NAME

       tlshd - TLS handshake for kernel TLS sockets

SYNOPSIS

       /usr/sbin/tlshd [options]

DESCRIPTION

       The  tlshd  program implements a user agent that services TLS handshake requests on behalf
       of kernel TLS consumers.  Using the accept(2) system call, it materializes  kernel  socket
       endpoints  in  user  space  in order to perform TLS handshakes using a TLS library.  After
       each handshake completes, tlshd plants TLS session metadata  into  the  kernel  socket  to
       enable the use of kTLS to secure subsequent communication on that socket.

OPTIONS

       -c  or  --config
              When specified this option sets the location for tlshd's config file.

       -h  or  --help
              When specified tlshd displays a help message then exits immediately.

       -s  or  --stderr
              When specified this option forces messages to go to both stderr and the system log.
              By default, messages go only to the system log.

       -v  or  --version
              When specified tlshd displays build version information then exits immediately.

ENVIRONMENT VARIABLES

       The  GnuTLS  library  provides  certain  capabilities  that  can  be  enabled  by  setting
       environment  variables before tlshd is started.  More information about these variables is
       available in GnuTLS library documentation.

       SSLKEYLOGFILE
              When set, this variable specifies the pathname  of  a  file  to  which  the  GnuTLS
              library appends negotiated session keys in the NSS Key Log format.  The NSS Key Log
              format can be read by wireshark, enabling decryption of recorded sessions.

       GNUTLS_FORCE_FIPS_MODE
              When set to `1', this variable forces the TLS library into FIPS mode  if  FIPS140-2
              support is available.

NOTES

       This  software  is  a  prototype.   It's  purpose  is for demonstration and as a proof-of-
       concept.  USE THIS SOFTWARE AT YOUR OWN RISK.

SEE ALSO

       tlshd.conf(5), ssl(7)

AUTHOR

       Chuck Lever

                                           20 Dec 2021                                   tlshd(8)