Skip to content

Reduce unnecessary trust list creation

Michael Catanzaro requested to merge mcatanzaro/gnutls-credentials into master

We have discovered that trust list initialization is a massive performance bottleneck when loading websites:

https://bugs.webkit.org/show_bug.cgi?id=251336 https://gitlab.com/gnutls/gnutls/-/issues/1528

At first, I thought there was not much we can do about this, because the gnutls_certificate_credentials_t object takes ownership of the gnutls_x509_trust_list object that we pass to it, meaning we definitely need to create a new trust list each time we create a new credentials object. But I eventually realized that we can safely cache and reuse the gnutls_certificate_credentials_t instead.

With this, we now only need to populate the trust list twice per connection.

We need to do it twice because we cannot share the priv->trust_list that we use in g_tls_database_gnutls_verify_chain() with the one that is given to the credentials object, since, again, the credentials object takes ownership.

We could alternatively always create priv->credentials when initializing the database and instead create priv->trust_list lazily only when the first first verify_chain() operation is requested, which would get us down to one initialization in the usual case. (Normally, the application will never call g_tls_database_gnutls_verify_chain(), because GTlsConnectionGnutls will never do this, because it defers certificate verification to the GTlsDatabase only when it is not a GTlsDatabaseGnutls). But I think it's slightly easier to read this way. Twice isn't so bad. We can always change it in the future if desired.

Edited by Michael Catanzaro

Merge request reports