From owner-freebsd-current@freebsd.org Fri Dec 7 15:40:42 2018 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 827BA1311002; Fri, 7 Dec 2018 15:40:42 +0000 (UTC) (envelope-from lev@FreeBSD.org) Received: from onlyone.not-for.work (onlyone.not-for.work [148.251.9.81]) by mx1.freebsd.org (Postfix) with ESMTP id D947F8FE18; Fri, 7 Dec 2018 15:40:41 +0000 (UTC) (envelope-from lev@FreeBSD.org) Received: from [192.168.23.186] (unknown [89.113.128.32]) (Authenticated sender: lev@serebryakov.spb.ru) by onlyone.not-for.work (Postfix) with ESMTPSA id A9FAC3BA8; Fri, 7 Dec 2018 18:40:40 +0300 (MSK) Reply-To: lev@FreeBSD.org Subject: Re: iflib.tx_abdicate: very strange behavior on incoming IPsec traffic (regression?) From: Lev Serebryakov To: FreeBSD Net , FreeBSD Current Cc: olivier@cochard.me References: <94ec8936-4a66-ee1a-5a38-ee27a4bbfbee@FreeBSD.org> <93d241ab-abf8-7f9b-7876-ba727ec8fea4@FreeBSD.org> Openpgp: preference=signencrypt Autocrypt: addr=lev@FreeBSD.org; prefer-encrypt=mutual; keydata= xsFNBFKbGksBEADeguVs+XyJc3mL3iiOBqDd16wSk97YTJYOi4VsHsINzJr09oFvNDiaDBIi fLn2p8XcJvehcsF2GSgrfXfw+uK4O1jyNIKJmiYA0EtE+ZbRtvDrrE0w6Q8+SDeKA21SWh3Y vSQ0DJUontbgW55ER2CbEiIUTIn34uQ0kmESAaw/v5p/9ue8yPTmURvv130FqPFz8VPzltqL NxyGt54TxPfKAzAHEIwxlEZ63JOwzloKh1UDBExcsf9nJO08/TAVgR5UZ5njFBPzaaquhRoP qPJLEQQDqxPIlvMNtHKf7iIebE4BHeqgCdJA0BoiR6gpa0wlsZtdrTPK3n4wYSphLvGbhfOZ YW/hbcu7HYS/FImkVxB3iY17kcC1UTnx4ZaYeASPBGOOPbXky1lLfmDGWIFT//70yx+G17qD OZzF1SvJJhGvh6ilFYaWMX7T+nIp6Mcafc4D7AakXM+XdubNXOMlCJhzPcZ0skgAEnYV587w V7em5fDVwQccwvtfezzqKeJAU5TGiywBHSR5Svzk2FwRNf6M//hWkpq0SRR63iOhkHGOAEBi 69GfEIwH2/w24rLxP0E+Hqq8n+EWNkPatw1Mhcl5PKkdvGCjJUaGNMkpBffjyYo254JXRscR eEnwdIkJt4ErDvjb2/UrOFq31wWMOiLzJeVchAgvTHBMRfP9aQARAQABzShMZXYgU2VyZWJy eWFrb3YgPGxldkBzZXJlYnJ5YWtvdi5zcGIucnU+wsGZBBMBCABDAhsDBwsJCAcDAgEGFQgC CQoLBBYCAwECHgECF4ACGQEWIQT5bRygtfQxi2dLMwrqsDxYv9xHjwUCW/03kQUJDwW3xgAK CRDqsDxYv9xHjx8ZD/sFjawMpLNn0HLWPxpe0zIfmEPbl9IQLmdlb4tC7MAZf0fOUrEuyLyP W96IDlgPAgJRwMZL4B+rFq8EUzXAj0tTM7pWMUvdeNAkpHcMG79ScgzjlmFOrPD30/fgWa/v XjV0rZhHRC+V3ANZNmJ3ELZUd5vqC5KpQDrbXmVrYqYrTCF/QRmCFSspdLdEZyMfpv0D1RlP YLtNo9CNzUkZykD8hcWamCtJzwbvhSmhISAKnSjzrxi+P4o2p7HYljt5l8tfBtDJK/MmEUon aRoFxmOpZhs0N0emUt9GyyPA5LJDjr3xK8IWb+XR+cOPiR+bEO2yC+RxF7P/2VPVMzHUMHFE TI3BXyhsny9IUi0asz/Ju0i9ZPWS9etTkOguc1TvzG0gpnni5G3zo9TVtWSL+lI1VVhPy0uP oKoP9OAvmNuL4/u7zKQVRHr3cJiBHZlXIhbnZJXJzaJrqHG9vRim6rkWUQxohPpoapMJqeXu fQJ3j6d/gL5HsEgrF5UdbH4xD/05+TrGHqye3gADow48Tt++EwKiRuX7VuAQP51ZsfRRildf wPWHNVLh+i3UHy3+6Zk3JNQsYOJHR/t6ihg+t7AEdFodu1w45wSlyVDeyfp3LVjGSTL8ODoU 