Re: [PATCH] Persistent connections and HTTPS

--===============4957733350761289659==
Content-Type: multipart/signed; micalg="pgp-sha1";
	protocol="application/pgp-signature"; 
	boundary="=-Y16mzKUiAevNiHYOfH3d"


--=-Y16mzKUiAevNiHYOfH3d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

thanks for the patch. If I don't find another solution, I'll apply it.

Currently, I'm revising SSL anyway - OCamlnet 4.0 will have its own
binding for GnuTLS, and this will give us a lot more freedom in the
design. In particular, the management of the TCP connection and the TLS
tunnel can be completely decoupled (i.e. TLS will appear as a separate
layer on top of the multiplex controller).

(If you are curious:
https://godirepo.camlcity.org/wwwsvn/branches/onet4/code/src/nettls-gnutls/=
?root=3Dlib-ocamlnet2)

Gerd



Am Samstag, den 21.09.2013, 22:58 +0300 schrieb T=C3=B6r=C3=B6k Edwin:
> Hi,
>=20
> Attached patch implements a workaround to allow persistent connections to=
 work with HTTPS,
> avoiding bugs in Https_client#continue. See below for the long explanatio=
n.
>=20
> Persistent HTTP connections work if I enable the aggressive connection ca=
che with Http_client.
> However with Https_client I noticed that it always closed and reopened th=
e Ssl connections.=20
> While this doesn't influence the application's correctness (thanks to the=
 retry mechanisms in Http_client!), it heavily influences its performance: =
the latency is very bad due to repeated reopened connections, and repeated =
SSL handshakes ... even on localhost.
>=20
> Enabling Netlog debugging showed that some Ssl exceptions were thrown eac=
h time around read/write/shutdown after the 1st query completed. Further in=
vestigation revealed that the problem might be with Https_client#continue:
>=20
>        method continue fd cb tmo tmo_x host port esys =3D
> -	let mplex =3D
> -	  Uq_ssl.create_ssl_multiplex_controller
> -	    ~close_inactive_descr:true
> -	    ~preclose:(preclose fd)
> -	    ~initial_state:`Client
> -	    ~timeout:(tmo, tmo_x)
> -	    fd ctx esys in
> -	(mplex :> Uq_engines.multiplex_controller)
>=20
> Problems with this code:
>   * creating a new ssl multiplex controller will create a new Ssl.socket =
(and share just the Ssl.context and fd).
>   * the new Ssl.socket doesn't have a defined state (SSL_set_connected_st=
ate was not called, and there was no prior handshake either), causing furth=
er operations on it to raise errors (if I add some debugging code
> to Uq_ssl to print Ssl.get_error_string):
> [Thu Sep 19 14:57:29 2013] [debug] [7534:11] Uq_ssl: SSL write error: err=
or:140D0114:SSL routines:SSL_write:uninitialized
> [Thu Sep 19 14:57:29 2013] [debug] [7534:11] Uq_ssl: SSL read error: erro=
r:140DF114:SSL routines:SSL_read:uninitialized
> [Thu Sep 19 14:57:29 2013] [debug] [7534:11] Uq_ssl: SSL shutdown error: =
error:140E0114:SSL routines:SSL_shutdown:uninitialized
>   * the new Ssl.socket is probably missing the state of the handshake (se=
ssion keys, etc.)
>=20
>    =20
> The attached workaround implements a very simple workaround: if the esys =
is still the same
> just reuse the previous multiplex controller, I'm guessing this is what t=
he Hashtbl was meant for anyway.
>=20
> A better solution would be to have something like create_ssl_multiplex_co=
ntroller_for_existing_session that would take the existing Ssl.socket inste=
ad of creating a new one, and then Https_client#continue wouldn't have to d=
rop the connection if esys or tmo changes.
>=20
> Best regards,
> --Edwin
>=20
> -------------------------------------------------------------------------=
-----
> LIMITED TIME SALE - Full Year of Microsoft Training For Just $49.99!
> 1,500+ hours of tutorials including VisualStudio 2012, Windows 8, SharePo=
int
> 2013, SQL 2012, MVC 4, more. BEST VALUE: New Multi-Library Power Pack inc=
ludes
> Mobile, Cloud, Java, and UX Design. Lowest price ever! Ends 9/22/13.=20
> http://pubads.g.doubleclick.net/gampad/clk?id=3D64545871&iu=3D/4140/ostg.=
clktrk
> _______________________________________________ Ocamlnet-devel mailing li=
st [email protected] https://lists.sourceforge.net/lists=
/listinfo/ocamlnet-devel

--=20
------------------------------------------------------------
Gerd Stolpmann, Darmstadt, Germany    [email protected]
My OCaml site:          http://www.camlcity.org
Contact details:        http://www.camlcity.org/contact.html
Company homepage:       http://www.gerd-stolpmann.de
------------------------------------------------------------

--=-Y16mzKUiAevNiHYOfH3d
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEcBAABAgAGBQJSQB57AAoJEAaM4b9ZLB5T6fEH/A5Lpf7t0Sfv9RPmUke5HY0f
CRTfOw9TPpbGvamrsfbdherYZSVlYH8hiOx4wUiHtSxQhMM4qohkaExplFbMP1+Z
prqdKmrbYctzz3uUV2+kpnT4YkNGsdIM+eshvM4qPo3U2GIl+EmTjGztLhMNfESz
lK39Z3w/lP4wF6RjdgI8eG8s/Vp2oX3D91ALfqRneCHSbSB0zONF50AQ+o5ZJf7l
zHlAWuo6pQLCib7Fw9InWVAUZakBgk2pmKRWJAeHGRCQmVvkUuFUXWSIesLq2aua
omacVxphUZILKOSGVMRxk2y1baYKsCKvffEkUMFUjsycpqPpT0A70toJrbf3EWM=
=Q5ze
-----END PGP SIGNATURE-----

--=-Y16mzKUiAevNiHYOfH3d--



--===============4957733350761289659==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
LIMITED TIME SALE - Full Year of Microsoft Training For Just $49.99!
1,500+ hours of tutorials including VisualStudio 2012, Windows 8, SharePoint
2013, SQL 2012, MVC 4, more. BEST VALUE: New Multi-Library Power Pack includes
Mobile, Cloud, Java, and UX Design. Lowest price ever! Ends 9/20/13. 
http://pubads.g.doubleclick.net/gampad/clk?id=58041151&iu=/4140/ostg.clktrk
--===============4957733350761289659==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Ocamlnet-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel

--===============4957733350761289659==--