msquic
msquic copied to clipboard
microsoft
Avoid fetching OpenSSL digests and ciphers
The old cipher returning calls like EVP_aes_128_gcm() perform late binding which means they fetch on initialisation. Fetching in OpenSSL 3.0 is a relatively expensive operation. Instead of fetching every time a cipher is required, it is faster to pre-fetch and reuse the same EVP_CIPHER object.
Likewise, HMAC is better prefetched but it has the additional complexity of fetching a digest internally. Instead of just prefetching the EVP_MAC object, it is better to create an EVP_MAC_CTX object and call EVP_MAC_CTX_dup() as required.
According to the profiling I've done, this represents a circa 4% boost in HPS.
Thank you for your submission, we really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
:x: paulidale sign now
You have signed the CLA already but the status is still pending? Let us recheck it.
![azure-pipelines[bot] avatar](https://avatars.githubusercontent.com/in/9426?v=4 "Published by a pub.dev verified publisher"){kind=small}
You also need to run ./scripts/update-sidecar.ps1 but only after all event code changes are made.
You also need to run
./scripts/update-sidecar.ps1but only after all event code changes are made.
That exploded nicely :(
dotnet: /home/pauli/work/msquic/msquic/scripts/update-sidecar.ps1:45
Line |
45 | dotnet publish ../submodules/clog/src/clog -o ${ClogDir} -f net6.0
| ~~~~~~
| The term 'dotnet' is not recognized as a name of a cmdlet,
| function, script file, or executable program. Check the
| spelling of the name, or if a path was included, verify that
| the path is correct and try again.
/home/pauli/work/msquic/msquic/build/clog/clog: The term '/home/pauli/work/msquic/msquic/build/clog/clog' is not recognized as a name of a cmdlet, function, script file, or executable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
/home/pauli/work/msquic/msquic/build/clog/clog: The term '/home/pauli/work/msquic/msquic/build/clog/clog' is not recognized as a name of a cmdlet, function, script file, or executable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
/home/pauli/work/msquic/msquic/build/clog/clog: The term '/home/pauli/work/msquic/msquic/build/clog/clog' is not recognized as a name of a cmdlet, function, script file, or executable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
/home/pauli/work/msquic/msquic/build/clog/clog: The term '/home/pauli/work/msquic/msquic/build/clog/clog' is not recognized as a name of a cmdlet, function, script file, or executable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
/home/pauli/work/msquic/msquic/build/clog/clog: The term '/home/pauli/work/msquic/msquic/build/clog/clog' is not recognized as a name of a cmdlet, function, script file, or executable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
Also, please verify you've signed the Microsoft CLA.
The CLA is underway, I'll need an OMC vote before I can confirm that my employer is agreeable. I've added this to the next meeting's agenda.
You need .net 6 installed to run update-sidecar.ps1. https://docs.microsoft.com/en-us/dotnet/core/install/linux
I've run the update script and pushed. Still trying to figure out the ChaCha20-Poly1305 issue.
The TLS changes give me better than 2x improvement to handshakes/second. There is another one coming that will (hopefully) be better.
Also, please verify you've signed the Microsoft CLA.
The CLA is underway, I'll need an OMC vote before I can confirm that my employer is agreeable. I've added this to the next meeting's agenda.
@paulidale when is the next meeting? This PR seems to be pretty close to done so I'm just trying to get an idea of how much longer until it might be merged.
The perf results are in (below), and I don't see a significant difference in HPS. Is this PR primarily for 3.0 perf?
Windows OpenSSL (1.1.1)
Run 1: 6073 HPS
Run 2: 6025 HPS
Run 3: 6183 HPS
Run 4: 6041 HPS
Run 5: 6192 HPS
Median: 6073 HPS (+.11%)
Remote: 6066.6 HPS
Linux OpenSSL (1.1.1)
Run 1: 12672 HPS
Run 2: 12834 HPS
Run 3: 12497 HPS
Run 4: 13086 HPS
Run 5: 12887 HPS
Median: 12834 HPS (+1.23%)
Remote: 12678.4 HPS
I missed the OMC meeting yesterday and the item slipped a week.
Yes, this is for 3.x performance. I doubt it will make a noticeable change to 1.1.1.
The other change is avoid calls to SSL_CTX_new() which is a pretty heavy operation (more so in 3.x than in 1.1.1). A new SSL_CTX object is currently being created for every connection whereas the usual approach is to just create one, configure it and create the SSL objects from that. It's not quite that straightforward with SNI and ALPN where you might need several pre-created SSL_CTX objects swapping in the correct one using SSL_set_SSL_CTX().
I'm not sure how to fit this into the library/performance test framework. It might be better done as a separate PR: it will be a set of quite distinct changes to what is here and likely involve more widespread modifications in the OpenSSL platform code.
I missed the OMC meeting yesterday and the item slipped a week.
Ok. So when is the next one? Is this something you might be able to ask and get approval via email earlier?
Yes, this is for 3.x performance. I doubt it will make a noticeable change to 1.1.1.
Ok. That's fine.
The other change is avoid calls to
SSL_CTX_new()which is a pretty heavy operation (more so in 3.x than in 1.1.1). A newSSL_CTXobject is currently being created for every connection whereas the usual approach is to just create one, configure it and create theSSLobjects from that. It's not quite that straightforward with SNI and ALPN where you might need several pre-createdSSL_CTXobjects swapping in the correct one usingSSL_set_SSL_CTX().I'm not sure how to fit this into the library/performance test framework. It might be better done as a separate PR: it will be a set of quite distinct changes to what is here and likely involve more widespread modifications in the OpenSSL platform code.
Yeah, that seems fairly complicated. Definitely put it into a separate PR. Thanks.
An email discussion is unlikely to be faster. That's why we have regular calls. This Wednesday hopefully.
An email discussion is unlikely to be faster. That's why we have regular calls. This Wednesday hopefully.
Any updates on getting approval @paulidale?
@paulidale any updates? Is there some particular hold up on getting approval to sign?
The committee wants some input from our lawyers and this is but no means the highest priority. It will happen, the question at the moment is when.