mbedtls_ssl_config, mbedtls_ssl_session: reorder fields
Move small fields first so that more fields can be within the Arm Thumb 128-element direct access window. Keep the int section after the pointer section: moving int fields first cost a few bytes on the reference baremetal-m0plus build. The ordering in this commit is not based on field access frequency. Results (arm-none-eabi-gcc 7.3.1, build_arm_none_eabi_gcc_m0plus build): library/ssl_cli.o: 19687 -> 19543 (diff: 144) library/ssl_msg.o: 24834 -> 24726 (diff: 108) library/ssl_srv.o: 20562 -> 20462 (diff: 100) library/ssl_tls.o: 20907 -> 20707 (diff: 200) library/ssl_tls13_client.o: 7272 -> 7252 (diff: 20) library/ssl_tls13_generic.o: 4721 -> 4705 (diff: 16) Results (same architecture, config-suite-b.h + MBEDTLS_ECDH_LEGACY_CONTEXT + MBEDTLS_ECP_RESTARTABLE): library/ssl_cli.o: 2936 -> 2876 (diff: 60) library/ssl_msg.o: 3080 -> 3068 (diff: 12) library/ssl_srv.o: 3400 -> 3372 (diff: 28) library/ssl_tls.o: 6730 -> 6658 (diff: 72) Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine
parent
ec45c1e174
commit
8834d87ef6
1 changed files with 65 additions and 62 deletions
|
|
@ -1108,6 +1108,17 @@ mbedtls_dtls_srtp_info;
|
|||
*/
|
||||
struct mbedtls_ssl_session
|
||||
{
|
||||
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
|
||||
unsigned char MBEDTLS_PRIVATE(mfl_code); /*!< MaxFragmentLength negotiated by peer */
|
||||
#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
|
||||
|
||||
unsigned char MBEDTLS_PRIVATE(exported);
|
||||
|
||||
/* This field is temporarily duplicated with mbedtls_ssl_context.minor_ver.
|
||||
* Once runtime negotiation of TLS 1.2 and TLS 1.3 is implemented, it needs
|
||||
* to be studied whether one of them can be removed. */
|
||||
unsigned char MBEDTLS_PRIVATE(minor_ver); /*!< The TLS version used in the session. */
|
||||
|
||||
#if defined(MBEDTLS_HAVE_TIME)
|
||||
mbedtls_time_t MBEDTLS_PRIVATE(start); /*!< starting time */
|
||||
#endif
|
||||
|
|
@ -1117,13 +1128,6 @@ struct mbedtls_ssl_session
|
|||
unsigned char MBEDTLS_PRIVATE(id)[32]; /*!< session identifier */
|
||||
unsigned char MBEDTLS_PRIVATE(master)[48]; /*!< the master secret */
|
||||
|
||||
unsigned char MBEDTLS_PRIVATE(exported);
|
||||
|
||||
/* This field is temporarily duplicated with mbedtls_ssl_context.minor_ver.
