Skip to content

Commit c7a5b79

Browse files
tobiasb-mstobiasb-ms
authored
openssl speed fixes (#12992)
With the symcrypt provider installed, openssl speed has a couple problems. First, there are intermittent (but frequent) segfaults in openssl speed ecdh and openssl speed ffdh. This is fixed by upstream pull openssl/openssl#26976. We fix that by taking that patch. Second, there are several warnings, the root cause of which also makes certain speed test be skipped. This boils down to a feature gap between symcrypt and default provider. For now, we will patch out the specific tests that are warning/bailing, but as those features come online in symcrypt we'll modify/remove that patch.
1 parent fc75060 commit c7a5b79

7 files changed

Lines changed: 231 additions & 23 deletions

‎SPECS/openssl/Keep-the-provided-peer-EVP_PKEY-in-the-EVP_PKEY_CTX-too.patch‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
From 782912cccc70f8c3fed4e49db2f479d97af0bdf9 Mon Sep 17 00:00:00 2001
2+
From: Tomas Mraz <tomas@openssl.org>
3+
Date: Tue, 4 Mar 2025 18:43:18 +0100
4+
Subject: [PATCH] Keep the provided peer EVP_PKEY in the EVP_PKEY_CTX too
5+
6+
Reviewed-by: Tim Hudson <tjh@openssl.org>
7+
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
8+
Reviewed-by: Matt Caswell <matt@openssl.org>
9+
(Merged from https://github.com/openssl/openssl/pull/26976)
10+
11+
(cherry picked from commit 2656922febfc36f6b44cff1c363917685633b4c5)
12+
---
13+
crypto/evp/exchange.c | 8 +++++++-
14+
1 file changed, 7 insertions(+), 1 deletion(-)
15+
16+
diff --git a/crypto/evp/exchange.c b/crypto/evp/exchange.c
17+
index d9eed1cea5be2..70c2f441b9d7a 100644
18+
--- a/crypto/evp/exchange.c
19+
+++ b/crypto/evp/exchange.c
20+
@@ -431,7 +431,13 @@ int EVP_PKEY_derive_set_peer_ex(EVP_PKEY_CTX *ctx, EVP_PKEY *peer,
21+
*/
22+
if (provkey == NULL)
23+
goto legacy;
24+
- return ctx->op.kex.exchange->set_peer(ctx->op.kex.algctx, provkey);
25+
+ ret = ctx->op.kex.exchange->set_peer(ctx->op.kex.algctx, provkey);
26+
+ if (ret <= 0)
27+
+ return ret;
28+
+ EVP_PKEY_free(ctx->peerkey);
29+
+ ctx->peerkey = peer;
30+
+ EVP_PKEY_up_ref(peer);
31+
+ return 1;
32+
33+
legacy:
34+
#ifdef FIPS_MODULE

‎SPECS/openssl/openssl.spec‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
Summary: Utilities from the general purpose cryptography library with TLS implementation
1010
Name: openssl
1111
Version: 3.3.3
12-
Release: 1%{?dist}
12+
Release: 2%{?dist}
1313
Vendor: Microsoft Corporation
1414
Distribution: Azure Linux
1515
Source: https://github.com/openssl/openssl/releases/download/openssl-%{version}/openssl-%{version}.tar.gz
@@ -62,6 +62,14 @@ Patch52: 0052-Allow-SHA1-in-seclevel-1-if-rh-allow-sha1-signatures.patch
6262
# # See notes in the patch for details, but this patch will not be needed if
6363
# # the openssl issue https://github.com/openssl/openssl/issues/7048 is ever implemented and released.
6464
Patch80: 0001-Replacing-deprecated-functions-with-NULL-or-highest.patch
65+
# Fix crashes in openssl speed with providers that don't refcount keys.
66+
# Upstream: https://github.com/openssl/openssl/pull/26976 has been merged into 3.3, so if we
67+
# upgrade to 3.3.4 when it comes out, we can remove this patch.
68+
Patch81: Keep-the-provided-peer-EVP_PKEY-in-the-EVP_PKEY_CTX-too.patch
69+
# The Symcrypt provider, which is our default, doesn't support some of the
70+
# algorithms that are used in the speed tests. This patch skips those tests.
71+
# If SymCrypt adds support, we should change and eventually remove this patch.
72+
Patch82: prevent-unsupported-calls-into-symcrypt-in-speed.patch
6573

