Messages in this thread |  | | Date | Tue, 2 Oct 2018 23:35:36 +0200 | From | Florian Westphal <> | Subject | Re: Regression: kernel 4.14 an later very slow with many ipsec tunnels |
| |
Wolfgang Walter <linux@stwm.de> wrote: > Am Dienstag, 2. Oktober 2018, 16:56:16 schrieb Florian Westphal: > > I'm experimenting with per-dst inexact lists in an rbtree but > > this will take time. > > Hmm, I doubt that this is worth the effort. And certainly not that easy
Well, I'm not going to send a revert of the flowcache removal.
I'm willing to experiment with alternatives to a full iteration of the inexact list but thats it.
> correctly done, as it still would have to obey the original order of the rules > (their priority).
Except that neither the priority or the order in which it was added matters in case the selector doesn't match.
I see no reason why we can't have inexact lists done per dst<->src pairs.
> You may have a lot of rules of the form say > > 10.0.0.0/16 <=> 10.1.0.0/29 encrypt .... > 10.0.0.0/16 <=> 10.1.0.8/29 encrypt ....
Sure.
> Also, you get something like that > > 10.0.1.0/24 <=> 10.0.2.0/29 allow > 10.0.0.0/16 <=> 10.0.2.0/24 encrypt > 0.0.0.0 <=> 10.0.2.0/16 block > > And people may use source port and/or destination port or protocol > (tcp/udp/imcp) to further tailor there ruleset.
Yes. 0.0.0.0/0 handling will require some extra consideration.
So far I have not seen a show-stopper however.
|  |