€•ýªŒsphinx.addnodes”Œdocument”“”)”}”(Œ rawsource”Œ”Œchildren”]”(Œ translations”Œ LanguagesNode”“”)”}”(hhh]”(hŒ pending_xref”“”)”}”(hhh]”Œdocutils.nodes”ŒText”“”ŒChinese (Simplified)”…””}”Œparent”hsbaŒ attributes”}”(Œids”]”Œclasses”]”Œnames”]”Œdupnames”]”Œbackrefs”]”Œ refdomain”Œstd”Œreftype”Œdoc”Œ reftarget”Œ"/translations/zh_CN/networking/tls”Œmodname”NŒ classname”NŒ refexplicit”ˆuŒtagname”hhh ubh)”}”(hhh]”hŒChinese (Traditional)”…””}”hh2sbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ"/translations/zh_TW/networking/tls”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒItalian”…””}”hhFsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ"/translations/it_IT/networking/tls”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒJapanese”…””}”hhZsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ"/translations/ja_JP/networking/tls”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒKorean”…””}”hhnsbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ"/translations/ko_KR/networking/tls”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒPortuguese (Brazilian)”…””}”hh‚sbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ"/translations/pt_BR/networking/tls”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubh)”}”(hhh]”hŒSpanish”…””}”hh–sbah}”(h]”h ]”h"]”h$]”h&]”Œ refdomain”h)Œreftype”h+Œ reftarget”Œ"/translations/sp_SP/networking/tls”Œmodname”NŒ classname”NŒ refexplicit”ˆuh1hhh ubeh}”(h]”h ]”h"]”h$]”h&]”Œcurrent_language”ŒEnglish”uh1h hhŒ _document”hŒsource”NŒline”NubhŒtarget”“”)”}”(hŒ.. _kernel_tls:”h]”h}”(h]”h ]”h"]”h$]”h&]”Œrefid”Œ kernel-tls”uh1hµh´Khhh²hh³Œcmsg_level = SOL_TLS; cmsg->cmsg_type = TLS_SET_RECORD_TYPE; cmsg->cmsg_len = CMSG_LEN(cmsg_len); *CMSG_DATA(cmsg) = record_type; msg.msg_controllen = cmsg->cmsg_len; msg_iov.iov_base = data; msg_iov.iov_len = length; msg.msg_iov = &msg_iov; msg.msg_iovlen = 1; return sendmsg(sock, &msg, 0); }”h]”hX^/* send TLS control message using record_type */ static int klts_send_ctrl_message(int sock, unsigned char record_type, void *data, size_t length) { struct msghdr msg = {0}; int cmsg_len = sizeof(record_type); struct cmsghdr *cmsg; char buf[CMSG_SPACE(cmsg_len)]; struct iovec msg_iov; /* Vector of data to send/receive into. */ msg.msg_control = buf; msg.msg_controllen = sizeof(buf); cmsg = CMSG_FIRSTHDR(&msg); cmsg->cmsg_level = SOL_TLS; cmsg->cmsg_type = TLS_SET_RECORD_TYPE; cmsg->cmsg_len = CMSG_LEN(cmsg_len); *CMSG_DATA(cmsg) = record_type; msg.msg_controllen = cmsg->cmsg_len; msg_iov.iov_base = data; msg_iov.iov_len = length; msg.msg_iov = &msg_iov; msg.msg_iovlen = 1; return sendmsg(sock, &msg, 0); }”…””}”hj²sbah}”(h]”h ]”h"]”h$]”h&]”jBjCjD‰jEjFjG}”uh1j2h³hÃh´K†hj“h²hubhë)”}”(hŒYControl message data should be provided unencrypted, and will be encrypted by the kernel.”h]”hŒYControl message data should be provided unencrypted, and will be encrypted by the kernel.”…””}”(hjÁh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´K£hj“h²hubeh}”(h]”Œsend-tls-control-messages”ah ]”h"]”Œsend tls control messages”ah$]”h&]”uh1hÄhjh²hh³hÃh´K~ubhÅ)”}”(hhh]”(hÊ)”}”(hŒReceiving TLS control messages”h]”hŒReceiving TLS control messages”…””}”(hjÚh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhj×h²hh³hÃh´K§ubhë)”}”(hŒìTLS control messages are passed in the userspace buffer, with message type passed via cmsg. If no cmsg buffer is provided, an error is returned if a control message is received. Data messages may be received without a cmsg buffer set.”h]”hŒìTLS control messages are passed in the userspace buffer, with message type passed via cmsg. If no cmsg buffer is provided, an error is returned if a control message is received. Data messages may be received without a cmsg buffer set.”