Skip to content

docs(linuxkm): document DTLS 1.3 configure flags #10377

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jackctj117 wants to merge 2 commits into
base: master
Choose a base branch
from
+32 −1
Open

docs(linuxkm): document DTLS 1.3 configure flags #10377

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0870e86
docs(linuxkm): document DTLS 1.3 configure flags
jackctj117 May 1, 2026
8d6afc8
ci(linuxkm): test minimal DTLS 1.3 build + exports
jackctj117 May 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions linuxkm/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,24 @@ $ sudo modprobe libwolfssl
| `--enable-intelasm` | x86/amd64 crypto acceleration |
| `--enable-cryptonly` | Omit TLS/DTLS implementation (normally recommended) |

### Enabling DTLS 1.3 in the kernel module

`--enable-linuxkm` does not implicitly enable TLS 1.3 or DTLS, so the DTLS 1.3
configure check (`configure.ac:5634-5636`) requires all three flags to be
passed explicitly:
Comment on lines +62 to +64
Copy link

Copilot AI May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The text says DTLS 1.3 "requires all three flags" to be passed explicitly and points to specific configure.ac line numbers. In configure.ac, --enable-tls13 defaults to enabled (unless overridden, e.g., some FIPS cases), so explicitly passing it is not generally required. Also, hard-coding configure.ac:5634-5636 is brittle as line numbers change; consider referencing the actual configure error message or simply stating that --enable-dtls13 requires both DTLS and TLS 1.3 to be enabled.

Suggested change
`--enable-linuxkm` does not implicitly enable TLS 1.3 or DTLS, so the DTLS 1.3
configure check (`configure.ac:5634-5636`) requires all three flags to be
passed explicitly:
`--enable-linuxkm` does not implicitly enable TLS 1.3 or DTLS. To enable
DTLS 1.3 support, `--enable-dtls13` requires both DTLS and TLS 1.3 to be
enabled, for example:

Copilot uses AI. Check for mistakes.

```sh
./configure --enable-linuxkm \
--enable-tls13 --enable-dtls --enable-dtls13 \
--with-linux-source=/lib/modules/$(uname -r)/build
make -j$(nproc) module
Comment on lines +67 to +70
Copy link

Copilot AI May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For consistency with the earlier README examples, consider prefixing the configure/make commands with a shell prompt ($) and keeping the make -j form consistent (the earlier section uses make -j module). This helps readers copy/paste and visually parse the commands.

Suggested change
./configure --enable-linuxkm \
--enable-tls13 --enable-dtls --enable-dtls13 \
--with-linux-source=/lib/modules/$(uname -r)/build
make -j$(nproc) module
$ ./configure --enable-linuxkm \
--enable-tls13 --enable-dtls --enable-dtls13 \
--with-linux-source=/lib/modules/$(uname -r)/build
$ make -j module

Copilot uses AI. Check for mistakes.
```

The resulting `linuxkm/libwolfssl.ko` exports the DTLS 1.3 entry points
(`wolfDTLSv1_3_client_method`, `wolfDTLSv1_3_server_method`, etc.) as GPL
kernel symbols, available to other in-kernel consumers via
`EXPORT_SYMBOL_GPL`.
Comment on lines +74 to +76
Copy link

Copilot AI May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The module export mechanism here is EXPORT_SYMBOL_NS_GPL(..., WOLFSSL) (see linuxkm/Kbuild and module_exports.c.template), not plain EXPORT_SYMBOL_GPL. On kernels with symbol namespaces, in-kernel consumers may also need to import the namespace (e.g., MODULE_IMPORT_NS(WOLFSSL)). Consider updating this wording to avoid implying the symbols are exported without a namespace.

Suggested change
(`wolfDTLSv1_3_client_method`, `wolfDTLSv1_3_server_method`, etc.) as GPL
kernel symbols, available to other in-kernel consumers via
`EXPORT_SYMBOL_GPL`.
(`wolfDTLSv1_3_client_method`, `wolfDTLSv1_3_server_method`, etc.) as
namespace-qualified GPL kernel symbols via
`EXPORT_SYMBOL_NS_GPL(..., WOLFSSL)`. On kernels with symbol namespaces,
other in-kernel consumers may also need to import the `WOLFSSL` namespace,
for example with `MODULE_IMPORT_NS(WOLFSSL)`.

Copilot uses AI. Check for mistakes.

### Additional configuration options for verification, performance evaluation, and troubleshooting

| option | description |
Expand Down
Loading