TLS performance extensions

[krizhanovsky]

Task #81 was implemented by porting mbedTLS as is, i.e. with all buffering and copies. See comments in #603, #596 and #595 . The module must use in-place encryption and decryption.

Modern Linux kernels implement almost all crypto algorithms (maybe just except ECDSA) required for TLS. So it has sense to port mbed TLS handshake only to the kernel and use standard Linux crypto for encryption. Moreover, Linux 4.13 implements TLS, so moving to recent kernel is required. Only TLS handshake and infrastructure code must be taken from mbed TLS, while Linux code must be used for symmetric crypto. Full TLS (#769) must be kept in mind during the library adjustments.

Also current TLS code is based on mbedTLS 2.2 and must be updated to latest GPL version (currently 2.6), which has many security fixes.

It seems special hooks at handshake code are required to implement SSL/TLS Renegotiation DoS protection (#832).

Good reference article about TLS DDoS mitigation SSL computational DoS mitigation.

[krizhanovsky]

TLS is widespread nowadays, so the performance issue is crucial and must be in scope of 0.5.

[krizhanovsky]

Preliminary performance results for TLS default benchmark in 2-CPU VM for proxy mode. Note: wrk uses keep-alive connections, so stream encryption is mostly tested in this scenario.

./wrk -c 4096 -t 8 -d 30 https://192.168.100.4:443/
Running 30s test @ https://192.168.100.4:443/
  8 threads and 4096 connections
  Thread Stats   Avg      Stdev     Max   +/- Stdev
    Latency   545.38ms  457.87ms   2.00s    80.11%
    Req/Sec    78.52    109.64     0.98k    89.19%
  5484 requests in 30.15s, 6.81MB read
  Socket errors: connect 11333, read 0, write 0, timeout 935
Requests/sec:    181.87
Transfer/sec:    231.42KB

    16.59%  ksoftirqd/1      [tempesta_tls]                   [k] mpi_mul_hlp
     6.08%  ksoftirqd/0      [tempesta_tls]                   [k] mpi_mul_hlp
     3.77%  swapper          [tempesta_tls]                   [k] mpi_mul_hlp
     3.72%  ksoftirqd/1      [kernel.vmlinux]                 [k] queued_spin_lock_slowpath
     3.50%  ksoftirqd/1      [kernel.vmlinux]                 [k] memset_erms
     3.09%  ksoftirqd/1      [tempesta_tls]                   [k] mbedtls_mpi_shift_r
     2.46%  ksoftirqd/1      [tempesta_tls]                   [k] mpi_sub_hlp
     2.37%  ksoftirqd/1      [tempesta_tls]                   [k] mbedtls_mpi_bitlen
     1.96%  ksoftirqd/0      [kernel.vmlinux]                 [k] queued_spin_lock_slowpath
     1.88%  ksoftirqd/1      [tempesta_tls]                   [k] mbedtls_mpi_cmp_abs
     1.63%  ksoftirqd/1      [kernel.vmlinux]                 [k] __kmalloc
