mbedtls_ssl_config, mbedtls_ssl_session: reorder fields
Move small fields first so that more fields can be within the Arm Thumb 128-element direct access window. Keep the int section after the pointer section: moving int fields first cost a few bytes on the reference baremetal-m0plus build. The ordering in this commit is not based on field access frequency. Results (arm-none-eabi-gcc 7.3.1, build_arm_none_eabi_gcc_m0plus build): library/ssl_cli.o: 19687 -> 19543 (diff: 144) library/ssl_msg.o: 24834 -> 24726 (diff: 108) library/ssl_srv.o: 20562 -> 20462 (diff: 100) library/ssl_tls.o: 20907 -> 20707 (diff: 200) library/ssl_tls13_client.o: 7272 -> 7252 (diff: 20) library/ssl_tls13_generic.o: 4721 -> 4705 (diff: 16) Results (same architecture, config-suite-b.h + MBEDTLS_ECDH_LEGACY_CONTEXT + MBEDTLS_ECP_RESTARTABLE): library/ssl_cli.o: 2936 -> 2876 (diff: 60) library/ssl_msg.o: 3080 -> 3068 (diff: 12) library/ssl_srv.o: 3400 -> 3372 (diff: 28) library/ssl_tls.o: 6730 -> 6658 (diff: 72) Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine
parent
ec45c1e174
commit
8834d87ef6
@ -1108,6 +1108,17 @@ mbedtls_dtls_srtp_info;
|
|||||||
*/
|
*/
|
||||||
struct mbedtls_ssl_session
|
struct mbedtls_ssl_session
|
||||||
{
|
{
|
||||||
|
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
|
||||||
|
unsigned char MBEDTLS_PRIVATE(mfl_code); /*!< MaxFragmentLength negotiated by peer */
|
||||||
|
#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
|
||||||
|
|
||||||
|
unsigned char MBEDTLS_PRIVATE(exported);
|
||||||
|
|
||||||
|
/* This field is temporarily duplicated with mbedtls_ssl_context.minor_ver.
|
||||||
|
* Once runtime negotiation of TLS 1.2 and TLS 1.3 is implemented, it needs
|
||||||
|
* to be studied whether one of them can be removed. */
|
||||||
|
unsigned char MBEDTLS_PRIVATE(minor_ver); /*!< The TLS version used in the session. */
|
||||||
|
|
||||||
#if defined(MBEDTLS_HAVE_TIME)
|
#if defined(MBEDTLS_HAVE_TIME)
|
||||||
mbedtls_time_t MBEDTLS_PRIVATE(start); /*!< starting time */
|
mbedtls_time_t MBEDTLS_PRIVATE(start); /*!< starting time */
|
||||||
#endif
|
#endif
|
||||||
@ -1117,13 +1128,6 @@ struct mbedtls_ssl_session
|
|||||||
unsigned char MBEDTLS_PRIVATE(id)[32]; /*!< session identifier */
|
unsigned char MBEDTLS_PRIVATE(id)[32]; /*!< session identifier */
|
||||||
unsigned char MBEDTLS_PRIVATE(master)[48]; /*!< the master secret */
|
unsigned char MBEDTLS_PRIVATE(master)[48]; /*!< the master secret */
|
||||||
|
|
||||||
unsigned char MBEDTLS_PRIVATE(exported);
|
|
||||||
|
|
||||||
/* This field is temporarily duplicated with mbedtls_ssl_context.minor_ver.
