1- Performance testing tools
2- =========================
1+ # OpenSSL performance testing tools
32
43This directory holds tools for carrying out performance tests on OpenSSL.
54
@@ -11,47 +10,45 @@ OpenSSL version, e.g. 3.1, 3.0, 1.1.1 - which is the version of OpenSSL that
1110is to be tested. Typically we would expect the apps to be built multiple times
1211(once for each target OpenSSL version to be tested).
1312
14- To build the tests we assume that the target OpenSSL has already been built.
15- Two environment variables are required:
16-
17- TARGET_OSSL_INCLUDE_PATH: Points to a directory where the OpenSSL include files
18- are held (e.g. typically "include" under the build directory).
13+ ## Build
1914
20- TARGET_OSSL_LIBRARY_PATH: Points to a directory where libcrypto.so and libssl.so
21- are contained.
15+ To build the tests we assume that the target OpenSSL has already been built.
2216
23- To build:
17+ ``` sh
18+ cmake -S . -B < OUTPUT PATH> -DOPENSSL_ROOT_DIR=< OPENSSL_ROOT_DIR>
19+ cmake --build < OUTPUT PATH> --config Release
20+ ```
2421
25- export TARGET_OSSL_INCLUDE_PATH=/path/to/openssl/include
26- export TARGET_OSSL_LIBRARY_PATH=/path/to/openssl/lib
27- make
22+ ## Run
2823
29- The performance testing apps must be run ensuring that libcrypto.so and
30- libssl.so are on the library path.
24+ The performance testing apps must be run ensuring that ` libcrypto.so ` and
25+ ` libssl.so ` are on the library path.
3126
3227For example:
3328
34- LD_LIBRARY_PATH=/path/to/openssl/lib ./randbytes 10
29+ ``` sh
30+ LD_LIBRARY_PATH=< PATH TO OPENSSL LIB> ./randbytes 10
31+ ```
3532
3633Each performance testing app will take different parameters. They are described
37- individually below. All performance testing apps take the " --terse" option
34+ individually below. All performance testing apps take the ` --terse ` option
3835which has the affect of just printing bare performance numbers without any
3936labels.
4037
41- randbytes
42- ---------
38+ ## randbytes
4339
44- The randbytes test does 10000 calls of the RAND_bytes() function divided
40+ The randbytes test does 10000 calls of the [ RAND_bytes() ] ( https://docs.openssl.org/master/man3/RAND_bytes/ ) function divided
4541evenly among multiple threads. The number of threads to use is provided as
4642an argument and the test reports the average time take to execute a block of
47- 1000 RAND_bytes() calls.
43+ 1000 [ RAND_bytes() ] ( https://docs.openssl.org/master/man3/RAND_bytes/ ) calls.
4844
49- handshake
50- ---------
45+ ## handshake
5146
5247Performs a combined in-memory client and server handshake. In total 100000
5348handshakes are performed divided evenly among each thread. It take 2 optional
5449and two required arguments:
50+
51+ ```
5552handshake [-t] [-s] <certsdir> <threadcount>
5653-t - produce terse output
5754-s - create an ssl_ctx per connection, rather than a single thread-shared ctx
@@ -62,6 +59,7 @@ handshake [-t] [-s] <certsdir> <threadcount>
6259-l - use ssl_ctx pool
6360certsdir - Directory where the test can locate servercert.pem and serverkey.pem
6461threadcount - Number of concurrent threads to run in test
62+ ```
6563
6664The output is two values: the average time taken for a single handshake in us,
6765and the average number of simultaneous handshakes per second performed over the
@@ -70,123 +68,130 @@ course of the test.
7068Note: Note on OpenSSL earlier than 3.6 you might hit the thread key local storage
7169limit with higher number of threads.
7270
73- sslnew
74- ------
71+ ## sslnew
7572
76- The sslnew test repeatedly constructs a new SSL object and associates it with a
73+ The ` sslnew ` test repeatedly constructs a new SSL object and associates it with a
7774newly constructed read BIO and a newly constructed write BIO, and finally frees
7875them again. It does 100000 repetitions divided evenly among each thread.
7976The number of threads to use is provided as an argument and the test
8077reports the average time taken to execute a block of 1000 construction/free
8178calls.
