On (11/23/15 10:53), Hannes Frederic Sowa wrote: > > > > - Integration with TLS (TLS-in-kernel is a separate initiative). > > This is interesting: > > Regarding the last week's discussion about better OOB support in TCP > e.g. for SOCKET_DESTROY, do you already have a plan to handle TLS alerts > and do CHANGE_CIPHER on the socket synchronously?
I have had that same question too. In fact I pointed this out already in the thread at http://permalink.gmane.org/gmane.linux.network/382278 In addition to CCS, TLS does other complex things such as mid-session regeneration of new session keys based on the master-secret. If you move TLS to the kernel, there may be a lot of synchronicity/security/inter-op issues to resolve. Perhaps it's not a good idea to use "TLS" on the TCP socket, but let each kcm application negotiate a crypto key (in any manner that it wants) and set it on the PF_KCM socket, then use that key to encrypt application data just before passing it off to tcp. (Of course, then you have to deal with the fact that BPF still needs to get to the clear data somehow) --Sowmini -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
