xfrm/ipsec/iptfs and some new sysctls

xfrm/ipsec/iptfs and some new sysctls

[Christian Hopps]

[-- Attachment #1: Type: text/plain, Size: 1646 bytes --]


As part of the new IPsec IP-TFS code we are adding a few new xfrm sysctls. These sysctls are used for setting the system-wide defaults for new IP-TFS SAs. New SAs can still override these defaults on a per-SA basis.

The thinking behind adding these is that IP-TFS is still a new technology and we'd like to get deployment experience to find what the best default values will be.

Does anyone object to adding the new sysctls? (doc included below)

Thanks,
Chris.


xfrm_iptfs_max_qsize - UNSIGNED INTEGER
        The default IPTFS max output queue size in octets. The output queue is
        where received packets destined for output over an IPTFS tunnel are
        stored prior to being output in aggregated/fragmented form over the
        IPTFS tunnel.

        Default 1M.

xfrm_iptfs_drop_time - UNSIGNED INTEGER
        The default IPTFS drop time in microseconds. The drop time is the amount
        of time before a missing out-of-order IPTFS tunnel packet is considered
        lost. See also the reorder window.

        Default 1s (1000000).

xfrm_iptfs_init_delay - UNSIGNED INTEGER
        The default IPTFS initial output delay in microseconds. The initial
        output delay is the amount of time prior to servicing the output queue
        after queueing the first packet on said queue. This applies anytime
        the output queue was previously empty.

        Default 0.

xfrm_iptfs_reorder_window - UNSIGNED INTEGER
        The default IPTFS reorder window size. The reorder window size dictates
        the maximum number of IPTFS tunnel packets in a sequence that may arrive
        out of order.

        Default 3.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 857 bytes --]

Re: [devel-ipsec] xfrm/ipsec/iptfs and some new sysctls

[Michael Richardson]

[-- Attachment #1.1: Type: text/plain, Size: 465 bytes --]


I think that:
xfrm_iptfs_reorder_window
and
xfrm_iptfs_drop_time
are parameters about receiving.

While
xfrm_iptfs_init_delay
and
xfrm_iptfs_max_qsize

are parameters about sender stuff.. I think the names should include that
indication.   "xfrm_iptfs_sender_init_delay" maybe.
1M byte default for max_qsize feels big, it's 1000 x 1K packets.
I realize that isn't a lot at 10Gb/s+.   I dunno.

How do you plan to get feedback on whether the defaults are working?


[-- Attachment #1.2: Signature --]
[-- Type: text/plain, Size: 242 bytes --]

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        | network architect  [
]     mcr@sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [



[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [devel-ipsec] xfrm/ipsec/iptfs and some new sysctls

[Christian Hopps]

[-- Attachment #1: Type: text/plain, Size: 798 bytes --]


After talking this over some more with Steffen, we've decided to just remove the new sysctl's for now.

Thanks,
Chris.

Michael Richardson <mcr@sandelman.ca> writes:

> [[PGP Signed Part:Signature made by expired key 954CE156FDFC4290 Michael Richardson (Low Security Key) <mcr+travel@sandelman.ca>]]
>
> I think that:
> xfrm_iptfs_reorder_window
> and
> xfrm_iptfs_drop_time
> are parameters about receiving.
>
> While
> xfrm_iptfs_init_delay
> and
> xfrm_iptfs_max_qsize
>
> are parameters about sender stuff.. I think the names should include that
> indication.   "xfrm_iptfs_sender_init_delay" maybe.
> 1M byte default for max_qsize feels big, it's 1000 x 1K packets.
> I realize that isn't a lot at 10Gb/s+.   I dunno.
>
> How do you plan to get feedback on whether the defaults are working?


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 857 bytes --]