netdev - Re: [PATCH ipsec-next 00/11] xfrm: policy: add inexact policy search tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20181113214148.GK8742@gauss3.secunet.de>
Date:   Tue, 13 Nov 2018 22:41:48 +0100
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     David Miller <davem@...emloft.net>
CC:     <fw@...len.de>, <netdev@...r.kernel.org>
Subject: Re: [PATCH ipsec-next 00/11] xfrm: policy: add inexact policy search
 tree

On Thu, Nov 08, 2018 at 07:00:14PM -0800, David Miller wrote:
> From: Florian Westphal <fw@...len.de>
> Date: Wed,  7 Nov 2018 23:00:30 +0100
> 
> > This series attempts to improve xfrm policy lookup performance when
> > a lot of (several hundred or even thousands) inexact policies exist
> > on a system.
> > 
> > On insert, a policy is either placed in hash table (all direct (/32 for
> > ipv4, /128 policies, or all policies matching a user-configured threshold).
> > All other policies get inserted into inexact list as per priority.
> > 
> > Lookup then scans inexact list for first matching entry.
> > 
> > This series instead makes it so that inexact policy is added to exactly
> > one of four different search list classes.
> > 
> > 1. "Any:Any" list, containing policies where both saddr and daddr are
> >    wildcards or have very coarse prefixes, e.g. 10.0.0.0/8 and the like.
> > 2. "saddr:any" list, containing policies with a fixed saddr/prefixlen,
> >    but without destination restrictions.
> >    These lists are stored in rbtree nodes; each node contains those
> >    policies matching saddr/prefixlen.
> > 3. "Any:daddr" list. Similar to 2), except for policies where only the
> >    destinations are specified.
> > 4. "saddr:daddr" lists, containing policies that match the given
> >    source/destination network.
> > 
> >    The root of the saddr/daddr tree is stored in the nodes of the
> >    'daddr' tree.
> ...
> > Comments or questions welcome.
> 
> Acked-by: David S. Miller <davem@...emloft.net>

This is now applied to ipsec-next, thanks a lot
for your work Florian!