netdev - RE: CPU usage for IPSec in Linux 2.6.38

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 11 Jan 2012 08:20:12 +0530
From:	"Naveen B N (nbn)" <nbn@...co.com>
To:	<ipsec-tools-devel@...ts.sourceforge.net>
Cc:	<netdev@...r.kernel.org>
Subject: RE: CPU usage for IPSec in Linux 2.6.38

Hi All,
Did anybody try creating IPSec Tunnels > 6000 in Linux
And faced the same problem below.

Regards
Naveen

-----Original Message-----
From: Eric Dumazet [mailto:eric.dumazet@...il.com] 
Sent: Tuesday, January 10, 2012 8:55 PM
To: Naveen B N (nbn)
Cc: netdev@...r.kernel.org
Subject: RE: CPU usage for IPSec in Linux 2.6.38

Le mardi 10 janvier 2012 à 20:23 +0530, Naveen B N (nbn) a écrit :
> Hi All,
> I am using linux 2.6.36 kernel and trying to add 6000 Ikev2/ipsec
> tunnels at 20 Ikev2 messages per second , I am using netlink socket
> which is set to NON_BLOCKING and i am sending XFRM SPD added for every
> successful AUTH message received.
> 
> But the problem is after the 4000 tunnels are established, CPU usage
> goes to > 90%, which will likely cause dropping of few AUTH response
> from responder.
> 
> NOTE:
> But when I disabled adding SPD messaged via netlink sockets using xfrm
> messages, I am able to complete 6000 ikev2 SA negotiation successfully.
> 
> So the problem i am seeing is when sending XFRM netlink message > 4000.
> 
> Any solutions are or analysis different then the above is appreciated.
> 

Most probably something uses a linear search, giving O(N^2) complexity.

You could post "perf top" results while doing these operations.