€• žŒsphinx.addnodes”Œdocument”“”)”}”(Œ rawsource”Œ”Œchildren”]”(Œ translations”Œ LanguagesNode”“”)”}”(hhh]”(hŒ pending_xref”“”)”}”(hhh]”Œdocutils.nodes”ŒText”“”ŒChinese (Simplified)”…””}”Œparent”hsbaŒ attributes”}”(Œids”]”Œclasses”]”Œnames”]”Œdupnames”]”Œbackrefs”]”Œ refdomain”Œstd”Œreftype”Œdoc”Œ reftarget”Œ"/translations/zh_CN/networking/tls”Œmodname”NŒ classname”NŒ refexplicit”ˆuŒtagname”hhh ubh)”}”(hhh]”hŒChinese (Traditional)”…””}”hh2sbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ"/translations/zh_TW/networking/tls”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒItalian”…””}”hhFsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ"/translations/it_IT/networking/tls”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒJapanese”…””}”hhZsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ"/translations/ja_JP/networking/tls”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒKorean”…””}”hhnsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ"/translations/ko_KR/networking/tls”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒSpanish”…””}”hh‚sbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ"/translations/sp_SP/networking/tls”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubeh}”(h]”h ]”h"]”h$]”h&]”Œcurrent_language”ŒEnglish”uh1h hhŒ _document”hŒsource”NŒline”NubhŒtarget”“”)”}”(hŒ.. _kernel_tls:”h]”h}”(h]”h ]”h"]”h$]”h&]”Œrefid”Œ kernel-tls”uh1h¡h KhhhžhhŸŒcmsg_level = SOL_TLS; cmsg->cmsg_type = TLS_SET_RECORD_TYPE; cmsg->cmsg_len = CMSG_LEN(cmsg_len); *CMSG_DATA(cmsg) = record_type; msg.msg_controllen = cmsg->cmsg_len; msg_iov.iov_base = data; msg_iov.iov_len = length; msg.msg_iov = &msg_iov; msg.msg_iovlen = 1; return sendmsg(sock, &msg, 0); }”h]”hX^/* send TLS control message using record_type */ static int klts_send_ctrl_message(int sock, unsigned char record_type, void *data, size_t length) { struct msghdr msg = {0}; int cmsg_len = sizeof(record_type); struct cmsghdr *cmsg; char buf[CMSG_SPACE(cmsg_len)]; struct iovec msg_iov; /* Vector of data to send/receive into. */ msg.msg_control = buf; msg.msg_controllen = sizeof(buf); cmsg = CMSG_FIRSTHDR(&msg); cmsg->cmsg_level = SOL_TLS; cmsg->cmsg_type = TLS_SET_RECORD_TYPE; cmsg->cmsg_len = CMSG_LEN(cmsg_len); *CMSG_DATA(cmsg) = record_type; msg.msg_controllen = cmsg->cmsg_len; msg_iov.iov_base = data; msg_iov.iov_len = length; msg.msg_iov = &msg_iov; msg.msg_iovlen = 1; return sendmsg(sock, &msg, 0); }”…””}”hjžsbah}”(h]”h ]”h"]”h$]”h&]”j.j/j0‰j1j2j3}”uh1jhŸh¯h K„hjhžhubh×)”}”(hŒYControl message data should be provided unencrypted, and will be encrypted by the kernel.”h]”hŒYControl message data should be provided unencrypted, and will be encrypted by the kernel.”…””}”(hj­hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h K¡hjhžhubeh}”(h]”Œsend-tls-control-messages”ah ]”h"]”Œsend tls control messages”ah$]”h&]”uh1h°hhîhžhhŸh¯h K|ubh±)”}”(hhh]”(h¶)”}”(hŒReceiving TLS control messages”h]”hŒReceiving TLS control messages”…””}”(hjÆhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hµhjÃhžhhŸh¯h K¥ubh×)”}”(hŒìTLS control messages are passed in the userspace buffer, with message type passed via cmsg. If no cmsg buffer is provided, an error is returned if a control message is received. Data messages may be received without a cmsg buffer set.”h]”hŒìTLS control messages are passed in the userspace buffer, with message type passed via cmsg. If no cmsg buffer is provided, an error is returned if a control message is received. Data messages may be received without a cmsg buffer set.”