4 ms·

Solaris had kssl doing much more of this 7-8 years ago. In their case SPARC T1+ CPUs had hardware support to accelerate crypto ops but iirc kssl did not depend

Solaris had kssl doing much more of this 7-8 years ago. In their case SPARC T1+ CPUs had hardware support to accelerate crypto ops but iirc kssl did not depend on it. It also did not require applications to support/know about SSL/TLS. So after moving to Solaris 10 we were able to make some legacy apps use SSL/TLS without adding any code at all! Pretty cool stuff. They did have a few vulnerabilities causing kernel panic that Snorcle had to fix - so in terms of adding more complexity to the kernel it's a risky approach but in our case it was totally worth it and it helped that the SSL/TLS traffic was all internal - nothing public facing.

ekiwi 9y ago
> we were able to make some legacy apps use SSL/TLS without adding any code at all How did you deal with certificate validation?
- Mister_Snuggles 9y ago
  This[0] seems to answer your questions. TL;DR: The kernel does it all and passes the unencrypted traffic to the local port specified. There's a command to configure it with the appropriate keys, etc. [0] http://www.c0t0d0s0.org/archives/5575-Less-known-Solaris-Features-kssl.html http://www.c0t0d0s0.org/archives/5575-Less-known-Solaris-Fea...
  - sannee 9y ago
    Sounds like nginx streams - http://nginx.org/en/docs/stream/ngx_stream_core_module.html http://nginx.org/en/docs/stream/ngx_stream_core_module.html . Really useful if you need TLS but the author of whatever you are running couldn't be bothered by adding support (includes being able to do client certificate auth!).
  - derefr 9y ago
    So, the same API semantics as IPSec transport mode, but not using IPSec. Seems like the best of both worlds, really.
- blinkingled 9y ago
  Well the app didn't care - we had self signed certs (actually internal CA signed IIRC) that we had to feed to the kernel ssl module using the ksslconfig commands. Edit: @Mister_Snuggles points to a link below if you wanted to run through the whole process.

ekiwi 9y ago

> we were able to make some legacy apps use SSL/TLS without adding any code at all How did you deal with certificate validation?

Mister_Snuggles 9y ago
This[0] seems to answer your questions. TL;DR: The kernel does it all and passes the unencrypted traffic to the local port specified. There's a command to configure it with the appropriate keys, etc. [0] http://www.c0t0d0s0.org/archives/5575-Less-known-Solaris-Features-kssl.html http://www.c0t0d0s0.org/archives/5575-Less-known-Solaris-Fea...
- sannee 9y ago
  Sounds like nginx streams - http://nginx.org/en/docs/stream/ngx_stream_core_module.html http://nginx.org/en/docs/stream/ngx_stream_core_module.html . Really useful if you need TLS but the author of whatever you are running couldn't be bothered by adding support (includes being able to do client certificate auth!).
- derefr 9y ago
  So, the same API semantics as IPSec transport mode, but not using IPSec. Seems like the best of both worlds, really.
blinkingled 9y ago
Well the app didn't care - we had self signed certs (actually internal CA signed IIRC) that we had to feed to the kernel ssl module using the ksslconfig commands. Edit: @Mister_Snuggles points to a link below if you wanted to run through the whole process.