Turning on IPSEC used to introduce a slight amount of performance
degradation (7%) for host host TCP connections over 10Gbps links, even when there were no secuirty policies in place. There is no change in performance on 1Gbps network links. Testing GENERIC vs. GENERIC-NOIPSEC vs. GENERIC with this change shows that the new code removes any overhead introduced by having IPSEC always in the kernel. Differential Revision: D3993 MFC after: 1 month Sponsored by: Rubicon Communications (Netgate)
This commit is contained in:
parent
b0be2b128f
commit
26882b4239
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=290028
@ -158,6 +158,10 @@ int
|
||||
ip_ipsec_output(struct mbuf **m, struct inpcb *inp, int *error)
|
||||
{
|
||||
struct secpolicy *sp;
|
||||
|
||||
if (!key_havesp(IPSEC_DIR_INBOUND))
|
||||
return 0;
|
||||
|
||||
/*
|
||||
* Check the security policy (SP) for the packet and, if
|
||||
* required, do IPsec-related processing. There are two
|
||||
|
@ -1972,7 +1972,8 @@ ipsec_hdrsiz_tcp(struct tcpcb *tp)
|
||||
#endif
|
||||
struct tcphdr *th;
|
||||
|
||||
if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL))
|
||||
if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL) ||
|
||||
(!key_havesp(IPSEC_DIR_OUTBOUND)))
|
||||
return (0);
|
||||
m = m_gethdr(M_NOWAIT, MT_DATA);
|
||||
if (!m)
|
||||
|
@ -1276,6 +1276,9 @@ ipsec46_in_reject(struct mbuf *m, struct inpcb *inp)
|
||||
int error;
|
||||
int result;
|
||||
|
||||
if (!key_havesp(IPSEC_DIR_INBOUND))
|
||||
return 0;
|
||||
|
||||
IPSEC_ASSERT(m != NULL, ("null mbuf"));
|
||||
|
||||
/* Get SP for this packet. */
|
||||
@ -1403,6 +1406,9 @@ ipsec_hdrsiz(struct mbuf *m, u_int dir, struct inpcb *inp)
|
||||
int error;
|
||||
size_t size;
|
||||
|
||||
if (!key_havesp(dir))
|
||||
return 0;
|
||||
|
||||
IPSEC_ASSERT(m != NULL, ("null mbuf"));
|
||||
|
||||
/* Get SP for this packet. */
|
||||
|
Loading…
Reference in New Issue
Block a user