FS#76800 - [nginx][nginx-mainline] Enable use of kTLS

Attached to Project: Arch Linux
Opened by Daenney (daenney) - Sunday, 11 December 2022, 13:44 GMT
Last edited by Toolybird (Toolybird) - Monday, 12 December 2022, 20:13 GMT
Task Type Feature Request
Category Packages: Extra
Status Closed
Assigned To No-one
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 1
Private No

Details

Description:

Since nginx 1.21.4 kTLS is supported by nginx if running with OpenSSL 3+. Now that OpenSSL 3 is available in Arch and nginx has been rebuilt with it, it would be nice to enable kTLS too.

It should be a matter of adding `--with-openssl-opt=enable-ktls` to the `configure` step.
This task depends upon

Closed by  Toolybird (Toolybird)
Monday, 12 December 2022, 20:13 GMT
Reason for closing:  None
Additional comments about closing:  Already working. See comments
Comment by loqs (loqs) - Sunday, 11 December 2022, 14:40 GMT
`--with-openssl-opt=enable-ktls` I thought that set options for building a custom ssl library?
If you move to the configure step of [1] what is the result?

[1] https://www.nginx.com/blog/improving-nginx-performance-with-kernel-tls/
Comment by Toolybird (Toolybird) - Monday, 12 December 2022, 05:03 GMT
Yeah, I think @loqs is right. This should already be working. The nginx code has:

#ifdef BIO_get_ktls_send

and that define is present in our `/usr/include/openssl/bio.h'.

You should be able to verify using the link @loqs provided in the section "Verifying kTLS is Enabled".
Comment by Daenney (daenney) - Monday, 12 December 2022, 16:56 GMT
I might be doing something wrong here, but adding that to a server block and then testing the nginx config results in:

2022/12/12 18:53:31 [emerg] 1805148#1805148: SSL_CONF_cmd("Options", "KTLS") failed (SSL: error:1414E180:SSL routines:SSL_CONF_cmd:bad value:cmd=Options, value=KTLS)

$ pacman -Q nginx
nginx 1.22.1-1
Comment by Daenney (daenney) - Monday, 12 December 2022, 17:02 GMT
I managed to test this on a box that didn't have the OpenSSL 3 rebuild. It seems to be working. Apologies for the noise, I think this can be closed.

Loading...