{"action":"created","issue":{"url":"https://api.github.com/repos/netty/netty/issues/7957","repository_url":"https://api.github.com/repos/netty/netty","labels_url":"https://api.github.com/repos/netty/netty/issues/7957/labels{/name}","comments_url":"https://api.github.com/repos/netty/netty/issues/7957/comments","events_url":"https://api.github.com/repos/netty/netty/issues/7957/events","html_url":"https://github.com/netty/netty/issues/7957","id":324936542,"number":7957,"title":"OpenSSL server has a lower throughput than JDK SSL with larger responses","user":{"login":"timyates","id":49317,"avatar_url":"https://avatars1.githubusercontent.com/u/49317?v=4","gravatar_id":"","url":"https://api.github.com/users/timyates","html_url":"https://github.com/timyates","followers_url":"https://api.github.com/users/timyates/followers","following_url":"https://api.github.com/users/timyates/following{/other_user}","gists_url":"https://api.github.com/users/timyates/gists{/gist_id}","starred_url":"https://api.github.com/users/timyates/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timyates/subscriptions","organizations_url":"https://api.github.com/users/timyates/orgs","repos_url":"https://api.github.com/users/timyates/repos","events_url":"https://api.github.com/users/timyates/events{/privacy}","received_events_url":"https://api.github.com/users/timyates/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2018-05-21T14:28:01Z","updated_at":"2018-05-22T10:45:44Z","closed_at":null,"author_association":"NONE","body":"### Expected behavior\r\n\r\nI expected the native OpenSSL provider to be faster than the JDK provider, no matter what the size of the response payload is.\r\n\r\n### Actual behavior\r\n\r\nA Netty server using the JDK SSL provider is faster for any payload (I have tested 1MB up, and see the same results)\r\n\r\nThe results below are from running on an `i3.xlarge` EC2 box running `Amazon Linux AMI 2018.03.0`, but I have seen reproducible similar behaviour running on both Alpine Linux, and Os X 10.13.4.\r\n\r\nOpenSSL on this EC2 box has the version:\r\n\r\n```\r\n$ openssl version\r\nOpenSSL 1.0.2k-fips  26 Jan 2017\r\n```\r\n\r\n### Steps to reproduce\r\n\r\nI have linked to a project that reproduces the problem reliably for me, running the `runProfiling.sh` script executes 6 tests.\r\n\r\n1. empty response (OpenSSL)\r\n2. empty response (JDK SSL)\r\n3. 5MB response (OpenSSL)\r\n4. 5MB response (JDK SSL)\r\n5. 20MB response (OpenSSL)\r\n6. 20MB response (JDK SSL)\r\n\r\nThe results for these tests (a full run takes around 60 mins) are then available in `build/jmeter-report`.\r\n\r\n#### Empty Response\r\n\r\nThe empty test results are as expected;\r\n\r\nOpenSSL\r\n![image](https://user-images.githubusercontent.com/49317/40312057-ab3144de-5d09-11e8-9178-744bdff5087a.png)\r\nJDK\r\n![image](https://user-images.githubusercontent.com/49317/40312076-b76539ea-5d09-11e8-83b8-089375c92d8c.png)\r\n\r\n#### 5MB Response\r\n\r\nThe JDK SSL version gives a higher throughput than OpenSSL which is unexpected...\r\n\r\nOpenSSL\r\n![image](https://user-images.githubusercontent.com/49317/40312152-eb5c7ce0-5d09-11e8-9ccd-d5d3584c05bc.png)\r\nJDK\r\n![image](https://user-images.githubusercontent.com/49317/40312175-f72a4840-5d09-11e8-80b0-a752b701ca6a.png)\r\n\r\n#### 20MB response\r\n\r\nAgain, the JDK SSL version has a higher throughput\r\n\r\nOpenSSL\r\n![image](https://user-images.githubusercontent.com/49317/40312246-35bcf580-5d0a-11e8-862d-79c5a42189b8.png)\r\nJDK\r\n![image](https://user-images.githubusercontent.com/49317/40312252-3fa3f954-5d0a-11e8-9325-79a5c0a79071.png)\r\n\r\n### Minimal yet complete reproducer code (or URL to code)\r\n\r\nhttps://github.com/timyates/netty-openssl-perf-test\r\n\r\nRun `./runProfiling.sh` and wait (around an hour) for the 6 tests to generate jMeter dashboards.\r\n\r\n### Netty version\r\n\r\n```\r\n4.1.25.Final\r\n```\r\n\r\nand\r\n\r\n```\r\nio.netty:netty-tcnative-boringssl-static:2.0.8.Final\r\n```\r\n\r\n### JVM version (e.g. `java -version`)\r\n\r\n```\r\nopenjdk version \"1.8.0_171\"\r\nOpenJDK Runtime Environment (build 1.8.0_171-b10)\r\nOpenJDK 64-Bit Server VM (build 25.171-b10, mixed mode)\r\n```\r\n\r\n### OS version (e.g. `uname -a`)\r\n\r\n```\r\nLinux ip-172-31-12-49 4.14.26-46.32.amzn1.x86_64 #1 SMP Fri Mar 30 22:29:54 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux\r\n```"},"comment":{"url":"https://api.github.com/repos/netty/netty/issues/comments/390946514","html_url":"https://github.com/netty/netty/issues/7957#issuecomment-390946514","issue_url":"https://api.github.com/repos/netty/netty/issues/7957","id":390946514,"user":{"login":"timyates","id":49317,"avatar_url":"https://avatars1.githubusercontent.com/u/49317?v=4","gravatar_id":"","url":"https://api.github.com/users/timyates","html_url":"https://github.com/timyates","followers_url":"https://api.github.com/users/timyates/followers","following_url":"https://api.github.com/users/timyates/following{/other_user}","gists_url":"https://api.github.com/users/timyates/gists{/gist_id}","starred_url":"https://api.github.com/users/timyates/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timyates/subscriptions","organizations_url":"https://api.github.com/users/timyates/orgs","repos_url":"https://api.github.com/users/timyates/repos","events_url":"https://api.github.com/users/timyates/events{/privacy}","received_events_url":"https://api.github.com/users/timyates/received_events","type":"User","site_admin":false},"created_at":"2018-05-22T10:45:44Z","updated_at":"2018-05-22T10:45:44Z","author_association":"NONE","body":"Cool, thanks again!\r\n\r\nCan you think of a reason why jMeter negotiated a cipher with OpenSSL that Java does not support? 🤔\r\n\r\nNo worries if not, I'll do some digging 👍 "}}
{"actor":{"display_login":"timyates"}}