…””}”(hjèh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´K©hj×h²hubj3)”}”(hXÂchar buffer[16384]; char cmsg[CMSG_SPACE(sizeof(unsigned char))]; struct msghdr msg = {0}; msg.msg_control = cmsg; msg.msg_controllen = sizeof(cmsg); struct iovec msg_iov; msg_iov.iov_base = buffer; msg_iov.iov_len = 16384; msg.msg_iov = &msg_iov; msg.msg_iovlen = 1; int ret = recvmsg(sock, &msg, 0 /* flags */); struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg); if (cmsg->cmsg_level == SOL_TLS && cmsg->cmsg_type == TLS_GET_RECORD_TYPE) { int record_type = *((unsigned char *)CMSG_DATA(cmsg)); // Do something with record_type, and control message data in // buffer. // // Note that record_type may be == to application data (23). } else { // Buffer contains application data. }”h]”hXÂchar buffer[16384]; char cmsg[CMSG_SPACE(sizeof(unsigned char))]; struct msghdr msg = {0}; msg.msg_control = cmsg; msg.msg_controllen = sizeof(cmsg); struct iovec msg_iov; msg_iov.iov_base = buffer; msg_iov.iov_len = 16384; msg.msg_iov = &msg_iov; msg.msg_iovlen = 1; int ret = recvmsg(sock, &msg, 0 /* flags */); struct cmsghdr *cmsg = CMSG_FIRSTHDR(&msg); if (cmsg->cmsg_level == SOL_TLS && cmsg->cmsg_type == TLS_GET_RECORD_TYPE) { int record_type = *((unsigned char *)CMSG_DATA(cmsg)); // Do something with record_type, and control message data in // buffer. // // Note that record_type may be == to application data (23). } else { // Buffer contains application data. }”…””}”hjösbah}”(h]”h ]”h"]”h$]”h&]”jBjCjD‰jEjFjG}”uh1j2h³hÃh´K®hj×h²hubhë)”}”(hŒ`_.”h]”(hŒ9A patchset to OpenSSL to use ktls as the record layer is ”…””}”(hjåh²hh³Nh´NubhŒ reference”“”)”}”(hŒ=`here `_”h]”hŒhere”…””}”(hjïh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”Œname”Œhere”Œrefuri”Œ3https://github.com/Mellanox/openssl/commits/tls_rx2”uh1jíhjåubh¶)”}”(hŒ6 ”h]”h}”(h]”Œhere”ah ]”h"]”Œhere”ah$]”h&]”Œrefuri”juh1hµŒ referenced”KhjåubhŒ.”…””}”(hjåh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´KíhjÆh²hubhë)”}”(hŒÌ`An example `_ of calling send directly after a handshake using gnutls. Since it doesn't implement a full record layer, control messages are not supported.”h]”(jî)”}”(hŒ?`An example `_”h]”hŒ An example”…””}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”Œname”Œ An example”jÿŒ/https://github.com/ktls/af_ktls-tool/commits/RX”uh1jíhjubh¶)”}”(hŒ2 ”h]”h}”(h]”Œ an-example”ah ]”h"]”Œ an example”ah$]”h&]”Œrefuri”j-uh1hµjKhjubhŒ of calling send directly after a handshake using gnutls. Since it doesn’t implement a full record layer, control messages are not supported.”…””}”(hjh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´KðhjÆh²hubeh}”(h]”Œ'integrating-in-to-userspace-tls-library”ah ]”h"]”Œ'integrating in to userspace tls library”ah$]”h&]”uh1hÄhjh²hh³hÃh´KèubhÅ)”}”(hhh]”(hÊ)”}”(hŒOptional optimizations”h]”hŒOptional optimizations”…””}”(hjPh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhjMh²hh³hÃh´Köubhë)”}”(hXLThere are certain condition-specific optimizations the TLS ULP can make, if requested. Those optimizations are either not universally beneficial or may impact correctness, hence they require an opt-in. All options are set per-socket using setsockopt(), and their state can be checked using getsockopt() and via socket diag (``ss``).”h]”(hXDThere are certain condition-specific optimizations the TLS ULP can make, if requested. Those optimizations are either not universally beneficial or may impact correctness, hence they require an opt-in. All options are set per-socket using setsockopt(), and their state can be checked using getsockopt() and via socket diag (”…””}”(hj^h²hh³Nh´Nubj:)”}”(hŒ``ss``”h]”hŒss”…””}”(hjfh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hj^ubhŒ).”