Dear Maintainer,

After a system upgrade today, openvpn-dco-dkms failed to build against
the newly installed kernel with headers from the
linux-headers-7.1.5+deb14-amd64 package. It looks like the interface to
setup_udp_tunnel_sock has changed, with the second argument now being a
"struct sock *" instead of a "struct socket *", as per
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/diff/include/net/udp_tunnel.h?id=v7.1.5&id2=v7.1.4

Here's the build log that backs that up:
--- Build log start ---
DKMS (dkms-3.2.2) make.log for ovpn-dco/0.0+git20260519 for kernel 7.1.5+deb14-amd64 (x86_64)
Tue 28 Jul 07:17:39 BST 2026

Building module(s)
# command: make -j4 KERNELRELEASE=7.1.5+deb14-amd64 VER=7.1.5+deb14-amd64 KERNEL_SRC=/lib/modules/7.1.5+deb14-amd64/build REVISION=0.0+git20260519
/var/lib/dkms/ovpn-dco/0.0+git20260519/build/gen-compat-autoconf.sh /var/lib/dkms/ovpn-dco/0.0+git20260519/build/compat-autoconf.h
make -C /lib/modules/7.1.5+deb14-amd64/build M=/var/lib/dkms/ovpn-dco/0.0+git20260519/build PWD=/var/lib/dkms/ovpn-dco/0.0+git20260519/build REVISION=0.0+git20260519 CONFIG_OVPN_DCO_V2=m INSTALL_MOD_DIR=updates/     modules
make[1]: Entering directory '/usr/src/linux-headers-7.1.5+deb14-amd64'
make[2]: Entering directory '/var/lib/dkms/ovpn-dco/0.0+git20260519/build'
  CC [M]  drivers/net/ovpn-dco/main.o
  CC [M]  drivers/net/ovpn-dco/bind.o
  CC [M]  drivers/net/ovpn-dco/crypto.o
  CC [M]  drivers/net/ovpn-dco/ovpn.o
  CC [M]  drivers/net/ovpn-dco/peer.o
  CC [M]  drivers/net/ovpn-dco/sock.o
  CC [M]  drivers/net/ovpn-dco/stats.o
  CC [M]  drivers/net/ovpn-dco/netlink.o
  CC [M]  drivers/net/ovpn-dco/crypto_aead.o
  CC [M]  drivers/net/ovpn-dco/pktid.o
  CC [M]  drivers/net/ovpn-dco/tcp.o
  CC [M]  drivers/net/ovpn-dco/udp.o
drivers/net/ovpn-dco/udp.c: In function ‘ovpn_udp_socket_attach’:
drivers/net/ovpn-dco/udp.c:346:51: error: passing argument 2 of ‘setup_udp_tunnel_sock’ from incompatible pointer type [-Wincompatible-pointer-types]
  346 |         setup_udp_tunnel_sock(sock_net(sock->sk), sock, &cfg);
      |                                                   ^~~~
      |                                                   |
      |                                                   struct socket *
In file included from drivers/net/ovpn-dco/udp.c:25:
/usr/src/linux-headers-7.1.5+deb14-common/include/net/udp_tunnel.h:97:58: note: expected ‘struct sock *’ but argument is of type ‘struct socket *’
   97 | void setup_udp_tunnel_sock(struct net *net, struct sock *sk,
      |                                             ~~~~~~~~~~~~~^~
drivers/net/ovpn-dco/udp.c: In function ‘ovpn_udp_socket_detach’:
drivers/net/ovpn-dco/udp.c:356:51: error: passing argument 2 of ‘setup_udp_tunnel_sock’ from incompatible pointer type [-Wincompatible-pointer-types]
  356 |         setup_udp_tunnel_sock(sock_net(sock->sk), sock, &cfg);
      |                                                   ^~~~
      |                                                   |
      |                                                   struct socket *
/usr/src/linux-headers-7.1.5+deb14-common/include/net/udp_tunnel.h:97:58: note: expected ‘struct sock *’ but argument is of type ‘struct socket *’
   97 | void setup_udp_tunnel_sock(struct net *net, struct sock *sk,
      |                                             ~~~~~~~~~~~~~^~
make[5]: *** [/usr/src/linux-headers-7.1.5+deb14-common/scripts/Makefile.build:294: drivers/net/ovpn-dco/udp.o] Error 1
make[4]: *** [/usr/src/linux-headers-7.1.5+deb14-common/scripts/Makefile.build:553: drivers/net/ovpn-dco] Error 2
make[3]: *** [/usr/src/linux-headers-7.1.5+deb14-common/Makefile:2186: .] Error 2
make[2]: *** [/usr/src/linux-headers-7.1.5+deb14-common/Makefile:260: __sub-make] Error 2
make[2]: Leaving directory '/var/lib/dkms/ovpn-dco/0.0+git20260519/build'
make[1]: *** [/usr/src/linux-headers-7.1.5+deb14-common/Makefile:260: __sub-make] Error 2
make[1]: Leaving directory '/usr/src/linux-headers-7.1.5+deb14-amd64'
make: *** [Makefile:51: all] Error 2

