svn commit: r291355 - in stable/10/sys: netinet netipsec

[Renato Botelho]

> On Nov 26, 2015, at 00:24, George V. Neville-Neil <gnn at FreeBSD.org> wrote:
> 
> Author: gnn
> Date: Thu Nov 26 02:24:45 2015
> New Revision: 291355
> URL: https://svnweb.freebsd.org/changeset/base/291355
> 
> Log:
>  MFC 290028:
>  Turning on IPSEC used to introduce a slight amount of performance
>  degradation (7%) for host host TCP connections over 10Gbps links,
>  even when there were no secuirty policies in place. There is no
>  change in performance on 1Gbps network links. Testing GENERIC vs.
>  GENERIC-NOIPSEC vs. GENERIC with this change shows that the new
>  code removes any overhead introduced by having IPSEC always in the
>  kernel.
> 
>  Differential Revision:	D3993
>  Sponsored by:	Rubicon Communications (Netgate)
> 
> Modified:
>  stable/10/sys/netinet/ip_ipsec.c
>  stable/10/sys/netinet/tcp_subr.c
>  stable/10/sys/netipsec/ipsec.c
> Directory Properties:
>  stable/10/   (props changed)
> 
> Modified: stable/10/sys/netinet/ip_ipsec.c
> ==============================================================================
> --- stable/10/sys/netinet/ip_ipsec.c	Thu Nov 26 02:16:25 2015	(r291354)
> +++ stable/10/sys/netinet/ip_ipsec.c	Thu Nov 26 02:24:45 2015	(r291355)
> @@ -230,6 +230,10 @@ ip_ipsec_output(struct mbuf **m, struct 
> 	struct secpolicy *sp = NULL;
> 	struct tdb_ident *tdbi;
> 	struct m_tag *mtag;
> +
> +	if (!key_havesp(IPSEC_DIR_OUTBOUND))
> +		return 0;
> +
> 	/*
> 	 * Check the security policy (SP) for the packet and, if
> 	 * required, do IPsec-related processing.  There are two
> 
> Modified: stable/10/sys/netinet/tcp_subr.c
> ==============================================================================
> --- stable/10/sys/netinet/tcp_subr.c	Thu Nov 26 02:16:25 2015	(r291354)
> +++ stable/10/sys/netinet/tcp_subr.c	Thu Nov 26 02:24:45 2015	(r291355)
> @@ -1947,7 +1947,8 @@ ipsec_hdrsiz_tcp(struct tcpcb *tp)
> #endif
> 	struct tcphdr *th;
> 
> -	if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL))
> +	if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL) ||
> +		(!key_havesp(IPSEC_DIR_OUTBOUND)))

Looks like style is broken here ^

--
Renato Botelho