[PATCH net-next 2/3] docs: net: tls-offload: document tls_dev_del, tls_dev_resync, and rekey
flat view
STALE131d
SUPERSEDED
From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-06-09 20:12:28
Also in:
bpf, linux-doc
Subsystem:
documentation, networking [general], networking [tls], the rest · Maintainers:
Jonathan Corbet, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, John Fastabend, Sabrina Dubroca, Linus Torvalds
Revision v1 of 2 in this series.
Revisions (2)
- v1 current
- v2 [diff vs current]
Fill in some gaps in the TLS offload doc: - describe the tls_dev_del and tls_dev_resync callbacks - add a mention of rekeying being out of scope for now Signed-off-by: Jakub Kicinski <kuba@kernel.org> --- CC: john.fastabend@gmail.com CC: sd@queasysnail.net CC: corbet@lwn.net CC: skhan@linuxfoundation.org CC: linux-doc@vger.kernel.org --- Documentation/networking/tls-offload.rst | 29 ++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
diff --git a/Documentation/networking/tls-offload.rst b/Documentation/networking/tls-offload.rst
index c173f537bf4d..a41f46885e8c 100644
--- a/Documentation/networking/tls-offload.rst
+++ b/Documentation/networking/tls-offload.rst@@ -104,6 +104,29 @@ at the end of kernel structures (see :c:member:`driver_state` members in ``include/net/tls.h``) to avoid additional allocations and pointer dereferences. +When the offloaded connection is destroyed the core calls +the :c:member:`tls_dev_del` callback so the driver can release per-direction +state: + +.. code-block:: c + + void (*tls_dev_del)(struct net_device *netdev, + struct tls_context *ctx, + enum tls_offload_ctx_dir direction); + +``tls_dev_del`` is mandatory whenever ``tls_dev_add`` is provided. + +The third TLS device callback is :c:member:`tls_dev_resync`, called by the core +to synchronize the TCP stream with the record boundaries: + +.. code-block:: c + + int (*tls_dev_resync)(struct net_device *netdev, + struct sock *sk, u32 seq, u8 *rcd_sn, + enum tls_offload_ctx_dir direction); + +See the `Resync handling`_ section for details. + TX --
@@ -381,6 +404,12 @@ synchronization with an exponential back off (first after 2 encrypted records, then after 4 records, after 8, after 16... up until every 128 records). +Rekey +===== + +Offload does not currently support TLS 1.3, therefore key rotation +is not a concern for offloaded connections at this point. + Error handling ==============
--
2.54.0