Turning on IPSEC used to introduce a slight amount of performance

degradation (7%) for host host TCP connections over 10Gbps links,
even when there were no secuirty policies in place. There is no
change in performance on 1Gbps network links. Testing GENERIC vs.
GENERIC-NOIPSEC vs. GENERIC with this change shows that the new
code removes any overhead introduced by having IPSEC always in the
kernel.

Differential Revision:	D3993
MFC after:	1 month
Sponsored by:	Rubicon Communications (Netgate)

diff --git a/sys/netinet/ip_ipsec.c b/sys/netinet/ip_ipsec.c
index 546f802f96177cc2dc41abae94f298ccf08cc9cb..77ce4c1a79ad979ca32bf43cf00e331b1cc26fca 100644 (file)
--- a/sys/netinet/ip_ipsec.c
+++ b/sys/netinet/ip_ipsec.c
@@ -158,6 +158,10 @@ int
 ip_ipsec_output(struct mbuf **m, struct inpcb *inp, int *error)
 {
        struct secpolicy *sp;
+
+       if (!key_havesp(IPSEC_DIR_INBOUND))
+               return 0;
+
        /*
         * Check the security policy (SP) for the packet and, if
         * required, do IPsec-related processing.  There are two

diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c
index e3f5b1324ce84b1e5a1f44ac06c059ce4deb26cc..29af76664098d4ffd385dd7df2a4c874b3524606 100644 (file)
--- a/sys/netinet/tcp_subr.c
+++ b/sys/netinet/tcp_subr.c
@@ -1972,7 +1972,8 @@ ipsec_hdrsiz_tcp(struct tcpcb *tp)
 #endif
        struct tcphdr *th;
 
-       if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL))
+       if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL) ||
+               (!key_havesp(IPSEC_DIR_OUTBOUND)))
                return (0);
        m = m_gethdr(M_NOWAIT, MT_DATA);
        if (!m)

diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c
index 2ac87ab5523af8a6103e2568cbf70c84b71d2bc9..9172347898bcd5c83a3eb6d02d7b2b3e481c7eb7 100644 (file)
--- a/sys/netipsec/ipsec.c
+++ b/sys/netipsec/ipsec.c
@@ -1276,6 +1276,9 @@ ipsec46_in_reject(struct mbuf *m, struct inpcb *inp)
        int error;
        int result;
 
+       if (!key_havesp(IPSEC_DIR_INBOUND))
+               return 0;
+
        IPSEC_ASSERT(m != NULL, ("null mbuf"));
 
        /* Get SP for this packet. */
@@ -1403,6 +1406,9 @@ ipsec_hdrsiz(struct mbuf *m, u_int dir, struct inpcb *inp)
        int error;
        size_t size;
 
+       if (!key_havesp(dir))
+               return 0;
+
        IPSEC_ASSERT(m != NULL, ("null mbuf"));
 
        /* Get SP for this packet. */