On Mon, 2017-01-16 at 22:18 -0800, Tom Herbert wrote: > On Mon, Jan 16, 2017 at 6:34 PM, Eric Dumazet <eric.duma...@gmail.com> wrote: > > On Mon, 2017-01-16 at 17:44 -0800, Eric Dumazet wrote: > >> On Mon, 2017-01-16 at 17:04 -0700, Andrew Collins wrote: > > > >> > Is there a better way to manage flow separation in routed+encapsulated > >> > traffic? > >> > >> Encapsulated traffic is fine, since flow dissector skips encap header(s) > >> up to the L4 header. > >> > >> Problem is about encrypted traffic, since presumably this L4 header is > >> opaque for flow dissector ;) > > > > > > BTW, how can we make sure skb->hash is populated before IPSEC ? > > > > Relying on forwarding, and skb->hash set by a device might be not > > enough. > > > Should we do skb_get_hash upon entry to IPsec?
Right, but that might add overhead in cases we do not need skb->hash after IPsec . I've heard IPsec is already quite slow :/
