3 ms·
Both FreeBSD (https://www.freebsd.org/cgi/man.cgi?query=ktls&sektion=4 https://www.freebsd.org/cgi/man.cgi?query=ktls&sektion=4) and Linux (https://www.kernel.o
by wahern 5y ago
Both FreeBSD (https://www.freebsd.org/cgi/man.cgi?query=ktls&sektion=4 https://www.freebsd.org/cgi/man.cgi?query=ktls&sektion=4) and Linux (https://www.kernel.org/doc/html/latest/networking/tls.html https://www.kernel.org/doc/html/latest/networking/tls.html) support kernel TLS. Though only for the bulk encryption. Stream initiation and certificate verification is too complex, with more regularly changing requirements and features. So most developers would still end up using an SSL library like OpenSSL to avoid having to directly use the more complex kernel interfaces and data processing dance on connection.
- XorNot 5y agoDefining a common syscall interface for stream initiation and cert verification, and then implementing the logic as a Linux kernel module would be a decent compromise I think.