diff options
author | George V. Neville-Neil <gnn@FreeBSD.org> | 2015-10-27 00:42:15 +0000 |
---|---|---|
committer | George V. Neville-Neil <gnn@FreeBSD.org> | 2015-10-27 00:42:15 +0000 |
commit | 26882b4239964b741bf42da504b14eedf5f40227 (patch) | |
tree | 9855b9677205615c2be8a1db40ff0ea6ae06a564 /sys/netinet | |
parent | b0be2b128f2acf23dee6d614a49a3573fdcb8ffc (diff) | |
download | src-26882b4239964b741bf42da504b14eedf5f40227.tar.gz src-26882b4239964b741bf42da504b14eedf5f40227.zip |
Turning on IPSEC used to introduce a slight amount of performance
degradation (7%) for host host TCP connections over 10Gbps links,
even when there were no secuirty policies in place. There is no
change in performance on 1Gbps network links. Testing GENERIC vs.
GENERIC-NOIPSEC vs. GENERIC with this change shows that the new
code removes any overhead introduced by having IPSEC always in the
kernel.
Differential Revision: D3993
MFC after: 1 month
Sponsored by: Rubicon Communications (Netgate)
Notes
Notes:
svn path=/head/; revision=290028
Diffstat (limited to 'sys/netinet')
-rw-r--r-- | sys/netinet/ip_ipsec.c | 4 | ||||
-rw-r--r-- | sys/netinet/tcp_subr.c | 3 |
2 files changed, 6 insertions, 1 deletions
diff --git a/sys/netinet/ip_ipsec.c b/sys/netinet/ip_ipsec.c index 546f802f9617..77ce4c1a79ad 100644 --- a/sys/netinet/ip_ipsec.c +++ b/sys/netinet/ip_ipsec.c @@ -158,6 +158,10 @@ int ip_ipsec_output(struct mbuf **m, struct inpcb *inp, int *error) { struct secpolicy *sp; + + if (!key_havesp(IPSEC_DIR_INBOUND)) + return 0; + /* * Check the security policy (SP) for the packet and, if * required, do IPsec-related processing. There are two diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c index e3f5b1324ce8..29af76664098 100644 --- a/sys/netinet/tcp_subr.c +++ b/sys/netinet/tcp_subr.c @@ -1972,7 +1972,8 @@ ipsec_hdrsiz_tcp(struct tcpcb *tp) #endif struct tcphdr *th; - if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL)) + if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL) || + (!key_havesp(IPSEC_DIR_OUTBOUND))) return (0); m = m_gethdr(M_NOWAIT, MT_DATA); if (!m) |