On Thu, Nov 08, 2018 at 07:00:14PM -0800, David Miller wrote: > From: Florian Westphal <f...@strlen.de> > Date: Wed, 7 Nov 2018 23:00:30 +0100 > > > This series attempts to improve xfrm policy lookup performance when > > a lot of (several hundred or even thousands) inexact policies exist > > on a system. > > > > On insert, a policy is either placed in hash table (all direct (/32 for > > ipv4, /128 policies, or all policies matching a user-configured threshold). > > All other policies get inserted into inexact list as per priority. > > > > Lookup then scans inexact list for first matching entry. > > > > This series instead makes it so that inexact policy is added to exactly > > one of four different search list classes. > > > > 1. "Any:Any" list, containing policies where both saddr and daddr are > > wildcards or have very coarse prefixes, e.g. 10.0.0.0/8 and the like. > > 2. "saddr:any" list, containing policies with a fixed saddr/prefixlen, > > but without destination restrictions. > > These lists are stored in rbtree nodes; each node contains those > > policies matching saddr/prefixlen. > > 3. "Any:daddr" list. Similar to 2), except for policies where only the > > destinations are specified. > > 4. "saddr:daddr" lists, containing policies that match the given > > source/destination network. > > > > The root of the saddr/daddr tree is stored in the nodes of the > > 'daddr' tree. > ... > > Comments or questions welcome. > > Acked-by: David S. Miller <da...@davemloft.net>
This is now applied to ipsec-next, thanks a lot for your work Florian!
