diff --git a/ctlsock/ctlsock.go b/ctlsock/ctlsock.go
new file mode 100644
index 0000000..893b3b0
--- /dev/null
+++ b/ctlsock/ctlsock.go
@@ -0,0 +1,26 @@
+// Package ctlsock is a Go library that can be used to query the
+// gocryptfs control socket interface. This interface can be
+// activated by passing `-ctlsock /tmp/my.sock` to gocryptfs on the
+// command line.
+package ctlsock
+
+// RequestStruct is sent by a client
+type RequestStruct struct {
+	EncryptPath string
+	DecryptPath string
+}
+
+// ResponseStruct is sent by the server in response to a request
+type ResponseStruct struct {
+	// Result is the resulting decrypted or encrypted path. Empty on error.
+	Result string
+	// ErrNo is the error number as defined in errno.h.
+	// 0 means success and -1 means that the error number is not known
+	// (look at ErrText in this case).
+	ErrNo int32
+	// ErrText is a detailed error message.
+	ErrText string
+	// WarnText contains warnings that may have been encountered while
+	// processing the message.
+	WarnText string
+}
diff --git a/internal/ctlsock/ctlsock_serve.go b/internal/ctlsocksrv/ctlsock_serve.go
similarity index 83%
rename from internal/ctlsock/ctlsock_serve.go
rename to internal/ctlsocksrv/ctlsock_serve.go
index 8b19e8a..b63759e 100644
--- a/internal/ctlsock/ctlsock_serve.go
+++ b/internal/ctlsocksrv/ctlsock_serve.go
@@ -1,6 +1,6 @@
-// Package ctlsock implements the control socket interface that can be
+// Package ctlsocksrv implements the control socket interface that can be
 // activated by passing "-ctlsock" on the command line.
-package ctlsock
+package ctlsocksrv
 
 import (
 	"encoding/json"
@@ -11,6 +11,7 @@ import (
 	"os"
 	"syscall"
 
+	"github.com/rfjakob/gocryptfs/ctlsock"
 	"github.com/rfjakob/gocryptfs/internal/tlog"
 )
 
@@ -20,27 +21,6 @@ type Interface interface {
 	DecryptPath(string) (string, error)
 }
 
-// RequestStruct is sent by a client
-type RequestStruct struct {
-	EncryptPath string
-	DecryptPath string
-}
-
-// ResponseStruct is sent by us as response to a request
-type ResponseStruct struct {
-	// Result is the resulting decrypted or encrypted path. Empty on error.
-	Result string
-	// ErrNo is the error number as defined in errno.h.
-	// 0 means success and -1 means that the error number is not known
-	// (look at ErrText in this case).
-	ErrNo int32
-	// ErrText is a detailed error message.
-	ErrText string
-	// WarnText contains warnings that may have been encountered while
-	// processing the message.
-	WarnText string
-}
-
 type ctlSockHandler struct {
 	fs     Interface
 	socket *net.UnixListener
@@ -97,7 +77,7 @@ func (ch *ctlSockHandler) handleConnection(conn *net.UnixConn) {
 			return
 		}
 		data := buf[:n]
-		var in RequestStruct
+		var in ctlsock.RequestStruct
 		err = json.Unmarshal(data, &in)
 		if err != nil {
 			tlog.Warn.Printf("ctlsock: JSON Unmarshal error: %#v", err)
@@ -110,7 +90,7 @@ func (ch *ctlSockHandler) handleConnection(conn *net.UnixConn) {
 }
 
 // handleRequest handles an already-unmarshaled JSON request
-func (ch *ctlSockHandler) handleRequest(in *RequestStruct, conn *net.UnixConn) {
+func (ch *ctlSockHandler) handleRequest(in *ctlsock.RequestStruct, conn *net.UnixConn) {
 	var err error
 	var inPath, outPath, clean, warnText string
 	// You cannot perform both decryption and encryption in one request
@@ -153,7 +133,7 @@ func (ch *ctlSockHandler) handleRequest(in *RequestStruct, conn *net.UnixConn) {
 
