This series adds support for kernel TLS encryption over TCP sockets.
A standard TCP socket is converted to a TLS socket using a setsockopt.
Only symmetric crypto is done in the kernel, as well as TLS record
framing. The handshake remains in userspace, and the negotiated
cipher keys/iv are provided to the TCP socket.
We implemented support for this API in OpenSSL 1.1.0, the code is
available at https://github.com/Mellanox/tls-openssl/tree/master
It should work with any TLS library with similar modifications,
a test tool using gnutls is here: https://github.com/Mellanox/tls-af_ktls_tool
Changes from RFC V2:
* Generic ULP (upper layer protocol) framework instead of TLS specific
setsockopts
* Dropped Mellanox hardware patches, will come as separate series.
Framework will work for both.
RFC V2:
http://www.mail-archive.com/[email protected]/msg160317.html
Changes from RFC V1:
* Socket based on changing TCP proto_ops instead of crypto framework
* Merged code with Mellanox's hardware tls offload
* Zerocopy sendmsg support added - sendpage/sendfile is no longer
necessary for zerocopy optimization
RFC V1:
http://www.mail-archive.com/[email protected]/msg88021.html
* Socket based on crypto userspace API framework, required two
sockets in userspace, one encrypted, one unencrypted.
Paper: https://netdevconf.org/1.2/papers/ktls.pdf
Aviad Yehezkel (1):
tcp: export do_tcp_sendpages and tcp_rate_check_app_limited functions
Boris Pismenny (2):
tcp: ULP infrastructure
tls: Documentation
Ilya Lesokhin (1):
tls: kernel TLS support
Documentation/networking/tls.txt | 120 ++++++
MAINTAINERS | 10 +
include/linux/socket.h | 1 +
include/net/inet_connection_sock.h | 4 +
include/net/tcp.h | 27 ++
include/net/tls.h | 223 +++++++++++
include/uapi/linux/tcp.h | 1 +
include/uapi/linux/tls.h | 79 ++++
net/Kconfig | 1 +
net/Makefile | 1 +
net/ipv4/Makefile | 2 +-
net/ipv4/sysctl_net_ipv4.c | 25 ++
net/ipv4/tcp.c | 33 +-
net/ipv4/tcp_ipv4.c | 2 +
net/ipv4/tcp_rate.c | 1 +
net/ipv4/tcp_ulp.c | 134 +++++++
net/tls/Kconfig | 12 +
net/tls/Makefile | 7 +
net/tls/tls_main.c | 450 +++++++++++++++++++++
net/tls/tls_sw.c | 788 +++++++++++++++++++++++++++++++++++++
20 files changed, 1918 insertions(+), 3 deletions(-)
create mode 100644 Documentation/networking/tls.txt
create mode 100644 include/net/tls.h
create mode 100644 include/uapi/linux/tls.h
create mode 100644 net/ipv4/tcp_ulp.c
create mode 100644 net/tls/Kconfig
create mode 100644 net/tls/Makefile
create mode 100644 net/tls/tls_main.c
create mode 100644 net/tls/tls_sw.c
--
2.9.3
From: Dave Watson <[email protected]>
Date: Wed, 24 May 2017 09:26:33 -0700
> This series adds support for kernel TLS encryption over TCP sockets.
> A standard TCP socket is converted to a TLS socket using a setsockopt.
> Only symmetric crypto is done in the kernel, as well as TLS record
> framing. The handshake remains in userspace, and the negotiated
> cipher keys/iv are provided to the TCP socket.
>
> We implemented support for this API in OpenSSL 1.1.0, the code is
> available at https://github.com/Mellanox/tls-openssl/tree/master
>
> It should work with any TLS library with similar modifications,
> a test tool using gnutls is here: https://github.com/Mellanox/tls-af_ktls_tool
>
> Changes from RFC V2:
>
> * Generic ULP (upper layer protocol) framework instead of TLS specific
> setsockopts
> * Dropped Mellanox hardware patches, will come as separate series.
> Framework will work for both.
The value in this is seeing how it can work transparently behind
an existing userspace library providing TLS services.
So the reference to the gnutls and openssl implementations probably
belongs in the Documentation patch #4 too.
Thanks.