4 ms·

Can't you already do all of that with a userspace implementation?

• viraptor 9y ago
  That's pretty much what stunnel does.
• JoshTriplett 9y ago
  Somewhat, if you pass a pipe around, but that also requires you to keep a separate process around, and shuttle data through two address spaces. With this, you can have a process do the negotiation, arrange a KTLS file descriptor, and then exec the new process.
  • icebraining 9y ago
    Couldn't you open a TCP connection, do the handshake, then pass just the session key to the new process, along with the handler to the TCP connection?
    • viraptor 9y ago
      You could, but you lose out on a nice interface. Kernel implementation allows you to not care that you're actually using SSL. It's a normal socket and polling / waiting / data transmission works exactly the same as without SSL. Handing over a session key means you still have to include an SSL lib. This is likely to end up being supported in systemd soon (I'm guessing) to get an SSL socket activation.
  • caf 9y ago
    Not really - if a control frame is received the KTLS file descriptor will report an error and disassociate itself from the TCP file descriptor, at which point you're supposed to transition back to using the userspace TLS library. You'll also need the userspace TLS library to do a clean shutdown.