|
||||
* Once runtime negotiation of TLS 1.2 and TLS 1.3 is implemented, it needs
|
||||
* to be studied whether one of them can be removed. */
|
||||
unsigned char MBEDTLS_PRIVATE(minor_ver); /*!< The TLS version used in the session. */
|
||||
|
||||
#if defined(MBEDTLS_X509_CRT_PARSE_C)
|
||||
#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
|
||||
mbedtls_x509_crt *MBEDTLS_PRIVATE(peer_cert); /*!< peer X.509 cert chain */
|
||||
|
|
@ -1143,10 +1147,6 @@ struct mbedtls_ssl_session
|
|||
uint32_t MBEDTLS_PRIVATE(ticket_lifetime); /*!< ticket lifetime hint */
|
||||
#endif /* MBEDTLS_SSL_SESSION_TICKETS && MBEDTLS_SSL_CLI_C */
|
||||
|
||||
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
|
||||
unsigned char MBEDTLS_PRIVATE(mfl_code); /*!< MaxFragmentLength negotiated by peer */
|
||||
#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
|
||||
|
||||
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||
int MBEDTLS_PRIVATE(encrypt_then_mac); /*!< flag for EtM activation */
|
||||
#endif
|
||||
|
|
@ -1210,7 +1210,59 @@ typedef void mbedtls_ssl_export_keys_t( void *p_expkey,
|
|||
*/
|
||||
struct mbedtls_ssl_config
|
||||
{
|
||||
/* Group items by size (largest first) to minimize padding overhead */
|
||||
/* Group items mostly by size. This helps to reduce memory wasted to
|
||||
* padding. It also helps to keep smaller fields early in the structure,
|
||||
* so that elements tend to be in the 128-element direct access window
|
||||
* on Arm Thumb, which reduces the code size. */
|
||||
|
||||
unsigned char MBEDTLS_PRIVATE(max_major_ver); /*!< max. major version used */
|
||||
unsigned char MBEDTLS_PRIVATE(max_minor_ver); /*!< max. minor version used */
|
||||
unsigned char MBEDTLS_PRIVATE(min_major_ver); /*!< min. major version used */
|
||||
unsigned char MBEDTLS_PRIVATE(min_minor_ver); /*!< min. minor version used */
|
||||
|
||||
/*
|
||||
* Flags (bitfields)
|
||||
*/
|
||||
|
||||
unsigned int MBEDTLS_PRIVATE(endpoint) : 1; /*!< 0: client, 1: server */
|
||||
unsigned int MBEDTLS_PRIVATE(transport) : 1; /*!< stream (TLS) or datagram (DTLS) */
|
||||
unsigned int MBEDTLS_PRIVATE(authmode) : 2; /*!< MBEDTLS_SSL_VERIFY_XXX */
|
||||
/* needed even with renego disabled for LEGACY_BREAK_HANDSHAKE */
|
||||
unsigned int MBEDTLS_PRIVATE(allow_legacy_renegotiation) : 2 ; /*!< MBEDTLS_LEGACY_XXX */
|
||||
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
|
||||
unsigned int MBEDTLS_PRIVATE(mfl_code) : 3; /*!< desired fragment length */
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||
unsigned int MBEDTLS_PRIVATE(encrypt_then_mac) : 1 ; /*!< negotiate encrypt-then-mac? */
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
|
||||
unsigned int MBEDTLS_PRIVATE(extended_ms) : 1; /*!< negotiate extended master secret? */
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
|
||||
unsigned int MBEDTLS_PRIVATE(anti_replay) : 1; /*!< detect and prevent replay? */
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_RENEGOTIATION)
|
||||
unsigned int MBEDTLS_PRIVATE(disable_renegotiation) : 1; /*!< disable renegotiation? */
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_SESSION_TICKETS)
|
||||
unsigned int MBEDTLS_PRIVATE(session_tickets) : 1; /*!< use session tickets? */
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_SRV_C)
|
||||
unsigned int MBEDTLS_PRIVATE(cert_req_ca_list) : 1; /*!< enable sending CA list in
|
||||
Certificate Request messages? */
|
||||
unsigned int MBEDTLS_PRIVATE(respect_cli_pref) : 1; /*!< pick the ciphersuite according to
|
||||
the client's preferences rather
|
||||
than ours */
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
