netdev - Re: [RFC] State resolution packet queue for IPsec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20130121.161716.752461350033731834.davem@davemloft.net>
Date:	Mon, 21 Jan 2013 16:17:16 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	steffen.klassert@...unet.com
Cc:	herbert@...dor.apana.org.au, netdev@...r.kernel.org
Subject: Re: [RFC] State resolution packet queue for IPsec

From: Steffen Klassert <steffen.klassert@...unet.com>
Date: Mon, 21 Jan 2013 10:48:48 +0100

> I did a implementation of a state resolution packet queue for IPsec.
> The original idea is described in git commit 14e50e57a
> ([XFRM]: Allow packet drops during larval state resolution.)
> 
> Since we don't have any notifiers for xfrm state resolution, I used
> a timer that does a relookup in given intervals. This is mainly to speed
> up the start of tcp connections, so I tried to do the relookup in a higher
> rate that tcp would resend the syn packet. However, the relookup intervals,
> the queue size and the timeout value are choosen by gut instincts, so
> could be suboptimal. If anyone has some insight on good choices of these
> values, please let me know. All other comment are welcome too, of course.

This is probably the best way to solve this problem without adding
xfrm_state resolution notifications.

But really why would notifications be so bad even if they would not
be fine grained?

Any time a state is resolved, any state, you run what you have put
currently into this new timer function.

Most of the time, defer list is empty, so no work is done.  Otherwise
quick notification is essential and worth running the list.

Then there are no time based heuristics to come up with at all.

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html