[commits] (heikki) [11446] Bug 6472, cache SSL context to speed up SSL connections.

Thu, 17 Aug 2006 20:22:39 -0700

Title: [commits] (heikki) [11446] Bug 6472, cache SSL context to speed up SSL connections.
Revision
11446
Author
heikki
Date
2006-08-17 20:22:36 -0700 (Thu, 17 Aug 2006)

Log Message

Bug 6472, cache SSL context to speed up SSL connections.
On my computer publishing becomes about 3 seconds
faster when testing against cosmo-demo over SSL, and another
3 seconds for subscribe. r=pje.

Modified Paths

Diff

Modified: trunk/chandler/application/Utility.py (11445 => 11446)

--- trunk/chandler/application/Utility.py	2006-08-18 00:31:50 UTC (rev 11445)
+++ trunk/chandler/application/Utility.py	2006-08-18 03:22:36 UTC (rev 11446)
@@ -33,7 +33,7 @@
 # with your name (and some helpful text). The comment's really there just to
 # cause Subversion to warn you of a conflict when you update, in case someone 
 # else changes it at the same time you do (that's why it's on the same line).
-SCHEMA_VERSION = "236" # john: Dynamic Blocks bug fixes and cleanup
+SCHEMA_VERSION = "237" # heikki: added certificate watcher
 
 logger = None # initialized in initLogging()

Modified: trunk/chandler/parcels/osaf/framework/certstore/certificate.py (11445 => 11446)

--- trunk/chandler/parcels/osaf/framework/certstore/certificate.py	2006-08-18 00:31:50 UTC (rev 11445)
+++ trunk/chandler/parcels/osaf/framework/certstore/certificate.py	2006-08-18 03:22:36 UTC (rev 11446)
@@ -143,8 +143,24 @@
                                  'fingerprint', 'asTextAsString' ]:
             return False
         return super(Certificate, self).isAttributeModifiable(attribute)
+    
+    @schema.observer(type, trust, pem)
+    def changed(self, name):
+        """
+        Get a change notification for an attribute change. This happens
+        on item creation as well as normal attribute change (including
+        deletion), but not on item deletion.
+        """
+        # XXX Certificate should not need to know about ssl.contextCache
+        from osaf.framework.certstore import ssl
+        ssl.contextCache = None
+        
+    def onItemDelete(self, view, isDeferring):
+        """
+        Get a change notification for an item deletion.
+        """
+        self.changed(None)
 
-
 def _isRootCertificate(x509):
     # XXX This will need tweaks
     # XXX Should use OpenSSL itself if possible

Modified: trunk/chandler/parcels/osaf/framework/certstore/ssl.py (11445 => 11446)

--- trunk/chandler/parcels/osaf/framework/certstore/ssl.py	2006-08-18 00:31:50 UTC (rev 11445)
+++ trunk/chandler/parcels/osaf/framework/certstore/ssl.py	2006-08-18 03:22:36 UTC (rev 11446)
@@ -59,10 +59,12 @@
            'trusted_until_shutdown_site_certs',
            'trusted_until_shutdown_invalid_site_certs',
            'askTrustSiteCertificate',
-           'askIgnoreSSLError']
+           'askIgnoreSSLError', 'contextCache']
 
 log = logging.getLogger(__name__)
 
+contextCache = None
+
 def loadCertificatesToContext(repView, ctx):
     """
     Add certificates to SSL Context.
@@ -99,6 +101,10 @@
     @param verifyCallback: Function to call for certificate verification.
     @type verifyCallback:  Callback function
     """
+    global contextCache
+    if contextCache is not None:
+        return contextCache
+    
     ctx = SSL.Context(protocol)
 
     # XXX Sometimes we might want to accept any cert, and only use
@@ -137,6 +143,8 @@
         log.error('Could not set cipher list')
         raise SSLContextError(_(u'Could not set cipher list'))
 
+    contextCache = ctx
+
     return ctx

Modified: trunk/chandler/parcels/osaf/framework/certstore/tests/TestSSL.py (11445 => 11446)