…””}”(hj^h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´KøhjMh²hubhÅ)”}”(hhh]”(hÊ)”}”(hŒTLS_TX_ZEROCOPY_RO”h]”hŒTLS_TX_ZEROCOPY_RO”…””}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhj~h²hh³hÃh´Kÿubhë)”}”(hŒºFor device offload only. Allow sendfile() data to be transmitted directly to the NIC without making an in-kernel copy. This allows true zero-copy behavior when device offload is enabled.”h]”hŒºFor device offload only. Allow sendfile() data to be transmitted directly to the NIC without making an in-kernel copy. This allows true zero-copy behavior when device offload is enabled.”…””}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´Mhj~h²hubhë)”}”(hŒÔThe application must make sure that the data is not modified between being submitted and transmission completing. In other words this is mostly applicable if the data sent on a socket via sendfile() is read-only.”h]”hŒÔThe application must make sure that the data is not modified between being submitted and transmission completing. In other words this is mostly applicable if the data sent on a socket via sendfile() is read-only.”…””}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´Mhj~h²hubhë)”}”(hŒÿModifying the data may result in different versions of the data being used for the original TCP transmission and TCP retransmissions. To the receiver this will look like TLS records had been tampered with and will result in record authentication failures.”h]”hŒÿModifying the data may result in different versions of the data being used for the original TCP transmission and TCP retransmissions. To the receiver this will look like TLS records had been tampered with and will result in record authentication failures.”…””}”(hj«h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´M hj~h²hubeh}”(h]”Œtls-tx-zerocopy-ro”ah ]”h"]”Œtls_tx_zerocopy_ro”ah$]”h&]”uh1hÄhjMh²hh³hÃh´KÿubhÅ)”}”(hhh]”(hÊ)”}”(hŒTLS_RX_EXPECT_NO_PAD”h]”hŒTLS_RX_EXPECT_NO_PAD”…””}”(hjÄh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhjÁh²hh³hÃh´Mubhë)”}”(hŒ‡TLS 1.3 only. Expect the sender to not pad records. This allows the data to be decrypted directly into user space buffers with TLS 1.3.”h]”hŒ‡TLS 1.3 only. Expect the sender to not pad records. This allows the data to be decrypted directly into user space buffers with TLS 1.3.”…””}”(hjÒh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´MhjÁh²hubhë)”}”(hŒŒThis optimization is safe to enable only if the remote end is trusted, otherwise it is an attack vector to doubling the TLS processing cost.”h]”hŒŒThis optimization is safe to enable only if the remote end is trusted, otherwise it is an attack vector to doubling the TLS processing cost.”…””}”(hjàh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´MhjÁh²hubhë)”}”(hŒÍIf the record decrypted turns out to had been padded or is not a data record it will be decrypted again into a kernel buffer without zero copy. Such events are counted in the ``TlsDecryptRetry`` statistic.”h]”(hŒ¯If the record decrypted turns out to had been padded or is not a data record it will be decrypted again into a kernel buffer without zero copy. Such events are counted in the ”…””}”(hjîh²hh³Nh´Nubj:)”}”(hŒ``TlsDecryptRetry``”h]”hŒTlsDecryptRetry”…””}”(hjöh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hjîubhŒ statistic.”