netdev - Re: [PATCH ipsec-next 00/11] xfrm: policy: add inexact policy search tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20181108.190014.1425864633966867348.davem@davemloft.net>
Date:   Thu, 08 Nov 2018 19:00:14 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     fw@...len.de
Cc:     netdev@...r.kernel.org
Subject: Re: [PATCH ipsec-next 00/11] xfrm: policy: add inexact policy
 search tree

From: Florian Westphal <fw@...len.de>
Date: Wed,  7 Nov 2018 23:00:30 +0100

> This series attempts to improve xfrm policy lookup performance when
> a lot of (several hundred or even thousands) inexact policies exist
> on a system.
> 
> On insert, a policy is either placed in hash table (all direct (/32 for
> ipv4, /128 policies, or all policies matching a user-configured threshold).
> All other policies get inserted into inexact list as per priority.
> 
> Lookup then scans inexact list for first matching entry.
> 
> This series instead makes it so that inexact policy is added to exactly
> one of four different search list classes.
> 
> 1. "Any:Any" list, containing policies where both saddr and daddr are
>    wildcards or have very coarse prefixes, e.g. 10.0.0.0/8 and the like.
> 2. "saddr:any" list, containing policies with a fixed saddr/prefixlen,
>    but without destination restrictions.
>    These lists are stored in rbtree nodes; each node contains those
>    policies matching saddr/prefixlen.
> 3. "Any:daddr" list. Similar to 2), except for policies where only the
>    destinations are specified.
> 4. "saddr:daddr" lists, containing policies that match the given
>    source/destination network.
> 
>    The root of the saddr/daddr tree is stored in the nodes of the
>    'daddr' tree.
...
> Comments or questions welcome.

Acked-by: David S. Miller <davem@...emloft.net>

This looks really great.  Nice work Florian.