From owner-freebsd-current@freebsd.org Sun Mar 14 17:14:46 2021 Return-Path: Delivered-To: freebsd-current@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 353705ACC0B for ; Sun, 14 Mar 2021 17:14:46 +0000 (UTC) (envelope-from kaduk@mit.edu) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4Dz5l823fJz4VvD for ; Sun, 14 Mar 2021 17:14:43 +0000 (UTC) (envelope-from kaduk@mit.edu) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 12EHEbAX005917 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Sun, 14 Mar 2021 13:14:42 -0400 Date: Sun, 14 Mar 2021 10:14:37 -0700 From: Benjamin Kaduk To: FreeBSD CURRENT Subject: Re: Getting started with ktls Message-ID: <20210314171437.GA79563@kduck.mit.edu> References: <20210311003136.GM56617@kduck.mit.edu> <20210311031501.GP56617@kduck.mit.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Rspamd-Queue-Id: 4Dz5l823fJz4VvD X-Spamd-Bar: --- Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=pass (mx1.freebsd.org: domain of kaduk@mit.edu designates 18.9.28.11 as permitted sender) smtp.mailfrom=kaduk@mit.edu X-Spamd-Result: default: False [-3.50 / 15.00]; RCVD_TLS_LAST(0.00)[]; RWL_MAILSPIKE_VERYGOOD(0.00)[18.9.28.11:from]; ARC_NA(0.00)[]; FROM_HAS_DN(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; R_SPF_ALLOW(-0.20)[+ip4:18.9.28.0/24]; MIME_GOOD(-0.10)[text/plain]; PREVIOUSLY_DELIVERED(0.00)[freebsd-current@freebsd.org]; DMARC_NA(0.00)[mit.edu]; RCPT_COUNT_ONE(0.00)[1]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; TO_DN_ALL(0.00)[]; RCVD_IN_DNSWL_MED(-0.20)[18.9.28.11:from]; NEURAL_HAM_SHORT(-1.00)[-0.999]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:3, ipnet:18.9.0.0/16, country:US]; RCVD_COUNT_TWO(0.00)[2]; MAILMAN_DEST(0.00)[freebsd-current]; RECEIVED_SPAMHAUS_PBL(0.00)[24.16.140.251:received] X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Mar 2021 17:14:46 -0000 On Sun, Mar 14, 2021 at 09:54:33AM -0600, Alan Somers wrote: > On Sun, Mar 14, 2021 at 8:57 AM tech-lists wrote: > > > I'd like to have it (ktls) available on the ARM64 > > stable/13-n244876-0b45290603b. Is it just a matter of adding the option, > > and then the sysctls become available? Is it "better" with openssl[-devel] > > in ports or openssl in base? > > > > thanks, > > -- > > J.\ > > > It's present in current kernels for both 13 and 14, amd64 and aarch64. > However, it's not present in 13's openssl. To use it, you must either > rebuild world with WITH_OPENSSL_KTLS=YES in /etc/src.conf, install > security/openssl-devel from pkg, or built security/openssl from ports with > the KTLS option enabled. I don't know if any version of openssl is > "better" than another. The sysctls should be available in any case. security/openssl-devel is alpha-quality software; I don't recommend running it in production. -Ben