc-vpn.org
> https://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://www.tinc-vpn.org/pipermail/tinc/attachments/20180116/5d7d69a3/attachment.html>

Thanks for the info, that is very helpful.  It does look like that
change got back-ported to master, albeit in a different form.

I'll take a look at how OpenVPN does its windows device I/O.

 - todd