https://fedoraproject.org/wiki/Changes/KTLSSupportForGnuTLS This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee. == Summary == Acceleration of GnuTLS with software ''Kernel TLS'' (KTLS) == Owner == * Name: [[User:Fkrenzel| František Krenželok]], [[User:Ueno| Daiki Ueno]] * Email: fkrenzel@xxxxxxxxxx, dueno@xxxxxxxxxx == Detailed Description == The goal of this change is to provide GnuTLS users with a high throughput data transfer mechanism on encrypted channels, with emphasis on ''network block devices'' (NBD). We accomplish this with KTLS which offloads enc/decryption (TLS record) to the kernel, while GnuTLS handles initial connection (TLS handshake). GNUTLS will detect whether the kernel supports kTLS and will automatically enable its usage when compatible. Any package built against GNUTLS, is likely to see some performance benefit from kTLS, provided it has not installed custom push/pull I/O function callbacks. kTLS enables a reduction in context switching and reduced data copies when using send_file(). With suitable NIC hardware the encryption operations can be offloaded, freeing time on the main CPUs for application usage. Without offload hardware, kTLS may still improve parallelism for applications as the kernel can perform encryption operations on a differen host CPU to that running the application threads == Feedback == <!-- Summarize the feedback from the community and address why you chose not to accept proposed alternatives. This section is optional for all change proposals but is strongly suggested. Incorporating feedback here as it is raised gives FESCo a clearer view of your proposal and leaves a good record for the future. If you get no feedback, that is useful to note in this section as well. For innovative or possibly controversial ideas, consider collecting feedback before you file the change proposal. --> == Benefit to Fedora == The improvement lies in acceleration of large data transfers trough encrypted channels. The send_file function enables us to send data directly trough socket without entering user space, saving us from 2 context switches and 2 additional user space buffers. This is especially useful for NBD '''Benefits''' * Acceleration of ''live VM migration'', which should mitigate the downtime for various services used by both the users and the developers. * Increased speed at which files can be retrieved from NBD via encrypted channel and less CPU and memory strain on NBD server. packages that might benefit: {{package|nbd}} {{package|nbdkit}} {{package|qemu}} == Scope == * Proposal owners: Support for KTLS key update in GnuTLS ''track'': [https://gitlab.com/gnutls/gnutls/-/merge_requests/1625 gitlab] * Other developers: Support for TLS1.3 key update in KTLS (tls kernel module) * Release engineering: not needed for this Change * Policies and guidelines: not needed for this Change * Trademark approval: not needed for this Change * Alignment with Objectives: None == Upgrade/compatibility impact == Although this feature will be enabled by default, users will not notice any change, as in case of failure to initialize KTLS, GnuTLS will fallback to the currently used mode of operation. Users will be also provided with means to disable this feature trough crypto-policies == How To Test == '''To enable this feature user has to:''' # load TLS kernel module (`modprobe tls`) # enable ktls with crypto policies {{admon/note|Once proposal accepted|KTLS will be enabled by default and this step will not be needed.}} <pre>$ cat > /etc/crypto-policies/local.d/gnutls-ktls.config <<EOF [global] ktls = true EOF </pre> <pre>$ update-crypto-policies</pre> {{admon/important||KTLS will not initialize if app uses custom push/pull callback for GnuTLS.}} == User Experience == This change should accelerate large data transfers especially that of files. This will affect users that use applications which utilize GnuTLS for encrypting communication channels. == Dependencies == Currently '''KTLS doesn't support key_update''' (The keys delivered to the kernel can’t be set more than once per session) so a kernel module patch would be needed for this functionality. This not only impacts key_update invokation by user of either side, but also by [https://datatracker.ietf.org/doc/html/rfc8446#section-5.5 AES-GCM key usage limit]. As this could weaken the security of TLS protocol, GnuTLS will disable KTLS for rest of the session and fallback to default mode of operation i.e. move encryption and decryption back to usersace after the key_update is called. {{admon/note|GnuTLS supports KTLS key_update| This feature is supported if apropriate kernel patch is applied}} == Contingency Plan == * Contingency mechanism: Feature will be disabled by default in crypto-policies. * Contingency deadline: 2023-02-21 * Blocks release? No == Documentation == === API === '''[https://gnutls.org/manual/gnutls.html#index-gnutls_005ftransport_005fis_005fktls_005fenabled gnutls_transport_is_ktls_enabled()]''' To check if KTLS was properly initialized on the interfaces: {{admon/important||it has to be invoked no earlier that after a TLS-handshake}} <pre> gnutls_transport_ktls_enable_flags_t gnutls_transport_is_ktls_enabled(gnutls_session_t session);</pre> '''[https://gnutls.org/manual/gnutls.html#index-gnutls_005frecord_005fsend_005ffile gnutls_record_send_file()]''' To send data directly from a file descriptor in a zero-copy manner if KTLS is enabled; otherwise it will just iteratively read from the file descriptor: <pre> ssize_t gnutls_record_send_file(gnutls_session_t session, int fd, off_t *offset, size_t count);</pre> == Release Notes == -- Ben Cotton He / Him / His Fedora Program Manager Red Hat TZ=America/Indiana/Indianapolis _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
