gh-96828: Add an ssl.OP_ENABLE_KTLS option#96830
Conversation
|
Is there any benefit in using KTLS without SSL_sendfile at all? Did you test that the feature actually works with Python's ssl module? It's definitely incompatible with MemoryBIO / asyncio. |
|
@tiran let me cite your colleagues to respond about the benefit 🙂:
Also, I posted about I did a test using this code and new methods of import asyncio
import socket
import ssl
import certifi
def check_ktls(sslobj):
print(f"kTLS read {sslobj.uses_ktls_for_read()}")
print(f"kTLS write {sslobj.uses_ktls_for_write()}")
hostname = "example.com"
request = b"GET /\r\n\r\n"
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
context.load_verify_locations(certifi.where(), None, None)
context.options |= ssl.OP_ENABLE_KTLS
with socket.create_connection((hostname, 443)) as sock:
with context.wrap_socket(sock, server_hostname=hostname) as ssock:
ssock.send(request)
print(ssock.recv(20))
print(ssock.cipher())
check_ktls(ssock._sslobj)
print()
async def check():
print("asyncio")
reader, writer = await asyncio.open_connection(hostname, 443, ssl=context)
writer.write(request)
print(await reader.read(20))
ssl_object = writer.transport.get_extra_info("ssl_object")
print(ssl_object.cipher())
check_ktls(ssl_object._sslobj)
writer.close()
asyncio.run(check())This was the result, kTLS was used for writing when asyncio was not used: |
|
Thanks! |
Resolves #96828.
ssl.OP_ENABLE_KTLSoption for enabling the use of the kernel TLS #96828