Netflix ua faʻasalalau TLS faʻatinoga patch mo le FreeBSD kernel

Kamupani Netflix fautuaina mo le suʻeina o le FreeBSD kernel-level faʻatinoga o le TLS (KTLS), lea e mafai ai mo se faʻaopoopoga tele o faʻamatalaga faʻamalamalamaga mo TCP sockets. Lagolagoina le faʻavaveina o faʻamatalaga o faʻamatalaga faʻasalalau e faʻaaoga ai TLS 1.0 ma 1.2 protocols na lafoina i le socket e faʻaaoga ai le tusitusi, aio_write ma le sendfile galuega.

E le'o lagolagoina le fa'aliliuga autu o le Kernel-level ma e tatau ona fa'atumauina muamua le feso'ota'iga ma fa'atalanoa i avanoa fa'aoga. Ina ia faʻafeiloaʻi i le fatu le ki o le sauniga na maua i le faagasologa o feutagaiga fesoʻotaʻiga mo sockets, o le TCP_TXTLS_ENABLE filifiliga ua faʻaopoopoina, pe a uma ona faʻagaoioia o faʻamatalaga uma na lafoina i le socket o le a faʻapipiʻiina i TLS faʻavaa e faʻaaoga ai le ki faʻamaonia. Mo le auina atu o fe'au tautua, mo se fa'ata'ita'iga e fa'atalanoa se feso'ota'iga, e tatau ona e fa'aogaina le galuega sendmsg ma le ituaiga fa'amaumauga TLS_SET_RECORD_TYPE.

E lua auala autu mo le fa'ailogaina o fa'avaa TLS o lo'o lagolagoina: polokalama fa'akomepiuta ma le ifnet (fa'aogaina o masini fa'avavevave o kata feso'otaiga). Ole filifiliga ole auala e faʻaaogaina
avanoa avanoa TCP_TXTLS_MODE. O le auala faakomepiuta e mafai ai ona e faʻafesoʻotaʻi pito i tua eseese mo faʻamatalaga. Mo se faʻataʻitaʻiga, o le ktls_ocf.ko backend ma le lagolago mo AES-GCM, faʻatinoina e faʻavae i luga o le OpenCrypto framework, ua lomia. E tele sysctls o lo'o ofoina atu mo le pulega i totonu o le lala kern.ipc.tls.*. I le fausiaina o le fatu, e mafai ona faʻaogaina le TLS i le faʻaaogaina o le KERN_TLS filifiliga.

puna: opennet.ru