…””}”(hjîh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´MhjÁh²hubeh}”(h]”Œtls-rx-expect-no-pad”ah ]”h"]”Œtls_rx_expect_no_pad”ah$]”h&]”uh1hÄhjMh²hh³hÃh´MubhÅ)”}”(hhh]”(hÊ)”}”(hŒTLS_TX_MAX_PAYLOAD_LEN”h]”hŒTLS_TX_MAX_PAYLOAD_LEN”…””}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhjh²hh³hÃh´Mubhë)”}”(hŒPSpecifies the maximum size of the plaintext payload for transmitted TLS records.”h]”hŒPSpecifies the maximum size of the plaintext payload for transmitted TLS records.”…””}”(hj'h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´Mhjh²hubhë)”}”(hŒØWhen this option is set, the kernel enforces the specified limit on all outgoing TLS records. No plaintext fragment will exceed this size. This option can be used to implement the TLS Record Size Limit extension [1].”h]”hŒØWhen this option is set, the kernel enforces the specified limit on all outgoing TLS records. No plaintext fragment will exceed this size. This option can be used to implement the TLS Record Size Limit extension [1].”…””}”(hj5h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´M hjh²hubhŒ bullet_list”“”)”}”(hhh]”(hŒ list_item”“”)”}”(hŒEFor TLS 1.2, the value corresponds directly to the record size limit.”h]”hë)”}”(hjLh]”hŒEFor TLS 1.2, the value corresponds directly to the record size limit.”…””}”(hjNh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´M$hjJubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjEh²hh³hÃh´NubjI)”}”(hŒ“For TLS 1.3, the value should be set to record_size_limit - 1, since the record size limit includes one additional byte for the ContentType field. ”h]”hë)”}”(hŒ’For TLS 1.3, the value should be set to record_size_limit - 1, since the record size limit includes one additional byte for the ContentType field.”h]”hŒ’For TLS 1.3, the value should be set to record_size_limit - 1, since the record size limit includes one additional byte for the ContentType field.”…””}”(hjeh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´M%hjaubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjEh²hh³hÃh´Nubeh}”(h]”h ]”h"]”h$]”h&]”Œbullet”Œ*”uh1jCh³hÃh´M$hjh²hubhë)”}”(hŒ½The valid range for this option is 64 to 16384 bytes for TLS 1.2, and 63 to 16384 bytes for TLS 1.3. The lower minimum for TLS 1.3 accounts for the extra byte used by the ContentType field.”h]”hŒ½The valid range for this option is 64 to 16384 bytes for TLS 1.2, and 63 to 16384 bytes for TLS 1.3. The lower minimum for TLS 1.3 accounts for the extra byte used by the ContentType field.”…””}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´M)hjh²hubhë)”}”(hŒ1[1] https://datatracker.ietf.org/doc/html/rfc8449”h]”(hŒ[1] ”…””}”(hjh²hh³Nh´Nubjî)”}”(hŒ-https://datatracker.ietf.org/doc/html/rfc8449”h]”hŒ-https://datatracker.ietf.org/doc/html/rfc8449”…””}”(hj—h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”j™uh1jíhjubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´M-hjh²hubeh}”(h]”Œtls-tx-max-payload-len”ah ]”h"]”Œtls_tx_max_payload_len”ah$]”h&]”uh1hÄhjMh²hh³hÃh´Mubeh}”(h]”Œoptional-optimizations”ah ]”h"]”Œoptional optimizations”ah$]”h&]”uh1hÄhjh²hh³hÃh´Köubeh}”(h]”Œuser-interface”ah ]”h"]”Œuser interface”ah$]”h&]”uh1hÄhhÆh²hh³hÃh´KubhÅ)”}”(hhh]”(hÊ)”}”(hŒ Statistics”h]”hŒ Statistics”…””}”(hjÇh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhjÄh²hh³hÃh´M0ubhë)”}”(hŒ[TLS