|
|
||||||
* Once runtime negotiation of TLS 1.2 and TLS 1.3 is implemented, it needs
|
|
||||||
* to be studied whether one of them can be removed. */
|
|
||||||
unsigned char MBEDTLS_PRIVATE(minor_ver); /*!< The TLS version used in the session. */
|
|
||||||
|
|
||||||
#if defined(MBEDTLS_X509_CRT_PARSE_C)
|
#if defined(MBEDTLS_X509_CRT_PARSE_C)
|
||||||
#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
|
#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
|
||||||
mbedtls_x509_crt *MBEDTLS_PRIVATE(peer_cert); /*!< peer X.509 cert chain */
|
mbedtls_x509_crt *MBEDTLS_PRIVATE(peer_cert); /*!< peer X.509 cert chain */
|
||||||
@ -1143,10 +1147,6 @@ struct mbedtls_ssl_session
|
|||||||
uint32_t MBEDTLS_PRIVATE(ticket_lifetime); /*!< ticket lifetime hint */
|
uint32_t MBEDTLS_PRIVATE(ticket_lifetime); /*!< ticket lifetime hint */
|
||||||
#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
|
#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
|
||||||
|
|
||||||
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
|
|
||||||
unsigned char MBEDTLS_PRIVATE(mfl_code); /*!< MaxFragmentLength negotiated by peer */
|
|
||||||
#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
|
|
||||||
|
|
||||||
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||||
int MBEDTLS_PRIVATE(encrypt_then_mac); /*!< flag for EtM activation */
|
int MBEDTLS_PRIVATE(encrypt_then_mac); /*!< flag for EtM activation */
|
||||||
#endif
|
#endif
|
||||||
@ -1210,7 +1210,59 @@ typedef void mbedtls_ssl_export_keys_t( void *p_expkey,
|
|||||||
*/
|
*/
|
||||||
struct mbedtls_ssl_config
|
struct mbedtls_ssl_config
|
||||||
{
|
{
|
||||||
/* Group items by size (largest first) to minimize padding overhead */
|
/* Group items mostly by size. This helps to reduce memory wasted to
|
||||||
|
* padding. It also helps to keep smaller fields early in the structure,
|
||||||
|
* so that elements tend to be in the 128-element direct access window
|
||||||
|
* on Arm Thumb, which reduces the code size. */
|
||||||
|
|
||||||
|
unsigned char MBEDTLS_PRIVATE(max_major_ver); /*!< max. major version used */
|
||||||
|
unsigned char MBEDTLS_PRIVATE(max_minor_ver); /*!< max. minor version used */
|
||||||
|
unsigned char MBEDTLS_PRIVATE(min_major_ver); /*!< min. major version used */
|
||||||
|
unsigned char MBEDTLS_PRIVATE(min_minor_ver); /*!< min. minor version used */
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Flags (bitfields)
|
||||||
|
*/
|
||||||
|
|
||||||
|
unsigned int MBEDTLS_PRIVATE(endpoint) : 1; /*!< 0: client, 1: server */
|
||||||
|
unsigned int MBEDTLS_PRIVATE(transport) : 1; /*!< stream (TLS) or datagram (DTLS) */
|
||||||
|
unsigned int MBEDTLS_PRIVATE(authmode) : 2; /*!< MBEDTLS_SSL_VERIFY_XXX */
|
||||||
|
/* needed even with renego disabled for LEGACY_BREAK_HANDSHAKE */
|
||||||
|
unsigned int MBEDTLS_PRIVATE(allow_legacy_renegotiation) : 2 ; /*!< MBEDTLS_LEGACY_XXX */
|
||||||
|
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
|
||||||
|
unsigned int MBEDTLS_PRIVATE(mfl_code) : 3; /*!< desired fragment length */
|
||||||
|
#endif
|
||||||
|
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||||
|
unsigned int MBEDTLS_PRIVATE(encrypt_then_mac) : 1 ; /*!< negotiate encrypt-then-mac? */
|
||||||
|
#endif
|
||||||
|
#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
|
||||||
|
unsigned int MBEDTLS_PRIVATE(extended_ms) : 1; /*!< negotiate extended master secret? */
|
||||||
|
#endif
|
||||||
|
#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
|
||||||
|
unsigned int MBEDTLS_PRIVATE(anti_replay) : 1; /*!< detect and prevent replay? */
|
||||||
|
#endif
|
||||||
|
#if defined(MBEDTLS_SSL_RENEGOTIATION)
|
||||||
|
unsigned int MBEDTLS_PRIVATE(disable_renegotiation) : 1; /*!< disable renegotiation? */
|
||||||
|
#endif
|
||||||
|
#if defined(MBEDTLS_SSL_SESSION_TICKETS)
|
||||||
|
unsigned int MBEDTLS_PRIVATE(session_tickets) : 1; /*!< use session tickets? */
|
||||||
|
#endif
|
||||||
|
#if defined(MBEDTLS_SSL_SRV_C)
|
||||||
|
unsigned int MBEDTLS_PRIVATE(cert_req_ca_list) : 1; /*!< enable sending CA list in
|
||||||
|
Certificate Request messages? */
|
||||||
|
unsigned int MBEDTLS_PRIVATE(respect_cli_pref) : 1; /*!< pick the ciphersuite according to
|
||||||
|
the client's preferences rather
|
||||||
|
than ours */
|
||||||
|
#endif
|
||||||
|
