Great post! One nice thing about having the data path in kernel is that you aren’t context switching to userspace and back, nor doing the associated copyin/cop

Great post! One nice thing about having the data path in kernel is that you aren’t context switching to userspace and back, nor doing the associated copyin/copyout to move data between address spaces. This can be further leveraged to do inline crypto offload, with Chelsio’s T6 NIC and Intel QuickAssist chipsets. This means it’s quite possible to do 100gbit IPSec networking with commodity hardware. With KTLS it may be possible to do that with other VPN technology too though! It may also be helpful to think of IPSec as layer 3ish while TLS is 4ish.