implementation exposes the following per-namespace statistics (``/proc/net/tls_stat``):”h]”(hŒCTLS implementation exposes the following per-namespace statistics (”…””}”(hjÕh²hh³Nh´Nubj:)”}”(hŒ``/proc/net/tls_stat``”h]”hŒ/proc/net/tls_stat”…””}”(hjÝh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hjÕubhŒ):”…””}”(hjÕh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´M2hjÄh²hubjD)”}”(hhh]”(jI)”}”(hŒt``TlsCurrTxSw``, ``TlsCurrRxSw`` - number of TX and RX sessions currently installed where host handles cryptography ”h]”hë)”}”(hŒs``TlsCurrTxSw``, ``TlsCurrRxSw`` - number of TX and RX sessions currently installed where host handles cryptography”h]”(j:)”}”(hŒ``TlsCurrTxSw``”h]”hŒ TlsCurrTxSw”…””}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hjüubhŒ, ”…””}”(hjüh²hh³Nh´Nubj:)”}”(hŒ``TlsCurrRxSw``”h]”hŒ TlsCurrRxSw”…””}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hjüubhŒS - number of TX and RX sessions currently installed where host handles cryptography”…””}”(hjüh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´M5hjøubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjõh²hh³hÃh´NubjI)”}”(hŒ{``TlsCurrTxDevice``, ``TlsCurrRxDevice`` - number of TX and RX sessions currently installed where NIC handles cryptography ”h]”hë)”}”(hŒz``TlsCurrTxDevice``, ``TlsCurrRxDevice`` - number of TX and RX sessions currently installed where NIC handles cryptography”h]”(j:)”}”(hŒ``TlsCurrTxDevice``”h]”hŒTlsCurrTxDevice”…””}”(hj8h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hj4ubhŒ, ”…””}”(hj4h²hh³Nh´Nubj:)”}”(hŒ``TlsCurrRxDevice``”h]”hŒTlsCurrRxDevice”…””}”(hjJh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hj4ubhŒR - number of TX and RX sessions currently installed where NIC handles cryptography”…””}”(hj4h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´M9hj0ubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjõh²hh³hÃh´NubjI)”}”(hŒV``TlsTxSw``, ``TlsRxSw`` - number of TX and RX sessions opened with host cryptography ”h]”hë)”}”(hŒU``TlsTxSw``, ``TlsRxSw`` - number of TX and RX sessions opened with host cryptography”h]”(j:)”}”(hŒ ``TlsTxSw``”h]”hŒTlsTxSw”…””}”(hjph²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hjlubhŒ, ”…””}”(hjlh²hh³Nh´Nubj:)”}”(hŒ ``TlsRxSw``”h]”hŒTlsRxSw”…””}”(hj‚h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hjlubhŒ= - number of TX and RX sessions opened with host cryptography”…””}”(hjlh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´M=hjhubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjõh²hh³hÃh´NubjI)”}”(hŒ]``TlsTxDevice``, ``TlsRxDevice`` - number of TX and RX sessions opened with NIC cryptography ”h]”hë)”}”(hŒ\``TlsTxDevice``, ``TlsRxDevice`` - number of TX and RX sessions opened with NIC cryptography”h]”(j:)”}”(hŒ``TlsTxDevice``”h]”hŒ TlsTxDevice”…””}”(hj¨h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hj¤ubhŒ, ”…””}”(hj¤h²hh³Nh´Nubj:)”}”(hŒ``TlsRxDevice``”h]”hŒ TlsRxDevice”…””}”(hjºh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hj¤ubhŒ< - number of TX and RX sessions opened with NIC cryptography”…””}”(hj¤h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´M@hj ubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjõh²hh³hÃh´NubjI)”}”(hŒZ``TlsDecryptError`` - record decryption failed (e.g. due to incorrect authentication tag) ”h]”hë)”}”(hŒY``TlsDecryptError`` - record decryption failed (e.g. due to incorrect authentication tag)”h]”(j:)”}”(hŒ``TlsDecryptError``”h]”hŒTlsDecryptError”…””}”(hjàh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hjÜubhŒF - record decryption failed (e.g. due to incorrect authentication tag)”…””}”(hjÜh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´MChjØubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjõh²hh³hÃh´NubjI)”}”(hŒP``TlsDeviceRxResync`` - number of RX resyncs sent to NICs handling cryptography ”h]”hë)”}”(hŒO``TlsDeviceRxResync`` - number of RX resyncs sent to NICs handling cryptography”h]”(j:)”}”(hŒ``TlsDeviceRxResync``”h]”hŒTlsDeviceRxResync”…””}”(hjh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hjubhŒ: - number of RX resyncs sent to NICs handling cryptography”…””}”(hjh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´MFhjþubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjõh²hh³hÃh´NubjI)”}”(hŒ¹``TlsDecryptRetry`` - number of RX records which had to be re-decrypted due to ``TLS_RX_EXPECT_NO_PAD`` mis-prediction. Note that this counter will also increment for non-data records. ”h]”hë)”}”(hŒ¸``TlsDecryptRetry`` - number of RX records which had to be re-decrypted due to ``TLS_RX_EXPECT_NO_PAD`` mis-prediction. Note that this counter will also increment for non-data records.”h]”(j:)”}”(hŒ``TlsDecryptRetry``”h]”hŒTlsDecryptRetry”…””}”(hj,h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hj(ubhŒ< - number of RX records which had to be re-decrypted due to ”…””}”(hj(h²hh³Nh´Nubj:)”}”(hŒ``TLS_RX_EXPECT_NO_PAD``”h]”hŒTLS_RX_EXPECT_NO_PAD”…””}”(hj>h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hj(ubhŒQ mis-prediction. Note that this counter will also increment for non-data records.”…””}”(hj(h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´MIhj$ubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjõh²hh³hÃh´NubjI)”}”(hŒ``TlsRxNoPadViolation`` - number of data RX records which had to be re-decrypted due to ``TLS_RX_EXPECT_NO_PAD`` mis-prediction. ”h]”hë)”}”(hŒ€``TlsRxNoPadViolation`` - number of data RX records which had to be re-decrypted due to ``TLS_RX_EXPECT_NO_PAD`` mis-prediction.”h]”(j:)”}”(hŒ``TlsRxNoPadViolation``”h]”hŒTlsRxNoPadViolation”…””}”(hjdh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hj`ubhŒA - number of data RX records which had to be re-decrypted due to ”…””}”(hj`h²hh³Nh´Nubj:)”}”(hŒ``TLS_RX_EXPECT_NO_PAD``”h]”hŒTLS_RX_EXPECT_NO_PAD”…””}”(hjvh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hj`ubhŒ mis-prediction.”…””}”(hj`h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´MNhj\ubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjõh²hh³hÃh´NubjI)”}”(hŒd``TlsTxRekeyOk``, ``TlsRxRekeyOk`` - number of successful rekeys on existing sessions for TX and RX ”h]”hë)”}”(hŒc``TlsTxRekeyOk``, ``TlsRxRekeyOk`` - number of successful rekeys on existing sessions for TX and RX”h]”(j:)”}”(hŒ``TlsTxRekeyOk``”h]”hŒ TlsTxRekeyOk”…””}”(hjœh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hj˜ubhŒ, ”…””}”(hj˜h²hh³Nh´Nubj:)”}”(hŒ``TlsRxRekeyOk``”h]”hŒ TlsRxRekeyOk”…””}”(hj®h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hj˜ubhŒA - number of successful rekeys on existing sessions for TX and RX”…””}”(hj˜h²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´MRhj”ubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjõh²hh³hÃh´NubjI)”}”(hŒf``TlsTxRekeyError``, ``TlsRxRekeyError`` - number of failed rekeys on existing sessions for TX and RX ”h]”hë)”}”(hŒe``TlsTxRekeyError``, ``TlsRxRekeyError`` - number of failed rekeys on existing sessions for TX and