Re: Regression: kernel 4.14 an later very slow with many ipsec tunnels

[Florian Westphal]

Wolfgang Walter <linux@xxxxxxx> wrote:
> Am Dienstag, 2. Oktober 2018, 16:56:16 schrieb Florian Westphal:
> > I'm experimenting with per-dst inexact lists in an rbtree but
> > this will take time.
> 
> Hmm, I doubt that this is worth the effort. And certainly not that easy 

Well, I'm not going to send a revert of the flowcache removal.

I'm willing to experiment with alternatives to a full iteration of the
inexact list but thats it.

> correctly done, as it still would have to obey the original order of the rules 
> (their priority).

Except that neither the priority or the order in which it was added
matters in case the selector doesn't match.

I see no reason why we can't have inexact lists done per dst<->src pairs.

> You may have a lot of rules of the form say
> 
> 	10.0.0.0/16 <=> 10.1.0.0/29 encrypt ....
> 	10.0.0.0/16 <=> 10.1.0.8/29 encrypt ....

Sure.

> Also, you get something like that
> 
> 	10.0.1.0/24 <=> 10.0.2.0/29 allow
> 	10.0.0.0/16 <=> 10.0.2.0/24 encrypt
> 	0.0.0.0 <=> 10.0.2.0/16 block
> 
> And people may use source port and/or destination port or protocol 
> (tcp/udp/imcp) to further tailor there ruleset.

Yes. 0.0.0.0/0 handling will require some extra consideration.

So far I have not seen a show-stopper however.