Skip to content

handshake: test SSL_CTX pool #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

npajkovsky
Copy link

@npajkovsky npajkovsky commented Jun 19, 2025

use an SSL_CTX pool of the same size as the libctx pool size, with server and client SSL_CTX objects allocated alongside the associated libctx.

| Threads | NoOpts |   -p |   -s | -s -P |    -P | -s -p |    -l |
|---------+--------+------+------+-------+-------+-------+-------|
|       2 |   3188 | 2053 | 2023 |  2053 |  3241 |  2054 |  3226 |
|       3 |   4624 | 3013 | 2990 |  3025 |  4786 |  3017 |  4760 |
|       4 |   6252 | 4036 | 3877 |  4028 |  6388 |  4005 |  6329 |
|       5 |   7405 | 5013 | 4727 |  4971 |  7967 |  4971 |  7909 |
|       6 |   8975 | 5982 | 5544 |  5985 |  9496 |  6006 |  9456 |
|       7 |  10151 | 6875 | 6391 |  6933 | 11047 |  6862 | 11003 |
|       8 |  10998 | 7655 | 7105 |  7703 | 12218 |  7666 | 11962 |
|       9 |  11166 | 7740 | 7107 |  7713 | 12346 |  7627 | 12327 |
|      10 |  11623 | 7919 | 7110 |  7931 | 12600 |  7897 | 12577 |
|      20 |  11857 | 7474 | 7040 |  7348 | 12446 |  7380 | 12943 |
|      30 |  11492 | 7295 | 6848 |  6990 | 13008 |  7163 | 13332 |
|      40 |  11868 | 7035 | 6680 |  6946 | 13191 |  7054 | 13028 |
|      50 |  11547 | 6785 | 6586 |  6661 | 13468 |  6732 | 13178 |
|      60 |  11659 | 7090 | 6386 |  7040 | 13447 |  6869 | 13452 |
|      70 |  11749 | 6547 | 6309 |  6801 | 13700 |  6839 | 13606 |
|      80 |  12344 | 6742 | 6839 |  6619 | 13737 |  6706 | 13399 |
|      90 |  12149 | 7012 | 6524 |  6761 | 13613 |  6941 | 13741 |
|     100 |  11928 | 6335 | 6426 |  6708 | 13499 |  6437 | 13764 |
|     110 |  11990 | 6840 | 6471 |  6834 | 13588 |  6680 | 13708 |
|     120 |  12185 | 6615 | 6277 |  6430 | 13307 |  6577 | 13531 |
|     130 |  12067 | 6530 | 6310 |  6597 | 13642 |  6709 | 13423 |
|     140 |  12429 | 6494 | 6453 |  6717 | 13702 |  6590 | 13507 |
|     150 |  11786 | 6550 | 6443 |  6643 | 13695 |  6735 | 13808 |
|     160 |  11742 | 6506 | 6212 |  6707 | 13552 |  6613 | 13425 |
|     170 |  11855 | 6580 | 6268 |  6401 | 13604 |  6524 | 13730 |
|     180 |  11629 | 6526 | 6185 |  6419 | 13602 |  6526 | 13813 |
|     190 |  11734 | 6710 | 6073 |  6559 | 13590 |  6407 | 13180 |
|     200 |  11677 | 6526 | 5987 |  6414 | 13610 |  6466 | 13726 |

There does not seem to be much of a difference between using a pool of lib_ctx with allocating ssl_ctx per thread, and having pre-allocated pool of lib_ctx alongside associated libctx.

Resolves: openssl/project#1228

use an SSL_CTX pool of the same size as the libctx pool size, with
server and client SSL_CTX objects allocated alongside the associated
libctx.

| Threads | NoOpts |   -p |   -s | -s -P |    -P | -s -p |    -l |
|---------+--------+------+------+-------+-------+-------+-------|
|       2 |   3188 | 2053 | 2023 |  2053 |  3241 |  2054 |  3226 |
|       3 |   4624 | 3013 | 2990 |  3025 |  4786 |  3017 |  4760 |
|       4 |   6252 | 4036 | 3877 |  4028 |  6388 |  4005 |  6329 |
|       5 |   7405 | 5013 | 4727 |  4971 |  7967 |  4971 |  7909 |
|       6 |   8975 | 5982 | 5544 |  5985 |  9496 |  6006 |  9456 |
|       7 |  10151 | 6875 | 6391 |  6933 | 11047 |  6862 | 11003 |
|       8 |  10998 | 7655 | 7105 |  7703 | 12218 |  7666 | 11962 |
|       9 |  11166 | 7740 | 7107 |  7713 | 12346 |  7627 | 12327 |
|      10 |  11623 | 7919 | 7110 |  7931 | 12600 |  7897 | 12577 |
|      20 |  11857 | 7474 | 7040 |  7348 | 12446 |  7380 | 12943 |
|      30 |  11492 | 7295 | 6848 |  6990 | 13008 |  7163 | 13332 |
|      40 |  11868 | 7035 | 6680 |  6946 | 13191 |  7054 | 13028 |
|      50 |  11547 | 6785 | 6586 |  6661 | 13468 |  6732 | 13178 |
|      60 |  11659 | 7090 | 6386 |  7040 | 13447 |  6869 | 13452 |
|      70 |  11749 | 6547 | 6309 |  6801 | 13700 |  6839 | 13606 |
|      80 |  12344 | 6742 | 6839 |  6619 | 13737 |  6706 | 13399 |
|      90 |  12149 | 7012 | 6524 |  6761 | 13613 |  6941 | 13741 |
|     100 |  11928 | 6335 | 6426 |  6708 | 13499 |  6437 | 13764 |
|     110 |  11990 | 6840 | 6471 |  6834 | 13588 |  6680 | 13708 |
|     120 |  12185 | 6615 | 6277 |  6430 | 13307 |  6577 | 13531 |
|     130 |  12067 | 6530 | 6310 |  6597 | 13642 |  6709 | 13423 |
|     140 |  12429 | 6494 | 6453 |  6717 | 13702 |  6590 | 13507 |
|     150 |  11786 | 6550 | 6443 |  6643 | 13695 |  6735 | 13808 |
|     160 |  11742 | 6506 | 6212 |  6707 | 13552 |  6613 | 13425 |
|     170 |  11855 | 6580 | 6268 |  6401 | 13604 |  6524 | 13730 |
|     180 |  11629 | 6526 | 6185 |  6419 | 13602 |  6526 | 13813 |
|     190 |  11734 | 6710 | 6073 |  6559 | 13590 |  6407 | 13180 |
|     200 |  11677 | 6526 | 5987 |  6414 | 13610 |  6466 | 13726 |

There does not seem to be much of differece between using pool of
lib_ctx with allocating ssl_ctx per thread, and having having
pre-allocated pool of lib_ctx alongside with associated
libctx.

Resolves: openssl/project#1228
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
@npajkovsky npajkovsky requested a review from vdukhovni June 19, 2025 15:38
@vdukhovni
Copy link

Good to know. I think indicates that sharing an SSL_CTX across multiple threads is not a source of contention, with any hot locks on the libctx and not the SSL_CTX side. This is good to know.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

handshake: test SSL_CTX pool
3 participants