…””}”(hjÔhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h K§hjÃhžhubj)”}”(hXÂchar buffer[16384]; char cmsg[CMSG_SPACE(sizeof(unsigned char))]; struct msghdr msg = {0}; msg.msg_control = cmsg; msg.msg_controllen = sizeof(cmsg); struct iovec msg_iov; msg_iov.iov_base = buffer; msg_iov.iov_len = 16384; msg.msg_iov = &msg_iov; msg.msg_iovlen = 1; int ret = recvmsg(sock, &msg, 0 /* flags */); struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg); if (cmsg->cmsg_level == SOL_TLS && cmsg->cmsg_type == TLS_GET_RECORD_TYPE) { int record_type = *((unsigned char *)CMSG_DATA(cmsg)); // Do something with record_type, and control message data in // buffer. // // Note that record_type may be == to application data (23). } else { // Buffer contains application data. }”h]”hXÂchar buffer[16384]; char cmsg[CMSG_SPACE(sizeof(unsigned char))]; struct msghdr msg = {0}; msg.msg_control = cmsg; msg.msg_controllen = sizeof(cmsg); struct iovec msg_iov; msg_iov.iov_base = buffer; msg_iov.iov_len = 16384; msg.msg_iov = &msg_iov; msg.msg_iovlen = 1; int ret = recvmsg(sock, &msg, 0 /* flags */); struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg); if (cmsg->cmsg_level == SOL_TLS && cmsg->cmsg_type == TLS_GET_RECORD_TYPE) { int record_type = *((unsigned char *)CMSG_DATA(cmsg)); // Do something with record_type, and control message data in // buffer. // // Note that record_type may be == to application data (23). } else { // Buffer contains application data. }”…””}”hjâsbah}”(h]”h ]”h"]”h$]”h&]”j.j/j0‰j1j2j3}”uh1jhŸh¯h K¬hjÃhžhubh×)”}”(hŒ`_.”h]”(hŒ9A patchset to OpenSSL to use ktls as the record layer is ”…””}”(hjÑhžhhŸNh NubhŒ reference”“”)”}”(hŒ=`here `_”h]”hŒhere”…””}”(hjÛhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œname”Œhere”Œrefuri”Œ3https://github.com/Mellanox/openssl/commits/tls_rx2”uh1jÙhjÑubh¢)”}”(hŒ6 ”h]”h}”(h]”Œhere”ah ]”h"]”Œhere”ah$]”h&]”Œrefuri”jìuh1h¡Œ referenced”KhjÑubhŒ.”…””}”(hjÑhžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h Këhj²hžhubh×)”}”(hŒÌ`An example `_ of calling send directly after a handshake using gnutls. Since it doesn't implement a full record layer, control messages are not supported.”h]”(jÚ)”}”(hŒ?`An example `_”h]”hŒ An example”…””}”(hj hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œname”Œ An example”jëŒ/https://github.com/ktls/af_ktls-tool/commits/RX”uh1jÙhjubh¢)”}”(hŒ2 ”h]”h}”(h]”Œ an-example”ah ]”h"]”Œ an example”ah$]”h&]”Œrefuri”juh1h¡júKhjubhŒ of calling send directly after a handshake using gnutls. Since it doesn’t implement a full record layer, control messages are not supported.”…””}”(hjhžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h Kîhj²hžhubeh}”(h]”Œ'integrating-in-to-userspace-tls-library”ah ]”h"]”Œ'integrating in to userspace tls library”ah$]”h&]”uh1h°hhîhžhhŸh¯h Kæubh±)”}”(hhh]”(h¶)”}”(hŒOptional optimizations”h]”hŒOptional optimizations”…””}”(hj<hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hµhj9hžhhŸh¯h Kôubh×)”}”(hXLThere are certain condition-specific optimizations the TLS ULP can make, if requested. Those optimizations are either not universally beneficial or may impact correctness, hence they require an opt-in. All options are set per-socket using setsockopt(), and their state can be checked using getsockopt() and via socket diag (``ss``).”h]”(hXDThere are certain condition-specific optimizations the TLS ULP can make, if requested. Those optimizations are either not universally beneficial or may impact correctness, hence they require an opt-in. All options are set per-socket using setsockopt(), and their state can be checked using getsockopt() and via socket diag (”…””}”(hjJhžhhŸNh Nubj&)”}”(hŒ``ss``”h]”hŒss”…””}”(hjRhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hjJubhŒ).”