lkml.org 
[lkml]   [2018]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Regression: kernel 4.14 an later very slow with many ipsec tunnels
    Wolfgang Walter <linux@stwm.de> wrote:
    > Am Dienstag, 2. Oktober 2018, 16:56:16 schrieb Florian Westphal:
    > > I'm experimenting with per-dst inexact lists in an rbtree but
    > > this will take time.
    >
    > Hmm, I doubt that this is worth the effort. And certainly not that easy

    Well, I'm not going to send a revert of the flowcache removal.

    I'm willing to experiment with alternatives to a full iteration of the
    inexact list but thats it.

    > correctly done, as it still would have to obey the original order of the rules
    > (their priority).

    Except that neither the priority or the order in which it was added
    matters in case the selector doesn't match.

    I see no reason why we can't have inexact lists done per dst<->src pairs.

    > You may have a lot of rules of the form say
    >
    > 10.0.0.0/16 <=> 10.1.0.0/29 encrypt ....
    > 10.0.0.0/16 <=> 10.1.0.8/29 encrypt ....

    Sure.

    > Also, you get something like that
    >
    > 10.0.1.0/24 <=> 10.0.2.0/29 allow
    > 10.0.0.0/16 <=> 10.0.2.0/24 encrypt
    > 0.0.0.0 <=> 10.0.2.0/16 block
    >
    > And people may use source port and/or destination port or protocol
    > (tcp/udp/imcp) to further tailor there ruleset.

    Yes. 0.0.0.0/0 handling will require some extra consideration.

    So far I have not seen a show-stopper however.

    \
     
     \ /
      Last update: 2018-10-02 23:36    [W:2.448 / U:0.244 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site