Re: [PATCH net-next v4 0/5] tls: perform TLS 1.3 KeyUpdate in the kernel
From: Martin Belanger
Date: Mon Nov 02 2026 - 14:45:14 EST
On 11/2/26 13:24, Chuck Lever wrote:
On Mon, 02 Nov 2026 11:57:57 -0500, Martin Belanger wrote:Thanks for the review.
The matching tlshd change for ktls-utils is a small patch to be
submitted at a later time if this series is accepted.
Recognizing that there may be further API changes, for the series:
Reviewed-by: Chuck Lever <cel@xxxxxxxxxx>
I don't expect any changes for the sunrpc consumers will be necessary.
For tlshd, as far as I can tell the whole change is:
- In tlshd_start_tls_handshake(), register a callback with
gnutls_handshake_set_secret_function() before the gnutls_handshake()
loop, as quic.c already does. We rely on SSLKEYLOGFILE to decrypt
NFS traffic in Wireshark, so that needs to continue to work.
- In tlshd_initialize_ktls(), after the existing TLS_TX and TLS_RX
install succeeds and only for a TLS 1.3 session, set
TLS_TX_TRAFFIC_SECRET with the write secret, then
TLS_RX_TRAFFIC_SECRET with the read secret.
- A configure.ac check for TLS_TX_TRAFFIC_SECRET in the installed
uapi header, so the build works against older kernels.
I assume you plan to send tlshd patches, but let me know if instead
you'd like the ktls-handshake folks to take care of this.
Yes, I will send the tlshd patches. I have a prototype, but it uses
gnutls_session_set_keylog_function(). That replaces the default
SSLKEYLOGFILE writer, so I will switch it to
gnutls_handshake_set_secret_function() as quic.c does, and add the
configure.ac check. I will post it to ktls-utils once the kernel uAPI
is settled.
Martin