RFR: 8286433: Cache certificates decoded from TLS session tickets

[Daniel Jeliński]

On Mon, 9 May 2022 19:38:36 GMT, Daniel Jeliński <djelinski at openjdk.org> wrote:

> When a TLS server resumes a session from a stateless session ticket, it populates the `SSLSessionImpl`'s `localCerts` and `peerCerts` fields with certificates deserialized from the session ticket. These certificates are often the same across a large number of tickets.
> 
> This patch implements a certificate cache lookup for these certificates. This enables us to avoid deserializing the same certificates repeatedly, and saves memory by reusing the same certificate objects.

Performance results:
Before:

Benchmark                 (resume)  (tlsVersion)   Mode  Cnt      Score     Error  Units
SSLHandshake.doHandshake      true       TLSv1.2  thrpt    5  10425.534 ± 785.613  ops/s
SSLHandshake.doHandshake      true           TLS  thrpt    5    673.131 ±  24.857  ops/s

after:

Benchmark                 (resume)  (tlsVersion)   Mode  Cnt      Score     Error  Units
SSLHandshake.doHandshake      true       TLSv1.2  thrpt    5  11882.724 ± 106.444  ops/s
SSLHandshake.doHandshake      true           TLS  thrpt    5    717.195 ± 210.658  ops/s

The benchmark shows a nice improvement in throughput on session resumption; it uses the same `localCerts` on all sessions, and `peerCerts` are empty.

The performance of full handshakes (not shown) didn't change, which is expected because full handshakes do not use the changed code.

GC profiling results:
Before:

Benchmark                                                  (resume)  (tlsVersion)   Mode  Cnt       Score       Error   Units
SSLHandshake.doHandshake:·gc.alloc.rate.norm                   true       TLSv1.2  thrpt   15  173868.322 ±  1554.251    B/op
SSLHandshake.doHandshake:·gc.alloc.rate.norm                   true           TLS  thrpt   15  404166.493 ±  1640.523    B/op

After:

Benchmark                                                  (resume)  (tlsVersion)   Mode  Cnt       Score       Error   Units
SSLHandshake.doHandshake:·gc.alloc.rate.norm                   true       TLSv1.2  thrpt   15  140972.286 ±  1782.103    B/op
SSLHandshake.doHandshake:·gc.alloc.rate.norm                   true           TLS  thrpt   15  370317.660 ±  1846.107    B/op

Memory allocation is reduced by ~30kB per handshake on session resumption. The allocation profile of full handshakes (not shown) didn't change.

-------------

PR: https://git.openjdk.java.net/jdk/pull/8608