svn commit: r291355 - in stable/10/sys: netinet netipsec

[George V. Neville-Neil]

Author: gnn
Date: Thu Nov 26 02:24:45 2015
New Revision: 291355
URL: https://svnweb.freebsd.org/changeset/base/291355

Log:
  MFC 290028:
  Turning on IPSEC used to introduce a slight amount of performance
  degradation (7%) for host host TCP connections over 10Gbps links,
  even when there were no secuirty policies in place. There is no
  change in performance on 1Gbps network links. Testing GENERIC vs.
  GENERIC-NOIPSEC vs. GENERIC with this change shows that the new
  code removes any overhead introduced by having IPSEC always in the
  kernel.
  
  Differential Revision:	D3993
  Sponsored by:	Rubicon Communications (Netgate)

Modified:
  stable/10/sys/netinet/ip_ipsec.c
  stable/10/sys/netinet/tcp_subr.c
  stable/10/sys/netipsec/ipsec.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/netinet/ip_ipsec.c
==============================================================================
--- stable/10/sys/netinet/ip_ipsec.c	Thu Nov 26 02:16:25 2015	(r291354)
+++ stable/10/sys/netinet/ip_ipsec.c	Thu Nov 26 02:24:45 2015	(r291355)
@@ -230,6 +230,10 @@ ip_ipsec_output(struct mbuf **m, struct 
 	struct secpolicy *sp = NULL;
 	struct tdb_ident *tdbi;
 	struct m_tag *mtag;
+
+	if (!key_havesp(IPSEC_DIR_OUTBOUND))
+		return 0;
+
 	/*
 	 * Check the security policy (SP) for the packet and, if
 	 * required, do IPsec-related processing.  There are two

Modified: stable/10/sys/netinet/tcp_subr.c
==============================================================================
--- stable/10/sys/netinet/tcp_subr.c	Thu Nov 26 02:16:25 2015	(r291354)
+++ stable/10/sys/netinet/tcp_subr.c	Thu Nov 26 02:24:45 2015	(r291355)
@@ -1947,7 +1947,8 @@ ipsec_hdrsiz_tcp(struct tcpcb *tp)
 #endif
 	struct tcphdr *th;
 
-	if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL))
+	if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL) ||
+		(!key_havesp(IPSEC_DIR_OUTBOUND)))
 		return (0);
 	m = m_gethdr(M_NOWAIT, MT_DATA);
 	if (!m)

Modified: stable/10/sys/netipsec/ipsec.c
==============================================================================
--- stable/10/sys/netipsec/ipsec.c	Thu Nov 26 02:16:25 2015	(r291354)
+++ stable/10/sys/netipsec/ipsec.c	Thu Nov 26 02:24:45 2015	(r291355)
@@ -1273,6 +1273,9 @@ ipsec46_in_reject(struct mbuf *m, struct
 	int error;
 	int result;
 
+	if (!key_havesp(IPSEC_DIR_INBOUND))
+		return 0;
+
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 
 	/*
@@ -1405,6 +1408,9 @@ ipsec_hdrsiz(struct mbuf *m, u_int dir, 
 	int error;
 	size_t size;
 
+	if (!key_havesp(dir))
+		return 0;
+
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 
 	/* Get SP for this packet.