#include <tls.h>

Data Fields
KlTlsResult(*	handshake )(KlTls *self, int fd)
	Non-blocking handshake step. Call repeatedly until OK or ERROR.

ssize_t(*	read )(KlTls self, int fd, void buf, size_t len)
	Decrypt: read up to len bytes of plaintext into buf.

ssize_t(*	write )(KlTls self, int fd, const void buf, size_t len)
	Encrypt: write up to len bytes of plaintext from buf.

KlTlsResult(*	shutdown )(KlTls *self, int fd)
	Initiate TLS shutdown (close_notify).

size_t(*	pending )(KlTls *self)
	Bytes buffered inside TLS that can be read without a syscall.

void(*	reset )(KlTls *self)
	Reset for connection reuse (keep-alive). TLS session persists.

void(*	destroy )(KlTls *self)
	Free all resources.

const char (	alpn_protocol )(KlTls *self)
	Negotiated ALPN protocol, or NULL. Optional — set to NULL if not supported.

int(*	set_hostname )(KlTls self, const char hostname)
	Set the expected server hostname for SNI (client mode). Optional — set to NULL if not supported by the backend. Must be called before handshake().

Field Documentation

◆ handshake

KlTlsResult(* KlTls::handshake) (KlTls *self, int fd)

Non-blocking handshake step. Call repeatedly until OK or ERROR.

Parameters

self	TLS session.
fd	Socket file descriptor.

Returns: KL_TLS_OK on completion, WANT_READ/WANT_WRITE to retry, ERROR on failure.

◆ read

ssize_t(* KlTls::read) (KlTls *self, int fd, void *buf, size_t len)

Decrypt: read up to len bytes of plaintext into buf.

Returns: Bytes read (>0), 0 for WANT_READ, -1 for error.

◆ write

ssize_t(* KlTls::write) (KlTls *self, int fd, const void *buf, size_t len)

Encrypt: write up to len bytes of plaintext from buf.

Returns: Bytes written (>0), 0 for WANT_WRITE, -1 for error.

◆ shutdown

KlTlsResult(* KlTls::shutdown) (KlTls *self, int fd)

Initiate TLS shutdown (close_notify).

Returns: KlTlsResult indicating completion or need for more I/O.

◆ pending

size_t(* KlTls::pending) (KlTls *self)

Bytes buffered inside TLS that can be read without a syscall.

Critical for edge-triggered event loops: TLS may decrypt multiple application records in one read. Without pending(), buffered plaintext stalls until the next TCP segment arrives.

◆ reset

void(* KlTls::reset) (KlTls *self)

Reset for connection reuse (keep-alive). TLS session persists.

◆ destroy

void(* KlTls::destroy) (KlTls *self)

Free all resources.

◆ alpn_protocol

const char *(* KlTls::alpn_protocol) (KlTls *self)

Negotiated ALPN protocol, or NULL. Optional — set to NULL if not supported.

◆ set_hostname

int(* KlTls::set_hostname) (KlTls *self, const char *hostname)

Set the expected server hostname for SNI (client mode). Optional — set to NULL if not supported by the backend. Must be called before handshake().