Changes/KTLSSupportForGnuTLS

KTLS implementation for GnuTLS

kTLS now disabled by default
see the rationale for this decision here.

Summary

Acceleration of GnuTLS with software Kernel TLS (KTLS)

Owner

• Name: František Krenželok, Daiki Ueno
• Email: fkrenzel@redhat.com, dueno@redhat.com

Current status

• Targeted release: Fedora Linux 38
• Last updated: 2022-11-07
• devel thread
• FESCo issue: #2871
• Tracker bug: #2130000
• Release notes tracker: #881

Detailed Description

The goal of this change is to provide GnuTLS users with a high throughput data transfer mechanism on encrypted channels, with emphasis on network block devices (NBD).

We accomplish this with kTLS which offloads enc/decryption (TLS record) to the kernel, while GnuTLS handles initial connection (TLS handshake).

GNUTLS will detect whether the kernel supports kTLS and will automatically enable its usage when compatible
kTLS will be disabled by default and enabled with the following steps. Any package built against GNUTLS with kTLS enabled, is likely to see some performance benefit from kTLS, provided it has not installed custom push/pull I/O function callbacks.

kTLS enables a reduction in context switching and reduced data copies when using send_file(). With suitable NIC hardware the encryption operations can be offloaded, freeing time on the main CPUs for application usage. Without offload hardware, kTLS may still improve parallelism for applications as the kernel can perform encryption operations on a differen host CPU to that running the application threads

Benefit to Fedora

The improvement lies in acceleration of large data transfers trough encrypted channels. The send_file function enables us to send data directly trough socket without entering user space, saving us from 2 context switches and 2 additional user space buffers. This is especially useful for NBD

Benefits

• Acceleration of live VM migration, which should mitigate the downtime for various services used by both the users and the developers.

• Increased speed at which files can be retrieved from NBD via encrypted channel and less CPU and memory strain on NBD server.

packages that might benefit: nbd nbdkit qemu

Scope

• Proposal owners: Support for kTLS key update in GnuTLS track: gitlab
• Other developers: Support for TLS1.3 key update in kTLS (tls kernel module)
• Release engineering: https://pagure.io/releng/issue/11016
• Policies and guidelines: not needed for this Change
• Trademark approval: not needed for this Change
• Alignment with Objectives: None

Upgrade/compatibility impact

Although this feature will be enabled by default, users will not notice any change, as in case of failure to initialize kTLS, GnuTLS will fallback to the currently used mode of operation. kTLS will be disabled by default so users will not notice any changes.

How To Test

To enable this feature user has to:

1. load TLS kernel module (modprobe tls)
2. enable ktls with crypto policies

$ cat > /etc/crypto-policies/local.d/gnutls-ktls.config <<EOF
[global]
ktls = true
EOF

$ update-crypto-policies

kTLS will not initialize if app uses custom push/pull callback for GnuTLS.

User Experience

This change should accelerate large data transfers especially that of files. This will affect users that use applications which utilize GnuTLS for encrypting communication channels.

Dependencies

Currently kTLS doesn't support key_update (The keys delivered to the kernel can’t be set more than once per session) so a kernel module patch would be needed for this functionality. This not only impacts key_update invokation by user of either side, but also by AES-GCM key usage limit. As this could weaken the security of TLS protocol, GnuTLS will disable kTLS for rest of the session and fallback to default mode of operation i.e. move encryption and decryption back to usersace GnuTLS will invalidate the session and return a error after the key_update is called.

GnuTLS supports kTLS key_update
This feature is supported if apropriate kernel patch is applied

Contingency Plan

• Contingency mechanism: Feature will be disabled by default in crypto-policies.
• Contingency deadline: 2023-02-21
• Blocks release? No

Documentation

API

gnutls_transport_is_ktls_enabled() To check if kTLS was properly initialized on the interfaces:

it has to be invoked no earlier that after a TLS-handshake

 gnutls_transport_ktls_enable_flags_t gnutls_transport_is_ktls_enabled(gnutls_session_t session);

gnutls_record_send_file() To send data directly from a file descriptor in a zero-copy manner if kTLS is enabled; otherwise it will just iteratively read from the file descriptor:

 ssize_t gnutls_record_send_file(gnutls_session_t session, int fd, off_t *offset, size_t count);