From 8019260926dcebe4f4be99cb5f92f84fbc9cd6d3 Mon Sep 17 00:00:00 2001 From: eunhhu Date: Sun, 27 Sep 2026 19:03:34 +0100 Subject: Map OpenSSL only in a server that uses it Linking OpenSSL cost every pure-serve 2.3 MiB of resident memory, 0.66 MiB of it the process's own (relocated data), though most servers never reach an https receiver or seal a send. The code that uses OpenSSL (TLS to https receivers, sealing) is now built as pure-crypto.so beside pure-serve and exports one table; pure-serve maps it the first time a wire to an https URL opens or a key is read or a seal wired (serve/crypto.c), and a missing library is reported at startup. What needs no OpenSSL, a key's hex and the suite this CPU seals with, stays in pure-serve. An idle server: RSS 4,496 -> 2,320 kB, PSS 1,639 -> 881 kB, private dirty 1,296 -> 864 kB. A static OpenSSL was measured too and is worse (RSS 3.8 MiB, but 2.3 MiB private: all of its tables relocated). The checks, https webhooks and sealed sends included, pass unchanged. --- serve/crypto.h | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 serve/crypto.h (limited to 'serve/crypto.h') diff --git a/serve/crypto.h b/serve/crypto.h new file mode 100644 index 0000000..5083b23 --- /dev/null +++ b/serve/crypto.h @@ -0,0 +1,31 @@ +#ifndef PURE_CRYPTO_H +#define PURE_CRYPTO_H +#include "seal.h" +#include "tls.h" + +/* What pure-serve asks of OpenSSL, as the table pure-crypto.so exports + * (serve/crypto-openssl.c). pure-serve maps it, and OpenSSL with it, the + * first time a server seals, opens a seal or connects to an https receiver + * (serve/crypto.c): one that does none of these maps no OpenSSL, 2.3 MiB + * less resident and 0.6 MiB less of its own. */ +enum { PURE_CRYPTO_VERSION = 1 }; + +typedef struct { + unsigned version; + /* TLS client: the context (verifying against ca_file, or the system's + * CAs when NULL), sessions over connected sockets, their reads and + * writes (as SSL_read and SSL_write: bytes, or <= 0), and their end. */ + bool (*tls_start)(const char *ca_file); + PureTls *(*tls_open)(const char *host, int fd); + int (*tls_read)(PureTls *, void *bytes, int size); + int (*tls_write)(PureTls *, const void *bytes, int size); + void (*tls_close)(PureTls *); + /* Sealing, as serve/seal.h says, in the suite named. */ + PureSealKey *(*seal_key)(const char *path, char public_hex[2 * PURE_SEAL_KEY + 1], char *error, size_t size); + void (*seal_key_free)(PureSealKey *); + bool (*seal)(const char *suite, const unsigned char peer[PURE_SEAL_KEY], const char *aad, + const unsigned char *plain, size_t size, unsigned char *out); + bool (*unseal)(const PureSealKey *, const char *suite, const char *aad, const unsigned char *sealed, size_t size, + unsigned char *plain); +} PureCrypto; +#endif -- cgit v1.2.3