Documentation/networking/tls-offload.rst

4 Kernel TLS offload
10 Linux kernel provides TLS connection offload infrastructure. Once a TCP
24  * Packet-based NIC offload mode (``TLS_HW``) - the NIC handles crypto
28    (``ethtool`` flags ``tls-hw-tx-offload`` and ``tls-hw-rx-offload``).
29  * Full TCP NIC offload mode (``TLS_HW_RECORD``) - mode of operation where
36 offload opt-in or opt-out on per-connection basis is not currently supported.
48 for crypto offload based on the socket the packet is attached to,
63 .. kernel-figure::  tls-offload-layers.svg
64    :alt:	TLS offload layers
82 network device is offload-capable and attempts the offload. In case offload
84 as if the offload was never tried.
86 Offload request is performed via the :c:member:`tls_dev_add` callback of
114 TX offload being fully initialized does not imply that all segments passing
149 Record reassembly is not necessary for TLS offload. If the packets arrive
164 packets requiring HW offload, see the :ref:`5tuple_problems` section)
182 Device indicates successful handling of TLS offload in the per-packet context
268 .. kernel-figure::  tls-offload-reorder-good.svg
293 .. kernel-figure::  tls-offload-reorder-bad.svg
360 device than the selected TLS offload device. The stack will handle
362 (TLS offload code installs :c:func:`tls_validate_xmit_skb` at this hook).
363 Offload maintains information about all records until the data is
367 Any device TLS offload handling error on the transmission side must result
375 If the device encounters any problems with TLS offload on the receive
391 A packet should also not be handled by the TLS offload if it contains
397 TLS offload can be characterized by the following basic metrics:
416 Offload performance may depend on segment and record size.
431  * ``rx_tls_ctx`` - number of TLS RX HW offload contexts added to device for
433  * ``rx_tls_del`` - number of TLS RX HW offload contexts deleted from device
453  * ``tx_tls_ctx`` - number of TLS TX HW offload contexts added to device for
458    a TLS stream and arrived out-of-order, but skipped the HW offload routine
466    software and data that expects hardware crypto offload.
477 of the socket. Current ``ktls`` implementation will not offload sockets
483 should still be able to perform TX offload (encryption) and should
500 Coexistence with standard networking offload features
504 transparently. Enabling device TLS offload should not cause any difference
511 of the simplifying TLS offload.
514 necessary for TLS offload.
533 offload. Hence, TLS TX device feature flag requires TX csum offload being set.
534 Disabling the latter implies clearing the former. Disabling TX checksum offload
538 does not want to enable RX csum offload, TLS RX device feature is disabled