GNU bug report logs - #22966
HTTPS with GnuTLS's 'session-record-port' is inefficient

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: ludo <at> gnu.org (Ludovic Courtès)
Subject: bug#22966: closed (Re: bug#22966: HTTPS with GnuTLS's
 'session-record-port' is inefficient)
Date: Tue, 15 Mar 2016 17:56:01 +0000

[Message part 1 (text/plain, inline)]

Your bug report

#22966: HTTPS with GnuTLS's 'session-record-port' is inefficient

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to 22966 <at> debbugs.gnu.org.

-- 
22966: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=22966
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: ludo <at> gnu.org (Ludovic Courtès)
To: 22966-done <at> debbugs.gnu.org
Subject: Re: bug#22966: HTTPS with GnuTLS's 'session-record-port' is
 inefficient
Date: Tue, 15 Mar 2016 18:55:44 +0100

ludo <at> gnu.org (Ludovic Courtès) skribis:

> The problem is that every write to the port, that is, every call to
> ‘write_to_session_record_port’ in the GnuTLS bindings, leads to the
> creation of one “Application Data” packet.

Guix commit ec278439f3ff5dcd3d02c05099ba1724cc2459f1 works around it in
‘guix substitute’.

GnuTLS commit 0b1c136947878ccb600b4fa785ef257909104144 explains this in
the guile-gnutls manual.

I consider this bug closed.

Ludo’.

[Message part 3 (message/rfc822, inline)]

From: ludo <at> gnu.org (Ludovic Courtès)
To: bug-guix <at> gnu.org
Subject: HTTPS with GnuTLS's 'session-record-port' is inefficient
Date: Wed, 09 Mar 2016 23:02:24 +0100

(guix build download) uses ‘session-record-port’ from (gnutls), which
returns a port to conveniently write to/read from the TLS session’s
“record” layer.

The problem is that every write to the port, that is, every call to
‘write_to_session_record_port’ in the GnuTLS bindings, leads to the
creation of one “Application Data” packet.

For instance, when (web requests) writes an HTTP GET request, it roughly
does:

  (display "GET" port)
  (display " " port)
  (display uri port)
  (display "\n\r" port)
  …

it ends up creating a lot of small Application Data packets.  When
debugging is enabled in (guix build download), that translates to things
like:

  gnutls: [14594|5] REC[0x152c9c0]: Preparing Packet Application Data(23) with length: 1 and min pad: 0
  gnutls: [14594|9] ENC[0x152c9c0]: cipher: AES-128-GCM, MAC: AEAD, Epoch: 1
  gnutls: [14594|5] REC[0x152c9c0]: Sent Packet[4] Application Data(23) in epoch 1 and length: 30

Terribly suboptimal.

The difficulty is that the session record port doesn’t do any caching by
itself, and it shouldn’t, because it’s the application’s responsibility.
So we might have to do our own caching and/or use ‘record-send’ and
‘record-receive!’ instead of ‘session-record-port’.

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.