Re: [RFC] State resolution packet queue for IPsec

[David Miller <davem@davemloft.net>]

From: Steffen Klassert <steffen.klassert@secunet.com>
Date: Mon, 21 Jan 2013 10:48:48 +0100

> I did a implementation of a state resolution packet queue for IPsec.
> The original idea is described in git commit 14e50e57a
> ([XFRM]: Allow packet drops during larval state resolution.)
> 
> Since we don't have any notifiers for xfrm state resolution, I used
> a timer that does a relookup in given intervals. This is mainly to speed
> up the start of tcp connections, so I tried to do the relookup in a higher
> rate that tcp would resend the syn packet. However, the relookup intervals,
> the queue size and the timeout value are choosen by gut instincts, so
> could be suboptimal. If anyone has some insight on good choices of these
> values, please let me know. All other comment are welcome too, of course.

This is probably the best way to solve this problem without adding
xfrm_state resolution notifications.

But really why would notifications be so bad even if they would not
be fine grained?

Any time a state is resolved, any state, you run what you have put
currently into this new timer function.

Most of the time, defer list is empty, so no work is done.  Otherwise
quick notification is essential and worth running the list.

Then there are no time based heuristics to come up with at all.