Re: NSS certutil doesn't properly batch sqlite transactions when adding a cert

Hi Jeremy,

Am I correct about NSS currently using 2 transactions to add a cert?


It probably does.

Is there some undocumented trick to fix this, or should I file a Bugzilla
> bug?


I don't think that's something that can be changed without code changes.
You should probably file a bug. (I can't guarantee that it'll get fixed
quickly though.)

Cheers,
Franziskus


On Sat, Jan 27, 2018 at 8:50 PM, Jeremy Rand <[email protected]> wrote:

> I've been doing some experiments with certutil in sqlite mode, and it
> appears that when I add a cert, 2 rows are inserted to the sqlite
> database.  So far so good.  However, based on looking at the source code
> (and some cursory ltrace inspection) it definitely looks like each of
> those rows is inserted in its own sqlite transaction, rather than
> batching the two inserts into a single transaction.
>
> I strongly suspect that this is the reason why adding a cert in sqlite
> mode is so slow.  (I'm seeing latency of around 800ms on a regular
> basis, although I'm on Qubes, so any I/O latency caused by NSS will be
> exacerbated on my system.)
>
> Am I correct about NSS currently using 2 transactions to add a cert?  Is
> there some undocumented trick to fix this, or should I file a Bugzilla
> bug?  (I'm seriously on the verge of trying to implement an LD_PRELOAD
> proxy between NSS and sqlite in order to filter out the extra
> transaction commands, but I definitely hope that level of witchcraft
> won't be necessary....)
>
> Cheers,
> --
> -Jeremy Rand
> Lead Application Engineer at Namecoin
> Mobile email: [email protected]
> Mobile OpenPGP: 2158 0643 C13B B40F B0FD 5854 B007 A32D AB44 3D9C
> Send non-security-critical things to my Mobile with OpenPGP.
> Please don't send me unencrypted messages.
> My business email [email protected] is having technical issues at the
> moment.
>
>
> _______________________________________________
> dev-security mailing list
> [email protected]
> https://lists.mozilla.org/listinfo/dev-security
>
>