RX”h]”(j:)”}”(hŒ``TlsTxRekeyError``”h]”hŒTlsTxRekeyError”…””}”(hjÔh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hjÐubhŒ, ”…””}”(hjÐh²hh³Nh´Nubj:)”}”(hŒ``TlsRxRekeyError``”h]”hŒTlsRxRekeyError”…””}”(hjæh²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hjÐubhŒ= - number of failed rekeys on existing sessions for TX and RX”…””}”(hjÐh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´MUhjÌubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjõh²hh³hÃh´NubjI)”}”(hŒu``TlsRxRekeyReceived`` - number of received KeyUpdate handshake messages, requiring userspace to provide a new RX key”h]”hë)”}”(hŒu``TlsRxRekeyReceived`` - number of received KeyUpdate handshake messages, requiring userspace to provide a new RX key”h]”(j:)”}”(hŒ``TlsRxRekeyReceived``”h]”hŒTlsRxRekeyReceived”…””}”(hj h²hh³Nh´Nubah}”(h]”h ]”h"]”h$]”h&]”uh1j9hjubhŒ_ - number of received KeyUpdate handshake messages, requiring userspace to provide a new RX key”…””}”(hjh²hh³Nh´Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hêh³hÃh´MXhjubah}”(h]”h ]”h"]”h$]”h&]”uh1jHhjõh²hh³hÃh´Nubeh}”(h]”h ]”h"]”h$]”h&]”jŒ-”uh1jCh³hÃh´M5hjÄh²hubeh}”(h]”Œ statistics”ah ]”h"]”Œ statistics”ah$]”h&]”uh1hÄhhÆh²hh³hÃh´M0ubeh}”(h]”(hÂŒid1”eh ]”h"]”(Œ kernel tls”Œ kernel_tls”eh$]”h&]”uh1hÄhhh²hh³hÃh´KŒexpect_referenced_by_name”}”j?h·sŒexpect_referenced_by_id”}”hÂh·subeh}”(h]”h ]”h"]”h$]”h&]”Œsource”hÃuh1hŒcurrent_source”NŒ current_line”NŒsettings”Œdocutils.frontend”ŒValues”“”)”}”(hÉNŒ generator”NŒ datestamp”NŒ source_link”NŒ source_url”NŒ toc_backlinks”Œentry”Œfootnote_backlinks”KŒ sectnum_xform”KŒstrip_comments”NŒstrip_elements_with_classes”NŒ strip_classes”NŒ report_level”KŒ halt_level”KŒexit_status_level”KŒdebug”NŒwarning_stream”NŒ traceback”ˆŒinput_encoding”Œ utf-8-sig”Œinput_encoding_error_handler”Œstrict”Œoutput_encoding”Œutf-8”Œoutput_encoding_error_handler”jiŒerror_encoding”Œutf-8”Œerror_encoding_error_handler”Œbackslashreplace”Œ language_code”Œen”Œrecord_dependencies”NŒconfig”NŒ id_prefix”hŒauto_id_prefix”Œid”Œ dump_settings”NŒdump_internals”NŒdump_transforms”NŒdump_pseudo_xml”NŒexpose_internals”NŒstrict_visitor”NŒ_disable_config”NŒ_source”hÃŒ _destination”NŒ _config_files”]”Œ7/var/lib/git/docbuild/linux/Documentation/docutils.conf”aŒfile_insertion_enabled”ˆŒ raw_enabled”KŒline_length_limit”M'Œpep_references”NŒ pep_base_url”Œhttps://peps.python.org/”Œpep_file_url_template”Œpep-%04d”Œrfc_references”NŒ rfc_base_url”Œ&https://datatracker.ietf.org/doc/html/”Œ tab_width”KŒtrim_footnote_reference_space”‰Œsyntax_highlight”Œlong”Œ smart_quotes”ˆŒsmartquotes_locales”]”Œcharacter_level_inline_markup”‰Œdoctitle_xform”‰Œ docinfo_xform”KŒsectsubtitle_xform”‰Œ image_loading”Œlink”Œembed_stylesheet”‰Œcloak_email_addresses”ˆŒsection_self_link”‰Œenv”NubŒreporter”NŒindirect_targets”]”Œsubstitution_defs”}”Œsubstitution_names”}”Œrefnames”}”Œrefids”}”hÂ]”h·asŒnameids”}”(j?hÂj>j;hÿhüjÁj¾jyjvjöjójjjÔjÑjjjÃjÀjJjGj jj7j4j¹j¶j¾j»jjj±j®j6j3uŒ nametypes”}”(j?ˆj>‰hÿ‰jÁ‰jy‰jö‰j‰jÔ‰j‰jÉjJ‰j ˆj7ˆj¹‰j¾‰j‰j±‰j6‰uh}”(hÂhÆj;hÆhühÙj¾jjvjjój|jjùjÑj“jj×jÀjjGjÆjjj4j.j¶jMj»j~jjÁj®jj3jÄuŒ footnote_refs”}”Œ citation_refs”}”Œ autofootnotes”]”Œautofootnote_refs”]”Œsymbol_footnotes”]”Œsymbol_footnote_refs”]”Œ footnotes”]”Œ citations”]”Œautofootnote_start”KŒsymbol_footnote_start”KŒ id_counter”Œ collections”ŒCounter”“”}”jwKs…”R”Œparse_messages”]”Œtransform_messages”]”hŒsystem_message”“”)”}”(hhh]”hë)”}”(hhh]”hŒ0Hyperlink target "kernel-tls" is not referenced.”…””}”hjÓsbah}”(h]”h ]”h"]”h$]”h&]”uh1hêhjÐubah}”(h]”h ]”h"]”h$]”h&]”Œlevel”KŒtype”ŒINFO”Œsource”hÃŒline”Kuh1jÎubaŒ transformer”NŒ include_log”]”Œ decoration”Nh²hub.