4 ms·

Nginx and OpenSSL are open source. Give it a try and reproduce their results with Linux ;-).

by crest 5y ago

betaby 5y ago
sendfile + kTLS. I'm unaware of the in-kernel TLS implementation for Linux. Is there any around?
- merb 5y ago
  https://www.kernel.org/doc/html/latest/networking/tls-offload.html https://www.kernel.org/doc/html/latest/networking/tls-offloa... https://docs.mellanox.com/display/OFEDv521040/Kernel+Transport+Layer+Security+%28kTLS%29+Offloads https://docs.mellanox.com/display/OFEDv521040/Kernel+Transpo...
- drewg123 5y ago
  Yes, Linux has kTLS. When I tried to use it, it was horribly broken, so my fear is that its not well used/tested, but it exists. Mellanox, for example, developed their inline hardware kTLS offload on linux.
  - Matthias247 5y ago
    > When I tried to use it, it was horribly broken, so my fear is that its not well used/tested, but it exists. Do you have any additional references around this? I'm aware that most rarely used functionality is often broken and therefore usually don't recommend people to use it, but would like to learn about kTLS in particular. I think for Linux OpenSSL 3 now added support for it in userspace. But there's also the kernel components as well as drivers - all of them could have their set of issues.
    - drewg123 5y ago
      I recall that simple transmits from offset 0..N in a file worked. But range requests of the form N..N+2MB lead to corrupt data. Its been 2+ years, and I heard it was later fixed in Linux.
      - genewitch 5y ago
        I once recommended a switch and router upgrade to allow for more, new WAPs for an office that was increasingly becoming dependent on laptops and video conferencing. I went with brand new kit, like just released earlier in the year because I'd heard good things about the traffic shaping, etc. Well, the printers wouldn't pair with the new APs, certain laptops with fruit logos would intermittently drop connection, and so on. I probably will never use that brand again, even though they escalated and promised patches quickly - within 6 hours they had found the issue and we're working on fixing it, but the damage to my reputation was already done. Since then I've always demanded to be able to test any new idea/kit/service for at least a week or two just to see if I can break it.
      - Matthias247 5y ago
        Interesting. I had imagined the range handling is purely handled by the reading side of things, and wouldn't care how the sink is implemented (kTLS, TLS, a pipe, etc). So I assumed the offset should be invisible for kTLS, which just sees a stream of data as usual.
      - Sesse__ 5y ago
        I've used sendfile + kTLS on Linux for a similar use case. It worked fine from the start, was broken in two (?) kernel releases for some use cases, and now works fine again from what I can tell. This is software kTLS, though; haven't tried hardware (not the least because it easily saturates 40 Gbit/sec, and I just don't have that level of traffic).
- deleted 5y ago
  [deleted]
Koshkin 5y ago
IMO the question was reasonable, whereas the answers like yours have always sounded to me like "fuck you."
relix42 5y ago
It was done a tested more than once. As I recall, it took quite a bit to get Linux to perform to the level that BSD was performing for (a) this use can and (b) the years of investment Netflix had already put into the BSD systems. So, could Linux be tweaked and made as performant for _this_ use case. I expect so. The question to be answered is _why_.

Nginx and OpenSSL are open source. Give it a try and reproduce their results with Linux ;-).

by crest 5y ago

Nginx and OpenSSL are open source. Give it a try and reproduce their results with Linux ;-).

betaby 5y ago

sendfile + kTLS. I'm unaware of the in-kernel TLS implementation for Linux. Is there any around?

merb 5y ago
https://www.kernel.org/doc/html/latest/networking/tls-offload.html https://www.kernel.org/doc/html/latest/networking/tls-offloa... https://docs.mellanox.com/display/OFEDv521040/Kernel+Transport+Layer+Security+%28kTLS%29+Offloads https://docs.mellanox.com/display/OFEDv521040/Kernel+Transpo...
drewg123 5y ago
Yes, Linux has kTLS. When I tried to use it, it was horribly broken, so my fear is that its not well used/tested, but it exists. Mellanox, for example, developed their inline hardware kTLS offload on linux.
- Matthias247 5y ago
  > When I tried to use it, it was horribly broken, so my fear is that its not well used/tested, but it exists. Do you have any additional references around this? I'm aware that most rarely used functionality is often broken and therefore usually don't recommend people to use it, but would like to learn about kTLS in particular. I think for Linux OpenSSL 3 now added support for it in userspace. But there's also the kernel components as well as drivers - all of them could have their set of issues.
  - drewg123 5y ago
    I recall that simple transmits from offset 0..N in a file worked. But range requests of the form N..N+2MB lead to corrupt data. Its been 2+ years, and I heard it was later fixed in Linux.
    - genewitch 5y ago
      I once recommended a switch and router upgrade to allow for more, new WAPs for an office that was increasingly becoming dependent on laptops and video conferencing. I went with brand new kit, like just released earlier in the year because I'd heard good things about the traffic shaping, etc. Well, the printers wouldn't pair with the new APs, certain laptops with fruit logos would intermittently drop connection, and so on. I probably will never use that brand again, even though they escalated and promised patches quickly - within 6 hours they had found the issue and we're working on fixing it, but the damage to my reputation was already done. Since then I've always demanded to be able to test any new idea/kit/service for at least a week or two just to see if I can break it.
    - Matthias247 5y ago
      Interesting. I had imagined the range handling is purely handled by the reading side of things, and wouldn't care how the sink is implemented (kTLS, TLS, a pipe, etc). So I assumed the offset should be invisible for kTLS, which just sees a stream of data as usual.
    - Sesse__ 5y ago
      I've used sendfile + kTLS on Linux for a similar use case. It worked fine from the start, was broken in two (?) kernel releases for some use cases, and now works fine again from what I can tell. This is software kTLS, though; haven't tried hardware (not the least because it easily saturates 40 Gbit/sec, and I just don't have that level of traffic).
deleted 5y ago
[deleted]

Koshkin 5y ago

IMO the question was reasonable, whereas the answers like yours have always sounded to me like "fuck you."

relix42 5y ago

It was done a tested more than once. As I recall, it took quite a bit to get Linux to perform to the level that BSD was performing for (a) this use can and (b) the years of investment Netflix had already put into the BSD systems. So, could Linux be tweaked and made as performant for _this_ use case. I expect so. The question to be answered is _why_.