     1.54%  ksoftirqd/1      [tempesta_tls]                   [k] mbedtls_mpi_cmp_mpi
     1.45%  swapper          [kernel.vmlinux]                 [k] queued_spin_lock_slowpath
     1.45%  ksoftirqd/0      [kernel.vmlinux]                 [k] memset_erms
     1.43%  ksoftirqd/1      [kernel.vmlinux]                 [k] memcpy_erms
     1.38%  ksoftirqd/1      [tempesta_tls]                   [k] mbedtls_mpi_add_abs
     1.34%  ksoftirqd/1      [tempesta_tls]                   [k] mbedtls_mpi_mul_mpi
     1.33%  ksoftirqd/0      [tempesta_tls]                   [k] mbedtls_mpi_shift_r
     1.29%  ksoftirqd/1      [kernel.vmlinux]                 [k] kfree
     1.29%  ksoftirqd/1      [tempesta_tls]                   [k] ecp_mod_p521
     1.27%  ksoftirqd/1      [tempesta_tls]                   [k] mbedtls_mpi_copy
     1.10%  ksoftirqd/1      [tempesta_tls]                   [k] mpi_montmul
     1.01%  ksoftirqd/1      [tempesta_tls]                   [k] mbedtls_mpi_sub_abs
     1.00%  nginx            [kernel.vmlinux]                 [k] queued_spin_lock_slowpath
     0.99%  ksoftirqd/0      [tempesta_tls]                   [k] mpi_sub_hlp
     0.96%  ksoftirqd/1      [tempesta_tls]                   [k] mbedtls_mpi_shift_l
     0.96%  ksoftirqd/0      [tempesta_tls]                   [k] mbedtls_mpi_bitlen
     0.95%  ksoftirqd/1      [tempesta_tls]                   [k] mbedtls_mpi_grow
     0.81%  ksoftirqd/0      [tempesta_tls]                   [k] mbedtls_mpi_cmp_abs
     0.80%  ksoftirqd/1      [kernel.vmlinux]                 [k] _raw_spin_lock_irqsave
     0.75%  ksoftirqd/0      [kernel.vmlinux]                 [k] __kmalloc
     0.72%  ksoftirqd/1      [tempesta_tls]                   [k] mbedtls_mpi_free
     0.69%  ksoftirqd/1      [kernel.vmlinux]                 [k] debug_check_no_obj_freed
     0.67%  swapper          [kernel.vmlinux]                 [k] memset_erms
     0.66%  ksoftirqd/0      [tempesta_tls]                   [k] mbedtls_mpi_cmp_mpi
     0.66%  ksoftirqd/1      [tempesta_tls]                   [k] mbedtls_mpi_safe_cond_assign
     0.61%  swapper          [tempesta_tls]                   [k] mbedtls_mpi_shift_r
     0.60%  ksoftirqd/1      [kernel.vmlinux]                 [k] _raw_spin_unlock_irqrestore
     0.59%  ksoftirqd/0      [tempesta_tls]                   [k] ecp_mod_p521
     0.59%  ksoftirqd/0      [kernel.vmlinux]                 [k] memcpy_erms
     0.57%  ksoftirqd/0      [tempesta_tls]                   [k] mbedtls_mpi_copy
     0.56%  ksoftirqd/0      [tempesta_tls]                   [k] mbedtls_mpi_mul_mpi
     0.56%  ksoftirqd/0      [tempesta_tls]                   [k] mbedtls_mpi_add_abs
     0.53%  ksoftirqd/0      [kernel.vmlinux]                 [k] kfree

