AAScratch: Difference between revisions

From Libreswan
Jump to navigation Jump to search
No edit summary
No edit summary
Line 34: Line 34:
   * idea presentation [http://vger.kernel.org/netconf2019_files/xfrm_xdp.pdf Steffen Klassert] Linux Netconf, Boston, June, 2019
   * idea presentation [http://vger.kernel.org/netconf2019_files/xfrm_xdp.pdf Steffen Klassert] Linux Netconf, Boston, June, 2019


== Per CPU effoorts ==
= Per CPU effoorts =
* XFRM pCPU prototype [https://libreswan.org/wiki/XFRM_pCPU experimental]==
* XFRM pCPU prototype [https://libreswan.org/wiki/XFRM_pCPU experimental]==
* [https://garycplin.blogspot.com/2017/06/linux-network-scaling-receives-packets.html Snabb] support RSS and parallel SAs
* [https://medium.com/fd-io-vpp/getting-to-40g-encrypted-container-networking-with-calico-vpp-on-commodity-hardware-d7144e52659a Cisco/VPP 40Gbps]


= Userspace IPsec Stacks =
= Userspace IPsec Stacks =
Line 46: Line 49:


== Snabb ESP userspace stack ==
== Snabb ESP userspace stack ==
Snabb as of 2020 has ESP. No IKE, it can easily use of the shelf IKE say strongswan for IKE and and few command line calls to installl snabb esp
Snabb as of 2020 has ESP. No IKE, it can easily use of the shelf IKE say strongswan for IKE and and few command line calls to install snabb esp
[https://fosdem.org/2020/schedule/event/vita_high_speed_traffic_encryption_on_x86_64/ Snabb FOSDEM 2020]
[https://fosdem.org/2020/schedule/event/vita_high_speed_traffic_encryption_on_x86_64/ Snabb FOSDEM 2020]
[https://blog.ipspace.net/2019/02/high-speed-ipsec-on-snabb-switch-on.html snabb ipsec podcast]
[https://blog.ipspace.net/2019/02/high-speed-ipsec-on-snabb-switch-on.html snabb ipsec podcast]

Revision as of 09:49, 14 October 2020

Antony's unsorted pages that I want to access quickly. These are mostly related to IPsec/libreswan and when I think I know this page exist but where is it.

KVM/QEMU

KVM/QEMU virtiofs to replace 9pfs: libvirt 6.2, qemu 5.0, kernel 5.4

KVM/QEMU + vsock NFS to replace 9pfs

KVM support for vsock and nfs support could have a better performance than 9pfs. This work could be interesting to libreswan KVM testing. It started in 2015. Slowly picking up, as 2018 it seems AWS and firecracker is pushing it. We are almost there.

Linux Kernel developments

XFRM Offload : starting 4.14

 * NAT support ??? 
 * What if the interface is a member of bridge? can libreswan/strongswan configure SA correctly? bridge
 * what if the packets arrive on different interface would that get decrypted correctly?
 * Bonded NIC card

XFRM and XDP

 * idea presentation Steffen Klassert Linux Netconf, Boston, June, 2019

Per CPU effoorts


Userspace IPsec Stacks

Over last few years specialized user space IPSec(ESP) stacks and IKE implementations are becoming popular.

VPP + DPDK (Userspace ESP + IKE)

VPP has its own IKEv2 and ESP implimentation.

Snabb ESP userspace stack

Snabb as of 2020 has ESP. No IKE, it can easily use of the shelf IKE say strongswan for IKE and and few command line calls to install snabb esp Snabb FOSDEM 2020 snabb ipsec podcast Strongswan inegeration

OVS

http://docs.openvswitch.org/en/latest/tutorials/ipsec/

iptable rule to drop IKEv2 message id X

https://unix.stackexchange.com/questions/321252/drop-a-packet-depending-on-its-options-or-type 

# drop ike message ID 6
iptables -A INPUT -m u32 --u32 '0x6 & 0xFF = 0x11 && 0x30 & 0xFFFFFFFF = 0x4' -j DROP

Hardware offload

XFRM offload

  • Mellonax Innova or ConnectX 6DX
  • Intel

Intel QAT

https://www.servethehome.com/intel-quickassist-at-40gbe-speeds-ipsec-vpn-testing/

Intel AES NI

Historic OCF

Back in the 90 there was alo

RSS/RPS/RFS

Interesting Linux referecncs

Linux packet path

https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg

Retrieved from "https://libreswan.org/wiki/index.php?title=AAScratch&oldid=22029"