6674
License: Apache-2.0
6775
URL: http://www.openssl.org/
@@ -357,6 +365,9 @@ install -m644 %{SOURCE9} \
357365
%ldconfig_scriptlets libs
358366

359367
%changelog
368+
* Mon Mar 17 2025 Tobias Brick <tobiasb@microsoft.com> - 3.3.3-2
369+
- Patch to fix segfaults and errors in openssl speed.
370+
360371
* Wed Feb 26 2025 Tobias Brick <tobiasb@microsoft.com> - 3.3.3-1
361372
- Auto-upgrade to 3.3.3 - none
362373
- Initially run through autoupgrader (CBL-Mariner Servicing Account <cblmargh@microsoft.com>)

‎SPECS/openssl/prevent-unsupported-calls-into-symcrypt-in-speed.patch‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
From 4576a24fbe145ea200b9f9eb7e1854c61932e8b6 Mon Sep 17 00:00:00 2001
2+
From: Tobias Brick <tobiasb@microsoft.com>
3+
Date: Tue, 25 Feb 2025 21:52:41 +0000
4+
Subject: [PATCH] prevent unsupported calls into symcrypt in speed
5+
6+
---
7+
apps/speed.c | 46 ++++++++++++++++++++++++++++++++++++++++++++--
8+
1 file changed, 44 insertions(+), 2 deletions(-)
9+
10+
diff --git a/apps/speed.c b/apps/speed.c
11+
index 8c3342e..b4e966d 100644
12+
--- a/apps/speed.c
13+
+++ b/apps/speed.c
14+
@@ -27,6 +27,9 @@
15+
/* We need to use some deprecated APIs */
16+
#define OPENSSL_SUPPRESS_DEPRECATED
17+
18+
+/* AZL3-Specific: Only run tests that work with the SymCrypt provider. */
19+
+#define AZL3_SYMCRYPT_PROVIDER
20+
+
21+
#include <stdio.h>
22+
#include <stdlib.h>
23+
#include <string.h>
24+
@@ -383,15 +386,24 @@ static double rsa_results[RSA_NUM][4]; /* 4 ops: sign, verify, encrypt, decrypt
25+
26+
#ifndef OPENSSL_NO_DH
27+
enum ff_params_t {
28+
- R_FFDH_2048, R_FFDH_3072, R_FFDH_4096, R_FFDH_6144, R_FFDH_8192, FFDH_NUM
29+
+ R_FFDH_2048,
30+
+ R_FFDH_3072,
31+
+ R_FFDH_4096,
32+
+#ifndef AZL3_SYMCRYPT_PROVIDER
33+
+ R_FFDH_6144,
34+
+ R_FFDH_8192,
35+
+#endif /* AZL3_SYMCRYPT_PROVIDER */
36+
+ FFDH_NUM,
37+
};
38+
39+
static const OPT_PAIR ffdh_choices[FFDH_NUM] = {
40+
{"ffdh2048", R_FFDH_2048},
41+
{"ffdh3072", R_FFDH_3072},
42+
{"ffdh4096", R_FFDH_4096},
43+
+#ifndef AZL3_SYMCRYPT_PROVIDER
44+
{"ffdh6144", R_FFDH_6144},
45+
{"ffdh8192", R_FFDH_8192},
46+
+#endif /* AZL3_SYMCRYPT_PROVIDER */
47+
