Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Reduce locking in x509 store #1493

Closed
nirvdrum opened this issue Feb 7, 2014 · 4 comments
Closed

Reduce locking in x509 store #1493

nirvdrum opened this issue Feb 7, 2014 · 4 comments
Labels
openssl
Milestone
Invalid or Duplicate

Comments

@nirvdrum
Copy link
Contributor

nirvdrum commented Feb 7, 2014

When using Excon to make HTTPS calls I noticed a lot of blocking in initializing the SSL certificates. In particular, each new connection calls OpenSSL::X509::Store.new. The locking seems to predominately occur in org.jruby.ext.openssl.x509store.Store.addCertificate. Since the same, default certificates are being used, perhaps a cheap way out is to cache that store.

A reproduction case is:

require 'excon'

# Call once so the hostname gets cached once, otherwise you might deadlock.
Excon.get('https://google.com/')

threads = []

100.times do
  threads << Thread.new do
    Excon.get('https://google.com/')
  end
end

threads.each(&:join)

If you look at the stack dump for that, you'll see a lot of blocked threads.
@nirvdrum
Copy link
Contributor Author

nirvdrum commented Sep 7, 2014

@kares Since you're looking into speeding up jruby-openssl, maybe you could look into this issue as well?

@kares
Copy link
Member

kares commented Sep 7, 2014

@nirvdrum those parts seem (unfortunately - for me) closely modelled after C code ... have to say they caught my eye - would be definitely great to refactor them - but I do not feel like going into that, since that might end up in a few weeks! also there's a lot of work to be done to make things correct for now ...

@kares
Copy link
Member

kares commented Sep 7, 2014

forgot to link in the C-like code bits that are in ... synchronizing pretty much around a single lock :

        synchronized (CRYPTO_LOCK_X509_STORE) {
            if ( X509Object.retrieveMatch(objects,certObj) != null ) {
                X509Error.addError(X509_R_CERT_ALREADY_IN_HASH_TABLE);
                ret = 0;
            }
            else {
                objects.add(certObj);
            }
        }

@kares
Copy link
Member

kares commented Jan 10, 2016

no longer an issue with jruby-openssl >= 0.9.10 (locking has been avoided in Store#addCertificate)

@kares kares closed this as completed Jan 10, 2016
@kares kares added the openssl label Jan 10, 2016
@kares kares added this to the Invalid or Duplicate milestone Jan 10, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
openssl
Projects
None yet
Milestone
Invalid or Duplicate
Development

No branches or pull requests
2 participants
@nirvdrum @kares