Netlink Transactions for IPsec control operations

[Stefan Götz]

Currently, HIPL controls IPsec SAs and SPs in the kernel via the netlink interface and sends each command individually.

An alternative would be to queue up multiple, possibly related netlink messages and send them to the kernel in a single packet (i.e., a 'transaction').

This alternative is likely to perform better (although the impact is probably not dramatic) and may be desirable for seamless handover scenarios where the more atomic nature of such a transaction could be beneficial.

Just an idea for the future.

[Miika Komu (miika-iki)]

Hi,

I think it would be far more important to support e.g. threads than do this kind of micro-optimization. Also, I think fixing this important bug will invalidate this bug id:

https://bugs.launchpad.net/hipl/+bug/697214

So I would suggest to change the status of this bug already now to invalid?

[René Hummen (rene-hummen)]

We update all policies and SAs to an association right after processing the triggering message (e.g., R1). It should be fairly simple to transform these into bulk transmissions.