};
48+
49+
static double ffdh_results[FFDH_NUM][1]; /* 1 op: derivation */
50+
@@ -403,8 +415,11 @@ enum ec_curves_t {
51+
R_EC_K163, R_EC_K233, R_EC_K283, R_EC_K409, R_EC_K571,
52+
R_EC_B163, R_EC_B233, R_EC_B283, R_EC_B409, R_EC_B571,
53+
#endif
54+
+#ifndef AZL3_SYMCRYPT_PROVIDER
55+
R_EC_BRP256R1, R_EC_BRP256T1, R_EC_BRP384R1, R_EC_BRP384T1,
56+
- R_EC_BRP512R1, R_EC_BRP512T1, ECDSA_NUM
57+
+ R_EC_BRP512R1, R_EC_BRP512T1,
58+
+#endif /* AZL3_SYMCRYPT_PROVIDER */
59+
+ ECDSA_NUM
60+
};
61+
/* list of ecdsa curves */
62+
static const OPT_PAIR ecdsa_choices[ECDSA_NUM] = {
63+
@@ -424,12 +439,14 @@ static const OPT_PAIR ecdsa_choices[ECDSA_NUM] = {
64+
{"ecdsab409", R_EC_B409},
65+
{"ecdsab571", R_EC_B571},
66+
#endif
67+
+#ifndef AZL3_SYMCRYPT_PROVIDER
68+
{"ecdsabrp256r1", R_EC_BRP256R1},
69+
{"ecdsabrp256t1", R_EC_BRP256T1},
70+
{"ecdsabrp384r1", R_EC_BRP384R1},
71+
{"ecdsabrp384t1", R_EC_BRP384T1},
72+
{"ecdsabrp512r1", R_EC_BRP512R1},
73+
{"ecdsabrp512t1", R_EC_BRP512T1}
74+
+#endif /* AZL3_SYMCRYPT_PROVIDER */
75+
};
76+
enum {
77+
#ifndef OPENSSL_NO_ECX
78+
@@ -456,12 +473,14 @@ static const OPT_PAIR ecdh_choices[EC_NUM] = {
79+
{"ecdhb409", R_EC_B409},
80+
{"ecdhb571", R_EC_B571},
81+
#endif
82+
+#ifndef AZL3_SYMCRYPT_PROVIDER
83+
{"ecdhbrp256r1", R_EC_BRP256R1},
84+
{"ecdhbrp256t1", R_EC_BRP256T1},
85+
{"ecdhbrp384r1", R_EC_BRP384R1},
86+
{"ecdhbrp384t1", R_EC_BRP384T1},
87+
{"ecdhbrp512r1", R_EC_BRP512R1},
88+
{"ecdhbrp512t1", R_EC_BRP512T1},
89+
+#endif /* AZL3_SYMCRYPT_PROVIDER */
90+
#ifndef OPENSSL_NO_ECX
91+
{"ecdhx25519", R_EC_X25519},
92+
{"ecdhx448", R_EC_X448}
93+
@@ -1806,8 +1825,10 @@ int speed_main(int argc, char **argv)
94+
{"ffdh2048", NID_ffdhe2048, 2048},
95+
{"ffdh3072", NID_ffdhe3072, 3072},
96+
{"ffdh4096", NID_ffdhe4096, 4096},
97+
+#ifndef AZL3_SYMCRYPT_PROVIDER
98+
{"ffdh6144", NID_ffdhe6144, 6144},
99+
{"ffdh8192", NID_ffdhe8192, 8192}
100+
+#endif /* AZL3_SYMCRYPT_PROVIDER */
101+
};
102+
uint8_t ffdh_doit[FFDH_NUM] = { 0 };
103+
104+
@@ -1839,12 +1860,14 @@ int speed_main(int argc, char **argv)
105+
{"nistb409", NID_sect409r1, 409},
106+
{"nistb571", NID_sect571r1, 571},
107+
#endif
108+
+#ifndef AZL3_SYMCRYPT_PROVIDER
109+
{"brainpoolP256r1", NID_brainpoolP256r1, 256},
110+
{"brainpoolP256t1", NID_brainpoolP256t1, 256},
111+
{"brainpoolP384r1", NID_brainpoolP384r1, 384},
112+
{"brainpoolP384t1", NID_brainpoolP384t1, 384},
113+
{"brainpoolP512r1", NID_brainpoolP512r1, 512},
114+
{"brainpoolP512t1", NID_brainpoolP512t1, 512},
115+
+#endif /* AZL3_SYMCRYPT_PROVIDER */
116+
#ifndef OPENSSL_NO_ECX
117+
/* Other and ECDH only ones */
118+
{"X25519", NID_X25519, 253},
119+
@@ -1885,8 +1908,13 @@ int speed_main(int argc, char **argv)
120+
OPENSSL_assert(ec_curves[EC_NUM - 1].nid == NID_X448);
121+
OPENSSL_assert(strcmp(ecdh_choices[EC_NUM - 1].name, "ecdhx448") == 0);
122+
123+
+#ifdef AZL3_SYMCRYPT_PROVIDER
124+
+ OPENSSL_assert(ec_curves[ECDSA_NUM - 1].nid == NID_secp521r1);
125+
+ OPENSSL_assert(strcmp(ecdsa_choices[ECDSA_NUM - 1].name, "ecdsap521") == 0);
126+
+#else
127+
OPENSSL_assert(ec_curves[ECDSA_NUM - 1].nid == NID_brainpoolP512t1);
128+
OPENSSL_assert(strcmp(ecdsa_choices[ECDSA_NUM - 1].name, "ecdsabrp512t1") == 0);
129+
+#endif /* AZL3_SYMCRYPT_PROVIDER */
130+
#endif /* OPENSSL_NO_ECX */
131+
132+
#ifndef OPENSSL_NO_SM2
133+
@@ -2066,6 +2094,13 @@ int speed_main(int argc, char **argv)
134+
goto end;
135+
}
136+
for (i = 0; i < OSSL_NELEM(rsa_choices); i++) {
137+
+#ifdef AZL3_SYMCRYPT_PROVIDER
138+
+ /* SymCrypt only supports 1024 and above */
139+
+ if (strcmp(rsa_choices[i].name, "rsa512") == 0) {
140+
+ continue;
141+
+ }
142+
+#endif /* AZL3_SYMCRYPT_PROVIDER */
143+
+
144+
kems_doit[kems_algs_len] = 1;
145+
kems_algname[kems_algs_len++] = OPENSSL_strdup(rsa_choices[i].name);
146+
}
147+
@@ -2111,6 +2146,13 @@ int speed_main(int argc, char **argv)
148+
goto end;
149+
}
150+
for (i = 0; i < OSSL_NELEM(rsa_choices); i++) {
151+
+#ifdef AZL3_SYMCRYPT_PROVIDER
152+
+ /* SymCrypt only supports 1024 and above */
153+
+ if (strcmp(rsa_choices[i].name, "rsa512") == 0) {
154+
+ continue;
155+
+ }
156+
+#endif /* AZL3_SYMCRYPT_PROVIDER */
157+
+
158+
sigs_doit[sigs_algs_len] = 1;
159+
sigs_algname[sigs_algs_len++] = OPENSSL_strdup(rsa_choices[i].name);
160+
}
161+
--
162+
2.45.3
163+