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
|
||||||
|
unsigned int MBEDTLS_PRIVATE(ignore_unexpected_cid) : 1; /*!< Determines whether DTLS
|
||||||
|
* record with unexpected CID
|
||||||
|
* should lead to failure. */
|
||||||
|
#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
|
||||||
|
#if defined(MBEDTLS_SSL_DTLS_SRTP)
|
||||||
|
unsigned int MBEDTLS_PRIVATE(dtls_srtp_mki_support) : 1; /* support having mki_value
|
||||||
|
in the use_srtp extension */
|
||||||
|
#endif
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Pointers
|
* Pointers
|
||||||
@ -1365,7 +1417,7 @@ struct mbedtls_ssl_config
|
|||||||
#endif /* MBEDTLS_SSL_DTLS_SRTP */
|
#endif /* MBEDTLS_SSL_DTLS_SRTP */
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Numerical settings (int then char)
|
* Numerical settings (int)
|
||||||
*/
|
*/
|
||||||
|
|
||||||
uint32_t MBEDTLS_PRIVATE(read_timeout); /*!< timeout for mbedtls_ssl_read (ms) */
|
uint32_t MBEDTLS_PRIVATE(read_timeout); /*!< timeout for mbedtls_ssl_read (ms) */
|
||||||
@ -1388,55 +1440,6 @@ struct mbedtls_ssl_config
|
|||||||
#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
|
#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
|
||||||
unsigned int MBEDTLS_PRIVATE(dhm_min_bitlen); /*!< min. bit length of the DHM prime */
|
unsigned int MBEDTLS_PRIVATE(dhm_min_bitlen); /*!< min. bit length of the DHM prime */
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
unsigned char MBEDTLS_PRIVATE(max_major_ver); /*!< max. major version used */
|
|
||||||
unsigned char MBEDTLS_PRIVATE(max_minor_ver); /*!< max. minor version used */
|
|
||||||
unsigned char MBEDTLS_PRIVATE(min_major_ver); /*!< min. major version used */
|
|
||||||
unsigned char MBEDTLS_PRIVATE(min_minor_ver); /*!< min. minor version used */
|
|
||||||
|
|
||||||
/*
|
|
||||||
* Flags (bitfields)
|
|
||||||
*/
|
|
||||||
|
|
||||||
unsigned int MBEDTLS_PRIVATE(endpoint) : 1; /*!< 0: client, 1: server */
|
|
||||||
unsigned int MBEDTLS_PRIVATE(transport) : 1; /*!< stream (TLS) or datagram (DTLS) */
|
|
||||||
unsigned int MBEDTLS_PRIVATE(authmode) : 2; /*!< MBEDTLS_SSL_VERIFY_XXX */
|
|
||||||
/* needed even with renego disabled for LEGACY_BREAK_HANDSHAKE */
|
|
||||||
unsigned int MBEDTLS_PRIVATE(allow_legacy_renegotiation) : 2 ; /*!< MBEDTLS_LEGACY_XXX */
|
|
||||||
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
|
|
||||||
unsigned int MBEDTLS_PRIVATE(mfl_code) : 3; /*!< desired fragment length */
|
|
||||||
#endif
|
|
||||||
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
|
||||||
unsigned int MBEDTLS_PRIVATE(encrypt_then_mac) : 1 ; /*!< negotiate encrypt-then-mac? */
|
|
||||||
#endif
|
|
||||||
#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
|
|
||||||
unsigned int MBEDTLS_PRIVATE(extended_ms) : 1; /*!< negotiate extended master secret? */
|
|
||||||
#endif
|
|
||||||
#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
|
|
||||||
unsigned int MBEDTLS_PRIVATE(anti_replay) : 1; /*!< detect and prevent replay? */
|
|
||||||
#endif
|
|
||||||
#if defined(MBEDTLS_SSL_RENEGOTIATION)
|
|
||||||
unsigned int MBEDTLS_PRIVATE(disable_renegotiation) : 1; /*!< disable renegotiation? */
|
|
||||||
#endif
|
|
||||||
#if defined(MBEDTLS_SSL_SESSION_TICKETS)
|
|
||||||
unsigned int MBEDTLS_PRIVATE(session_tickets) : 1; /*!< use session tickets? */
|
|
||||||
#endif
|
|
||||||
#if defined(MBEDTLS_SSL_SRV_C)
|
|
||||||
unsigned int MBEDTLS_PRIVATE(cert_req_ca_list) : 1; /*!< enable sending CA list in
|
|
||||||
Certificate Request messages? */
|
|
||||||
unsigned int MBEDTLS_PRIVATE(respect_cli_pref) : 1; /*!< pick the ciphersuite according to
|
|
||||||
the client's preferences rather
|
|
||||||
than ours */
|
|
||||||
#endif
|
|
||||||
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
|
|
||||||
unsigned int MBEDTLS_PRIVATE(ignore_unexpected_cid) : 1; /*!< Determines whether DTLS
|
|
||||||
* record with unexpected CID
|
|
||||||
* should lead to failure. */
|
|
||||||
#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
|
|
||||||
#if defined(MBEDTLS_SSL_DTLS_SRTP)
|
|
||||||
unsigned int MBEDTLS_PRIVATE(dtls_srtp_mki_support) : 1; /* support having mki_value
|
|
||||||
in the use_srtp extension */
|
|
||||||
#endif
|
|
||||||
};
|
};
|
||||||
|
|
||||||
struct mbedtls_ssl_context
|
struct mbedtls_ssl_context
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user