Add support for OpenSSL session reuse

[rlebeau]

Add support for reusing OpenSSL sessions between multiple TCP connections to minimize roundtrips used during handshake messaging. Very useful for HTTP in particular, which may have to disconnect sockets in between multiple requests to the same server.

[Memnarch]

Is this the reason OpenSSL makes a IDTCPServer horribly slow? Using OpenSSL 1.0.2o, when i use the IDOpenSSLHandler, i can't get more than 100-150 clients per Second processed. All clients do is:

connect
writeln
readln
disconnect

The "clients" in this case is a single programm that spawns a number of threads creating their own TCPClients and SSLIOHandler.

As far as i can see, until ssl_accept is called, no extra work has been done(ssl_accept is called when PassThrough is set to false, which happens in the OnConnect event, which is already in its own Worker).

Using Indy 10 from Delphi Berlin

[rlebeau]

Is this the reason OpenSSL makes a IDTCPServer horribly slow?

Possibly, though I think OpenSSL does do some amount of internal caching by default, so this might not be as big an issue as I initially thought.

There is a lot of overhead involved in establishing a new TCP connection and negotiating a new SSL session for it.

For instance, if an HTTP client is going to make a lot of requests to an HTTP server in a short amount of time, it would greatly benefit from utilizing HTTP keep-alives to reuse TCP connections and avoid all of that overhead on every request. Using keep-alives by default is one of the defining features of HTTP 1.1, but a client is free to ignore that feature and still force a disconnect after every response, if it wants to. While HTTP is technically a stateless protocol, and disconnecting between requests is allowed, it is not ideal or desirable.

You would have to do something similar in your protocol if you want to avoid the same overhead.

[Memnarch]

My post is about IdTCPServer with IdTCPCLient, without HTTP. I was trying something out by bombarding the Server.

The Client will

1. Connect
2. WriteLn "Hello World"
3. ReadLN
4. Disconnect

The Server will

1. ReadLN
2. WriteLN "Hello Client"
3. Disconnect the client

Where a Non SSL Server/Client utilizes some %of my CPU and manages up to 4k connections, using SSLIOHandler (TLS 1.2) it utilizes up to 100% of my CPU and manages only round about ~100 per second. With a scheduler i wrote it can handle ~150

It seems that the Handshake is burning down my system. Didn't expect it to be THAT expensive.

BTW Server and ClientProcess run on the same machine (but Server is eating up all of the CPU)

[ZSTelmo]

any update on this issue, can Indy use keepalive and cache de ssl handshake ?

[rlebeau]

No progress has been made for this issue in the older OpenSSL SSLIOHandler. I think there is some support for session reuse in the new OpenSSL SSLIOHandler, but I'm not sure if it requires any manual effort to use or if it is automatic. I haven't reviewed that code yet.

[mezen]

but I'm not sure if it requires any manual effort to use or if it is automatic.

It is automatic