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -170,11 +170,11 @@ gtk-doc-1.33.2-1.azl3.noarch.rpm
170170
autoconf-2.72-2.azl3.noarch.rpm
171171
automake-1.16.5-2.azl3.noarch.rpm
172172
ocaml-srpm-macros-9-4.azl3.noarch.rpm
173-
openssl-3.3.3-1.azl3.aarch64.rpm
174-
openssl-devel-3.3.3-1.azl3.aarch64.rpm
175-
openssl-libs-3.3.3-1.azl3.aarch64.rpm
176-
openssl-perl-3.3.3-1.azl3.aarch64.rpm
177-
openssl-static-3.3.3-1.azl3.aarch64.rpm
173+
openssl-3.3.3-2.azl3.aarch64.rpm
174+
openssl-devel-3.3.3-2.azl3.aarch64.rpm
175+
openssl-libs-3.3.3-2.azl3.aarch64.rpm
176+
openssl-perl-3.3.3-2.azl3.aarch64.rpm
177+
openssl-static-3.3.3-2.azl3.aarch64.rpm
178178
libcap-2.69-3.azl3.aarch64.rpm
179179
libcap-devel-2.69-3.azl3.aarch64.rpm
180180
debugedit-5.0-2.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -170,11 +170,11 @@ gtk-doc-1.33.2-1.azl3.noarch.rpm
170170
autoconf-2.72-2.azl3.noarch.rpm
171171
automake-1.16.5-2.azl3.noarch.rpm
172172
ocaml-srpm-macros-9-4.azl3.noarch.rpm
173-
openssl-3.3.3-1.azl3.x86_64.rpm
174-
openssl-devel-3.3.3-1.azl3.x86_64.rpm
175-
openssl-libs-3.3.3-1.azl3.x86_64.rpm
176-
openssl-perl-3.3.3-1.azl3.x86_64.rpm
177-
openssl-static-3.3.3-1.azl3.x86_64.rpm
173+
openssl-3.3.3-2.azl3.x86_64.rpm
174+
openssl-devel-3.3.3-2.azl3.x86_64.rpm
175+
openssl-libs-3.3.3-2.azl3.x86_64.rpm
176+
openssl-perl-3.3.3-2.azl3.x86_64.rpm
177+
openssl-static-3.3.3-2.azl3.x86_64.rpm
178178
libcap-2.69-3.azl3.x86_64.rpm
179179
libcap-devel-2.69-3.azl3.x86_64.rpm
180180
debugedit-5.0-2.azl3.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -287,12 +287,12 @@ npth-debuginfo-1.6-4.azl3.aarch64.rpm
287287
npth-devel-1.6-4.azl3.aarch64.rpm
288288
ntsysv-1.25-1.azl3.aarch64.rpm
289289
ocaml-srpm-macros-9-4.azl3.noarch.rpm
290-
openssl-3.3.3-1.azl3.aarch64.rpm
291-
openssl-debuginfo-3.3.3-1.azl3.aarch64.rpm
292-
openssl-devel-3.3.3-1.azl3.aarch64.rpm
293-
openssl-libs-3.3.3-1.azl3.aarch64.rpm
294-
openssl-perl-3.3.3-1.azl3.aarch64.rpm
295-
openssl-static-3.3.3-1.azl3.aarch64.rpm
290+
openssl-3.3.3-2.azl3.aarch64.rpm
291+
openssl-debuginfo-3.3.3-2.azl3.aarch64.rpm
292+
openssl-devel-3.3.3-2.azl3.aarch64.rpm
293+
openssl-libs-3.3.3-2.azl3.aarch64.rpm
294+
openssl-perl-3.3.3-2.azl3.aarch64.rpm
295+
openssl-static-3.3.3-2.azl3.aarch64.rpm
296296
p11-kit-0.25.0-1.azl3.aarch64.rpm
297297
p11-kit-debuginfo-0.25.0-1.azl3.aarch64.rpm
298298
p11-kit-devel-0.25.0-1.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -295,12 +295,12 @@ npth-debuginfo-1.6-4.azl3.x86_64.rpm
295295
npth-devel-1.6-4.azl3.x86_64.rpm
296296
ntsysv-1.25-1.azl3.x86_64.rpm
297297
ocaml-srpm-macros-9-4.azl3.noarch.rpm
298-
openssl-3.3.3-1.azl3.x86_64.rpm
299-
openssl-debuginfo-3.3.3-1.azl3.x86_64.rpm
300-
openssl-devel-3.3.3-1.azl3.x86_64.rpm
301-
openssl-libs-3.3.3-1.azl3.x86_64.rpm
302-
openssl-perl-3.3.3-1.azl3.x86_64.rpm
303-
openssl-static-3.3.3-1.azl3.x86_64.rpm
298+
openssl-3.3.3-2.azl3.x86_64.rpm
299+
openssl-debuginfo-3.3.3-2.azl3.x86_64.rpm
300+
openssl-devel-3.3.3-2.azl3.x86_64.rpm
301+
openssl-libs-3.3.3-2.azl3.x86_64.rpm
302+
openssl-perl-3.3.3-2.azl3.x86_64.rpm
303+
openssl-static-3.3.3-2.azl3.x86_64.rpm
304304
p11-kit-0.25.0-1.azl3.x86_64.rpm
305305
p11-kit-debuginfo-0.25.0-1.azl3.x86_64.rpm
306306
p11-kit-devel-0.25.0-1.azl3.x86_64.rpm

0 commit comments

Comments
 (0)