 // sendResponse sends a JSON response message
 func sendResponse(conn *net.UnixConn, err error, result string, warnText string) {
-	msg := ResponseStruct{
+	msg := ctlsock.ResponseStruct{
 		Result:   result,
 		WarnText: warnText,
 	}
diff --git a/internal/ctlsock/sanitize.go b/internal/ctlsocksrv/sanitize.go
similarity index 97%
rename from internal/ctlsock/sanitize.go
rename to internal/ctlsocksrv/sanitize.go
index 7cf77a5..4333872 100644
--- a/internal/ctlsock/sanitize.go
+++ b/internal/ctlsocksrv/sanitize.go
@@ -1,4 +1,4 @@
-package ctlsock
+package ctlsocksrv
 
 import (
 	"path/filepath"
diff --git a/internal/ctlsock/sanitize_test.go b/internal/ctlsocksrv/sanitize_test.go
similarity index 96%
rename from internal/ctlsock/sanitize_test.go
rename to internal/ctlsocksrv/sanitize_test.go
index d79fa7c..2462d5d 100644
--- a/internal/ctlsock/sanitize_test.go
+++ b/internal/ctlsocksrv/sanitize_test.go
@@ -1,4 +1,4 @@
-package ctlsock
+package ctlsocksrv
 
 import (
 	"testing"
diff --git a/internal/fusefrontend/ctlsock_interface.go b/internal/fusefrontend/ctlsock_interface.go
index e96d08d..2131463 100644
--- a/internal/fusefrontend/ctlsock_interface.go
+++ b/internal/fusefrontend/ctlsock_interface.go
@@ -7,13 +7,13 @@ import (
 	"strings"
 	"syscall"
 
-	"github.com/rfjakob/gocryptfs/internal/ctlsock"
+	"github.com/rfjakob/gocryptfs/internal/ctlsocksrv"
 	"github.com/rfjakob/gocryptfs/internal/nametransform"
 	"github.com/rfjakob/gocryptfs/internal/syscallcompat"
 	"github.com/rfjakob/gocryptfs/internal/tlog"
 )
 
-var _ ctlsock.Interface = &FS{} // Verify that interface is implemented.
+var _ ctlsocksrv.Interface = &FS{} // Verify that interface is implemented.
 
 // EncryptPath implements ctlsock.Backend
 //
diff --git a/internal/fusefrontend_reverse/ctlsock_interface.go b/internal/fusefrontend_reverse/ctlsock_interface.go
index a1e782d..f7b8afd 100644
--- a/internal/fusefrontend_reverse/ctlsock_interface.go
+++ b/internal/fusefrontend_reverse/ctlsock_interface.go
@@ -6,11 +6,11 @@ import (
 
 	"golang.org/x/sys/unix"
 
-	"github.com/rfjakob/gocryptfs/internal/ctlsock"
+	"github.com/rfjakob/gocryptfs/internal/ctlsocksrv"
 	"github.com/rfjakob/gocryptfs/internal/pathiv"
 )
 
-var _ ctlsock.Interface = &ReverseFS{} // Verify that interface is implemented.
+var _ ctlsocksrv.Interface = &ReverseFS{} // Verify that interface is implemented.
 
 // EncryptPath implements ctlsock.Backend.
 // This is used for the control socket and for the "-exclude" logic.
diff --git a/mount.go b/mount.go
index c0ef190..45773ce 100644
--- a/mount.go
+++ b/mount.go
@@ -29,7 +29,7 @@ import (
 	"github.com/rfjakob/gocryptfs/internal/configfile"
 	"github.com/rfjakob/gocryptfs/internal/contentenc"
 	"github.com/rfjakob/gocryptfs/internal/cryptocore"
-	"github.com/rfjakob/gocryptfs/internal/ctlsock"
+	"github.com/rfjakob/gocryptfs/internal/ctlsocksrv"
 	"github.com/rfjakob/gocryptfs/internal/exitcodes"
 	"github.com/rfjakob/gocryptfs/internal/fusefrontend"
 	"github.com/rfjakob/gocryptfs/internal/fusefrontend_reverse"
@@ -222,11 +222,11 @@ func setOpenFileLimit() {
 	}
 }
 
