Linux QUIC: Bringing a Modern Secure Transport into the Kernel#

Xin Long

Why: QUIC in the kernel changes what kernel subsystems (SMB, NFS) can use as a secure transport, and it puts a POSIX-shaped API on a protocol that has so far been userspace-library-only. That has knock-on effects for anything doing per-connection identity and crypto offload.

What: A kernel QUIC implementation exposing a new IPPROTO_QUIC socket type, described as already past prototype stage.

How: The kernel owns the full transport — stream management, congestion control, loss recovery, packet handling, connection migration, flow control — while the TLS handshake stays in userspace, coordinated for kernel consumers through the existing net/handshake framework and the tlshd service. The socket API keeps connect()/accept()/sendmsg()/recvmsg() and extends it with ALPN-based dispatching, transport-parameter configuration and stream lifecycle control. Validation covers interop against major QUIC implementations, syzkaller fuzzing and high-speed benchmarking; consumers so far include Samba, in-progress NFS work, curl HTTP/3 and NetPerfMeter. Future work: upstreaming across kernel and GnuTLS, and NIC crypto offload. (From abstract only.)

Where applicable: Broad, once upstream — but note the split trust model (handshake in userspace via tlshd) and that NIC crypto offload is still future work.