d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Reduce overhead of IPSEC for traffic generated from host

Browse Source 
When IPSEC is enabled on the kernel the forwarding path has an optimization to not enter the code paths
for checking security policies but first checks if there is any security policy active at all.

The patch introduces the same optimization but for traffic generated from the host itself.
This reduces the overhead by 50% on my tests for generated host traffic without and SP active.

Differential Revision:	https://reviews.freebsd.org/D2980
Reviewed by:	ae, gnn
Approved by:	gnn(mentor)
This commit is contained in:
Ermal Luçi 2015-07-03 15:31:56 +00:00
parent 4ebd95ae06
commit c1fc5e9601
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/netipsec/ipsec.c
View File

@ -334,6 +334,12 @@ ipsec_getpolicybysock(struct mbuf *m, u_int dir, struct inpcb *inp, int *error)
IPSEC_ASSERT(dir == IPSEC_DIR_INBOUND || dir == IPSEC_DIR_OUTBOUND,
("invalid direction %u", dir));
if (!key_havesp(dir)) {
/* No SP found, use system default. */
sp = KEY_ALLOCSP_DEFAULT();
return (sp);
}
/* Set spidx in pcb. */
*error = ipsec_setspidx_inpcb(m, inp);
if (*error)