Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve SSL performance by avoiding SSLWantReadError exception and using much faster checks whenever possible #629

Open
wants to merge 9 commits into
base: master
Choose a base branch
from

Conversation

tarasko
Copy link

@tarasko tarasko commented Sep 11, 2024

SSLWantReadError is expensive.

python/cpython#123954

This PR tries to predict that there will be SSLWantReadError by checking incoming.pending and SSLObject.pending() first.
This check works in 99% of cases. For the rest 1% we still rely on SSLWantReadError

@tarasko tarasko changed the title Improve performance of ssl reads Improve SSL performance by avoiding SSLWantReadError exception and using much faster alternative whenever possible Oct 15, 2024
@tarasko tarasko changed the title Improve SSL performance by avoiding SSLWantReadError exception and using much faster alternative whenever possible Improve SSL performance by avoiding SSLWantReadError exception and using much faster checks whenever possible Oct 15, 2024
@andersfylling
Copy link

Can you expend on how you figured out it handles 99% of cases, and what are the last 1%?

@tarasko
Copy link
Author

tarasko commented Nov 25, 2024

99% - 1% is figurative. I don't know the real numbers and obviously it depends on a particular use case.

Checking incoming.pending > 0 or SSLObject.pending() > 0 may not help if we've received only a part of SSL frame. I think it may happen if system TCP stack broke it up or some receiving buffer was too small. In such case incoming.pending > 0 or SSLObject.pending() > 0 will be True but when we call SSLObject.read there will be SSLWantRead exception anyway.

In my use case client and server exchange a lot of small messages and every message (every SSL frame) can fit into a single TCP packet. Incoming data can also fit into all receiving buffers. So it never happens that uvloop reads only a part of SSL frame, it is always a complete frame, and SSLObject.read is able to process all incoming data.

Checking incoming.pending > 0 or SSLObject.pending() is very cheap comparing to raising and catching SSLWantRead. I think it would be always good if we can prevent SSLWantRead.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants