From 8019260926dcebe4f4be99cb5f92f84fbc9cd6d3 Mon Sep 17 00:00:00 2001 From: eunhhu Date: Sun, 27 Sep 2026 19:03:34 +0100 Subject: Map OpenSSL only in a server that uses it Linking OpenSSL cost every pure-serve 2.3 MiB of resident memory, 0.66 MiB of it the process's own (relocated data), though most servers never reach an https receiver or seal a send. The code that uses OpenSSL (TLS to https receivers, sealing) is now built as pure-crypto.so beside pure-serve and exports one table; pure-serve maps it the first time a wire to an https URL opens or a key is read or a seal wired (serve/crypto.c), and a missing library is reported at startup. What needs no OpenSSL, a key's hex and the suite this CPU seals with, stays in pure-serve. An idle server: RSS 4,496 -> 2,320 kB, PSS 1,639 -> 881 kB, private dirty 1,296 -> 864 kB. A static OpenSSL was measured too and is worse (RSS 3.8 MiB, but 2.3 MiB private: all of its tables relocated). The checks, https webhooks and sealed sends included, pass unchanged. --- serve/tls.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 serve/tls.h (limited to 'serve/tls.h') diff --git a/serve/tls.h b/serve/tls.h new file mode 100644 index 0000000..704924d --- /dev/null +++ b/serve/tls.h @@ -0,0 +1,18 @@ +#ifndef PURE_TLS_H +#define PURE_TLS_H +#include +#include + +/* TLS to https receivers (serve/crypto.c): one client context, verifying a + * receiver's certificate against the system's CAs or ca_file, and its name. */ +typedef struct PureTls PureTls; +/* The context, made once; false with why in error when it cannot be. */ +bool pure_tls_start(const char *ca_file, char *error, size_t size); +/* A session over a connected socket to host (a DNS name, or an IP address + * written as one), its certificate verified; NULL when it fails. */ +PureTls *pure_tls_open(const char *host, int fd); +/* As SSL_read and SSL_write: the bytes moved, or <= 0. */ +int pure_tls_read(PureTls *, void *bytes, int size); +int pure_tls_write(PureTls *, const void *bytes, int size); +void pure_tls_close(PureTls *); +#endif -- cgit v1.2.3