]> git.ipfire.org Git - thirdparty/openssl.git/commit
x509store: reduce lock contention in X509_STORE
authorNikola Pajkovsky <nikolap@openssl.org>
Thu, 18 Sep 2025 09:13:45 +0000 (11:13 +0200)
committerNeil Horman <nhorman@openssl.org>
Thu, 16 Oct 2025 13:11:20 +0000 (09:11 -0400)
commit04589b59ef50b1f8a4cec5d15ce172c32e0aa01c
treee6a9fbb8d7c7884d3de130993e2b633af5cc0a2a
parent0955904db17f1589dc920cd7c6103f2246e2d163
x509store: reduce lock contention in X509_STORE

X509_STORE was using STACK_OF(X509_OBJECT) which is not ideal structure. The
better solution is to use hashmap. The performance gains come from the fact that
sorting was removed and therefore read lock is just enough for looking up
objects/cert/crls from hashmap.

When X509_STORE_get0_objects() is called, the hashmap converts back to
the STACK_OF(X509_OBJECT), and goes back to the original
implementation with the performance hit on lookup side because stack is not
sorted anymore.

Note, hashmap maps X509_NAME to STACK_OF(X509_OBJECT), and the stack is never
sorted which may lead to performance impact if stack contains a huge of objects.

Before the change

| Threads |   mean/us |  var/us |
|---------+-----------+---------|
|       1 |  2.434803 | .034190 |
|       2 |  3.033588 | .247471 |
|       4 |  6.551132 | .150209 |
|       6 | 12.548113 | .258445 |
|       8 | 17.566257 | .168508 |
|      10 | 22.782846 | .182674 |
|      12 | 27.928990 | .426779 |
|      14 | 32.844572 | .307754 |
|      16 | 37.816247 | .660630 |
|      18 | 42.662465 | .434926 |

After the change

| Threads |  mean/us |  var/us |
|---------+----------+---------|
|       1 | 2.385398 | .015329 |
|       2 | 2.775794 | .172223 |
|       4 | 3.071882 | .126400 |
|       6 | 3.174147 | .139685 |
|       8 | 3.479235 | .297154 |
|      10 | 4.206260 | .149006 |
|      12 | 5.044039 | .194108 |
|      14 | 5.890640 | .185817 |
|      16 | 6.447808 | .256179 |
|      18 | 7.489261 | .149204 |

Resolves: https://github.com/openssl/project/issues/1275
Signed-off-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28599)
crypto/x509/by_dir.c
crypto/x509/by_store.c
crypto/x509/x509_local.h
crypto/x509/x509_lu.c
test/cmp_protect_test.c
test/helpers/cmp_testlib.c
test/helpers/cmp_testlib.h
test/x509_load_cert_file_test.c