13U8lYVrelEihM8PDOaZWOLBasQRAHvIoEF5atV43SEle8GIU+Jdxc7BTQRSmxpLARAAtGvc H46Nj9yck+y3PkJWxVbIRm0m2s2+Jmu0GBuSGWQ+b3ywRZHj6BunJ6591gl6eAON4bMwMpws HuHl8gJL+PoDxd2UnjROVs982Bvo4dp5tohgpMmlcpH2wPtnIaK9gyh+bR6bjTAZRfsEiR2S iZpaP7BSJLQJ1dTQVYOP3C/vf4SKb5fNnJd4WAg+/3u/6kRPsN/AqQAM5+uRb2zg5+8ZWN37 CbfnBzwSeBATPSp08HHHvhfu9kUDGUBJe7yAMEkZi3YGRzdDBQud95etklaCo09HmjjiAa73 rJqI4Vo38LoIm16/lkRf7RnFu+wccHtnkC2xFREqlnjDkcUcaHMe0O2gAqB5n+BuFNVc8e81 BHzXx4342XkFXwFEX/zKFHpWUlvwZjCHygoN5UZVgLfj6todlAAz1agGc3uOW3hP3PM/C2bD mYhqEYWC/DUoOvs4i03ZmC1nbRRgLmYajrTaeYerRo9tTpLAaLXGiGuWI2wpppyJiIxpUgZF CryIav0V7YeW9oDcGkHbvmL+AJWVR0bLlcsC/7JAxS+flntdWwyujEOT875p7USXIG8qIrJ9 YYldODldS6SSTJCZ9Y/FZQag0DU/8/gYwdK7v9Gp7/ubi4+79HJNOqxKOMol0/2QHATO+o+1 exWhm5KG2um1FAkNh+WGATiqYpIwp6cAEQEAAcLBfAQYAQgAJgIbDBYhBPltHKC19DGLZ0sz CuqwPFi/3EePBQJb/TeyBQkPBbfnAAoJEOqwPFi/3EePcKcP/1u0K2RymFFhFR7Ty1TJXDNX +zIMJ2JSEXvyOoMpML7fO7KsUmLu3h8X1+iWUdjPVGLlGLHEkee4MVyrtlM6ms9io7xCFyQs Ak7Ll2Y5ENfaC4QD7LnMNgHDCOmKj122e4TtDIfIzHicw+rw78d877p0MRkKGSsa9wb0VMju zQmGwOzfHHCNxE5nY4/SU27bnvVmlHhi7MxQ4iE5pAEgXbCtO8uMpSwCc1Bgr2CwVN4MdGwT gdkvEm8R2JkJY3sI6L26fjG0/gqFzcWafoA0TKHRsiDHUSKLZEYg24DZdFViE9EktRlFJVBy s0P2T1L6b5OhqrP0mAUu6wUDUqF15icTVuiOmrVTVuyYSJwtbZB8QZW6YpOBStOyejRxU8fv coMgsW8cDQPy3hRpC95FNFRV0dnTYgFW3rnlDxerVOQcnuX7YKSyjkgG6NYPvhClJHPN9+f+ KGEQTHBhJOMVKzQL86BT4QNltyrZJa7ifU4axbffv/zQeckpVYE8BljLgSaLJBJjTkwb9+P1 ED1CLhOMUsMush/p0UCaKIjBaOUAqLLJST5cMletzUvZWFwep90Fjgj+rBXVgAjVAjhb+LpO y0HWPQbAprdk5HC7h5qEvn71HrEF52FdmkIvR3Iq4jyI9oLyelo4Imgvz6Xj4pdH88q3xvyT Mhy9KnIJmKI9 Organization: FreeBSD Message-ID: Date: Fri, 7 Dec 2018 18:40:40 +0300 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.3.2 MIME-Version: 1.0 In-Reply-To: <93d241ab-abf8-7f9b-7876-ba727ec8fea4@FreeBSD.org> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="TdfCbLHs8qMB1P1NzASTtIfev3QbrBW56" X-Rspamd-Queue-Id: D947F8FE18 X-Spamd-Result: default: False [-2.98 / 15.00]; local_wl_from(0.00)[FreeBSD.org]; NEURAL_HAM_MEDIUM(-1.00)[-0.995,0]; NEURAL_HAM_SHORT(-0.98)[-0.984,0]; ASN(0.00)[asn:24940, ipnet:148.251.0.0/16, country:DE]; NEURAL_HAM_LONG(-1.00)[-0.999,0] X-Rspamd-Server: mx1.freebsd.org X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Dec 2018 15:40:42 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --TdfCbLHs8qMB1P1NzASTtIfev3QbrBW56 Content-Type: multipart/mixed; boundary="kcXWFDL3Tr7tv2Kf4ehp2U6RzU6Ck2Arb"; protected-headers="v1" From: Lev Serebryakov Reply-To: lev@FreeBSD.org To: FreeBSD Net , FreeBSD Current Cc: olivier@cochard.me Message-ID: Subject: Re: iflib.tx_abdicate: very strange behavior on incoming IPsec traffic (regression?) References: <94ec8936-4a66-ee1a-5a38-ee27a4bbfbee@FreeBSD.org> <93d241ab-abf8-7f9b-7876-ba727ec8fea4@FreeBSD.org> In-Reply-To: <93d241ab-abf8-7f9b-7876-ba727ec8fea4@FreeBSD.org> --kcXWFDL3Tr7tv2Kf4ehp2U6RzU6Ck2Arb Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 07.12.2018 18:02, Lev Serebryakov wrote: >> (I'm not sure, that it is exactly "bug" or "defect" and want to > ... discuss it here before filing PR. >=20 >> Now I'm throwing IPsec into mix. All incoming traffic is tunneled wit= h >> IPsec policy, with aes-128-gcm encryption. And with IPsec tx_abdicate >> makes thing much worse and much more unstable. > I could say, that it doesn't matter, if I using IPsec with "tunnel" > policy to encrypt and tunnel transit traffic or if I add "gif" into mix= > and encrypt GIF traffic in "transport" mode. In both cases tx_abdicate > makes PPS much lower. And one more datapoint: if I'm using "null" cipher (so, IPsec is in play, but no real encryption is performed) losses in packet rate are about 50% from turning on tx_abdicate. It is worst-case scenario. And if I have outbound traffic (traffic is received without IPsec processing and sent with IPsec processing on other interface) I have noticeable gains, up to 15% in packets per second and bandwidth. So, lookslike tx_abdicate works well when it is applied to non-IPsec-processed traffic. --=20 // Lev Serebryakov --kcXWFDL3Tr7tv2Kf4ehp2U6RzU6Ck2Arb-- --TdfCbLHs8qMB1P1NzASTtIfev3QbrBW56 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEE+W0coLX0MYtnSzMK6rA8WL/cR48FAlwKlHhfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEY5 NkQxQ0EwQjVGNDMxOEI2NzRCMzMwQUVBQjAzQzU4QkZEQzQ3OEYACgkQ6rA8WL/c R4+/KBAAnewTJ2lxyYFYcQsvUFEyepxL+nVpWvS0BvXxHdgfrJAO/9zVHQT1fDF0 KSYgR97Z7yWVZBSkwxTiD73pgCUH6JGxuA+WscacAedVvS9bHogj0stW8+6ecb8Z dM/s8jBxfPaS6GhnCgJiPPyVU1lufe9AuCORYFinihXEPjzI7Wx0EI0AeKV2jqUB fVwimtsa3eLqtEDOfiuXGDy1Y6Pm7UK5LlrGeKhG9I3/rT7rMTSeuou0yy9IeIMX 7sgxmFSWKqbCKTB3rgeV/6y4VnlTPaQ5rQ1UVnKJdKs5XQKQJAxUhj//essnXb06 I5RovO/n0a5Sx/Jetqf9i/BXDuDWtDMOKKEhJlU3hwsK/cCaf8NLFIQEz2Mlm5dE 3W2BR1Sm+yOGU9PkVyribt/CKL6TqFoKg0h0/IUKTsbG0OhBXUJw8zE8+Eh7RKTe qBblaNpbQzWVAQtdisrZWE3FW90bmSQuEvOrnRpxBBmuiA33+l5gJmKVEWIIZubT iCH48+XugsTRhg0mEdXmOfvjptY4vtqHYcprZGUTQxttVYMbU7IiqM4+u1LfPr7b VnYI5kkPaSL7h/DYVBokSHffJ1NKZHizxU29U2hle9WP3dxnRYOuyD4b8qNLlpBW zwyWN35JNEDdVQEPJ+sxdZ+harYZ2XNmyhe8ZjXWvrsX1uPWTuk= =pGNS -----END PGP SIGNATURE----- --TdfCbLHs8qMB1P1NzASTtIfev3QbrBW56--