-
-
Notifications
You must be signed in to change notification settings - Fork 31.8k
gh-96828: Add an ssl.OP_ENABLE_KTLS
option
#96830
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I added @tiran to confirm we want this, otherwise this looks good.
Is there any benefit in using KTLS without SSL_sendfile at all? Did you test that the feature actually works with Python's ssl module? It's definitely incompatible with MemoryBIO / asyncio. |
@tiran let me cite your colleagues to respond about the benefit 🙂:
Also, I posted about I did a test using this code and new methods of import asyncio
import socket
import ssl
import certifi
def check_ktls(sslobj):
print(f"kTLS read {sslobj.uses_ktls_for_read()}")
print(f"kTLS write {sslobj.uses_ktls_for_write()}")
hostname = "example.com"
request = b"GET /\r\n\r\n"
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
context.load_verify_locations(certifi.where(), None, None)
context.options |= ssl.OP_ENABLE_KTLS
with socket.create_connection((hostname, 443)) as sock:
with context.wrap_socket(sock, server_hostname=hostname) as ssock:
ssock.send(request)
print(ssock.recv(20))
print(ssock.cipher())
check_ktls(ssock._sslobj)
print()
async def check():
print("asyncio")
reader, writer = await asyncio.open_connection(hostname, 443, ssl=context)
writer.write(request)
print(await reader.read(20))
ssl_object = writer.transport.get_extra_info("ssl_object")
print(ssl_object.cipher())
check_ktls(ssl_object._sslobj)
writer.close()
asyncio.run(check()) This was the result, kTLS was used for writing when asyncio was not used:
|
Thanks! |
Resolves #96828.
ssl.OP_ENABLE_KTLS
option for enabling the use of the kernel TLS #96828