Re: IPsec workshop at netdev01?

[Fan Du <fengyuleidian0615@gmail.com>]

于 2015年01月06日 18:19, Steffen Klassert 写道:
> Is there any interest in doing an IPsec workshop at netdev01?
>
> This mail is to probe if we can gather enough discussion topics to run
> such a workshop. So if someone is interested to attend and/or has a
> related discussion topic, please let me know.
>
> The idea to do this workshop came yesterday, so I'm still collecting
> topics I'm interested in. Some things that came immediately to my mind
> are:
>
> - Our IPsec policy/state lookups are still hashlist based on slowpath with
>    a flowcache to do fast lookups for traffic flows we have already seen.
>    This flowcache has similar issues like the ipv4 routing chache had.
>    Is the flowcache an appropriate lookup method on the long run or should
>    we at least think about an additional alternative lookup method?
>
> - We still lack a 32/64 bit compatibiltiy layer for IPsec, this issue
>    comes up from time to time. Some solutions were proposed in the past
>    but all had problems. The current behaviour is broken if someone tries
>    to configure IPsec with 32 bit tools on a 64 bit machine. Can we get
>    this right somehow or is it better to just return an error in this case?

Before a clean solution show up, I think it's better to warn user in some way
like http://patchwork.ozlabs.org/patch/323842/ did. Otherwise, many people
who stuck there will always spend time and try to fix this issue in whatever way.

> - Changing the system time can lead to unexpected SA lifetime changes. The
>    discussion on the list did not lead to a conclusion on how to fix this.
>    What is the best way to get this fixed?

I rise this issue long ago before, the culprit is SA lifetime is marked by wall clock.
In a reasonable way it should be marked as monotonic boot time(counting suspend time
as well). Then every thing will be work correctly. I have such a patch works correctly.
EXCEPT: SA migration, where SA lifetime comes from outside.
I didn't look at SA migration part though, so any comments? Steffen


-- 
No zuo no die but I have to try.