…””}”(hjJhžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h Köhj9hžhubh±)”}”(hhh]”(h¶)”}”(hŒTLS_TX_ZEROCOPY_RO”h]”hŒTLS_TX_ZEROCOPY_RO”…””}”(hjmhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hµhjjhžhhŸh¯h Kýubh×)”}”(hŒºFor device offload only. Allow sendfile() data to be transmitted directly to the NIC without making an in-kernel copy. This allows true zero-copy behavior when device offload is enabled.”h]”hŒºFor device offload only. Allow sendfile() data to be transmitted directly to the NIC without making an in-kernel copy. This allows true zero-copy behavior when device offload is enabled.”…””}”(hj{hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h Kÿhjjhžhubh×)”}”(hŒÔThe application must make sure that the data is not modified between being submitted and transmission completing. In other words this is mostly applicable if the data sent on a socket via sendfile() is read-only.”h]”hŒÔThe application must make sure that the data is not modified between being submitted and transmission completing. In other words this is mostly applicable if the data sent on a socket via sendfile() is read-only.”…””}”(hj‰hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h Mhjjhžhubh×)”}”(hŒÿModifying the data may result in different versions of the data being used for the original TCP transmission and TCP retransmissions. To the receiver this will look like TLS records had been tampered with and will result in record authentication failures.”h]”hŒÿModifying the data may result in different versions of the data being used for the original TCP transmission and TCP retransmissions. To the receiver this will look like TLS records had been tampered with and will result in record authentication failures.”…””}”(hj—hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h Mhjjhžhubeh}”(h]”Œtls-tx-zerocopy-ro”ah ]”h"]”Œtls_tx_zerocopy_ro”ah$]”h&]”uh1h°hj9hžhhŸh¯h Kýubh±)”}”(hhh]”(h¶)”}”(hŒTLS_RX_EXPECT_NO_PAD”h]”hŒTLS_RX_EXPECT_NO_PAD”…””}”(hj°hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hµhj­hžhhŸh¯h M ubh×)”}”(hŒ‡TLS 1.3 only. Expect the sender to not pad records. This allows the data to be decrypted directly into user space buffers with TLS 1.3.”h]”hŒ‡TLS 1.3 only. Expect the sender to not pad records. This allows the data to be decrypted directly into user space buffers with TLS 1.3.”…””}”(hj¾hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h Mhj­hžhubh×)”}”(hŒŒThis optimization is safe to enable only if the remote end is trusted, otherwise it is an attack vector to doubling the TLS processing cost.”h]”hŒŒThis optimization is safe to enable only if the remote end is trusted, otherwise it is an attack vector to doubling the TLS processing cost.”…””}”(hjÌhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h Mhj­hžhubh×)”}”(hŒÍIf the record decrypted turns out to had been padded or is not a data record it will be decrypted again into a kernel buffer without zero copy. Such events are counted in the ``TlsDecryptRetry`` statistic.”h]”(hŒ¯If the record decrypted turns out to had been padded or is not a data record it will be decrypted again into a kernel buffer without zero copy. Such events are counted in the ”…””}”(hjÚhžhhŸNh Nubj&)”}”(hŒ``TlsDecryptRetry``”h]”hŒTlsDecryptRetry”…””}”(hjâhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hjÚubhŒ statistic.”