Client tunnel with DCO aborts if tun iface was created with --mktun

Hello everybody,

I have an issue with an OpenVPN tunnel on the client that does not come UP, because it cannot create a DCO interface - Error: sitnl_send: rtnl: generic error (-17): File exists

The OpenVPN client is running the latest v2.6.6 compiled with DCO on an ARM device and the DCO kernel module loaded, which is connecting to an OVPN server running v2.4.7 on a Ubuntu v20.04. An important notice to mention is that I create the TUN device with openvpn --mktun --dev tunG --dev-type tun in advance before initializing the tunnel.

The tunnel is based on certificates and the authentication passes without any problems, so I think that the server logs are irrelevant for this issue.

Thanks for the help.

Client infos and logs:

openvpn --version OpenVPN 2.6.6 arm-linux-musleabi [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] [DCO] library versions: OpenSSL 1.1.1u 30 May 2023, LZO 2.10 DCO version: 2.0.0 Originally developed by James Yonan Copyright (C) 2002-2023 OpenVPN Inc <sales@openvpn.net> Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto_ofb_cfb=yes enable_dco=yes enable_dco_arg=yes enable_debug=no enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_doc=no enable_docs=no enable_documentation=no enable_fast_install=yes enable_fragment=yes enable_gtk_doc=no enable_gtk_doc_html=no enable_iproute2=no enable_ipv6=yes enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_management=no enable_multihome=no enable_nls=no enable_pam_dlopen=no enable_pedantic=no enable_pkcs11=no enable_plugin_auth_pam=no enable_plugin_down_root=no enable_plugins=no enable_port_share=yes enable_selinux=no enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_static=no enable_strict=no enable_strict_options=no enable_systemd=no enable_unit_tests=no enable_werror=no enable_win32_dll=yes enable_wolfssl_options_h=yes enable_x509_alt_username=no with_aix_soname=aix with_crypto_library=openssl with_fop=no with_gnu_ld=yes with_mem_check=no with_openssl_engine=no with_sysroot=no with_xmlto=no

# cat tunG.conf
float
resolv-retry 60
remote-random
remote 172.16.0.9 1194 udp
ifconfig-noexec
lport 1194
dev tunG
dev-type tun
cipher AES-128-CBC
auth SHA256
keepalive 10 120
tls-client
ca /var/etc/openvpn/tunG/ca.pem
cert /var/etc/openvpn/tunG/my_cert.pem
key /var/etc/openvpn/tunG/my_key.pem
tls-verify "..."
pull
replay-window 64
script-security 2
up-delay
up-restart
block-ipv6
verb 7
#
# Logs:

