Take a look at
https://patchwork.ozlabs.org/patch/835816/.
TLS also needs to maintain a per-record mapping on the skb, which is similar
to the DSS-mapping.
For each TLS record, they seem to allocate a data-structure and maintain a
list of it. tls_get_record() allows to find the record based on the
sequence-number.
They seem like a good candidate for an skb_shared_info_ext :-)
I will try to find the guy who presented it here at netdev and talk to him
about it.
Christoph