On Mon, 02 Nov 2026 11:57:57 -0500, Martin Belanger wrote:
The matching tlshd change for ktls-utils is a small patch to be
submitted at a later time if this series is accepted.
Recognizing that there may be further API changes, for the series:
Reviewed-by: Chuck Lever [off-list ref]
I don't expect any changes for the sunrpc consumers will be necessary.
For tlshd, as far as I can tell the whole change is:
- In tlshd_start_tls_handshake(), register a callback with
gnutls_handshake_set_secret_function() before the gnutls_handshake()
loop, as quic.c already does. We rely on SSLKEYLOGFILE to decrypt
NFS traffic in Wireshark, so that needs to continue to work.
- In tlshd_initialize_ktls(), after the existing TLS_TX and TLS_RX
install succeeds and only for a TLS 1.3 session, set
TLS_TX_TRAFFIC_SECRET with the write secret, then
TLS_RX_TRAFFIC_SECRET with the read secret.
- A configure.ac check for TLS_TX_TRAFFIC_SECRET in the installed
uapi header, so the build works against older kernels.
I assume you plan to send tlshd patches, but let me know if instead
you'd like the ktls-handshake folks to take care of this.
--
Chuck Lever (Come to NFS bake-a-thon! https://nfsv4bat.org)