Page MenuHomeFreeBSD

ktls: Always create a software backend for receive sessions.
ClosedPublic

Authored by jhb on Oct 19 2021, 5:51 PM.

Details

Summary

A future change to TOE TLS will require a software fallback for the
first few TLS records received. Future support for NIC TLS on receive
will also require a software fallback for certain cases.

Sponsored by: Chelsio Communications

Diff Detail

Repository
R10 FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

jhb requested review of this revision.Oct 19 2021, 5:51 PM

FYI, this effectively disables support for AES-CBC ciphers via TOE TLS. In the future I may add it back by adding a software decryption for MTE, but probably restrict it by default to only being enabled for TOE where the software route is only used for a few records.

This revision is now accepted and ready to land.Oct 19 2021, 10:19 PM