-// ctlsockFs satisfies both the pathfs.FileSystem and the ctlsock.Interface
+// ctlsockFs satisfies both the pathfs.FileSystem and the ctlsocksrv.Interface
 // interfaces
 type ctlsockFs interface {
 	pathfs.FileSystem
-	ctlsock.Interface
+	ctlsocksrv.Interface
 }
 
 // initFuseFrontend - initialize gocryptfs/fusefrontend
@@ -331,7 +331,7 @@ func initFuseFrontend(args *argContainer) (pfs pathfs.FileSystem, wipeKeys func(
 	// We have opened the socket early so that we cannot fail here after
 	// asking the user for the password
 	if args._ctlsockFd != nil {
-		go ctlsock.Serve(args._ctlsockFd, fs)
+		go ctlsocksrv.Serve(args._ctlsockFd, fs)
 	}
 	return fs, func() { cCore.Wipe() }
 }
diff --git a/tests/defaults/ctlsock_test.go b/tests/defaults/ctlsock_test.go
index b987bf6..64b72a2 100644
--- a/tests/defaults/ctlsock_test.go
+++ b/tests/defaults/ctlsock_test.go
@@ -5,7 +5,7 @@ import (
 	"syscall"
 	"testing"
 
-	"github.com/rfjakob/gocryptfs/internal/ctlsock"
+	"github.com/rfjakob/gocryptfs/ctlsock"
 	"github.com/rfjakob/gocryptfs/tests/test_helpers"
 )
 
diff --git a/tests/reverse/correctness_test.go b/tests/reverse/correctness_test.go
index 206bebd..9ebff37 100644
--- a/tests/reverse/correctness_test.go
+++ b/tests/reverse/correctness_test.go
@@ -10,7 +10,7 @@ import (
 
 	"golang.org/x/sys/unix"
 
-	"github.com/rfjakob/gocryptfs/internal/ctlsock"
+	"github.com/rfjakob/gocryptfs/ctlsock"
 	"github.com/rfjakob/gocryptfs/internal/syscallcompat"
 	"github.com/rfjakob/gocryptfs/tests/test_helpers"
 )
diff --git a/tests/reverse/ctlsock_test.go b/tests/reverse/ctlsock_test.go
index 6ccc724..ecb0b96 100644
--- a/tests/reverse/ctlsock_test.go
+++ b/tests/reverse/ctlsock_test.go
@@ -5,7 +5,7 @@ import (
 	"syscall"
 	"testing"
 
-	"github.com/rfjakob/gocryptfs/internal/ctlsock"
+	"github.com/rfjakob/gocryptfs/ctlsock"
 	"github.com/rfjakob/gocryptfs/tests/test_helpers"
 )
 
diff --git a/tests/reverse/exclude_test.go b/tests/reverse/exclude_test.go
index 1662f93..110a407 100644
--- a/tests/reverse/exclude_test.go
+++ b/tests/reverse/exclude_test.go
@@ -5,7 +5,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/rfjakob/gocryptfs/internal/ctlsock"
+	"github.com/rfjakob/gocryptfs/ctlsock"
 	"github.com/rfjakob/gocryptfs/internal/nametransform"
 	"github.com/rfjakob/gocryptfs/tests/test_helpers"
 )
diff --git a/tests/test_helpers/helpers.go b/tests/test_helpers/helpers.go
index 93d34d6..1fe0c19 100644
--- a/tests/test_helpers/helpers.go
+++ b/tests/test_helpers/helpers.go
@@ -16,7 +16,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/rfjakob/gocryptfs/internal/ctlsock"
+	"github.com/rfjakob/gocryptfs/ctlsock"
 	"github.com/rfjakob/gocryptfs/internal/nametransform"
 	"github.com/rfjakob/gocryptfs/internal/syscallcompat"
 )
@@ -362,7 +362,7 @@ func QueryCtlSock(t *testing.T, socketPath string, req ctlsock.RequestStruct) (r
 	if err != nil {
 		t.Fatal(err)
 	}
-	buf := make([]byte, ctlsock.ReadBufSize)
+	buf := make([]byte, 5000)
 	n, err := conn.Read(buf)
 	if err != nil {
 		t.Fatal(err)