floatdrop / zoxy / 28694447259
96%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 25
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 96.787% (-0.06%) from 96.851%
28694447259

push

github

floatdrop 
tls: kernel switchover — steady-state TLS is the plaintext relay (kTLS 4+5)

The decision is owed from handshake completion and taken exactly once
the wire is idle: a pending wire send would be double-encrypted by
kernel TX, and an in-flight recv would complete with kernel-decrypted
plaintext in the ciphertext staging — both defer, their completions
loop back through tls_progress. HTTP (arm_recv_head) starts only after
the decision, on whichever relay won. On switch: enable_kernel_tls
installs the parameters composed from the captured secrets, the
channel (SSL + BIO pair, ~161 KiB) frees mid-connection, conn.tls
returns to null — so every downstream op is literally the plaintext
path on the fd — and ktls_active only changes the polite close, which
sends the alert as a TLS_SET_RECORD_TYPE cmsg via the send_message op.
Ineligible or refused connections stay on the userspace relay
(tls_ktls_active / tls_ktls_fallbacks count the split), and
tls.kernel_offload=false in config forces it.

Tests: a delayed-request client (past the Finished flight) must switch
— response over kernel crypto, close_notify arrives as a kernel-built
alert the client decrypts, heap back to baseline with the channel
freed mid-connection; the immediate-write clients assert the decision
sum since loopback coalescing decides which relay serves them — both
must produce identical bytes. Skips when the tls module cannot load.

Verified on the real binary: curl and zrk switch 100% (7k+ churn
switchovers, zero fallbacks, zero client-visible errors — the strict
std client accepts the kernel close_notify); steady 20k req/s at
p50 135µs; carved TLS heap under load 11.1 -> 4.9 MiB.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

5572 of 5757 relevant lines covered (96.79%)

0.97 hits per line

Coverage Regressions

Lines Coverage ∆ File
40
98.25
 0.09% net/proxy.zig
13
96.23
 0.0% tls/terminator.zig
11
91.85
 -2.28% io/test_io.zig
6
96.47
 0.11% tls/kernel.zig
Jobs
ID Job ID Ran Files Coverage
1 28694447259.1 25
96.79
 GitHub Action Run
Source Files on build 28694447259