> On Nov 26, 2015, at 00:24, George V. Neville-Neil <[email protected]> wrote: > > Author: gnn > Date: Thu Nov 26 02:24:45 2015 > New Revision: 291355 > URL: https://svnweb.freebsd.org/changeset/base/291355 > > Log: > MFC 290028: > Turning on IPSEC used to introduce a slight amount of performance > degradation (7%) for host host TCP connections over 10Gbps links, > even when there were no secuirty policies in place. There is no > change in performance on 1Gbps network links. Testing GENERIC vs. > GENERIC-NOIPSEC vs. GENERIC with this change shows that the new > code removes any overhead introduced by having IPSEC always in the > kernel. > > Differential Revision: D3993 > Sponsored by: Rubicon Communications (Netgate) > > Modified: > stable/10/sys/netinet/ip_ipsec.c > stable/10/sys/netinet/tcp_subr.c > stable/10/sys/netipsec/ipsec.c > Directory Properties: > stable/10/ (props changed) > > Modified: stable/10/sys/netinet/ip_ipsec.c > ============================================================================== > --- stable/10/sys/netinet/ip_ipsec.c Thu Nov 26 02:16:25 2015 > (r291354) > +++ stable/10/sys/netinet/ip_ipsec.c Thu Nov 26 02:24:45 2015 > (r291355) > @@ -230,6 +230,10 @@ ip_ipsec_output(struct mbuf **m, struct > struct secpolicy *sp = NULL; > struct tdb_ident *tdbi; > struct m_tag *mtag; > + > + if (!key_havesp(IPSEC_DIR_OUTBOUND)) > + return 0; > + > /* > * Check the security policy (SP) for the packet and, if > * required, do IPsec-related processing. There are two > > Modified: stable/10/sys/netinet/tcp_subr.c > ============================================================================== > --- stable/10/sys/netinet/tcp_subr.c Thu Nov 26 02:16:25 2015 > (r291354) > +++ stable/10/sys/netinet/tcp_subr.c Thu Nov 26 02:24:45 2015 > (r291355) > @@ -1947,7 +1947,8 @@ ipsec_hdrsiz_tcp(struct tcpcb *tp) > #endif > struct tcphdr *th; > > - if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL)) > + if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL) || > + (!key_havesp(IPSEC_DIR_OUTBOUND)))
Looks like style is broken here ^ -- Renato Botelho _______________________________________________ [email protected] mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10 To unsubscribe, send any mail to "[email protected]"