Cached mode has even lower performance:

./wrk -c 4096 -t 8 -d 30 https://192.168.100.4:443/
Running 30s test @ https://192.168.100.4:443/
  8 threads and 4096 connections
  Thread Stats   Avg      Stdev     Max   +/- Stdev
    Latency   192.22ms  277.56ms   1.96s    93.04%
    Req/Sec    96.49    131.75   700.00     86.71%
  1727 requests in 30.10s, 2.19MB read
  Socket errors: connect 1610, read 0, write 0, timeout 304
Requests/sec:     57.38
Transfer/sec:     74.40KB

    10.81%  ksoftirqd/1      [tempesta_tls]            [k] mpi_mul_hlp
     8.84%  ksoftirqd/0      [tempesta_tls]            [k] mpi_mul_hlp
     4.88%  ksoftirqd/0      [kernel.vmlinux]          [k] queued_spin_lock_slowpath
     4.50%  ksoftirqd/1      [kernel.vmlinux]          [k] queued_spin_lock_slowpath
     4.41%  swapper          [tempesta_tls]            [k] mpi_mul_hlp
     2.37%  ksoftirqd/1      [tempesta_tls]            [k] mbedtls_mpi_shift_r
     2.28%  ksoftirqd/1      [kernel.vmlinux]          [k] memset_erms
     2.02%  swapper          [kernel.vmlinux]          [k] memset_erms
     1.83%  swapper          [tempesta_tls]            [k] mbedtls_mpi_shift_r
     1.76%  ksoftirqd/0      [kernel.vmlinux]          [k] memset_erms
     1.71%  ksoftirqd/1      [tempesta_tls]            [k] mpi_sub_hlp
     1.62%  swapper          [tempesta_tls]            [k] mbedtls_mpi_bitlen
     1.61%  ksoftirqd/0      [tempesta_tls]            [k] mbedtls_mpi_shift_r
     1.58%  ksoftirqd/1      [tempesta_tls]            [k] mbedtls_mpi_bitlen
     1.28%  ksoftirqd/1      [tempesta_tls]            [k] mbedtls_mpi_cmp_abs
     1.24%  ksoftirqd/0      [tempesta_tls]            [k] mpi_sub_hlp
     1.19%  ksoftirqd/0      [tempesta_tls]            [k] mbedtls_mpi_bitlen
     1.18%  swapper          [tempesta_tls]            [k] mpi_sub_hlp
     1.11%  ksoftirqd/1      [tempesta_tls]            [k] mbedtls_mpi_cmp_mpi
     1.08%  swapper          [tempesta_tls]            [k] mbedtls_mpi_cmp_abs
     1.06%  ksoftirqd/1      [kernel.vmlinux]          [k] __kmalloc
     1.05%  swapper          [kernel.vmlinux]          [k] __kmalloc
     0.97%  ksoftirqd/1      [tempesta_tls]            [k] mbedtls_mpi_add_abs
     0.97%  swapper          [tempesta_tls]            [k] ecp_mod_p521
     0.97%  ksoftirqd/1      [tempesta_tls]            [k] ecp_mod_p521
     0.93%  ksoftirqd/1      [kernel.vmlinux]          [k] memcpy_erms
     0.93%  ksoftirqd/1      [tempesta_tls]            [k] mbedtls_mpi_copy
     0.92%  swapper          [tempesta_tls]            [k] mbedtls_mpi_add_abs
     0.91%  ksoftirqd/0      [tempesta_tls]            [k] mbedtls_mpi_cmp_abs
     0.89%  ksoftirqd/1      [tempesta_tls]            [k] mbedtls_mpi_mul_mpi
     0.89%  swapper          [tempesta_tls]            [k] mbedtls_mpi_cmp_mpi
     0.88%  ksoftirqd/0      [kernel.vmlinux]          [k] __kmalloc
     0.87%  swapper          [kernel.vmlinux]          [k] kfree
     0.87%  ksoftirqd/0      [tempesta_tls]            [k] mbedtls_mpi_cmp_mpi
     0.87%  ksoftirqd/1      [kernel.vmlinux]          [k] kfree
     0.80%  swapper          [kernel.vmlinux]          [k] memcpy_erms
     0.73%  ksoftirqd/0      [tempesta_tls]            [k] ecp_mod_p521
     0.73%  swapper          [tempesta_tls]            [k] mbedtls_mpi_copy
     0.72%  ksoftirqd/0      [kernel.vmlinux]          [k] memcpy_erms
     0.72%  swapper          [tempesta_tls]            [k] mbedtls_mpi_sub_abs
     0.71%  ksoftirqd/1      [tempesta_tls]            [k] mbedtls_mpi_shift_l
     0.70%  ksoftirqd/0      [tempesta_tls]            [k] mbedtls_mpi_add_abs
     0.70%  ksoftirqd/1      [tempesta_tls]            [k] mbedtls_mpi_sub_abs
     0.68%  ksoftirqd/1      [tempesta_tls]            [k] mpi_montmul

Measurements for Nginx 1.10.3 with OpenSSL 1.1.0d in default configuration

        listen 9443 ssl backlog=131072 deferred reuseport fastopen=4096;
        ssl_certificate /root/tempesta/etc/tfw-root.crt;
        ssl_certificate_key /root/tempesta/etc/tfw-root.key;
        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers         HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        resolver 192.168.1.1 valid=300s;
        resolver_timeout 5s;
        # ssl_session_cache   shared:SSL:10m;
        # ssl_session_timeout 10m;

./wrk -c 4096 -t 8 -d 30 https://192.168.100.4:9443/
Running 30s test @ https://192.168.100.4:9443/
  8 threads and 4096 connections
  Thread Stats   Avg      Stdev     Max   +/- Stdev
    Latency   277.92ms  312.08ms   2.00s    87.63%
    Req/Sec     1.40k   675.97     3.67k    69.72%
  250921 requests in 30.09s, 296.73MB read
  Socket errors: connect 0, read 0, write 0, timeout 4756
Requests/sec:   8337.70
Transfer/sec:      9.86MB

