Re: NSS certutil doesn't properly batch sqlite transactions when adding a cert

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============1285355141045384482==
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature";
 boundary="Et7KL6dgZBGEuofQVpRBdF4hjesCLxkeA"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--Et7KL6dgZBGEuofQVpRBdF4hjesCLxkeA
From: Jeremy Rand <[email protected]>
To: [email protected]
Message-ID: <[email protected]>
Subject: Re: NSS certutil doesn't properly batch sqlite transactions when
 adding a cert
References: <[email protected]>
 <CADthy-+7KU9Rx2Z7yaG4=uLtwCr7-d1=63faXRFG+t82Voj1Pg@mail.gmail.com>
In-Reply-To: <CADthy-+7KU9Rx2Z7yaG4=uLtwCr7-d1=63faXRFG+t82Voj1Pg@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Thanks, I've just filed
https://bugzilla.mozilla.org/show_bug.cgi?id=3D1435954 .

Cheers,
-Jeremy

Franziskus Kiefer:
> Hi Jeremy,
>=20
> Am I correct about NSS currently using 2 transactions to add a cert?
>=20
>=20
> It probably does.
>=20
> Is there some undocumented trick to fix this, or should I file a Bugzil=
la
>> bug?
>=20
>=20
> I don't think that's something that can be changed without code changes=
=2E
> You should probably file a bug. (I can't guarantee that it'll get fixed=

> quickly though.)
>=20
> Cheers,
> Franziskus
>=20
>=20
> On Sat, Jan 27, 2018 at 8:50 PM, Jeremy Rand <[email protected]> wr=
ote:
>=20
>> I've been doing some experiments with certutil in sqlite mode, and it
>> appears that when I add a cert, 2 rows are inserted to the sqlite
>> database.  So far so good.  However, based on looking at the source co=
de
>> (and some cursory ltrace inspection) it definitely looks like each of
>> those rows is inserted in its own sqlite transaction, rather than
>> batching the two inserts into a single transaction.
>>
>> I strongly suspect that this is the reason why adding a cert in sqlite=

>> mode is so slow.  (I'm seeing latency of around 800ms on a regular
>> basis, although I'm on Qubes, so any I/O latency caused by NSS will be=

>> exacerbated on my system.)
>>
>> Am I correct about NSS currently using 2 transactions to add a cert?  =
Is
>> there some undocumented trick to fix this, or should I file a Bugzilla=

>> bug?  (I'm seriously on the verge of trying to implement an LD_PRELOAD=

>> proxy between NSS and sqlite in order to filter out the extra
>> transaction commands, but I definitely hope that level of witchcraft
>> won't be necessary....)
>>
>> Cheers,
>> --
>> -Jeremy Rand
>> Lead Application Engineer at Namecoin
>> Mobile email: [email protected]
>> Mobile OpenPGP: 2158 0643 C13B B40F B0FD 5854 B007 A32D AB44 3D9C
>> Send non-security-critical things to my Mobile with OpenPGP.
>> Please don't send me unencrypted messages.
>> My business email [email protected] is having technical issues at the=

>> moment.
>>
>>
>> _______________________________________________
>> dev-security mailing list
>> [email protected]
>> https://lists.mozilla.org/listinfo/dev-security
>>
>>
> _______________________________________________
> dev-security mailing list
> [email protected]
> https://lists.mozilla.org/listinfo/dev-security
>=20


--=20
-Jeremy Rand
Lead Application Engineer at Namecoin
Mobile email: [email protected]
Mobile OpenPGP: 2158 0643 C13B B40F B0FD 5854 B007 A32D AB44 3D9C
Send non-security-critical things to my Mobile with OpenPGP.
Please don't send me unencrypted messages.
My business email [email protected] is having technical issues at the
moment.


--Et7KL6dgZBGEuofQVpRBdF4hjesCLxkeA
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEVB3fdzAraEcoBtkSs/LRZXhtZXAFAlp5Xc0ACgkQs/LRZXht
ZXDwMg/+M19CSqyNUrMNO94+b8gbl38pXWmkdcpNHCMACYkCw+JL6tuMCh94f2T8
sYSq1fvGbn/j7ya+vqvTqyf0bB48A/7lm2llE4SxlXp9LvEUwJWVfMtoFT7AXyeF
7ojfm5L4qyZXHm/9I3z0nzHj8XQsmeJCiIjvzgadkLXgQ/9z38uH4XM4TRjyFZ72
2ylchDhE01H2hYFpJsOTmT/w+3C2GI5LTJC9RqHkgxrPB+3y4l9WWrZB2i3hhu6D
cYh/knkT1EvMPILgIU3e/By+GJBuEC9/i51OssfKXn2F7TLhnn/EeKir5d+G8bdS
C7dpHqzrqtjDTVsztpvZPAUKRy57/SbDBB6UtLsdCrBOHHifv1K547yfZYhGuQUq
qeXz3IE8ozP37wpaMyRJueufSl02T1/6DGrhY0GSW4NGxItbEDXcMgrSQ/wGE2xY
6dZFWIWTJGqTxNJyjnRZK/M+W86lalO8DHqZFuTwewh4VshfLbcqfCTrgfANfkq1
ZW8051jcDBDi/aK1nyRg7NTG7F/TlvYNbB0jI2abwpseirYWFq3jHgiJjqxm3aZH
ky99U3TMrFT/tEaJILycl8ZWLuas2JBpR/aS+KEDMELUInFDQPl0LWWmqcD1NBLw
dtu06zkDJDlPavQmmUbD4FGg/AjkUZbG+JsFLIeJEqMTkhWRzII=
=aO36
-----END PGP SIGNATURE-----

--Et7KL6dgZBGEuofQVpRBdF4hjesCLxkeA--

--===============1285355141045384482==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security

--===============1285355141045384482==--