These changes add locking and cleanup some of the infrastructure; e.g. to do better accounting of dynamically allocated data structures.
Basic operation is well-tested but I haven't done extensive testing of the re-keying (e.g. with racoon). There is one known performance bottleneck: the lock in the ipsecrequest structure is held for every outbound packet to guard against modification to the data structure. This looks to be fixable by redoing the SADB but won't happen for a while. Note that with these changes much of fast ipsec runs Giant-free because the crypto code is already Giant-free. I did some performance measurements a while back with this code and a Giant-free em driver and got netperf results over a h/w-accelerated 3DES+SHA1 tunnel that was about the same as -stable.
Sam
_______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "[EMAIL PROTECTED]"