# exit code: 2
# elapsed time: 00:00:04
--- Build log end ---

The solution feels like passing in sock->sk would do the trick if
compiling for >=7.1.5. I've tried this locally, and it seems to work.
I've attached the patch, but as I'm not a seasoned kernel developer it
might need a bit of cleaning or, or there could be better ways to do it,
but at least it unambiguously shows the path to the fix.

If I can be of any further assistance, just let me know.

Control: forwarded -1 https://github.com/OpenVPN/ovpn-dco/issues/103

Thanks a lot for your report, I have forwarded it upstream.

I assume you are aware, that openvpn-dco-dkms is solely used by OpenVPN
2.6. Since forky includes OpenVPN 2.7 (which only uses the in-tree
ovpn module) it's likely not in use on your system anymore and can
safely be deinstalled.

I will still follow up on this because there might be reasons for
trixie-backports kernel + openvpn 2.6 in Trixie, or forky with OpenVPN
pinned to 2.6, but it will definitely not be shipped with Forky release.

Bernhard

Excellent, thanks very much.

I actually realised this when I first experienced the problem, and after
verifying that my systems were in fact using the new ovpn module,
removed it. It thought it was still worth reporting for cases where this
couldn't happen, as you've pointed out. I appreciate your assistance in
pointing this out, though, thank you.

Hello, I don't fully understand your comment that the dco module only works with OpenVPN 2.6.

I use this module (openvpn-dco-dkms) with the openvpn3-client package, via the --dco true flag.

You can see this option in the openvpn3-client documentation here:

https://openvpn.net/community-docs/openvpn-client-for-linux.html#about-dco--data-channel-offload-

So, currently I'm affected by this bug on sid with openvpn3-client.

Thanks for your work!

Hi Angel,

Am 01.08.26 um 12:29 schrieb Angel Abad:

openvpn3 is not packaged for Debian.

Upstream calls ovpn-dco-v2 obsolete, see
https://github.com/OpenVPN/ovpn-dco . There is no in-Debian consumer for
openvpn-dco-dkms. OpenVPN3 will need to migrate to the new in-tree dco
module at some point.

Bernhard

Hi Bernhard

Yes, the client is:

https://tracker.debian.org/pkg/openvpn3-client

https://packages.debian.org/sid/openvpn3-client

This behavior is very strange, I didn't know about the in-tree ovpn module, but
when I launch openvpn3 session-start with "--dco true" (you can test it), this command
loads these modules:

ovpn_dco_v2            94208  0
ip6_udp_tunnel         16384  1 ovpn_dco_v2
udp_tunnel             40960  1 ovpn_dco_v2

But when I launch openvpn3 without any flags, no kernel module is loaded at all, not even ovpn.

Do you understand this, or do you know why this might be happening if this module is deprecated?

Why does the v3 client use it?

Happy to provide more logs/output if needed. Thanks!

Angel,

Hi,

Whoops, you are right. Sorry for missing that. Note that openvpn2 and
openvpn3 are two different implementations around the same wire
protocol, and don't have any overlap on the Debian maintainer side.

Yup, it looks like openvpn3 is still using the deprecated out-of-tree
ovpn-dco-v2 module.

I found some threads about the openvpn3 client in need to migrate to the
new DCO version, i.e.

https://codeberg.org/OpenVPN/openvpn3-linux/issues/96

However, I cannot find any change going into that direction on
openvpn3-core master. So it might take some more time.

I assume openvpn3 will be on the new in-tree module before Forky is
released, so openvpn-dco-dkms can go for good. If not, someone is always
free to adopt this package.