8279
83- newrawkey
84- ---------
80+ ## newrawkey
8581
86- The newrawkey test repeatedly calls the EVP_PKEY_new_raw_public_key_ex()
82+ The ` newrawkey ` test repeatedly calls the [ EVP_PKEY_new_raw_public_key_ex() ] ( https://docs.openssl.org/master/man3/EVP_PKEY_new/ )
8783function. It does 100000 repetitions divided evenly among each thread. The
8884number of threads to use is provided as an argument and the test reports the
89- average time take to execute a block of 1000 EVP_PKEY_new_raw_public_key_ex()
85+ average time take to execute a block of 1000 [ EVP_PKEY_new_raw_public_key_ex() ] ( https://docs.openssl.org/master/man3/EVP_PKEY_new/ )
9086calls.
9187
9288Note that this test does not support OpenSSL 1.1.1.
9389
94- rsasign
95- -------
90+ ## rsasign
9691
97- The rsasign test repeatedly calls the EVP_PKEY_sign_init()/EVP_PKEY_sign()
92+ The ` rsasign ` test repeatedly calls the [ EVP_PKEY_sign_init()/EVP_PKEY_sign() ] ( https://docs.openssl.org/master/man3/EVP_PKEY_sign/ )
9893functions, using a 512 bit RSA key. It does 100000 repetitions divided evenly
9994among each thread. The number of threads to use is provided as an argument and
10095the test reports the average time take to execute a block of 1000
101- EVP_PKEY_sign_init()/EVP_PKEY_sign() calls.
96+ [ EVP_PKEY_sign_init()/EVP_PKEY_sign() ] ( https://docs.openssl.org/master/man3/EVP_PKEY_sign/ ) calls.
10297
103- x509storeissuer
104- ---------------
98+ ## x509storeissuer
10599
106- Runs the function call X509_STORE_CTX_get1_issuer() repeatedly in a loop (which
100+ Runs the function call [ X509_STORE_CTX_get1_issuer() ] ( https://docs.openssl.org/master/man3/X509_STORE_set_verify_cb_func/ ) repeatedly in a loop (which
107101is used in certificate chain building as part of a verify operation). The test
108102assumes that the default certificates directly exists but is empty. For a
109103default configuration this is "/usr/local/ssl/certs". The test takes the number
110104of threads to use as an argument and the test reports the average time take to
111- execute a block of 1000 X509_STORE_CTX_get1_issuer() calls.
105+ execute a block of 1000 [ X509_STORE_CTX_get1_issuer() ] ( https://docs.openssl.org/master/man3/X509_STORE_set_verify_cb_func/ ) calls.
112106
113- providerdoall
114- -------------
107+ ## providerdoall
115108
116- The providerdoall test repeatedly calls the OSSL_PROVIDER_do_all() function.
109+ The ` providerdoall ` test repeatedly calls the [ OSSL_PROVIDER_do_all() ] ( https://docs.openssl.org/master/man3/OSSL_PROVIDER ) function.
117110It does 100000 repetitions divided evenly among each thread. The number of
118111threads to use is provided as an argument and the test reports the average time
119- take to execute a block of 1000 OSSL_PROVIDER_do_all() calls.
112+ take to execute a block of 1000 [ OSSL_PROVIDER_do_all()] ( https://docs.openssl.org/master/man3/OSSL_PROVIDER ) calls.
113+
114+ ## rwlocks
120115
121- rwlocks
122- -------------
123- the rwlocks test creates the command line specified number of threads, splitting
116+ The ` rwlocks ` test creates the command line specified number of threads, splitting
124117them evenly between read and write functions (though this is adjustable via the
125118LOCK_WRITERS environment variable). Threads then iteratively acquire a shared
126119rwlock to read or update some shared data. The number of read and write
127120lock/unlock pairs are reported as a performance measurement
128121
129- pkeyread
130- --------
122+ ## pkeyread
131123
132- The pkeyread test repeatedly calls the PEM_read_bio_PrivateKey() function on a
124+ The ` pkeyread ` test repeatedly calls the [ PEM_read_bio_PrivateKey() ] ( https://docs.openssl.org/master/man3/PEM_read_bio_PrivateKey/ ) function on a
133125memory BIO with a private key of desired type, when it is running in pem mode
134126(-f pem). If test is running in der mode (-f der) it calls to
135- d2i_PrivateKey_ex() function to repeatedly read private key of desired type.
127+ [ d2i_PrivateKey_ex() ] ( https://docs.openssl.org/master/man3/d2i_PrivateKey/ ) function to repeatedly read private key of desired type.
