From 561eebe170d02047e92141fa04b70313beb2ac0b Mon Sep 17 00:00:00 2001 From: Amber Brown Date: Tue, 19 Feb 2019 16:18:05 +1100 Subject: [PATCH 1/3] fix to use makeContext so that we don't need to rebuild the certificateoptions each time --- synapse/crypto/context_factory.py | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/synapse/crypto/context_factory.py b/synapse/crypto/context_factory.py index 85f2848fb1..49cbc7098f 100644 --- a/synapse/crypto/context_factory.py +++ b/synapse/crypto/context_factory.py @@ -1,4 +1,5 @@ # Copyright 2014-2016 OpenMarket Ltd +# Copyright 2019 New Vector Ltd # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. @@ -11,6 +12,7 @@ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. + import logging from zope.interface import implementer @@ -105,9 +107,7 @@ class ClientTLSOptions(object): self._hostnameBytes = _idnaBytes(hostname) self._sendSNI = True - ctx.set_info_callback( - _tolerateErrors(self._identityVerifyingInfoCallback) - ) + ctx.set_info_callback(_tolerateErrors(self._identityVerifyingInfoCallback)) def clientConnectionForTLS(self, tlsProtocol): context = self._ctx @@ -128,10 +128,8 @@ class ClientTLSOptionsFactory(object): def __init__(self, config): # We don't use config options yet - pass + self._options = CertificateOptions(verify=False) def get_options(self, host): - return ClientTLSOptions( - host, - CertificateOptions(verify=False).getContext() - ) + # Use _makeContext so that we get a fresh OpenSSL CTX each time. + return ClientTLSOptions(host, self._options._makeContext()) From 2b2466f78bafe1d7083d32f1495f20746159b470 Mon Sep 17 00:00:00 2001 From: Amber Brown Date: Tue, 19 Feb 2019 16:18:48 +1100 Subject: [PATCH 2/3] changelog --- changelog.d/4674.misc | 1 + 1 file changed, 1 insertion(+) create mode 100644 changelog.d/4674.misc diff --git a/changelog.d/4674.misc b/changelog.d/4674.misc new file mode 100644 index 0000000000..84630bb201 --- /dev/null +++ b/changelog.d/4674.misc @@ -0,0 +1 @@ +Reduce the overhead of creating outbound federation connections over TLS by caching the TLS client options. From 107aeb6915927a4278290dd3bdc5e01497a0dce0 Mon Sep 17 00:00:00 2001 From: Richard van der Hoff Date: Tue, 19 Feb 2019 10:18:48 +0000 Subject: [PATCH 3/3] misc->feature --- changelog.d/{4674.misc => 4674.feature} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename changelog.d/{4674.misc => 4674.feature} (100%) diff --git a/changelog.d/4674.misc b/changelog.d/4674.feature similarity index 100% rename from changelog.d/4674.misc rename to changelog.d/4674.feature