From owner-freebsd-net@freebsd.org  Thu Jul  2 00:42:35 2015
Return-Path: <owner-freebsd-net@freebsd.org>
Delivered-To: freebsd-net@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 3C1D69920B9
 for <freebsd-net@mailman.ysv.freebsd.org>;
 Thu,  2 Jul 2015 00:42:35 +0000 (UTC)
 (envelope-from lichray@gmail.com)
Received: from mail-vn0-x229.google.com (mail-vn0-x229.google.com
 [IPv6:2607:f8b0:400c:c0f::229])
 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id F09131BFA
 for <freebsd-net@freebsd.org>; Thu,  2 Jul 2015 00:42:34 +0000 (UTC)
 (envelope-from lichray@gmail.com)
Received: by vnbg1 with SMTP id g1so8569738vnb.7
 for <freebsd-net@freebsd.org>; Wed, 01 Jul 2015 17:42:33 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:date:message-id:subject:from:to:content-type;
 bh=HvfV5xgjS60UHyNjXYBHM5HgfehQtwYbXkxqYMwRzAk=;
 b=L9rG+SEyONTwFZCzy3fkDnOtKPAlMEQwypjt4uVLaAlpK5kwN7EewVOo8CIHMrzrB6
 uTZ0l9FvrBadOQeUKGifiaY/EWTXl1g7lWY5iWtRlHiI+yVVe00pKEiJKRqik7U3mrf/
 ksPjJQCq+7YEZt7sc465CrNxGYIObNjVvhVH3K9qSTNjtK/2x5qVcifTttgjIQ55CBuw
 L2Hc+63eUH+VX8LJq4K8CeT4Leqq4RcWRAza1Oq7u17nwCGtvrhBbzV3e/6Vgdhxq+t/
 3ZZOe9LQKlnae3ukmBUJy78EfPmea7lpEil4xiLcTPDikjaTlM1oBAUVIMWewaFnO4gM
 e7fw==
MIME-Version: 1.0
X-Received: by 10.52.52.133 with SMTP id t5mr28450012vdo.56.1435797753767;
 Wed, 01 Jul 2015 17:42:33 -0700 (PDT)
Received: by 10.31.99.7 with HTTP; Wed, 1 Jul 2015 17:42:33 -0700 (PDT)
Date: Wed, 1 Jul 2015 19:42:33 -0500
Message-ID: <CAGsORuDcZz1Yq7rC4yQRT11ZyjPAq34txG9J+h43mJ29L54w9w@mail.gmail.com>
Subject: strongswan ikev2 slow on FreeBSD (DigitalOcean)
From: Zhihao Yuan <lichray@gmail.com>
To: freebsd-net@freebsd.org
Content-Type: text/plain; charset=UTF-8
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 02 Jul 2015 00:42:35 -0000

It might be hypervisor's problem because they use KVM, but here are
some information I have:

DO smallest instance.

> uname -a
FreeBSD megashadow2 10.2-PRERELEASE FreeBSD 10.2-PRERELEASE #3
r284996: Wed Jul  1 17:58:13 UTC 2015
freebsd@megashadow2:/usr/obj/usr/src/sys/DOIPSEC  amd64

cryptotest w/wo -p -- 2Gb/s, 400Mb/s, aesni, cryptodev present.

strongswan ipsec.conf:

    ike=aes256-sha1-modp1024!
    esp=aes256-sha1!

NAT done through one simple pf rule.

natstat -inw1 shows no error, no drop, just very small packets (10K-30K) even
for large data.

Top two functions in pmcstat -TS instructions -w1 are kernel
rijndaelEncrypt and sha1_step are the top two consuming function,
10%-20% for each.

TSO, IPSEC_DEBUG do not matter.

Boost performance is same as Ubuntu 15 (300kb/s in ssh, downloading to
my laptop), but most of the time is < 100kb/s, and overall speed is
50% slower.  Uploading is good.

-- 
Zhihao Yuan, ID lichray
The best way to predict the future is to invent it.
___________________________________________________
4BSD -- http://bit.ly/blog4bsd