Aug 30 14:31:38 notic tunG    [ 3224]: OpenVPN 2.6.6 arm-linux-musleabi [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] [DCO]
Aug 30 14:31:38 notic tunG    [ 3224]: library versions: OpenSSL 1.1.1u  30 May 2023, LZO 2.10
Aug 30 14:31:38 notic tunG    [ 3224]: DCO version: 2.0.0
Aug 30 14:31:38 warn  tunG    [ 3226]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Aug 30 14:31:38 notic tunG    [ 3226]: MTU: adding 426 buffer tailroom for compression for 1768 bytes of payload
Aug 30 14:31:38 notic tunG    [ 3226]: Control Channel MTU parms [ mss_fix:0 max_frag:0 tun_mtu:1250 tun_max_mtu:0 headroom:126 payload:1600 tailroom:126 ET:0 ]
Aug 30 14:31:38 notic tunG    [ 3226]: Data Channel MTU parms [ mss_fix:0 max_frag:0 tun_mtu:1500 tun_max_mtu:1600 headroom:136 payload:1768 tailroom:562 ET:0 ]
Aug 30 14:31:38 notic tunG    [ 3226]: Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1569,tun-mtu 1500,proto UDPv4,auth SHA256,keysize 128,key-method 2,tls-client'
Aug 30 14:31:38 notic tunG    [ 3226]: Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1569,tun-mtu 1500,proto UDPv4,auth SHA256,keysize 128,key-method 2,tls-server'
Aug 30 14:31:38 notic tunG    [ 3226]: TCP/UDP: Preserving recently used remote address: [AF_INET]172.16.0.9:1194
Aug 30 14:31:38 notic tunG    [ 3226]: Socket Buffers: R=[180224->180224] S=[180224->180224]
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 link local (bound): [AF_INET][undef]:1194
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 link remote: [AF_INET]172.16.0.9:1194
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 WRITE [14] to [AF_INET]172.16.0.9:1194: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 READ [26] from [AF_INET]172.16.0.9:1194: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
Aug 30 14:31:38 notic tunG    [ 3226]: TLS: Initial packet from [AF_INET]172.16.0.9:1194, sid=91eeeb7a 9bb7d9e2
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 WRITE [299] to [AF_INET]172.16.0.9:1194: P_CONTROL_V1 kid=0 [ 0 ] pid=1 DATA len=273
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 READ [22] from [AF_INET]172.16.0.9:1194: P_ACK_V1 kid=0 [ 1 ] DATA len=0
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 READ [1188] from [AF_INET]172.16.0.9:1194: P_CONTROL_V1 kid=0 [ ] pid=1 DATA len=1174
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 WRITE [26] to [AF_INET]172.16.0.9:1194: P_ACK_V1 kid=0 [ 1 0 ] DATA len=0
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 READ [1188] from [AF_INET]172.16.0.9:1194: P_CONTROL_V1 kid=0 [ ] pid=2 DATA len=1174
Aug 30 14:31:38 notic tunG    [ 3226]: VERIFY SCRIPT OK: ...
Aug 30 14:31:38 notic tunG    [ 3226]: VERIFY OK: ...
Aug 30 14:31:38 notic tunG    [ 3226]: VERIFY SCRIPT OK: depth=0, ...
Aug 30 14:31:38 notic tunG    [ 3226]: VERIFY OK: depth=0, ...
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 WRITE [30] to [AF_INET]172.16.0.9:1194: P_ACK_V1 kid=0 [ 2 1 0 ] DATA len=0
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 READ [207] from [AF_INET]172.16.0.9:1194: P_CONTROL_V1 kid=0 [ ] pid=3 DATA len=193
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 WRITE [1222] to [AF_INET]172.16.0.9:1194: P_CONTROL_V1 kid=0 [ 3 2 1 0 ] pid=2 DATA len=1184
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 WRITE [1115] to [AF_INET]172.16.0.9:1194: P_CONTROL_V1 kid=0 [ 3 2 1 0 ] pid=3 DATA len=1077
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 READ [22] from [AF_INET]172.16.0.9:1194: P_ACK_V1 kid=0 [ 2 ] DATA len=0
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 READ [184] from [AF_INET]172.16.0.9:1194: P_CONTROL_V1 kid=0 [ 3 ] pid=4 DATA len=158
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 WRITE [34] to [AF_INET]172.16.0.9:1194: P_ACK_V1 kid=0 [ 4 3 2 1 ] DATA len=0
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 READ [235] from [AF_INET]172.16.0.9:1194: P_CONTROL_V1 kid=0 [ ] pid=5 DATA len=221