--- trunk/chandler/parcels/osaf/framework/certstore/tests/TestSSL.py	2006-08-18 00:31:50 UTC (rev 11445)
+++ trunk/chandler/parcels/osaf/framework/certstore/tests/TestSSL.py	2006-08-18 03:22:36 UTC (rev 11446)
@@ -26,7 +26,7 @@
 import twisted.protocols.policies as policies
 
 import application.Utility as Utility
-from osaf.framework.certstore import ssl
+from osaf.framework.certstore import ssl, utils, certificate, constants
 from osaf.pim.tests import TestDomainModel
 
 class TestSSL(TestDomainModel.DomainModelTestCase):
@@ -132,6 +132,54 @@
                           x509, 'example.com')
         self.assertRaises(Checker.NoCertificate, wrapper.postConnectionVerify, 
                           None, 'example.com')
+        
+    def testContextCache(self):
+        pemRoot = '''-----BEGIN CERTIFICATE-----
+MIIDpzCCAxCgAwIBAgIBADANBgkqhkiG9w0BAQQFADCBmjELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRowGAYDVQQKExFv
+c2Fmb3VuZGF0aW9uLm9yZzELMAkGA1UECxMCQ0ExEDAOBgNVBAMTB09TQUYgQ0Ex
+KzApBgkqhkiG9w0BCQEWHGhvc3RtYXN0ZXJAb3NhZm91bmRhdGlvbi5vcmcwHhcN
+MDQwNjAyMjEzNTIzWhcNMjkwNTI3MjEzNTIzWjCBmjELMAkGA1UEBhMCVVMxCzAJ
+BgNVBAgTAkNBMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2NvMRowGAYDVQQKExFvc2Fm
+b3VuZGF0aW9uLm9yZzELMAkGA1UECxMCQ0ExEDAOBgNVBAMTB09TQUYgQ0ExKzAp
+BgkqhkiG9w0BCQEWHGhvc3RtYXN0ZXJAb3NhZm91bmRhdGlvbi5vcmcwgZ8wDQYJ
+KoZIhvcNAQEBBQADgY0AMIGJAoGBAMvKQY9ElPz4UOhYwKPhbHpSzxxGXxQHiOGu
+QDV9HuTaTD53cs4xhTau5nLrbqR6qkOpaxgq4+xGZGXwwdrl6vABXGamBAIS8U+C
+IoxMZmdi1zNCHpALjrUOr5zG+l5lbxKMzzfbBgz0EvnxdyUW3JzWlFA7gtKwNeq9
+8BbIVNIRAgMBAAGjgfowgfcwHQYDVR0OBBYEFFAUmTv7d1YAmmssTPTcaE3FWgdL
+MIHHBgNVHSMEgb8wgbyAFFAUmTv7d1YAmmssTPTcaE3FWgdLoYGgpIGdMIGaMQsw
+CQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28x
+GjAYBgNVBAoTEW9zYWZvdW5kYXRpb24ub3JnMQswCQYDVQQLEwJDQTEQMA4GA1UE
+AxMHT1NBRiBDQTErMCkGCSqGSIb3DQEJARYcaG9zdG1hc3RlckBvc2Fmb3VuZGF0
+aW9uLm9yZ4IBADAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBAUAA4GBAAdPk2l4
+bQBw41mQvTLGFVUx89oEqmlW8fMh06/PhNyKPvA+Ip/HL4fl71A8aGYINA2KGQeE
+Mi6jbcmKpkTked0C7KzayFkggv/SZtmeibzOjQJbO5WQCRgYuF9t7Rijk7oiAt3U
+3rOIG1GsNPeKaSKyc+Bpqd9phY+fPNsZf8b4
+-----END CERTIFICATE-----'''
+        
+        self.assert_(ssl.contextCache is None, 'cache should start empty')
+        ssl.getContext(self.rep.view) # set cache
+        self.assert_(ssl.contextCache is not None, 'cache should have an entry after getting a context')
+        
+        x509 = X509.load_cert_string(pemRoot)
+        fingerprint = utils.fingerprint(x509)
+        cert = certificate.importCertificate(x509,
+                                             fingerprint,
+                                             constants.TRUST_AUTHENTICITY | constants.TRUST_SITE,
+                                             self.rep.view)
+        self.assert_(ssl.contextCache is None, 'cache should have been cleared after adding a cert')
 
+        ssl.getContext(self.rep.view) # set cache
+        cert.trust = 0
+        self.assert_(ssl.contextCache is None, 'cache should have been cleared after changing cert.trust attribute')
+
+        ssl.getContext(self.rep.view) # set cache
+        del cert.trust
+        self.assert_(ssl.contextCache is None, 'cache should have been cleared after deleting cert.trust attribute')
+
+        ssl.getContext(self.rep.view) # set cache
+        cert.delete()
+        self.assert_(ssl.contextCache is None, 'cache should have been cleared after removing a cert')
+
 if __name__ == "__main__":
     unittest.main()






_______________________________________________
Commits mailing list
[email protected]
http://lists.osafoundation.org/mailman/listinfo/commits

Reply via email to