Bernhard

We believe that the bug you reported is fixed in the latest version of
openvpn-dco-dkms, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142917@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bernhard Schmidt <berni@debian.org> (supplier of updated openvpn-dco-dkms package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 03 Aug 2026 23:38:11 +0200
Source: openvpn-dco-dkms
Architecture: source
Version: 0.0+git20260519-2
Distribution: unstable
Urgency: medium
Maintainer: Bernhard Schmidt <berni@debian.org>
Changed-By: Bernhard Schmidt <berni@debian.org>
Closes: 1142917
Changes:
 openvpn-dco-dkms (0.0+git20260519-2) unstable; urgency=medium
 .
   * Cherry-pick proposed upstream commit to fix FTBFS on Linux 7.1.5+
     (Closes: #1142917)
Checksums-Sha1:
 3b128550fbba4a64aa87ed13cd19baa73ef8dead 2053 openvpn-dco-dkms_0.0+git20260519-2.dsc
 b7ff615c43ee93baaaa616833e607210b61de581 4436 openvpn-dco-dkms_0.0+git20260519-2.debian.tar.xz
 9de2d8eb64c4e20db8681e8bd4cacf65bca8864a 5686 openvpn-dco-dkms_0.0+git20260519-2_amd64.buildinfo
Checksums-Sha256:
 eae5154fb2ca3d9e247a76f74451880ab7b685a93211cd3c6a61b847491a0d02 2053 openvpn-dco-dkms_0.0+git20260519-2.dsc
 bcf06e2b05d8c535a0aa895c5b14c268b9a870ea1c9487f7704d90a178382822 4436 openvpn-dco-dkms_0.0+git20260519-2.debian.tar.xz
 1fa65bf0d3467ba5cdbba52bbf60a6e2d797e96921c09f489d2c02eb30c4cf82 5686 openvpn-dco-dkms_0.0+git20260519-2_amd64.buildinfo
Files:
 1b601e7f376b0343f77da5efcfe45641 2053 net optional openvpn-dco-dkms_0.0+git20260519-2.dsc
 44465905ee4b0e533983491c2e6c97b0 4436 net optional openvpn-dco-dkms_0.0+git20260519-2.debian.tar.xz
 92c0c84329036f91c1d19022ee51b061 5686 net optional openvpn-dco-dkms_0.0+git20260519-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEE1uAexRal3873GVbTd1B55bhQvJMFAmpxC2oRHGJlcm5pQGRl
Ymlhbi5vcmcACgkQd1B55bhQvJOZvhAAopw8l3/uye6sN4Io+LADQ3jiQS33HuWc
g0jHK2afMVX1KNsu+aKl/Az4cjwgfcbzkOxQKRpj2Thxz3JiaVIr6l4VnAJwzSMu
+OMaA/McrsShBAzHOJlfUQ/sFPFYJuE42MjX8Zkm2llzOsx/ItLaKEIyl485jBQC
s0A/trDnnw0X07tjhu/mmaHr0g4WOQLDHNab8U22p9b3GyG2oIwG98G8ueNTIl+7
Q+VCEkfYTPYixvsd/L6gn90RroKiyvXnH78ZaZ5K75WKCiGtx+VJxXXerknuyfOy
yAZ8RBu4enb4ou9Tuye3lDwU/+8gKCtXn7S+EiyurbdGa7VmLa3tlL15QymS54Pa
UmAffDlngsiQY6wjh5Fj6+9TBX10GmbVqteb2/OsNgPM0qdiUqQV0sNu5S+gZ2o1
1maxpYPpZdf1zJ5naFwhF1fxSagLVM3UXgoXtLASFaeMplKkUmYL+cxCHcmKQBHj
/2DdZzLaZXRW15CynirQOICYGKJsIPOEzJiCRO7wnlLZgQAKH229mgoSpeaS0muu
BV3mmEwQGgA2p4eDAmTxyoW70hW4p9E4vKuU8F6f9/zeSWIbB0kCOGVMWu/UeJeN
hYdcehg85r2Jge9/xooJoAFjZ86wTTZW58HUFneTFbWlTdSKX7+gsF25us4JjZou
ovriRktw7b4=
=lkhx
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