     4.58%  nginx          libc-2.24.so                     [.] _int_malloc
     4.07%  nginx          [kernel.vmlinux]                 [k] queued_spin_lock_slowpath
     0.84%  nginx          [kernel.vmlinux]                 [k] __fget_light
     0.82%  nginx          libc-2.24.so                     [.] _int_free
     0.77%  nginx          [kernel.vmlinux]                 [k] syscall_return_via_sysret
     0.75%  nginx          libc-2.24.so                     [.] __memmove_avx_unaligned_erms
     0.74%  nginx          libcrypto.so.1.1                 [.] EVP_MD_CTX_md
     0.63%  nginx          [kernel.vmlinux]                 [k] tcp_recvmsg
     0.57%  nginx          nginx                            [.] ngx_open_cached_file
     0.57%  nginx          nginx                            [.] ngx_rbtree_insert_timer_value
     0.57%  ksoftirqd/1    [kernel.vmlinux]                 [k] __inet_lookup_established
     0.55%  nginx          [kernel.vmlinux]                 [k] sock_poll
     0.50%  nginx          [kernel.vmlinux]                 [k] copy_user_enhanced_fast_string
     0.48%  nginx          nginx                            [.] ngx_ssl_send_chain
     0.47%  nginx          nginx                            [.] ngx_vslprintf
     0.46%  nginx          libssl.so.1.1                    [.] SSL_read
     0.45%  nginx          libcrypto.so.1.1                 [.] 0x00000000000d23cd
     0.44%  ksoftirqd/1    [kernel.vmlinux]                 [k] tcp_ack
     0.43%  nginx          libcrypto.so.1.1                 [.] 0x00000000000d2489
     0.41%  nginx          libc-2.24.so                     [.] __memset_avx2_unaligned_erms
     0.39%  nginx          nginx                            [.] ngx_rbtree_delete
     0.39%  nginx          nginx                            [.] 0x00000000000631af
     0.38%  nginx          libcrypto.so.1.1                 [.] BIO_read
     0.38%  nginx          libcrypto.so.1.1                 [.] OPENSSL_cleanse
     0.38%  nginx          nginx                            [.] ngx_http_parse_request_line
     0.37%  nginx          libcrypto.so.1.1                 [.] 0x00000000000d2369
     0.36%  nginx          libc-2.24.so                     [.] malloc
     0.35%  nginx          libcrypto.so.1.1                 [.] BN_div
     0.35%  nginx          [unknown]                        [k] 0xfffffe000000601e
     0.35%  nginx          libcrypto.so.1.1                 [.] 0x00000000000d23db
     0.34%  nginx          [kernel.vmlinux]                 [k] rw_verify_area
     0.34%  nginx          libc-2.24.so                     [.] malloc_consolidate
     0.34%  nginx          [e1000]                          [k] e1000_xmit_frame
     0.33%  nginx          [kernel.vmlinux]                 [k] tcp_transmit_skb
     0.32%  nginx          [kernel.vmlinux]                 [k] _raw_spin_lock_irqsave
     0.32%  ksoftirqd/1    [e1000]                          [k] e1000_clean
     0.32%  nginx          [kernel.vmlinux]                 [k] inet_recvmsg
     0.31%  nginx          [kernel.vmlinux]                 [k] __alloc_skb
     0.31%  nginx          nginx                            [.] ngx_reusable_connection
     0.31%  nginx          nginx                            [.] ngx_output_chain
     0.30%  nginx          libssl.so.1.1                    [.] 0x0000000000024d1e
     0.30%  ksoftirqd/1    [kernel.vmlinux]                 [k] tcp_check_space

[krizhanovsky]

Running wrk with wrong protocol specification (http instead of https)

./wrk -c 4096 -t 8 -d 30 http://192.168.100.4:443/

causes many handshake errors without freeing skb, which leads to OOM.

[krizhanovsky]

TLS is hard to debug due to random data, so orig_tls_dbg.diff.gz patch for current master with almost unmodified mbedTLS is required to make the TLS data constant.

OpenSSL even with -rand dev/zero option and RANDFILE=/dev/zero environment variable still doesn't generate constant data. tcpliveplay can not be used to send data to a server. Thus test_tls.py.gz (the script is available in tempesta-test/tls/test_tls.py) can be used to debug TLS handshakes, but only with DEBUG=3 level for Tempesta FW which makes random and time functions to return the same data from handshake to handshake allowing to compare current TLS implementation with the reference, ported mbedTLS.