When AES and GCM acceleration is available increase the priority of AES-GCM ciphersui...

diff --git a/lib/accelerated/intel/aes-x86.c b/lib/accelerated/intel/aes-x86.c
index 5f3cc91cc30abec4d9d1421574851e3b7d5575e7..8bb6a5e5b988f46464c14eff63ebe7250d9e6654 100644 (file)
--- a/lib/accelerated/intel/aes-x86.c
+++ b/lib/accelerated/intel/aes-x86.c
@@ -214,6 +214,9 @@ register_x86_crypto (void)
             {
               gnutls_assert ();
             }
+          
+          if (ret >= 0)
+            _gnutls_priority_prefer_aes_gcm();
         }
     }
 

diff --git a/lib/gnutls_global.h b/lib/gnutls_global.h
index affd1faecfb905eed96a15e332e675d241dbd9c6..2fbb06a001f3572f3a1146a9c0b3e02072e624ca 100644 (file)
--- a/lib/gnutls_global.h
+++ b/lib/gnutls_global.h
@@ -45,5 +45,6 @@ extern gnutls_log_func _gnutls_log_func;
 extern gnutls_audit_log_func _gnutls_audit_log_func;
 extern int _gnutls_log_level;
 extern int gnutls_crypto_init (void);
+void _gnutls_priority_prefer_aes_gcm(void);
 
 #endif

diff --git a/lib/gnutls_priority.c b/lib/gnutls_priority.c
index 9500ea09adcb11fc392a3c12961cb55870b9af5b..9a40d124a7b9ea4b99ed4fdf809ec20373c6adb6 100644 (file)
--- a/lib/gnutls_priority.c
+++ b/lib/gnutls_priority.c
@@ -298,41 +298,74 @@ static const int kx_priority_secure[] = {
   0
 };
 
-static const int cipher_priority_performance[] = {
+static const int cipher_priority_performance_sw[] = {
   GNUTLS_CIPHER_ARCFOUR_128,
-  GNUTLS_CIPHER_CAMELLIA_128_CBC,
   GNUTLS_CIPHER_AES_128_CBC,
-  GNUTLS_CIPHER_3DES_CBC,
+  GNUTLS_CIPHER_CAMELLIA_128_CBC,
   GNUTLS_CIPHER_AES_256_CBC,
   GNUTLS_CIPHER_CAMELLIA_256_CBC,
+  GNUTLS_CIPHER_3DES_CBC,
   GNUTLS_CIPHER_AES_128_GCM,
   GNUTLS_CIPHER_AES_256_GCM,
   0
 };
 
-static const int cipher_priority_suiteb128[] = {
+/* If GCM and AES acceleration is available then prefer
+ * them over anything else.
+ */
+static const int cipher_priority_performance_hw_aes[] = {
   GNUTLS_CIPHER_AES_128_GCM,
   GNUTLS_CIPHER_AES_128_CBC,
-  0
-};
-
-static const int cipher_priority_suiteb192[] = {
   GNUTLS_CIPHER_AES_256_GCM,
   GNUTLS_CIPHER_AES_256_CBC,
+  GNUTLS_CIPHER_ARCFOUR_128,
+  GNUTLS_CIPHER_CAMELLIA_128_CBC,
+  GNUTLS_CIPHER_CAMELLIA_256_CBC,
+  GNUTLS_CIPHER_3DES_CBC,
   0
 };
 
-static const int cipher_priority_normal[] = {
+static const int cipher_priority_normal_sw[] = {
   GNUTLS_CIPHER_AES_128_CBC,
   GNUTLS_CIPHER_CAMELLIA_128_CBC,
+  GNUTLS_CIPHER_AES_128_GCM,
   GNUTLS_CIPHER_AES_256_CBC,
   GNUTLS_CIPHER_CAMELLIA_256_CBC,
+  GNUTLS_CIPHER_AES_256_GCM,
+  GNUTLS_CIPHER_3DES_CBC,
+  GNUTLS_CIPHER_ARCFOUR_128,
+  0
+};
+
+static const int cipher_priority_normal_hw_aes[] = {
   GNUTLS_CIPHER_AES_128_GCM,
+  GNUTLS_CIPHER_AES_128_CBC,
+  GNUTLS_CIPHER_AES_256_GCM,
+  GNUTLS_CIPHER_AES_256_CBC,
+  GNUTLS_CIPHER_CAMELLIA_128_CBC,
+  GNUTLS_CIPHER_CAMELLIA_256_CBC,
   GNUTLS_CIPHER_3DES_CBC,
   GNUTLS_CIPHER_ARCFOUR_128,
   0
 };
 
+static const int *cipher_priority_performance = cipher_priority_performance_sw;
+static const int *cipher_priority_normal = cipher_priority_normal_sw;
+
+
+static const int cipher_priority_suiteb128[] = {
+  GNUTLS_CIPHER_AES_128_GCM,
+  GNUTLS_CIPHER_AES_128_CBC,
+  0
+};
+
+static const int cipher_priority_suiteb192[] = {
+  GNUTLS_CIPHER_AES_256_GCM,
+  GNUTLS_CIPHER_AES_256_CBC,
+  0
+};
+
+
 static const int cipher_priority_secure128[] = {
   GNUTLS_CIPHER_AES_128_CBC,
   GNUTLS_CIPHER_CAMELLIA_128_CBC,
@@ -1068,3 +1101,12 @@ gnutls_set_default_export_priority (gnutls_session_t session)
 {
   return gnutls_priority_set_direct (session, "EXPORT", NULL);
 }
+
+/* Increases the priority of AES-GCM as it is much faster
+ * than anything else if hardware support is there.
+ */
+void _gnutls_priority_prefer_aes_gcm(void)
+{
+  cipher_priority_performance = cipher_priority_performance_hw_aes;
+  cipher_priority_normal = cipher_priority_normal_hw_aes;
+}