…””}”(hjÚhžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h Mhj­hžhubeh}”(h]”Œtls-rx-expect-no-pad”ah ]”h"]”Œtls_rx_expect_no_pad”ah$]”h&]”uh1h°hj9hžhhŸh¯h M ubeh}”(h]”Œoptional-optimizations”ah ]”h"]”Œoptional optimizations”ah$]”h&]”uh1h°hhîhžhhŸh¯h Kôubeh}”(h]”Œuser-interface”ah ]”h"]”Œuser interface”ah$]”h&]”uh1h°hh²hžhhŸh¯h Kubh±)”}”(hhh]”(h¶)”}”(hŒ Statistics”h]”hŒ Statistics”…””}”(hjhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hµhjhžhhŸh¯h Mubh×)”}”(hŒ[TLS implementation exposes the following per-namespace statistics (``/proc/net/tls_stat``):”h]”(hŒCTLS implementation exposes the following per-namespace statistics (”…””}”(hj#hžhhŸNh Nubj&)”}”(hŒ``/proc/net/tls_stat``”h]”hŒ/proc/net/tls_stat”…””}”(hj+hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hj#ubhŒ):”…””}”(hj#hžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h MhjhžhubhŒ bullet_list”“”)”}”(hhh]”(hŒ list_item”“”)”}”(hŒt``TlsCurrTxSw``, ``TlsCurrRxSw`` - number of TX and RX sessions currently installed where host handles cryptography ”h]”h×)”}”(hŒs``TlsCurrTxSw``, ``TlsCurrRxSw`` - number of TX and RX sessions currently installed where host handles cryptography”h]”(j&)”}”(hŒ``TlsCurrTxSw``”h]”hŒ TlsCurrTxSw”…””}”(hjRhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hjNubhŒ, ”…””}”(hjNhžhhŸNh Nubj&)”}”(hŒ``TlsCurrRxSw``”h]”hŒ TlsCurrRxSw”…””}”(hjdhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hjNubhŒS - number of TX and RX sessions currently installed where host handles cryptography”…””}”(hjNhžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h MhjJubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjEhžhhŸh¯h NubjI)”}”(hŒ{``TlsCurrTxDevice``, ``TlsCurrRxDevice`` - number of TX and RX sessions currently installed where NIC handles cryptography ”h]”h×)”}”(hŒz``TlsCurrTxDevice``, ``TlsCurrRxDevice`` - number of TX and RX sessions currently installed where NIC handles cryptography”h]”(j&)”}”(hŒ``TlsCurrTxDevice``”h]”hŒTlsCurrTxDevice”…””}”(hjŠhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hj†ubhŒ, ”…””}”(hj†hžhhŸNh Nubj&)”}”(hŒ``TlsCurrRxDevice``”h]”hŒTlsCurrRxDevice”…””}”(hjœhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hj†ubhŒR - number of TX and RX sessions currently installed where NIC handles cryptography”…””}”(hj†hžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h M#hj‚ubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjEhžhhŸh¯h NubjI)”}”(hŒV``TlsTxSw``, ``TlsRxSw`` - number of TX and RX sessions opened with host cryptography ”h]”h×)”}”(hŒU``TlsTxSw``, ``TlsRxSw`` - number of TX and RX sessions opened with host cryptography”h]”(j&)”}”(hŒ ``TlsTxSw``”h]”hŒTlsTxSw”…””}”(hjÂhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hj¾ubhŒ, ”…””}”(hj¾hžhhŸNh Nubj&)”}”(hŒ ``TlsRxSw``”h]”hŒTlsRxSw”…””}”(hjÔhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hj¾ubhŒ= - number of TX and RX sessions opened with host cryptography”…””}”(hj¾hžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h M'hjºubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjEhžhhŸh¯h NubjI)”}”(hŒ]``TlsTxDevice``, ``TlsRxDevice`` - number of TX and RX sessions opened with NIC cryptography ”h]”h×)”}”(hŒ\``TlsTxDevice``, ``TlsRxDevice`` - number of TX and RX sessions opened with NIC cryptography”h]”(j&)”}”(hŒ``TlsTxDevice``”h]”hŒ TlsTxDevice”…””}”(hjúhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hjöubhŒ, ”…””}”(hjöhžhhŸNh Nubj&)”}”(hŒ``TlsRxDevice``”h]”hŒ TlsRxDevice”…””}”(hj hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hjöubhŒ< - number of TX and RX sessions opened with NIC cryptography”…””}”(hjöhžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h M*hjòubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjEhžhhŸh¯h NubjI)”}”(hŒZ``TlsDecryptError`` - record decryption failed (e.g. due to incorrect authentication tag) ”h]”h×)”}”(hŒY``TlsDecryptError`` - record decryption failed (e.g. due to incorrect authentication tag)”h]”(j&)”}”(hŒ``TlsDecryptError``”h]”hŒTlsDecryptError”…””}”(hj2hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hj.ubhŒF - record decryption failed (e.g. due to incorrect authentication tag)”…””}”(hj.hžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h M-hj*ubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjEhžhhŸh¯h NubjI)”}”(hŒP``TlsDeviceRxResync`` - number of RX resyncs sent to NICs handling cryptography ”h]”h×)”}”(hŒO``TlsDeviceRxResync`` - number of RX resyncs sent to NICs handling cryptography”h]”(j&)”}”(hŒ``TlsDeviceRxResync``”h]”hŒTlsDeviceRxResync”…””}”(hjXhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hjTubhŒ: - number of RX resyncs sent to NICs handling cryptography”…””}”(hjThžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h M0hjPubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjEhžhhŸh¯h NubjI)”}”(hŒ¹``TlsDecryptRetry`` - number of RX records which had to be re-decrypted due to ``TLS_RX_EXPECT_NO_PAD`` mis-prediction. Note that this counter will also increment for non-data records. ”h]”h×)”}”(hŒ¸``TlsDecryptRetry`` - number of RX records which had to be re-decrypted due to ``TLS_RX_EXPECT_NO_PAD`` mis-prediction. Note that this counter will also increment for non-data records.”h]”(j&)”}”(hŒ``TlsDecryptRetry``”h]”hŒTlsDecryptRetry”…””}”(hj~hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hjzubhŒ< - number of RX records which had to be re-decrypted due to ”…””}”(hjzhžhhŸNh Nubj&)”}”(hŒ``TLS_RX_EXPECT_NO_PAD``”h]”hŒTLS_RX_EXPECT_NO_PAD”…””}”(hjhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hjzubhŒQ mis-prediction. Note that this counter will also increment for non-data records.”…””}”(hjzhžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h M3hjvubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjEhžhhŸh¯h NubjI)”}”(hŒ``TlsRxNoPadViolation`` - number of data RX records which had to be re-decrypted due to ``TLS_RX_EXPECT_NO_PAD`` mis-prediction. ”h]”h×)”}”(hŒ€``TlsRxNoPadViolation`` - number of data RX records which had to be re-decrypted due to ``TLS_RX_EXPECT_NO_PAD`` mis-prediction.”h]”(j&)”}”(hŒ``TlsRxNoPadViolation``”h]”hŒTlsRxNoPadViolation”…””}”(hj¶hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hj²ubhŒA - number of data RX records which had to be re-decrypted due to ”…””}”(hj²hžhhŸNh Nubj&)”}”(hŒ``TLS_RX_EXPECT_NO_PAD``”h]”hŒTLS_RX_EXPECT_NO_PAD”…””}”(hjÈhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hj²ubhŒ mis-prediction.”…””}”(hj²hžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h M8hj®ubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjEhžhhŸh¯h NubjI)”}”(hŒd``TlsTxRekeyOk``, ``TlsRxRekeyOk`` - number of successful rekeys on existing sessions for TX and RX ”h]”h×)”}”(hŒc``TlsTxRekeyOk``, ``TlsRxRekeyOk`` - number of successful rekeys on existing sessions for TX and RX”h]”(j&)”}”(hŒ``TlsTxRekeyOk``”h]”hŒ TlsTxRekeyOk”…””}”(hjîhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hjêubhŒ, ”…””}”(hjêhžhhŸNh Nubj&)”}”(hŒ``TlsRxRekeyOk``”h]”hŒ TlsRxRekeyOk”…””}”(hjhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hjêubhŒA - number of successful rekeys on existing sessions for TX and RX”…””}”(hjêhžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h M<hjæubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjEhžhhŸh¯h NubjI)”}”(hŒf``TlsTxRekeyError``, ``TlsRxRekeyError`` - number of failed rekeys on existing sessions for TX and RX ”h]”h×)”}”(hŒe``TlsTxRekeyError``, ``TlsRxRekeyError`` - number of failed rekeys on existing sessions for TX and