Clone this repository
For self-hosted knots, clone URLs may differ based on your setup.
Download tar.gz
Rename kTLS-specific types and functions to generic protocol terminology:
- ktls_keys -> traffic_key_material
- ktls_version/ktls_cipher -> version/cipher
- client_key/iv -> client_write_key/client_write_iv
- server_key/iv -> server_write_key/server_write_iv
- client_seq/server_seq -> client_sequence/server_sequence
- ktls_keys_error -> key_material_error
This makes the TLS library's key export feature useful for any purpose
requiring access to traffic keys (kTLS, debugging, testing) rather than
being specific to kernel TLS offload.
馃 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit implements kTLS (kernel TLS) support allowing TLS encryption
to be offloaded to the Linux kernel after userspace handshake completion.
Three packages:
- ktls: Core library with C stubs for setsockopt(SOL_TLS)
- ktls-eio: Eio async I/O integration with automatic fallback
- tls-ktls: Forked TLS library exposing traffic keys
Key changes to tls-ktls fork:
- lib/core.ml: Added ktls_keys type for key material
- lib/state.ml: Added raw traffic key fields to session_data13
- lib/handshake_crypto13.ml: Added app_ctx_with_keys function
- lib/engine.ml: Added ktls_keys extraction function
- eio/tls_eio.ml: Added ktls_keys and underlying_flow functions
Supported:
- TLS 1.2 and 1.3
- Client and server modes
- AES-GCM-128, AES-GCM-256, ChaCha20-Poly1305 ciphers
- Automatic fallback to userspace TLS if kTLS unavailable
馃 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>