search

libreswan / libreswan

libreswan
https://libreswan.org/
Other
853 stars 225 forks source link

make probing nic_offload really on-demand #1701

Open cagney opened 6 months ago

cagney commented 6 months ago

per:

in 4.x and 5.0 the code probes the kernel to see if it supports nic_offload while adding an interface; which effectively means during startup (when ipsec listen is run).

The code should instead probe nic_offload on an interface when a connection tries to orient to it.

letoams commented 5 months ago

On Tue, 21 May 2024, The Libreswan Vault wrote:

Subject: Re: [libreswan/libreswan] make probing nic_offload really on-demand

Closed #1701 as completed via 9a13acb.

This seems wrong?

commit 9a13acb10937b28e823a4cd436f3fad53dbc4281 (HEAD -> main, origin/main) Author: Andrew Cagney @.***> Date: Tue May 21 15:20:04 2024 -0400

 ipsec globalstatus: only list algs approved by ike_alg

 fix #1701 in ipsec stats use ike_alg to select algorithm stats to be shown

I don't see this being related to nic_offload ?

cagney commented 5 months ago

The complication is:

         * Policy Packet nic offload requires us to poke an IPsec policy
         * hole that allows IKE packets. This installs one IPsec policy
         * per interface (that supports offload), this function is called
         * for port 500.

which happens when the interface is detected. If probing the interface is to be made on-demand then so too is poking this hole.

cagney commented 5 months ago

I've been playing probing when adding connections. I find the behaviour a little weird - announcing that an interface supports offload better fits with adding the interface and not the connection. With that in mind, I think adding knobs to:

might be better.

cagney commented 3 months ago

moving to 5.2; #1753 provides an immediate solution