Use SSL_MODE_RELEASE_BUFFERS if available

Hi,

Attached a very old patch from trac, rebased onto master and incorporated info from the trac ticket into the commit msg. See:
https://community.openvpn.net/openvpn/ticket/157

The change looks sane, and it passes client and loopback tests, so ACK.

-Steffan

From ffe73c0466e6f52ab7d9c49e5b6b7e77b93200df Mon Sep 17 00:00:00 2001
From: Cristian Rodriguez <[email protected]...>
Date: Sun, 25 May 2014 15:52:58 +0200
Subject: [PATCH] Use SSL_MODE_RELEASE_BUFFERS if available

Sets SSL_MODE_RELEASE_BUFFERS if available, to keep openSSL memory usage as low as possible.

For more info, see
http://www.imperialviolet.org/2010/06/25/overclocking-ssl.html
https://www.openssl.org/docs/ssl/SSL_CTX_set_mode.html

---
 src/openvpn/ssl_openssl.c | 3 +++
 1 file changed, 3 insertions(+)

index 3a222d8..4862bad 100644
@@ -198,6 +198,9 @@ tls_ctx_set_options (struct tls_root_ctx *ctx, unsigned int ssl_flags)
     SSL_CTX_set_options (ctx->ctx, sslopt);
   }
 
+#ifdef SSL_MODE_RELEASE_BUFFERS
+  SSL_CTX_set_mode (ctx, SSL_MODE_RELEASE_BUFFERS);
+#endif
   SSL_CTX_set_session_cache_mode (ctx->ctx, SSL_SESS_CACHE_OFF);
   SSL_CTX_set_default_passwd_cb (ctx->ctx, pem_password_callback);
 

1.9.1

Hi,

your patch has been applied to the OpenVPN master branch. Sorry it took us so long...

commit a6c573d22566a1dfc44ab060687192a4debc2e03

Author: Cristian Rodriguez
Date:   Sun May 25 15:52:58 2014 +0200

     Use SSL_MODE_RELEASE_BUFFERS if available

     Signed-off-by: Cristian Rodriguez <[email protected]...>
     Acked-by: Steffan Karger <[email protected]...>
     Message-Id: <[email protected]...>
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering

Hi,

Just noticed this patch needed a little more then resolving the merge conflict. The patch submission in 2011 was before the cipher abstraction layer was added. The attached patch contains the required extra change.

I noticed this while working on something else, compiling using --enable-strict. The compiler is very good in catching these kind of mistakes, but there are currently too many warnings to spot the useful ones. This is a good example why I think it would be worthwhile to get rid of more warnings.

-Steffan

From 63cd7bba2884cc713118783adfe3f1b20623457d Mon Sep 17 00:00:00 2001
From: Steffan Karger <[email protected]...>
Date: Wed, 28 May 2014 21:40:34 +0200
Subject: [PATCH] Fix merge error in a6c573d, the ssl ctx is now abstracted.

Between the origin patch submission (2011) and now the cipher abstraction layer has been added. This patch slipped through without proper adjustment.

---
 src/openvpn/ssl_openssl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 4862bad..c9d2d26 100644
@@ -199,7 +199,7 @@ tls_ctx_set_options (struct tls_root_ctx *ctx, unsigned int ssl_flags)
   }
 
 #ifdef SSL_MODE_RELEASE_BUFFERS
-  SSL_CTX_set_mode (ctx, SSL_MODE_RELEASE_BUFFERS);
+  SSL_CTX_set_mode (ctx->ctx, SSL_MODE_RELEASE_BUFFERS);
 #endif
   SSL_CTX_set_session_cache_mode (ctx->ctx, SSL_SESS_CACHE_OFF);
   SSL_CTX_set_default_passwd_cb (ctx->ctx, pem_password_callback);

1.9.1

Argh... so why didn't this blow up in my or buildbot's face? I *did* test this...

Anyway. ACK. Patch has been applied to the master branch.

Yes, de-warn patches welcome, though I dislike "just sprinkle casts around" patches :-)

commit efb304cf4904cbf5d926ab7a6ecde101472fa023

Author: Steffan Karger
Date:   Wed May 28 21:40:34 2014 +0200

     Fix merge error in a6c573d, the ssl ctx is now abstracted.

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Gert Doering <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/8745
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering