From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH] IPsec: Disable XFRM policy lookup for VTI devices
Date: Thu, 14 Jan 2021 18:54:03 +0000
Message-ID: <20210114185403.8839-1-michael.tremer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============6855109845865837437=="
List-Id: <development.lists.ipfire.org>

--===============6855109845865837437==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

This speeds up throughput slightly

Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
 src/scripts/ipsec-interfaces | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/scripts/ipsec-interfaces b/src/scripts/ipsec-interfaces
index 2546f8927..f0983dbdc 100644
--- a/src/scripts/ipsec-interfaces
+++ b/src/scripts/ipsec-interfaces
@@ -228,6 +228,11 @@ main() {
 			ip addr flush dev "${intf}"
 			ip addr add "${interface_address}" dev "${intf}"
 
+			# Disable IPsec policy lookup for VTI
+			if [ "${interface_mode}" = "vti" ]; then
+				sysctl -qw "net.ipv4.conf.${intf}.disable_policy=1"
+			fi
+
 			# Set MTU
 			ip link set dev "${intf}" mtu "${interface_mtu}"
 
-- 
2.28.0


--===============6855109845865837437==--