1. 06 Oct, 2023 4 commits
    • Steffen Klassert's avatar
      Merge branch 'xfrm: Support GRO decapsulation for ESP in UDP encapsulation' · e377240a
      Steffen Klassert authored
      Antony Antony says:
      
      ============
      I have added how to enable this feature, and more description to the second
      patch. Here is copy of that.
      
      xfrm: Support GRO for IPv4i & IPv6 ESP in UDP encapsulation
      
      This patchset enables the GRO codepath for ESP in UDP encapsulated
      packets. Decapsulation happens at L2 and saves a full round through
      the stack for each packet. This is also needed to support HW offload
      for ESP in UDP encapsulation.
      
      Enabling this would imporove performance for ESP in UDP datapath, i.e
      IPsec with NAT in between. Our initial tests show 20% improvement.
      
      By default GRP for ESP-in-UDP is disabled for UDP sockets.
      To enable this feature for an ESP socket, the following two options
      need to be set:
      1. enable ESP-in-UDP: (this is already set by an IKE daemon).
         int type = UDP_ENCAP_ESPINUDP;
         setsockopt(fd, SOL_UDP, UDP_ENCAP, &type, sizeof(type));
      
      2. To enable GRO for ESP in UDP socket:
         type = true;
         setsockopt(fd, SOL_UDP, UDP_GRO, &type, sizeof(type));
      
      Enabling ESP-in-UDP has the side effect of preventing the Linux stack from
      seeing ESP packets at the L3 (when ESP OFFLOAD is disabled), as packets are
      immediately decapsulated from UDP and decrypted.
      This change may affect nftable rules that match on ESP packets  at L3.
      Also tcpdump won't see the ESP packet.
      
      Developers/admins are advised to review and adapt any nftable rules
      accordingly before enabling this feature to prevent potential rule breakage.
      Also tcpdump will not see from ESP packets from a ESP in UDP flow when this
      is enabled.
      
      Initial, a quick test showed performance difference of about 20%
      impromvent on the receiver, when using iperf, tcp flow, over ESP in UDP.
      ============
      Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      e377240a
    • Steffen Klassert's avatar
      xfrm: Support GRO for IPv6 ESP in UDP encapsulation · 221ddb72
      Steffen Klassert authored
      This patch enables the GRO codepath for IPv6 ESP in UDP encapsulated
      packets. Decapsulation happens at L2 and saves a full round through
      the stack for each packet. This is also needed to support HW offload
      for ESP in UDP encapsulation.
      Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      Co-developed-by: default avatarAntony Antony <antony.antony@secunet.com>
      Signed-off-by: default avatarAntony Antony <antony.antony@secunet.com>
      Reviewed-by: default avatarEyal Birger <eyal.birger@gmail.com>
      221ddb72
    • Steffen Klassert's avatar
      xfrm: Support GRO for IPv4 ESP in UDP encapsulation · 172bf009
      Steffen Klassert authored
      This patch enables the GRO codepath for IPv4 ESP in UDP encapsulated
      packets. Decapsulation happens at L2 and saves a full round through
      the stack for each packet. This is also needed to support HW offload
      for ESP in UDP encapsulation.
      
      Enabling this would imporove performance for ESP in UDP datapath, i.e
      IPsec with NAT in between.
      
      By default GRP for ESP-in-UDP is disabled for UDP sockets.
      To enable this feature for an ESP socket, the following two options
      need to be set:
      1. enable ESP-in-UDP: (this is already set by an IKE daemon).
         int type = UDP_ENCAP_ESPINUDP;
         setsockopt(fd, SOL_UDP, UDP_ENCAP, &type, sizeof(type));
      
      2. To enable GRO for ESP in UDP socket:
         type = true;
         setsockopt(fd, SOL_UDP, UDP_GRO, &type, sizeof(type));
      
      Enabling ESP-in-UDP has the side effect of preventing the Linux stack from
      seeing ESP packets at the L3 (when ESP OFFLOAD is disabled), as packets are
      immediately decapsulated from UDP and decrypted.
      This change may affect nftable rules that match on ESP packets at L3.
      Also tcpdump won't see the ESP packet.
      
      Developers/admins are advised to review and adapt any nftable rules
      accordingly before enabling this feature to prevent potential rule breakage.
      Also tcpdump will not see from ESP packets from a ESP in UDP flow, when this
      is enabled.
      Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      Co-developed-by: default avatarAntony Antony <antony.antony@secunet.com>
      Signed-off-by: default avatarAntony Antony <antony.antony@secunet.com>
      Reviewed-by: default avatarEyal Birger <eyal.birger@gmail.com>
      172bf009
    • Steffen Klassert's avatar
      xfrm: Use the XFRM_GRO to indicate a GRO call on input · b439475a
      Steffen Klassert authored
      This is needed to support GRO for ESP in UDP encapsulation.
      Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
      Co-developed-by: default avatarAntony Antony <antony.antony@secunet.com>
      Signed-off-by: default avatarAntony Antony <antony.antony@secunet.com>
      Reviewed-by: default avatarEyal Birger <eyal.birger@gmail.com>
      b439475a
  2. 05 Oct, 2023 1 commit
  3. 28 Sep, 2023 1 commit
  4. 20 Sep, 2023 34 commits