renati/castle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

web: Try enabling kTLS

Browse Source
This commit is contained in:
Szymon Nowakowski
2026-06-24 13:15:23 +02:00
parent 9f9ae95f54
commit d2719a77f0
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
packages/web/src/Server.zig
View File

@@ -361,6 +361,10 @@ fn maybeInitSsl(self: *const Server, fd: FileDescriptor) !?*openssl.Ssl {
log.debug("Accepting SSL layer.", .{});
try ssl.accept();
log.debug("Accepted SSL layer.", .{});
const opt = std.mem.toBytes(@as(c_int, 1));
if (fd.setsockopt(linux.SOL.TLS, 3, &opt)) { // TLS_TX_ZEROCOPY_RO
log.debug("Enabled zero-copy on sendfile.", .{});
} else |_| {}
return ssl;
} else {
return null;

9
packages/web/src/main.zig
View File

@@ -88,8 +88,13 @@ pub fn main(init: std.process.Init) !void {
const ssl_ctx = try ssl.SslContext.new(.tlsServerMethod());
defer ssl_ctx.free();
_ = ssl_ctx.setMinProtoVersion(ssl.c_ssl.TLS1_3_VERSION);
_ = ssl_ctx.setOptions(ssl.c_ssl.SSL_OP_NO_SSLv3 | ssl.c_ssl.SSL_OP_NO_TLSv1 | ssl.c_ssl.SSL_OP_NO_TLSv1_1 | ssl.c_ssl.SSL_OP_NO_TLSv1_2);
_ = ssl_ctx.setMinProtoVersion(ssl.c_ssl.TLS1_2_VERSION);
_ = ssl_ctx.setMaxProtoVersion(ssl.c_ssl.TLS1_2_VERSION);
_ = ssl_ctx.setOptions(ssl.c_ssl.SSL_OP_NO_SSLv3 |
ssl.c_ssl.SSL_OP_NO_TLSv1 |
ssl.c_ssl.SSL_OP_NO_TLSv1_1 |
ssl.c_ssl.SSL_OP_NO_TLSv1_3 |
ssl.c_ssl.SSL_OP_ENABLE_KTLS);
try ssl_ctx.useCertificateFile("cert.pem", ssl.c_ssl.SSL_FILETYPE_PEM);
try ssl_ctx.usePrivateKeyFile("key.pem", ssl.c_ssl.SSL_FILETYPE_PEM);