[lkml]   [2018]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Regression: kernel 4.14 an later very slow with many ipsec tunnels
Wolfgang Walter <> wrote:
> Am Dienstag, 2. Oktober 2018, 16:56:16 schrieb Florian Westphal:
> > I'm experimenting with per-dst inexact lists in an rbtree but
> > this will take time.
> Hmm, I doubt that this is worth the effort. And certainly not that easy

Well, I'm not going to send a revert of the flowcache removal.

I'm willing to experiment with alternatives to a full iteration of the
inexact list but thats it.

> correctly done, as it still would have to obey the original order of the rules
> (their priority).

Except that neither the priority or the order in which it was added
matters in case the selector doesn't match.

I see no reason why we can't have inexact lists done per dst<->src pairs.

> You may have a lot of rules of the form say
> <=> encrypt ....
> <=> encrypt ....


> Also, you get something like that
> <=> allow
> <=> encrypt
> <=> block
> And people may use source port and/or destination port or protocol
> (tcp/udp/imcp) to further tailor there ruleset.

Yes. handling will require some extra consideration.

So far I have not seen a show-stopper however.

 \ /
  Last update: 2018-10-02 23:36    [W:0.106 / U:0.920 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site