Re: Regression: kernel 4.14 an later very slow with many ipsec tunnels

From: Florian Westphal
Date: Tue Oct 02 2018 - 17:35:45 EST


Wolfgang Walter <linux@xxxxxxx> wrote:
> Am Dienstag, 2. Oktober 2018, 16:56:16 schrieb Florian Westphal:
> > I'm experimenting with per-dst inexact lists in an rbtree but
> > this will take time.
>
> Hmm, I doubt that this is worth the effort. And certainly not that easy

Well, I'm not going to send a revert of the flowcache removal.

I'm willing to experiment with alternatives to a full iteration of the
inexact list but thats it.

> correctly done, as it still would have to obey the original order of the rules
> (their priority).

Except that neither the priority or the order in which it was added
matters in case the selector doesn't match.

I see no reason why we can't have inexact lists done per dst<->src pairs.

> You may have a lot of rules of the form say
>
> 10.0.0.0/16 <=> 10.1.0.0/29 encrypt ....
> 10.0.0.0/16 <=> 10.1.0.8/29 encrypt ....

Sure.

> Also, you get something like that
>
> 10.0.1.0/24 <=> 10.0.2.0/29 allow
> 10.0.0.0/16 <=> 10.0.2.0/24 encrypt
> 0.0.0.0 <=> 10.0.2.0/16 block
>
> And people may use source port and/or destination port or protocol
> (tcp/udp/imcp) to further tailor there ruleset.

Yes. 0.0.0.0/0 handling will require some extra consideration.

So far I have not seen a show-stopper however.