neqo-crypto: use SSL_PeerCertificateChainDER #2009
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The SSL_PeerCertificateChainDER function was added in NSS 3.103 to allow an application to retrieve the peer's presented certificate chain without constructing CERTCertificates. This is expected to improve performance, as constructing a CERTCertificate will typically involve querying the NSS certificate database.
jschanck
requested review from
KershawChang,
martinthomson and
larseggert
as code owners
Failed Interop TestsQUIC Interop Runner, client vs. server neqo-latest as client
neqo-latest as server
All resultsSucceeded Interop TestsQUIC Interop Runner, client vs. server neqo-latest as client
neqo-latest as server
Unsupported Interop TestsQUIC Interop Runner, client vs. server neqo-latest as client
neqo-latest as server
|
|
@jschanck I'll need to fix CI Monday, then will rebase. |
|
@jschanck I rebased, now the NSS build is breaking due to https://bugzilla.mozilla.org/show_bug.cgi?id=1902078#c13 |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #2009 +/- ##
==========================================
- Coverage 95.00% 95.00% -0.01%
==========================================
Files 112 112
Lines 36394 36400 +6
==========================================
+ Hits 34577 34581 +4
- Misses 1817 1819 +2 ☔ View full report in Codecov by Sentry. |
Benchmark resultsPerformance differences relative to c80630b. coalesce_acked_from_zero 1+1 entries: 💔 Performance has regressed. time: [198.20 ns 198.67 ns 199.19 ns]
change: [+3.3734% +3.7985% +4.2063%] (p = 0.00 < 0.05)
coalesce_acked_from_zero 3+1 entries: 💔 Performance has regressed. time: [243.05 ns 244.22 ns 246.12 ns]
change: [+3.7287% +4.3037% +4.9116%] (p = 0.00 < 0.05)
coalesce_acked_from_zero 10+1 entries: 💔 Performance has regressed. time: [242.83 ns 243.54 ns 244.40 ns]
change: [+3.2778% +4.1230% +4.8243%] (p = 0.00 < 0.05)
coalesce_acked_from_zero 1000+1 entries: 💔 Performance has regressed. time: [224.31 ns 224.47 ns 224.68 ns]
change: [+3.2674% +3.9504% +4.6547%] (p = 0.00 < 0.05)
RxStreamOrderer::inbound_frame(): Change within noise threshold. time: [120.78 ms 120.83 ms 120.89 ms]
change: [+0.1832% +0.3814% +0.5134%] (p = 0.00 < 0.05)
transfer/pacing-false/varying-seeds: No change in performance detected. time: [41.373 ms 43.153 ms 44.971 ms]
change: [-3.7790% +2.1895% +8.8402%] (p = 0.50 > 0.05)
transfer/pacing-true/varying-seeds: No change in performance detected. time: [53.740 ms 56.730 ms 59.728 ms]
change: [-6.8131% +0.3312% +8.0992%] (p = 0.93 > 0.05)
transfer/pacing-false/same-seed: No change in performance detected. time: [47.147 ms 48.743 ms 50.296 ms]
change: [-7.3968% -3.3797% +0.9063%] (p = 0.11 > 0.05)
transfer/pacing-true/same-seed: No change in performance detected. time: [69.367 ms 75.934 ms 82.415 ms]
change: [-9.2663% +2.8539% +15.277%] (p = 0.64 > 0.05)
1-conn/1-100mb-resp (aka. Download)/client: 💚 Performance has improved. time: [168.09 ms 176.20 ms 185.51 ms]
thrpt: [539.05 MiB/s 567.54 MiB/s 594.92 MiB/s]
change:
time: [-39.266% -35.647% -31.297%] (p = 0.00 < 0.05)
thrpt: [+45.553% +55.392% +64.653%]
1-conn/10_000-parallel-1b-resp (aka. RPS)/client: Change within noise threshold. time: [403.16 ms 406.34 ms 409.52 ms]
thrpt: [24.419 Kelem/s 24.610 Kelem/s 24.804 Kelem/s]
change:
time: [-3.2701% -2.1244% -0.9752%] (p = 0.00 < 0.05)
thrpt: [+0.9848% +2.1705% +3.3807%]
1-conn/1-1b-resp (aka. HPS)/client: 💚 Performance has improved. time: [46.055 ms 46.778 ms 47.496 ms]
thrpt: [21.054 elem/s 21.378 elem/s 21.713 elem/s]
change:
time: [-31.603% -30.349% -29.139%] (p = 0.00 < 0.05)
thrpt: [+41.122% +43.572% +46.206%]
Client/server transfer resultsTransfer of 33554432 bytes over loopback.
|
larseggert
approved these changes
Jul 31, 2024
There was a problem hiding this comment.
@jschanck any chance we could add some test to improve coverage? See https://app.codecov.io/gh/mozilla/neqo/pull/2009/blob/neqo-crypto/src/cert.rs
martinthomson
approved these changes
Aug 1, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The SSL_PeerCertificateChainDER function was added in NSS 3.103 to allow an application to retrieve the peer's presented certificate chain without constructing CERTCertificates. This is expected to improve performance, as constructing a CERTCertificate will typically involve querying the NSS certificate database.
We switched PSM over to SSL_PeerCertificateChainDER in Bug 1899431.
Assuming you land this, you'll need to apply the following patch to neqo-glue when you uplift to M-C: