From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Sun, 5 Jun 2011 11:30:34 +0000 (+0200)
Subject: When AES and GCM acceleration is available increase the priority of AES-GCM ciphersui... 
X-Git-Tag: gnutls_2_99_3~37
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=591186874eefa2f277dbd82819df96ae59787e5b;p=thirdparty%2Fgnutls.git

When AES and GCM acceleration is available increase the priority of AES-GCM ciphersuites in performance and normal cases.
---

diff --git a/lib/accelerated/intel/aes-x86.c b/lib/accelerated/intel/aes-x86.c
index 5f3cc91cc3..8bb6a5e5b9 100644
--- a/lib/accelerated/intel/aes-x86.c
+++ b/lib/accelerated/intel/aes-x86.c
@@ -214,6 +214,9 @@ register_x86_crypto (void)
             {
               gnutls_assert ();
             }
+          
+          if (ret >= 0)
+            _gnutls_priority_prefer_aes_gcm();
         }
     }
 
diff --git a/lib/gnutls_global.h b/lib/gnutls_global.h
index affd1faecf..2fbb06a001 100644
--- a/lib/gnutls_global.h
+++ b/lib/gnutls_global.h
@@ -45,5 +45,6 @@ extern gnutls_log_func _gnutls_log_func;
 extern gnutls_audit_log_func _gnutls_audit_log_func;
 extern int _gnutls_log_level;
 extern int gnutls_crypto_init (void);
+void _gnutls_priority_prefer_aes_gcm(void);
 
 #endif
diff --git a/lib/gnutls_priority.c b/lib/gnutls_priority.c
index 9500ea09ad..9a40d124a7 100644
--- a/lib/gnutls_priority.c
+++ b/lib/gnutls_priority.c
@@ -298,41 +298,74 @@ static const int kx_priority_secure[] = {
   0
 };
 
-static const int cipher_priority_performance[] = {
+static const int cipher_priority_performance_sw[] = {
   GNUTLS_CIPHER_ARCFOUR_128,
-  GNUTLS_CIPHER_CAMELLIA_128_CBC,
   GNUTLS_CIPHER_AES_128_CBC,
-  GNUTLS_CIPHER_3DES_CBC,
+  GNUTLS_CIPHER_CAMELLIA_128_CBC,
   GNUTLS_CIPHER_AES_256_CBC,
   GNUTLS_CIPHER_CAMELLIA_256_CBC,
+  GNUTLS_CIPHER_3DES_CBC,
   GNUTLS_CIPHER_AES_128_GCM,
   GNUTLS_CIPHER_AES_256_GCM,
   0
 };
 
-static const int cipher_priority_suiteb128[] = {
+/* If GCM and AES acceleration is available then prefer
+ * them over anything else.
+ */
+static const int cipher_priority_performance_hw_aes[] = {
   GNUTLS_CIPHER_AES_128_GCM,
   GNUTLS_CIPHER_AES_128_CBC,
-  0
-};
-
-static const int cipher_priority_suiteb192[] = {
   GNUTLS_CIPHER_AES_256_GCM,
   GNUTLS_CIPHER_AES_256_CBC,
+  GNUTLS_CIPHER_ARCFOUR_128,
+  GNUTLS_CIPHER_CAMELLIA_128_CBC,
+  GNUTLS_CIPHER_CAMELLIA_256_CBC,
+  GNUTLS_CIPHER_3DES_CBC,
   0
 };
 
-static const int cipher_priority_normal[] = {
+static const int cipher_priority_normal_sw[] = {
   GNUTLS_CIPHER_AES_128_CBC,
   GNUTLS_CIPHER_CAMELLIA_128_CBC,
+  GNUTLS_CIPHER_AES_128_GCM,
   GNUTLS_CIPHER_AES_256_CBC,
   GNUTLS_CIPHER_CAMELLIA_256_CBC,
+  GNUTLS_CIPHER_AES_256_GCM,
+  GNUTLS_CIPHER_3DES_CBC,
+  GNUTLS_CIPHER_ARCFOUR_128,
+  0
+};
+
+static const int cipher_priority_normal_hw_aes[] = {
   GNUTLS_CIPHER_AES_128_GCM,
+  GNUTLS_CIPHER_AES_128_CBC,
+  GNUTLS_CIPHER_AES_256_GCM,
+  GNUTLS_CIPHER_AES_256_CBC,
+  GNUTLS_CIPHER_CAMELLIA_128_CBC,
+  GNUTLS_CIPHER_CAMELLIA_256_CBC,
   GNUTLS_CIPHER_3DES_CBC,
   GNUTLS_CIPHER_ARCFOUR_128,
   0
 };
 
+static const int *cipher_priority_performance = cipher_priority_performance_sw;
+static const int *cipher_priority_normal = cipher_priority_normal_sw;
+
+
+static const int cipher_priority_suiteb128[] = {
+  GNUTLS_CIPHER_AES_128_GCM,
+  GNUTLS_CIPHER_AES_128_CBC,
+  0
+};
+
+static const int cipher_priority_suiteb192[] = {
+  GNUTLS_CIPHER_AES_256_GCM,
+  GNUTLS_CIPHER_AES_256_CBC,
+  0
+};
+
+
 static const int cipher_priority_secure128[] = {
   GNUTLS_CIPHER_AES_128_CBC,
   GNUTLS_CIPHER_CAMELLIA_128_CBC,
@@ -1068,3 +1101,12 @@ gnutls_set_default_export_priority (gnutls_session_t session)
 {
   return gnutls_priority_set_direct (session, "EXPORT", NULL);
 }
+
+/* Increases the priority of AES-GCM as it is much faster
+ * than anything else if hardware support is there.
+ */
+void _gnutls_priority_prefer_aes_gcm(void)
+{
+  cipher_priority_performance = cipher_priority_performance_hw_aes;
+  cipher_priority_normal = cipher_priority_normal_hw_aes;
+}