Date: Thu, 7 Nov 2019 13:05:39 +0000 From: Santiago Martinez <sm@codenetworks.net> To: Kurt Jaeger <pi@freebsd.org>, Damien DEVILLE <damien.deville@stormshield.eu> Cc: Lawrence Stewart <lstewart@freebsd.org>, olivier <olivier@freebsd.org>, Eugene Grosbein <eugen@grosbein.net>, freebsd-net@freebsd.org Subject: Re: 10g IPsec ? Message-ID: <c54bc3ce-aad3-040b-4f3a-1c0059363d83@codenetworks.net> In-Reply-To: <20191107104128.GI1203@fc.opsec.eu> References: <20191104194637.GA71627@home.opsec.eu> <20191105191514.GG8521@funkthat.com> <CA%2Bq%2BTcogf6uiCX=LiENB=hpz3V-hJtKY-4m_2YYbxbuy9bFVww@mail.gmail.com> <f4051158-b80c-3c54-10c8-f1b01c401f0d@freebsd.org> <261b842d-51eb-4522-6ef5-0672e5d1594e@grosbein.net> <d2b64075-b9fe-b13d-760e-70cf0e074ea6@freebsd.org> <20191107073255.GU8521@funkthat.com> <54db0c82-ad44-13ed-8e1f-702557f331e5@grosbein.net> <972466586.1921723.1573120331472.JavaMail.zimbra@stormshield.eu> <20191107104128.GI1203@fc.opsec.eu>
next in thread | previous in thread | raw e-mail | index | archive | help
Super interesting, I'm also up for it, i guess i can help with some funding. Santi On 2019-11-07 10:41, Kurt Jaeger wrote: > Hi! > >> At Stormshield we have various patches related to that topic that we can share. >> >> On the flow id part, we have a patch that recompute a new flowid for the IPsec flow after encapsulation based on the spi. >> This force the usage of the same transmit queue on the network card side for each tunnel/SPI. >> >> If you are interested i can make a review for this one to upstream it, it is a small and simple modification. > Yes, please. If you have the review, please add me to it. > >> On one of our high end hardware (Intel(R) Xeon(R) E-2176G with 6 cores / ixl network cards), the previous code was running around 2.4Gbps using AES-GCM with a mix of packet size whose average size was around 650 bytes. >> After various heavy optimization in opencrypto/crypto.c and on IPsec stack we managed to increase the performance on the same test to around 5Gbps. Take care this is mainly targeted to the subset of opencrypto feature we are using in our products (mainly IPsec with or without hardware cryptography) >> >> I can take some time to review and submit this big patch if there is some interest in it. > I would appreciate this -- would it help if my company pays some > money for this to make it happen ? > >> It will require some work on our side cause at the moment this patch is for FreeBSD 10.3 and has some depencies to our custom polling code which is not in FreeBSD. We made the modification to work using kproc in the non polling code but we have still to test those on an unmodified FreeBSD. > Again, depending on the amount of work: it would definitly be interesting. > >> I can also share the various benchmark we did to illustrate the impact of some of the optimisation we did. > That would be very interesting. The final point would be: How > interoperable is the resulting IPsec connect with non-FreeBSD > counterparts 8-} ? >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?c54bc3ce-aad3-040b-4f3a-1c0059363d83>