KarpelesLab / pktkit / 24003982542

53%

Build Type

push

github

Committed by MagicalTux

Commit Message

Optimize OpenVPN GCM data channel: 18x encrypt, 2x decrypt

Rewrite GCM encrypt/decrypt hot paths to eliminate per-packet allocations:

Encrypt (sendDataGCM): pre-allocate single output buffer from global pool,
build nonce/AD on stack, Seal directly into output. 9 allocs → 1 (4B pool
handle), 4450 → 226 ns/op, 319 → 6293 MB/s at 1420B.

Decrypt (handleDataGCM): parse wire format with direct slice indexing
instead of bytes.NewReader, swap tag in-place, Open in-place. 9 allocs → 1
(benchmark copy), 2769 → 1312 ns/op, 513 → 1082 MB/s at 1420B.

Move Noescape/NoescapeBytes helpers to pktkit.pool.go for sharing across
wg and ovpn packages. The noescape trick prevents stack-allocated [12]byte
nonce arrays from escaping to heap through the crypto AEAD []byte interface.

CBC path is unchanged (less common, more complex due to PKCS5/HMAC).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Coverage Stats

1 of 166 new or added lines in 3 files covered. (0.6%)

15 existing lines in 3 files now uncovered.

5871 of 13242 relevant lines covered (44.34%)

21.71 hits per line