RX”h]”(j&)”}”(hŒ``TlsTxRekeyError``”h]”hŒTlsTxRekeyError”…””}”(hj&hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hj"ubhŒ, ”…””}”(hj"hžhhŸNh Nubj&)”}”(hŒ``TlsRxRekeyError``”h]”hŒTlsRxRekeyError”…””}”(hj8hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hj"ubhŒ= - number of failed rekeys on existing sessions for TX and RX”…””}”(hj"hžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h M?hjubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjEhžhhŸh¯h NubjI)”}”(hŒu``TlsRxRekeyReceived`` - number of received KeyUpdate handshake messages, requiring userspace to provide a new RX key”h]”h×)”}”(hŒu``TlsRxRekeyReceived`` - number of received KeyUpdate handshake messages, requiring userspace to provide a new RX key”h]”(j&)”}”(hŒ``TlsRxRekeyReceived``”h]”hŒTlsRxRekeyReceived”…””}”(hj^hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j%hjZubhŒ_ - number of received KeyUpdate handshake messages, requiring userspace to provide a new RX key”…””}”(hjZhžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÖhŸh¯h MBhjVubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjEhžhhŸh¯h Nubeh}”(h]”h ]”h"]”h$]”h&]”Œbullet”Œ-”uh1jChŸh¯h Mhjhžhubeh}”(h]”Œ statistics”ah ]”h"]”Œ statistics”ah$]”h&]”uh1h°hh²hžhhŸh¯h Mubeh}”(h]”(h®Œid1”eh ]”h"]”(Œ kernel tls”Œ kernel_tls”eh$]”h&]”uh1h°hhhžhhŸh¯h KŒexpect_referenced_by_name”}”j’h£sŒexpect_referenced_by_id”}”h®h£subeh}”(h]”h ]”h"]”h$]”h&]”Œsource”h¯uh1hŒcurrent_source”NŒ current_line”NŒsettings”Œdocutils.frontend”ŒValues”“”)”}”(hµNŒ generator”NŒ datestamp”NŒ source_link”NŒ source_url”NŒ toc_backlinks”Œentry”Œfootnote_backlinks”KŒ sectnum_xform”KŒstrip_comments”NŒstrip_elements_with_classes”NŒ strip_classes”NŒ report_level”KŒ halt_level”KŒexit_status_level”KŒdebug”NŒwarning_stream”NŒ traceback”ˆŒinput_encoding”Œ utf-8-sig”Œinput_encoding_error_handler”Œstrict”Œoutput_encoding”Œutf-8”Œoutput_encoding_error_handler”j¼Œerror_encoding”Œutf-8”Œerror_encoding_error_handler”Œbackslashreplace”Œ language_code”Œen”Œrecord_dependencies”NŒconfig”NŒ id_prefix”hŒauto_id_prefix”Œid”Œ dump_settings”NŒdump_internals”NŒdump_transforms”NŒdump_pseudo_xml”NŒexpose_internals”NŒstrict_visitor”NŒ_disable_config”NŒ_source”h¯Œ _destination”NŒ _config_files”]”Œ7/var/lib/git/docbuild/linux/Documentation/docutils.conf”aŒfile_insertion_enabled”ˆŒ raw_enabled”KŒline_length_limit”M'Œpep_references”NŒ pep_base_url”Œhttps://peps.python.org/”Œpep_file_url_template”Œpep-%04d”Œrfc_references”NŒ rfc_base_url”Œ&https://datatracker.ietf.org/doc/html/”Œ tab_width”KŒtrim_footnote_reference_space”‰Œsyntax_highlight”Œlong”Œ smart_quotes”ˆŒsmartquotes_locales”]”Œcharacter_level_inline_markup”‰Œdoctitle_xform”‰Œ docinfo_xform”KŒsectsubtitle_xform”‰Œ image_loading”Œlink”Œembed_stylesheet”‰Œcloak_email_addresses”ˆŒsection_self_link”‰Œenv”NubŒreporter”NŒindirect_targets”]”Œsubstitution_defs”}”Œsubstitution_names”}”Œrefnames”}”Œrefids”}”h®]”h£asŒnameids”}”(j’h®j‘jŽhëhèjj jejbjâjßj|jyjÀj½jjj¯j¬j6j3jöjój#j jjjªj§jÿjüj‰j†uŒ nametypes”}”(j’ˆj‘‰hë‰j‰je‰jâ‰j|‰jÀ‰j‰j¯‰j6‰jöˆj#ˆj‰jª‰jÿ‰j‰‰uh}”(h®h²jŽh²hèhÅj hîjbhÿjßjhjyjåj½jjjÃj¬jj3j²jójíj jjj9j§jjjüj­j†juŒ footnote_refs”}”Œ citation_refs”}”Œ autofootnotes”]”Œautofootnote_refs”]”Œsymbol_footnotes”]”Œsymbol_footnote_refs”]”Œ footnotes”]”Œ citations”]”Œautofootnote_start”KŒsymbol_footnote_start”KŒ id_counter”Œ collections”ŒCounter”“”}”jÊKs…”R”Œparse_messages”]”Œtransform_messages”]”hŒsystem_message”“”)”}”(hhh]”h×)”}”(hhh]”hŒ0Hyperlink target "kernel-tls" is not referenced.”…””}”hj&sbah}”(h]”h ]”h"]”h$]”h&]”uh1hÖhj#ubah}”(h]”h ]”h"]”h$]”h&]”Œlevel”KŒtype”ŒINFO”Œsource”h¯Œline”Kuh1j!ubaŒ transformer”NŒ include_log”]”Œ decoration”Nhžhub.