lkml.org 
[lkml]   [2018]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Regression: kernel 4.14 an later very slow with many ipsec tunnels
Wolfgang Walter <linux@stwm.de> wrote:
> Am Dienstag, 2. Oktober 2018, 16:56:16 schrieb Florian Westphal:
> > I'm experimenting with per-dst inexact lists in an rbtree but
> > this will take time.
>
> Hmm, I doubt that this is worth the effort. And certainly not that easy

Well, I'm not going to send a revert of the flowcache removal.

I'm willing to experiment with alternatives to a full iteration of the
inexact list but thats it.

> correctly done, as it still would have to obey the original order of the rules
> (their priority).

Except that neither the priority or the order in which it was added
matters in case the selector doesn't match.

I see no reason why we can't have inexact lists done per dst<->src pairs.

> You may have a lot of rules of the form say
>
> 10.0.0.0/16 <=> 10.1.0.0/29 encrypt ....
> 10.0.0.0/16 <=> 10.1.0.8/29 encrypt ....

Sure.

> Also, you get something like that
>
> 10.0.1.0/24 <=> 10.0.2.0/29 allow
> 10.0.0.0/16 <=> 10.0.2.0/24 encrypt
> 0.0.0.0 <=> 10.0.2.0/16 block
>
> And people may use source port and/or destination port or protocol
> (tcp/udp/imcp) to further tailor there ruleset.

Yes. 0.0.0.0/0 handling will require some extra consideration.

So far I have not seen a show-stopper however.

\
 
 \ /
  Last update: 2018-10-02 23:36    [W:0.110 / U:0.472 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site