openssl: disable digests by default, misc fixes
[openwrt/openwrt.git] / package / libs / openssl / patches / 500-e_devcrypto-default-to-not-use-digests-in-engine.patch
1 From 5d3be6bc8ed7d73ab2c4d389fb0f0a03dacd04b1 Mon Sep 17 00:00:00 2001
2 From: Eneas U de Queiroz <cote2004-github@yahoo.com>
3 Date: Mon, 11 Mar 2019 09:29:13 -0300
4 Subject: [PATCH] e_devcrypto: default to not use digests in engine
5
6 Digests are almost always slower when using /dev/crypto because of the
7 cost of the context switches. Only for large blocks it is worth it.
8
9 Also, when forking, the open context structures are duplicated, but the
10 internal kernel sessions are still shared between forks, which means an
11 update/close operation in one fork affects all processes using that
12 session.
13
14 This affects digests, especially for HMAC, where the session with the
15 key hash is used as a source for subsequent operations. At least one
16 popular application does this across a fork. Disabling digests by
17 default will mitigate the problem, while still allowing the user to
18 turn them on if it is safe and fast enough.
19
20 Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
21
22 --- a/engines/e_devcrypto.c
23 +++ b/engines/e_devcrypto.c
24 @@ -854,7 +854,7 @@ static void prepare_digest_methods(void)
25 for (i = 0, known_digest_nids_amount = 0; i < OSSL_NELEM(digest_data);
26 i++) {
27
28 - selected_digests[i] = 1;
29 + selected_digests[i] = 0;
30
31 /*
32 * Check that the digest is usable
33 @@ -1074,7 +1074,7 @@ static const ENGINE_CMD_DEFN devcrypto_c
34 #ifdef IMPLEMENT_DIGEST
35 {DEVCRYPTO_CMD_DIGESTS,
36 "DIGESTS",
37 - "either ALL, NONE, or a comma-separated list of digests to enable [default=ALL]",
38 + "either ALL, NONE, or a comma-separated list of digests to enable [default=NONE]",
39 ENGINE_CMD_FLAG_STRING},
40 #endif
41