Aug 30 14:31:38 notic tunG    [ 3226]: Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA1
Aug 30 14:31:38 notic tunG    [ 3226]: [testdevice2] Peer Connection Initiated with [AF_INET]172.16.0.9:1194
Aug 30 14:31:38 notic tunG    [ 3226]: TLS: move_session: dest=TM_ACTIVE src=TM_INITIAL reinit_src=1
Aug 30 14:31:38 notic tunG    [ 3226]: TLS: tls_multi_process: initial untrusted session promoted to trusted
Aug 30 14:31:38 notic tunG    [ 3226]: UDPv4 WRITE [34] to [AF_INET]172.16.0.9:1194: P_ACK_V1 kid=0 [ 5 4 3 2 ] DATA len=0
Aug 30 14:31:39 notic tunG    [ 3226]: SENT CONTROL [testdevice2]: 'PUSH_REQUEST' (status=1)
Aug 30 14:31:39 notic tunG    [ 3226]: UDPv4 WRITE [73] to [AF_INET]172.16.0.9:1194: P_CONTROL_V1 kid=0 [ 5 4 3 2 ] pid=4 DATA len=35
Aug 30 14:31:39 notic tunG    [ 3226]: UDPv4 READ [22] from [AF_INET]172.16.0.9:1194: P_ACK_V1 kid=0 [ 4 ] DATA len=0
Aug 30 14:31:39 notic tunG    [ 3226]: UDPv4 READ [170] from [AF_INET]172.16.0.9:1194: P_CONTROL_V1 kid=0 [ ] pid=6 DATA len=156
Aug 30 14:31:39 notic tunG    [ 3226]: PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.5.0.1,topology subnet,ping 5,ping-restart 30,ifconfig 10.5.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Aug 30 14:31:39 notic tunG    [ 3226]: OPTIONS IMPORT: timers and/or timeouts modified
Aug 30 14:31:39 notic tunG    [ 3226]: OPTIONS IMPORT: --ifconfig/up options modified
Aug 30 14:31:39 notic tunG    [ 3226]: OPTIONS IMPORT: route-related options modified
Aug 30 14:31:39 notic tunG    [ 3226]: OPTIONS IMPORT: peer-id set
Aug 30 14:31:39 notic tunG    [ 3226]: OPTIONS IMPORT: data channel crypto options modified
Aug 30 14:31:39 notic tunG    [ 3226]: open_tun_dco: tunG
Aug 30 14:31:39 notic tunG    [ 3226]: net_iface_new: add tunG type ovpn-dco
Aug 30 14:31:39 notic tunG    [ 3226]: sitnl_send: checking for received messages
Aug 30 14:31:39 notic tunG    [ 3226]: sitnl_send: rtnl: received 96 bytes
Aug 30 14:31:39 warn  tunG    [ 3226]: sitnl_send: rtnl: generic error (-17): File exists
Aug 30 14:31:39 notic tunG    [ 3226]: Cannot create DCO interface tunG: -17
Aug 30 14:31:39 notic tunG    [ 3226]: DCO device tunG already exists, won't be destroyed at shutdown
Aug 30 14:31:39 notic tunG    [ 3226]: /sbin/openvpn-up-down.sh tunG tunG 1500 0 10.5.0.2 255.255.255.0 init
Aug 30 14:31:39 notic tunG    [ 3226]: dco_new_peer: peer-id 0, fd 3, remote addr: [AF_INET]172.16.0.9:1194
Aug 30 14:31:39 err   tunG    [ 3226]: dco_new_peer: netlink reports device not found:
Aug 30 14:31:39 notic tunG    [ 3226]: Exiting due to fatal error
Aug 30 14:31:39 notic tunG    [ 3226]: Closing DCO interface
Aug 30 14:31:39 notic tunG    [ 3226]: close_tun_dco
Aug 30 14:31:39 notic tunG    [ 3226]: net_iface_del: delete tunG

Server infos:

# openvpn --version OpenVPN 2.4.7 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep 5 2019 library versions: OpenSSL 1.1.1f 31 Mar 2020, LZO 2.10 Originally developed by James Yonan Copyright (C) 2002-2018 OpenVPN Inc <sales@openvpn.net> Compile time defines: enable_async_push=no enable_comp_stub=no enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_iproute2=yes enable_libtool_lock=yes enable_lz4=yes enable_lzo=yes enable_maintainer_mode=no enable_management=yes enable_multihome=yes enable_pam_dlopen=no enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_silent_rules=no enable_small=no enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=yes enable_werror=no enable_win32_dll=yes enable_x509_alt_username=yes with_aix_soname=aix with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_sysroot=no

Start by tracing the DCO interface lifecycle around the logged open_tun_dco, net_iface_new, dco_new_peer, and net_iface_del entry points. Reproduce the failure with a tunG device created by --mktun, then verify the interface can be reused for the tunnel without the File exists and device not found errors.