|
||||
unsigned int MBEDTLS_PRIVATE(ignore_unexpected_cid) : 1; /*!< Determines whether DTLS
|
||||
* record with unexpected CID
|
||||
* should lead to failure. */
|
||||
#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
|
||||
#if defined(MBEDTLS_SSL_DTLS_SRTP)
|
||||
unsigned int MBEDTLS_PRIVATE(dtls_srtp_mki_support) : 1; /* support having mki_value
|
||||
in the use_srtp extension */
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Pointers
|
||||
|
|
@ -1365,7 +1417,7 @@ struct mbedtls_ssl_config
|
|||
#endif /* MBEDTLS_SSL_DTLS_SRTP */
|
||||
|
||||
/*
|
||||
* Numerical settings (int then char)
|
||||
* Numerical settings (int)
|
||||
*/
|
||||
|
||||
uint32_t MBEDTLS_PRIVATE(read_timeout); /*!< timeout for mbedtls_ssl_read (ms) */
|
||||
|
|
@ -1388,55 +1440,6 @@ struct mbedtls_ssl_config
|
|||
#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
|
||||
unsigned int MBEDTLS_PRIVATE(dhm_min_bitlen); /*!< min. bit length of the DHM prime */
|
||||
#endif
|
||||
|
||||
unsigned char MBEDTLS_PRIVATE(max_major_ver); /*!< max. major version used */
|
||||
unsigned char MBEDTLS_PRIVATE(max_minor_ver); /*!< max. minor version used */
|
||||
unsigned char MBEDTLS_PRIVATE(min_major_ver); /*!< min. major version used */
|
||||
unsigned char MBEDTLS_PRIVATE(min_minor_ver); /*!< min. minor version used */
|
||||
|
||||
/*
|
||||
* Flags (bitfields)
|
||||
*/
|
||||
|
||||
unsigned int MBEDTLS_PRIVATE(endpoint) : 1; /*!< 0: client, 1: server */
|
||||
unsigned int MBEDTLS_PRIVATE(transport) : 1; /*!< stream (TLS) or datagram (DTLS) */
|
||||
unsigned int MBEDTLS_PRIVATE(authmode) : 2; /*!< MBEDTLS_SSL_VERIFY_XXX */
|
||||
/* needed even with renego disabled for LEGACY_BREAK_HANDSHAKE */
|
||||
unsigned int MBEDTLS_PRIVATE(allow_legacy_renegotiation) : 2 ; /*!< MBEDTLS_LEGACY_XXX */
|
||||
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
|
||||
unsigned int MBEDTLS_PRIVATE(mfl_code) : 3; /*!< desired fragment length */
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||
unsigned int MBEDTLS_PRIVATE(encrypt_then_mac) : 1 ; /*!< negotiate encrypt-then-mac? */
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
|
||||
unsigned int MBEDTLS_PRIVATE(extended_ms) : 1; /*!< negotiate extended master secret? */
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
|
||||
unsigned int MBEDTLS_PRIVATE(anti_replay) : 1; /*!< detect and prevent replay? */
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_RENEGOTIATION)
|
||||
unsigned int MBEDTLS_PRIVATE(disable_renegotiation) : 1; /*!< disable renegotiation? */
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_SESSION_TICKETS)
|
||||
unsigned int MBEDTLS_PRIVATE(session_tickets) : 1; /*!< use session tickets? */
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_SRV_C)
|
||||
unsigned int MBEDTLS_PRIVATE(cert_req_ca_list) : 1; /*!< enable sending CA list in
|
||||
Certificate Request messages? */
|
||||
unsigned int MBEDTLS_PRIVATE(respect_cli_pref) : 1; /*!< pick the ciphersuite according to
|
||||
the client's preferences rather
|
||||
than ours */
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
|
||||
unsigned int MBEDTLS_PRIVATE(ignore_unexpected_cid) : 1; /*!< Determines whether DTLS
|
||||
* record with unexpected CID
|
||||
* should lead to failure. */
|
||||
#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
|
||||
#if defined(MBEDTLS_SSL_DTLS_SRTP)
|
||||
unsigned int MBEDTLS_PRIVATE(dtls_srtp_mki_support) : 1; /* support having mki_value
|
||||
in the use_srtp extension */
|
||||
#endif
|
||||
};
|
||||
|
||||
struct mbedtls_ssl_context
|
||||
|
|
|
|||
Loading…
Reference in a new issue