136128It does 10000 repetitions divided evenly among each thread. The number of
137- threads to use is provided by option -t . The test reports average time per
138- call. Use option -k to select key type for benchmark. The list of keys for
129+ threads to use is provided by option ` -t ` . The test reports average time per
130+ call. Use option ` -k ` to select key type for benchmark. The list of keys for
139131testing is as follows: dh, dhx, dsa, ec, rsa, xkey. To run benchmark for all
140132keys and formats using 4 threads run pkeyread as follows:
141- ./pkeyread -f all -k all -t 4
142133
143- evp_setpeer
144- -------
134+ ``` sh
135+ ./pkeyread -f all -k all -t 4
136+ ```
137+
138+ ## evp_setpeer
145139
146- The evp_setpeer test repeatedly calls the EVP_PKEY_derive_set_peer() function
140+ The ` evp_setpeer ` test repeatedly calls the [ EVP_PKEY_derive_set_peer() ] ( https://docs.openssl.org/master/man3/EVP_PKEY_derive/ ) function
147141on a memory BIO with a private key of desired type. It does 10000
148142repetitions divided evenly among each thread. The last argument will be the
149- number of threads run. The test reports average time per call. Use option -k
143+ number of threads run. The test reports average time per call. Use option ` -k `
150144to select key type for benchmark. The list of keys for testing is as follows:
151145dh, ec256, ec521, x25519. To run benchmark for all keys using 4 threads, run
152146evp_setpeer as follows:
153- ./evp_setpeer -k all -t 4
154147
155- writeread
156- ---------
148+ ``` sh
149+ ./evp_setpeer -k all -t 4
150+ ```
151+
152+ ## writeread
157153
158154Performs an in-memory client and server handshake and measures the average
159- time taken for a single sequence of calling SSL_write_ex() on the client and
160- SSL_read_ex( ) on the server. In total 1000000 writes and reads are performed
155+ time taken for a single sequence of calling [ SSL_write_ex() ] ( https://docs.openssl.org/master/man3/SSL_write/ ) on the client and
156+ [ SSL_write_ex() ] ( https://docs.openssl.org/master/man3/SSL_write/ ) on the server. In total 1000000 writes and reads are performed
161157divided evenly among each thread. It take 4 optional and 2 required arguments:
158+
159+ ```
162160writeread [-t] [-s] [-d] [-b size] <certsdir> <threadcount>
163161-t - produce terse output.
164162-s - create an ssl_ctx per connection, rather than a single thread-shared ctx.
165163-d - use DTLS as connection method.
166164-b - size of buffer to write and read, default is 1024 bytes.
167165certsdir - directory where the test can locate servercert.pem and serverkey.pem.
168166threadcount - number of concurrent threads to run in test.
167+ ```
169168
170- ssl_poll_perf
171- -------------
169+ ## ssl_poll_perf
172170
173171Tool to evaluate performance of QUIC client and server which both use
174- SSL_poll(3ossl). Application creates two threads, one for client the
172+ [ SSL_poll] ( https://docs.openssl.org/master/man3/SSL_poll/ ) (3ossl). Application creates two threads, one for client the
175173other for server. Server and client can both accept/create simultanous
176174connections. Each connection then can carry multiple unidirectional/bidirectional
177175streams. The streams handle HTTP/1.0 GET request/responses only.
178176Server always drains the incoming stream initiated by client. It answers to
179177any GET request. The default reply is 200 OK with 12345 bytes of payload.
180178Client may request desired payload with URL as follows:
181- /any/path/to_8192whatever/foo_4096.txt
179+
180+ ```
181+ /any/path/to_8192whatever/foo_4096.txt
182+ ```
183+
182184In which case the server will send response with 8kB http/1.0 body.
183185The URL parser attempts to find leftmost number, which denotes the number
184186of bytes client expects in response.
185187The test program supports options as follows:
188+
189+ ```
186190-c - number of connections to create (default 10)
187191-b - number of bidirectional streams each connection creates (default 10)
188192-u - number of unidirectional streams each connection creates (default 10)
189193-s - the size of reply body, the maximum size is 100MB. The default size is 64.
190194-w - the size of request body, the maximum size is 100MB. The default size is 64.
191195-p - port number to use
192196-t - terse output
197+ ```
0 commit comments