[PATCH net-next v4 0/5] tls: perform TLS 1.3 KeyUpdate in the kernel

[Chuck Lever]

On Mon, 02 Nov 2026 11:57:57 -0500, Martin Belanger wrote:
> The matching tlshd change for ktls-utils is a small patch to be
> submitted at a later time if this series is accepted.

Recognizing that there may be further API changes, for the series:

  Reviewed-by: Chuck Lever <cel at kernel.org>

I don't expect any changes for the sunrpc consumers will be necessary.
For tlshd, as far as I can tell the whole change is:

- In tlshd_start_tls_handshake(), register a callback with
  gnutls_handshake_set_secret_function() before the gnutls_handshake()
  loop, as quic.c already does. We rely on SSLKEYLOGFILE to decrypt
  NFS traffic in Wireshark, so that needs to continue to work.

- In tlshd_initialize_ktls(), after the existing TLS_TX and TLS_RX
  install succeeds and only for a TLS 1.3 session, set
  TLS_TX_TRAFFIC_SECRET with the write secret, then
  TLS_RX_TRAFFIC_SECRET with the read secret.

- A configure.ac check for TLS_TX_TRAFFIC_SECRET in the installed
  uapi header, so the build works against older kernels.

I assume you plan to send tlshd patches, but let me know if instead
you'd like the ktls-handshake folks to take care of this.


-- 
Chuck Lever (Come to NFS bake-a-thon! https://nfsv4bat.org)