Re: [PATCH] Persistent connections and HTTPS

--===============6143558585939935383==
Content-Type: multipart/signed; micalg="pgp-sha1";
	protocol="application/pgp-signature"; 
	boundary="=-Sn4YePcch7crlSJU16rM"


--=-Sn4YePcch7crlSJU16rM
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

I finally fixed this problem the clean way, namely by storing the SSL
socket in the connection cache. This solution is now committed to trunk.

Gerd


Am Samstag, den 21.09.2013, 22:58 +0300 schrieb T=C3=B6r=C3=B6k Edwin:
> Hi,
>=20
> Attached patch implements a workaround to allow persistent connections to=
 work with HTTPS,
> avoiding bugs in Https_client#continue. See below for the long explanatio=
n.
>=20
> Persistent HTTP connections work if I enable the aggressive connection ca=
che with Http_client.
> However with Https_client I noticed that it always closed and reopened th=
e Ssl connections.=20
> While this doesn't influence the application's correctness (thanks to the=
 retry mechanisms in Http_client!), it heavily influences its performance: =
the latency is very bad due to repeated reopened connections, and repeated =
SSL handshakes ... even on localhost.
>=20
> Enabling Netlog debugging showed that some Ssl exceptions were thrown eac=
h time around read/write/shutdown after the 1st query completed. Further in=
vestigation revealed that the problem might be with Https_client#continue:
>=20
>        method continue fd cb tmo tmo_x host port esys =3D
> -	let mplex =3D
> -	  Uq_ssl.create_ssl_multiplex_controller
> -	    ~close_inactive_descr:true
> -	    ~preclose:(preclose fd)
> -	    ~initial_state:`Client
> -	    ~timeout:(tmo, tmo_x)
> -	    fd ctx esys in
> -	(mplex :> Uq_engines.multiplex_controller)
>=20
> Problems with this code:
>   * creating a new ssl multiplex controller will create a new Ssl.socket =
(and share just the Ssl.context and fd).
>   * the new Ssl.socket doesn't have a defined state (SSL_set_connected_st=
ate was not called, and there was no prior handshake either), causing furth=
er operations on it to raise errors (if I add some debugging code
> to Uq_ssl to print Ssl.get_error_string):
> [Thu Sep 19 14:57:29 2013] [debug] [7534:11] Uq_ssl: SSL write error: err=
or:140D0114:SSL routines:SSL_write:uninitialized
> [Thu Sep 19 14:57:29 2013] [debug] [7534:11] Uq_ssl: SSL read error: erro=
r:140DF114:SSL routines:SSL_read:uninitialized
> [Thu Sep 19 14:57:29 2013] [debug] [7534:11] Uq_ssl: SSL shutdown error: =
error:140E0114:SSL routines:SSL_shutdown:uninitialized
>   * the new Ssl.socket is probably missing the state of the handshake (se=
ssion keys, etc.)
>=20
>    =20
> The attached workaround implements a very simple workaround: if the esys =
is still the same
> just reuse the previous multiplex controller, I'm guessing this is what t=
he Hashtbl was meant for anyway.
>=20
> A better solution would be to have something like create_ssl_multiplex_co=
ntroller_for_existing_session that would take the existing Ssl.socket inste=
ad of creating a new one, and then Https_client#continue wouldn't have to d=
rop the connection if esys or tmo changes.
>=20
> Best regards,
> --Edwin
>=20
> -------------------------------------------------------------------------=
-----
> LIMITED TIME SALE - Full Year of Microsoft Training For Just $49.99!
> 1,500+ hours of tutorials including VisualStudio 2012, Windows 8, SharePo=
int
> 2013, SQL 2012, MVC 4, more. BEST VALUE: New Multi-Library Power Pack inc=
ludes
> Mobile, Cloud, Java, and UX Design. Lowest price ever! Ends 9/22/13.=20
> http://pubads.g.doubleclick.net/gampad/clk?id=3D64545871&iu=3D/4140/ostg.=
clktrk
> _______________________________________________ Ocamlnet-devel mailing li=
st [email protected] https://lists.sourceforge.net/lists=
/listinfo/ocamlnet-devel

--=20
------------------------------------------------------------
Gerd Stolpmann, Darmstadt, Germany    [email protected]
My OCaml site:          http://www.camlcity.org
Contact details:        http://www.camlcity.org/contact.html
Company homepage:       http://www.gerd-stolpmann.de
------------------------------------------------------------

--=-Sn4YePcch7crlSJU16rM
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEcBAABAgAGBQJSSturAAoJEAaM4b9ZLB5TIUcH/1xj+T5KxESrBOuhzOVG1oMa
ndXNLuHFUB+2aFO7YWVYp2OIAENKv4GtHz/DduNQ1I6NA63/5/1OiC9UzVgGnPDP
cFjhnI6D9JiOPe+17I+eMgrMEgJtXD48JZxp4HZe1yhSG22gM5S84O6Ar8e54zJo
H7q7Bn8c0VoEZLK4Z53k+t3nqOFUD3e0TZkOAsYiYXASP/xTd0HyBaJAnuZo3EHu
+OVgBNmnh1/JeliPOTGj9w9EPEid1CjGAgc+N3sANrFn3pWn7R8HwoHzoGEODCvG
ETbUhLiRZPDbyfaQkMXb3qlXdhH4nmrtoKLR8uSvt/UP5/n1RjPq/N/757o2ajE=
=zehs
-----END PGP SIGNATURE-----

--=-Sn4YePcch7crlSJU16rM--



--===============6143558585939935383==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
--===============6143558585939935383==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Ocamlnet-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel

--===============6143558585939935383==--