netty / netty/netty-tcnative

Netty: SslProvider.OPENSSL_REFCNT example

Open
#835 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
268
Forks
196
Avg merge
14h 34m
Merged PRs (30d)
10

Description

I am using netty-tcnative with SslProvider.OPENSSL provider. I see a warning msg in GC log analyzer about finalizers which I am suspecting is mostly because of it.

[Warning] At one point 25872 objects were queued for finalization. 
Using finalizers is not recommended as it can slow garbage collection and cause wasted space in the heap. 
Consider reviewing your application for occurrences of the finalize() method.

I see Netty provides another option SslProvider.OPENSSL_REFCNT which does not have finalizers and instead implements ReferenceCounted.

  • I am wondering if it is a drop-in replacement of SslProvider.OPENSSL or if it needs more changes.
  • Is it production ready? I see it is marked as @UnstableApi. Any known side effects or issues?
  • Does it perform better than SslProvider.OPENSSL for low latency high throughput system?
SslProvider provider = SslProvider.isAlpnSupported(SslProvider.OPENSSL) ? SslProvider.OPENSSL : SslProvider.JDK;
logger.info("SSL provider: {}", provider);
sslCtx = SslContextBuilder.forServer(keyManagerFactory)
    .sslProvider(provider)
    .ciphers(cypherList)
    .applicationProtocolConfig(new ApplicationProtocolConfig(
        Protocol.ALPN,
        SelectorFailureBehavior.NO_ADVERTISE,
        SelectedListenerFailureBehavior.ACCEPT,
        ApplicationProtocolNames.HTTP_1_1
    ))
    .sessionCacheSize(SSL_SESSION_CACHE_SIZE) // 1800 -> 30 mins
    .sessionTimeout(SSL_SESSION_CACHE_TIMEOUT_SECOND) // 1024 * 100 -> 1000_00 sessions
    .build();


// DefaultServerInitializer
public void initChannel(SocketChannel ch) {
...
if (sslContext != null) {
  pipeline.addLast(sslContext.newHandler(ch.alloc()));
}
...
}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the SslProvider.OPENSSL_REFCNT API and the SslContextBuilder usage shown in the issue, then compare it with SslProvider.OPENSSL and the DefaultServerInitializer example. Document whether the replacement requires other changes, its production-readiness and known side effects, and any performance differences; support the conclusions with relevant tests or existing provider documentation.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, java
Domain
security
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.