Procs
proc enableKtls(fd: SocketHandle) {....raises: [KtlsKeyUpdateNeeded, KtlsError], tags: [], forbids: [].}
-
Attach the "tls" ULP to an established TCP socket. Must precede setTx/setRx.
Raises KtlsError: ENOPROTOOPT/ENOENT means the kernel lacks kTLS; ENOTCONN means the socket is not an established TCP socket.
proc isRxOffloaded(fd: SocketHandle): bool {....raises: [], tags: [], forbids: [].}
- True when RX crypto state is installed.
proc isTxOffloaded(fd: SocketHandle): bool {....raises: [], tags: [], forbids: [].}
- True when TX crypto state is installed.
proc rxConf(fd: SocketHandle): tuple[version: TlsVersion, cipher: CipherSuite] {. ...raises: [KtlsKeyUpdateNeeded, KtlsError], tags: [], forbids: [].}
- Read back the installed RX state. Raises KtlsError when absent.
proc setRx(fd: SocketHandle; km: KeyMaterial) {. ...raises: [KtlsKeyUpdateNeeded, KtlsError], tags: [], forbids: [].}
- Install receive keys: subsequent recvs return kernel-decrypted plaintext. Raises KtlsError (see setTx for rekeying).
proc setRxExpectNoPad(fd: SocketHandle; enable: bool) {. ...raises: [KtlsKeyUpdateNeeded, KtlsError], tags: [], forbids: [].}
- Request opportunistic zero-copy on receive. Requires TLS 1.3 with RX already installed — call after setRx. Raises KtlsError.
proc setTx(fd: SocketHandle; km: KeyMaterial) {. ...raises: [KtlsKeyUpdateNeeded, KtlsError], tags: [], forbids: [].}
- Install transmit keys: subsequent sends are encrypted by the kernel. Raises KtlsError (EBUSY if TX is already installed and the version is not TLS 1.3 — use updateTxKey for 1.3 rekeying).
proc setTxMaxPayloadLen(fd: SocketHandle; maxLen: uint16) {. ...raises: [KtlsKeyUpdateNeeded, KtlsError], tags: [], forbids: [].}
- Cap plaintext bytes per record (kernel-validated, at most 16384). Raises KtlsError (EBUSY while a record is open).
proc setTxZerocopy(fd: SocketHandle; enable: bool) {. ...raises: [KtlsKeyUpdateNeeded, KtlsError], tags: [], forbids: [].}
- Toggle TX zerocopy (sendfile) mode. Raises KtlsError on failure.
proc txConf(fd: SocketHandle): tuple[version: TlsVersion, cipher: CipherSuite] {. ...raises: [KtlsKeyUpdateNeeded, KtlsError], tags: [], forbids: [].}
- Read back the installed TX state (4-byte header getsockopt). Raises KtlsError when no TX state is installed.
proc updateRxKey(fd: SocketHandle; km: KeyMaterial) {. ...raises: [KtlsKeyUpdateNeeded, KtlsError], tags: [], forbids: [].}
- TLS 1.3 KeyUpdate on the receive path: unblocks reads paused with EKEYEXPIRED (KtlsKeyUpdateNeeded). Same constraints as setRx.
proc updateTxKey(fd: SocketHandle; km: KeyMaterial) {. ...raises: [KtlsKeyUpdateNeeded, KtlsError], tags: [], forbids: [].}
- TLS 1.3 KeyUpdate on the transmit path. Same syscall as setTx; the kernel rejects version/cipher changes with EINVAL.