netdev - Re: [PATCH ipsec-next 0/2] xfrm interface: use hash to store xfrmi contexts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20200714094407.GR20687@gauss3.secunet.de>
Date:   Tue, 14 Jul 2020 11:44:07 +0200
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     Eyal Birger <eyal.birger@...il.com>
CC:     <davem@...emloft.net>, <herbert@...dor.apana.org.au>,
        <netdev@...r.kernel.org>
Subject: Re: [PATCH ipsec-next 0/2] xfrm interface: use hash to store xfrmi
 contexts

On Thu, Jul 09, 2020 at 01:16:50PM +0300, Eyal Birger wrote:
> When having many xfrm interfaces, the linear lookup of devices based on
> if_id becomes costly.
> 
> The first patch refactors xfrmi_decode_session() to use the xi used in
> the netdevice priv context instead of looking it up in the list based
> on ifindex. This is needed in order to use if_id as the only key used
> for xi lookup.
> 
> The second patch extends the existing infrastructure - which already
> stores the xfrmi contexts in an array of lists - to use a hash of the
> if_id.
> 
> Example benchmarks:
> - running on a KVM based VM
> - xfrm tunnel mode between two namespaces
> - xfrm interface in one namespace (10.0.0.2)
> 
> Before this change set:
> 
> Single xfrm interface in namespace:
> $ netperf -H 10.0.0.2 -l8 -I95,10 -t TCP_STREAM
> 
> MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.0.0.2 () port 0 AF_INET : +/-5.000% @ 95% conf.  : demo
> Recv   Send    Send                          
> Socket Socket  Message  Elapsed              
> Size   Size    Size     Time     Throughput  
> bytes  bytes   bytes    secs.    10^6bits/sec  
> 
> 131072  16384  16384    8.00      298.36
> 
> After adding 400 xfrmi interfaces in the same namespace:
> 
> $ netperf -H 10.0.0.2 -l8 -I95,10 -t TCP_STREAM
> 
> MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.0.0.2 () port 0 AF_INET : +/-5.000% @ 95% conf.  : demo
> Recv   Send    Send                          
> Socket Socket  Message  Elapsed              
> Size   Size    Size     Time     Throughput  
> bytes  bytes   bytes    secs.    10^6bits/sec  
> 
> 131072  16384  16384    8.00      221.77   
> 
> After this patchset there was no observed change after adding the
> xfrmi interfaces.
> 
> Eyal Birger (2):
>   xfrm interface: avoid xi lookup in xfrmi_decode_session()
>   xfrm interface: store xfrmi contexts in a hash by if_id
> 
>  net/xfrm/xfrm_interface.c | 52 +++++++++++++++++++++++++--------------
>  1 file changed, 33 insertions(+), 19 deletions(-)

Applied to ipsec-next, thanks a lot Eyal!