Re: Is if_ipsec/ipsec - AESNI accelerated ?

2018-08-09 Thread Jim Thompson
You're not running AES-GCM, you're running AES-CBC + HMAC-SHA256 >E: rijndael-cbc 221239cf e0ddedc5 88f1f711 5e744723 >A: hmac-sha2-256 bf214e0e 73b27e42 1090a067 eaed9e2a d36d3ae7 529a40a1 bf5ea2c9 0e3f5f27 Try running AES-GCM. Example (from the work that gnn@ and I did back

Re: Is if_ipsec/ipsec - AESNI accelerated ?

2018-08-09 Thread Andrey V. Elsukov
On 09.08.2018 23:11, David P. Discher wrote: > The documentation for using IPSec (especially if_ipsec) is really thin > for freebsd, so I pieced some of this together from various posts and > mailing lists threads. >   > Is there no need for racoon ?  How in this example is the IKE/ISAKMP > setup d

[Bug 228108] if_ipsec drops all the icmp v4&v6 error messages

2018-08-09 Thread bugzilla-noreply
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=228108 --- Comment #14 from Andrey V. Elsukov --- (In reply to dpd from comment #13) > I showed over here : > https://lists.freebsd.org/pipermail/freebsd-net/2018-August/051301.html > > That it seems to work with this line removed. > > Attached

Re: Is if_ipsec/ipsec - AESNI accelerated ?

2018-08-09 Thread David P. Discher
The documentation for using IPSec (especially if_ipsec) is really thin for freebsd, so I pieced some of this together from various posts and mailing lists threads. Is there no need for racoon ? How in this example is the IKE/ISAKMP setup done ? Is setkey doing this ? > On Aug 9, 2018, at 1

[Bug 228108] if_ipsec drops all the icmp v4&v6 error messages

2018-08-09 Thread bugzilla-noreply
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=228108 --- Comment #13 from d...@dpdtech.com --- I showed over here : https://lists.freebsd.org/pipermail/freebsd-net/2018-August/051301.html That it seems to work with this line removed. Attached is the shell transcript of my current observation

[Bug 228108] if_ipsec drops all the icmp v4&v6 error messages

2018-08-09 Thread bugzilla-noreply
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=228108 --- Comment #12 from d...@dpdtech.com --- Created attachment 196035 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=196035&action=edit Shell Transcript of Issue. -- You are receiving this mail because: You are on the CC list for

if_alloc() panic on CURRENT

2018-08-09 Thread Danilo Egêa Gondolfo
Hello, I'm getting a panic when I start a vbox VM. https://bz-attachments.freebsd.org/attachment.cgi?id=196033 Any clue about what can be happening? I'm running r337378 and the virtualbox-ose-kmod was built from ports. Thanks! ___ freebsd-net@freebsd.

Re: Is if_ipsec/ipsec - AESNI accelerated ?

2018-08-09 Thread John-Mark Gurney
David P. Discher wrote this message on Thu, Aug 09, 2018 at 00:00 -0700: > > > On Aug 8, 2018, at 10:37 PM, Andrey V. Elsukov wrote: > > > > On 09.08.2018 06:57, David P. Discher wrote: > >> I???m suspecting that IPSec in FreeBSD is not leveraging AESNI on Intel. > >> Is this correct ? > > >

[Bug 229384] Can't remove address from carp

2018-08-09 Thread bugzilla-noreply
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=229384 Michael changed: What|Removed |Added CC||m.mu...@spam-fetish.org --- Comment #13

[Bug 229384] Can't remove address from carp

2018-08-09 Thread bugzilla-noreply
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=229384 --- Comment #12 from Vinícius Zavam --- (In reply to Kajetan Staszkiewicz from comment #11) as I said, the main idea was to get as closest as possible to what we get from 11.2-RELEASE in order to help you (and others). with all respect, th

Re: Is if_ipsec/ipsec - AESNI accelerated ?

2018-08-09 Thread Andrey V. Elsukov
On 09.08.2018 10:00, David P. Discher wrote: > [ pts/0 sjc2 util201:~ ] > [ dpd ] > iperf3 -c 10.245.0.202 -i 8 -t 16 > Connecting to host 10.245.0.202, port 5201 > [ 5] local 10.245.0.201 port 55165 connected to 10.245.0.202 port 5201 > [ ID] Interval Trans

Re: Is if_ipsec/ipsec - AESNI accelerated ?

2018-08-09 Thread David P. Discher
> On Aug 8, 2018, at 10:37 PM, Andrey V. Elsukov wrote: > > On 09.08.2018 06:57, David P. Discher wrote: >> I’m suspecting that IPSec in FreeBSD is not leveraging AESNI on Intel. Is >> this correct ? > > IPsec uses crypto(9) framework that works by default without any > acceleration. You need