google / google/conscrypt

SSL connections causing high CPU usage during high QPS

Open
#982 0 comments 2 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
1.4k
Forks
326
Avg merge
16h 22m
Merged PRs (30d)
17

Description

We want to support high QPS ssl connections. We depend on Jetty to handle incoming connections. By default, Jetty uses the JSSE provider from the JVM for SSL. Since this is in-efficient, we recently made changes to use Conscypt in Jetty.

We still continue to see high CPU during high QPS ssl connections. When we took a flamechart, we observed that a significant CPU is being spent on `__lll_lock_wait_private` and `__lll_unlock_wake_private`. These locks seemed to be acquired/released from `org/conscrypt/NativeCrypto.ENGINE_SSL_read_direct` or `org/conscrypt/NativeCrypto.d2i_X509_bio` .

Were these locks introduced by [PR by @flooey ](https://github.com/google/conscrypt/pull/490) ? Can this be the cause ?

The flamechart svg file can be found here: (open with chrome)
https://drive.google.com/file/d/1ZxcKQhld2C1mV64pvdNCLEP3copI7J3b/view?usp=sharing

The code for our httpserver can be found here:
https://github.com/prestodb/airlift/blob/master/http-server/src/main/java/com/facebook/airlift/http/server/HttpServer.java

To use conscrypt, I changed
from:
`slContextFactory sslContextFactory = new SslContextFactory(); `
at [here](https://github.com/prestodb/airlift/blob/master/http-server/src/main/java/com/facebook/airlift/http/server/HttpServer.java#L228)

to:
```
static {
Security.addProvider(new OpenSSLProvider());
}
```
```
SslContextFactory.Server sslContextFactory = new SslContextFactory.Server();
sslContextFactory.addExcludeProtocols("TLSv1.3");
sslContextFactory.setProvider("Conscrypt");
```

Can someone help us understand the flamechart and figure out the reason for high CPU ?

Screen Shot 2021-02-23 at 10 42 01 PM

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.