feat(wireguard): WIREGUARD_GSO option to disable TUN vnet hdr batching (#3424)

internal/amneziawg/constructor_test.go

@@ -62,6 +62,7 @@ func Test_New(t *testing.T) {
 						MTU:            device.DefaultMTU,
 						IPv6:           ptrTo(false),
 						Implementation: "auto",
+						GSO:            ptrTo(true),
 					},
 				},
 			},

internal/amneziawg/log.go

@@ -6,6 +6,7 @@ type Logger interface {
 	Debug(s string)
 	Debugf(format string, args ...interface{})
 	Info(s string)
+	Warn(s string)
 	Error(s string)
 	Errorf(format string, args ...interface{})
 }

internal/amneziawg/log_mock_test.go

@@ -108,3 +108,15 @@ func (mr *MockLoggerMockRecorder) Info(s any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Info", reflect.TypeOf((*MockLogger)(nil).Info), s)
 }
+
+// Warn mocks base method.
+func (m *MockLogger) Warn(s string) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "Warn", s)
+}
+
+// Warn indicates an expected call of Warn.
+func (mr *MockLoggerMockRecorder) Warn(s any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Warn", reflect.TypeOf((*MockLogger)(nil).Warn), s)
+}

internal/amneziawg/offload_linux.go

@@ -0,0 +1,27 @@
+package amneziawg
+
+import (
+	"fmt"
+
+	amneziatun "github.com/amnezia-vpn/amneziawg-go/tun"
+	"github.com/qdm12/gluetun/internal/wireguard"
+)
+
+// createTUN creates a TUN device. When gso is false, IFF_VNET_HDR is
+// omitted so amneziawg-go's initFromFlags sees no vnet header support and
+// keeps tun.vnetHdr=false, falling back to simple single-packet writes instead
+// of the GRO/GSO batch path that causes EINVAL on some vendor kernels.
+func createTUN(name string, mtu int, gso bool) (amneziatun.Device, error) { //nolint:ireturn
+	if gso {
+		return amneziatun.CreateTUN(name, mtu)
+	}
+	tunFile, err := wireguard.OpenTUNFile(name)
+	if err != nil {
+		return nil, fmt.Errorf("creating tun fd file: %w", err)
+	}
+	tunDevice, err := amneziatun.CreateTUNFromFile(tunFile, mtu)
+	if err != nil {
+		return nil, fmt.Errorf("creating TUN device from file: %w", err)
+	}
+	return tunDevice, nil
+}

internal/amneziawg/offload_unspecified.go

@@ -0,0 +1,11 @@
+//go:build !linux
+
+package amneziawg
+
+import (
+	amneziatun "github.com/amnezia-vpn/amneziawg-go/tun"
+)
+
+func createTUN(name string, mtu int, _ bool) (amneziatun.Device, error) { //nolint:ireturn
+	return amneziatun.CreateTUN(name, mtu)
+}

internal/amneziawg/run.go

@@ -8,7 +8,6 @@ import (
 
 	amneziaconn "github.com/amnezia-vpn/amneziawg-go/conn"
 	amneziadevice "github.com/amnezia-vpn/amneziawg-go/device"
-	amneziatun "github.com/amnezia-vpn/amneziawg-go/tun"
 	"github.com/qdm12/gluetun/internal/cleanup"
 	"github.com/qdm12/gluetun/internal/wireguard"
 )
@@ -36,7 +35,7 @@ func setupUserspace(ctx context.Context,
 ) (
 	linkIndex uint32, waitAndCleanup func() error, err error,
 ) {
-	tun, err := amneziatun.CreateTUN(interfaceName, int(mtu))
+	tun, err := createTUN(interfaceName, int(mtu), *settings.Wireguard.GSO)
 	if err != nil {
 		return 0, nil, fmt.Errorf("creating TUN device: %w", err)
 	}