Getting started with ktls

[Alan Somers]

On Wed, Mar 10, 2021 at 5:31 PM Benjamin Kaduk <kaduk at mit.edu> wrote:

> On Wed, Mar 10, 2021 at 05:18:24PM -0700, Alan Somers wrote:
> > I'm trying to make ktls work with "zfs send/recv" to substantially reduce
> > the CPU utilization of applications like zrepl.  But I have a few
> questions:
> >
> > * ktls(4)'s "Transmit" section says "Once TLS transmit is enabled by a
> > successful set of the TCP_TXTLS_ENABLE socket option", but the "Supported
> > Libraries" section says "Applications using a supported library should
> > generally work with ktls without any changes".  These sentences seem to
> be
> > contradictory.  I think it means that the TCP_TXTLS_ENABLE option is
> > necessary, but OpenSSL sets it automatically?
>
> Yes, OpenSSL sets it automatically for the builtin socket and connection
> BIO classes.  Applications using other BIO classes will need to do things
> manually (or implement the appropriate _ctrl() parameters for their BIO
> class).
>
> > * When using OpenSSL, the library will automatically call setsockopt(_,
> > TCP_TXTLS_ENABLE).  But it swallows the error, if any.  How is an
> > application to tell if ktls is enabled on a particular socket or OpenSSL
> > session?
>
> IIRC the lack of answer for this is part of why upstream OpenSSL doesn't
> have specific KTLS tests enabled in the automated test suite.
>

getsockopt(_. TCP_TXTLS_ENABLE) returns ENOPROTOOPT.  Is there any reason
why it's not implemented?  That might be the easiest way to check for the
ktls status of an individual socket.


>
> > * From experiment, I can see that OpenSSL attempts to set
> > TCP_TXTLS_ENABLE.  But it doesn't try to set TCP_RXTLS_ENABLE.  Why not?
> > From reading ktls_start and ossl_statem_server_post_work, it looks like
> > maybe a single socket cannot have ktls enabled for both sending and
> > receiving at the same time.  Is that true?
>
> No.  They just get enabled separately, since change_cipher_state() is
> called separately for read and write transitions.
>

Apologies if I'm too ignorant, but what is a transition in SSL-speak?  This
is my first attempt at any kind of SSL programming.  What I know from
ktrace is that TCP_RXTLS_ENABLE never gets set.


>
> -Ben
>
> > Based on the man page and rmacklem's previous mailing list posts, I think
> > this should be workable with minor modifications to the kernel and
> libzfs.
> > I just need to figure out how to use ktls first.
> >
> > -Alan
> > _______________________________________________
> > freebsd-current at freebsd.org mailing list
> > https://lists.freebsd.org/mailman/listinfo/freebsd-current
> > To unsubscribe, send any mail to "
> freebsd-current-unsubscribe at freebsd.org"
>