netdev - xfrm/ipsec/iptfs and some new sysctls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <m2bk2rx2lb.fsf@dhcp-8377.meeting.ietf.org>
Date: Sat, 20 Jul 2024 12:27:38 -0700
From: Christian Hopps <chopps@...pps.org>
To: netdev@...r.kernel.org
Cc: chopps@...pps.org, chopps@...n.net, devel@...ux-ipsec.org
Subject: xfrm/ipsec/iptfs and some new sysctls


As part of the new IPsec IP-TFS code we are adding a few new xfrm sysctls. These sysctls are used for setting the system-wide defaults for new IP-TFS SAs. New SAs can still override these defaults on a per-SA basis.

The thinking behind adding these is that IP-TFS is still a new technology and we'd like to get deployment experience to find what the best default values will be.

Does anyone object to adding the new sysctls? (doc included below)

Thanks,
Chris.


xfrm_iptfs_max_qsize - UNSIGNED INTEGER
        The default IPTFS max output queue size in octets. The output queue is
        where received packets destined for output over an IPTFS tunnel are
        stored prior to being output in aggregated/fragmented form over the
        IPTFS tunnel.

        Default 1M.

xfrm_iptfs_drop_time - UNSIGNED INTEGER
        The default IPTFS drop time in microseconds. The drop time is the amount
        of time before a missing out-of-order IPTFS tunnel packet is considered
        lost. See also the reorder window.

        Default 1s (1000000).

xfrm_iptfs_init_delay - UNSIGNED INTEGER
        The default IPTFS initial output delay in microseconds. The initial
        output delay is the amount of time prior to servicing the output queue
        after queueing the first packet on said queue. This applies anytime
        the output queue was previously empty.

        Default 0.

xfrm_iptfs_reorder_window - UNSIGNED INTEGER
        The default IPTFS reorder window size. The reorder window size dictates
        the maximum number of IPTFS tunnel packets in a sequence that may arrive
        out of order.

        Default 3.

Download attachment "signature.asc" of type "application/pgp-signature" (858 bytes)