openvpn-dco-dkms, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1142917@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bernhard Schmidt <berni@debian.org> (supplier of updated openvpn-dco-dkms package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 06 Aug 2026 14:07:15 +0200
Source: openvpn-dco-dkms
Architecture: source
Version: 0.0+git20260804-1
Distribution: unstable
Urgency: medium
Maintainer: Bernhard Schmidt <berni@debian.org>
Changed-By: Bernhard Schmidt <berni@debian.org>
Closes: 1142917
Changes:
 openvpn-dco-dkms (0.0+git20260804-1) unstable; urgency=medium
 .
   * New upstream version 0.0+git20260804
     - really fixes FTBFS on 7.1.5+ (Closes: #1142917)
   * Drop patches included upstream
Checksums-Sha1:
 83660c7d5f372dfc54b554f2f6cea07e8aa028dc 2053 openvpn-dco-dkms_0.0+git20260804-1.dsc
 4f95b3cf4825a2e680b8cfbdfc19a47bb9545e18 71830 openvpn-dco-dkms_0.0+git20260804.orig.tar.gz
 40298d86b440024c9a3281cfb3b3712accff6194 3792 openvpn-dco-dkms_0.0+git20260804-1.debian.tar.xz
 1501440bafa5b7f6a17a8ca65b2c25af30bbae54 5686 openvpn-dco-dkms_0.0+git20260804-1_amd64.buildinfo
Checksums-Sha256:
 9cdb79db8af0ecf72c2d1fb588ab98c6d053c7261c548ce7543dfcfe5db5351d 2053 openvpn-dco-dkms_0.0+git20260804-1.dsc
 2b60c22316c458192701ffa5e346279aac2e079980d823c72fdaee2836edbe32 71830 openvpn-dco-dkms_0.0+git20260804.orig.tar.gz
 7eaf38393a1a9c4955a9a05c5f9ee265950b897951a70500f9ac261ba9b818d4 3792 openvpn-dco-dkms_0.0+git20260804-1.debian.tar.xz
 dc7858beeeff94df2656bc112b258b75d0502dae3df5f538e36787d537934ee9 5686 openvpn-dco-dkms_0.0+git20260804-1_amd64.buildinfo
Files:
 adff4a72307adcbad2d246ffe6f6c166 2053 net optional openvpn-dco-dkms_0.0+git20260804-1.dsc
 8f1d8708282353a515625d883576f6b8 71830 net optional openvpn-dco-dkms_0.0+git20260804.orig.tar.gz
 dcac81a8dd9a8678ecd10810c45508a5 3792 net optional openvpn-dco-dkms_0.0+git20260804-1.debian.tar.xz
 e44615500e8830d2ac5dee5b47790390 5686 net optional openvpn-dco-dkms_0.0+git20260804-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEE1uAexRal3873GVbTd1B55bhQvJMFAmp0eiIRHGJlcm5pQGRl
Ymlhbi5vcmcACgkQd1B55bhQvJP5Hg//RK4zoGInZ52YCUXyajRLCs8JxsiuOomT
9pK7hMosKydcLjq5OZRlc8ng4y8cUGnynA5KCi066dJ3LBDRtsaKGox3CXOYlWJR
tjLHXZRfv93SuK52qlQlOBcd1FZOsBCO6ir1qAY9M5pxqFgelVb2Nyy2rMMoTDQv
OHyKFr9BXyHoi9yHA/0peNE4hu3MYZChiswoQXJaFUeV2oze1NS0x2W2NL2pp9+4
ZTNQTrwBHrQwszFQUOkwwlbQ29tX3VqCWVaGprAKW9ORn1YOmmuPfApId+y3Ids6
aPpZ3+AdOaCV+L8nr8IXWJfdlqGivuby7M+X437WCH+u5Q96XEKN1QZtrX2/839p
uPNIYUTPGqyWXhngQ3G2TiLDO6ILErPVgtegXhA7/x6ZCwqHIeiU2Nxt+zzrnCEq
rspomlMtXfVb/SFgRfZrmDKsNJaDE9NxV05BFdXeDVsjFhEIfRr3A2NLIVdRDnsw
N+aYvr9sw5vxEzc218AiJUt4Yr6dsXy+zvvpcm2Xhcu0H9k+us2HpYZd8Jahg5Ej
wSdbj/u0nMBw74mkGnoTRwv5szIvvOnGf2YBrNSto+OKyD9IRWk4xSXyUR7fis56
ZhRAYHdwLYdGYBW6CIQZSkqb5z8YJfmVOntsfu6+Tq1c4FheaDDubx4eQBMMBXZJ
R3Twkvd9ZSA=
=5qoU
-----END PGP SIGNATURE-----