mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-09-22 14:21:25 +02:00
Code Issues Projects Releases Wiki Activity

MINOR: ssl: handshake optim for long certificate chains.

Browse Source 
Suggested on the mailing list by Ilya Grigorik and greatly inspired
from Nginx code: we try to dynamicaly rise the output buffer size from
4k to 16k during the handshake to reduce the number of round trips.
This is mostly beneficial when initcwnd==10.

Ilya's tests confirm the gain and show a handshake time divided by 3 :

before:
   http://www.webpagetest.org/result/140116_VW_3bd95a5cfb7e667498ef13b59639b9bf/2/details/
after:
   http://www.webpagetest.org/result/140201_2X_03511ec63344f442b81c24d2bf39f59d/3/details/
This commit is contained in:
Emeric Brun 2014-01-28 15:43:53 +01:00 committed by Willy Tarreau
parent 95ccdde1f2
commit d8b2bb5c05
1 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/ssl_sock.c
View File

@ -75,6 +75,7 @@
#include <proto/task.h> #include <proto/task.h>
#define SSL_SOCK_ST_FL_VERIFY_DONE 0x00000001 #define SSL_SOCK_ST_FL_VERIFY_DONE 0x00000001
#define SSL_SOCK_ST_FL_16K_WBFSIZE 0x00000002
/* bits 0xFFFF0000 are reserved to store verify errors */ /* bits 0xFFFF0000 are reserved to store verify errors */
/* Verify errors macros */ /* Verify errors macros */
@ -101,6 +102,7 @@ void ssl_sock_infocbk(const SSL *ssl, int where, int ret)
{ {
struct connection *conn = (struct connection *)SSL_get_app_data(ssl); struct connection *conn = (struct connection *)SSL_get_app_data(ssl);
(void)ret; /* shut gcc stupid warning */ (void)ret; /* shut gcc stupid warning */
BIO *write_bio;
if (where & SSL_CB_HANDSHAKE_START) { if (where & SSL_CB_HANDSHAKE_START) {
/* Disable renegotiation (CVE-2009-3555) */ /* Disable renegotiation (CVE-2009-3555) */
@ -109,6 +111,21 @@ void ssl_sock_infocbk(const SSL *ssl, int where, int ret)
conn->err_code = CO_ER_SSL_RENEG; conn->err_code = CO_ER_SSL_RENEG;
} }
} }
if ((where & SSL_CB_ACCEPT_LOOP) == SSL_CB_ACCEPT_LOOP) {
if (!(conn->xprt_st & SSL_SOCK_ST_FL_16K_WBFSIZE)) {
/* Long certificate chains optimz
If write and read bios are differents, we
consider that the buffering was activated,
so we rise the output buffer size from 4k
to 16k */
write_bio = SSL_get_wbio(ssl);
if (write_bio != SSL_get_rbio(ssl)) {
BIO_set_write_buffer_size(write_bio, 16384);
conn->xprt_st |= SSL_SOCK_ST_FL_16K_WBFSIZE;
}
}
}
} }
/* Callback is called for each certificate of the chain during a verify /* Callback is called for each certificate of the chain during a verify